| Adversarial examples usually refer to a small number of fake samples with specific disturbances that are not easily detected by human eyes added to the original samples for the purpose of deceiving the machine learning model.Adversarial examples first gained attention in computer vision,where researchers tricked deep learning models by adding small continuous perturbations to image pixels.Compared with image data,text data is discrete symbolic data,and its adversarial examples generally need to be generated by changing the characters in the text(synonym substitution)or replacing words/phrases with synonyms in more complex ways,so the generation of adversarial examples in the field of NLP is more challenging.The way of replacing words or phrases with synonyms to generate adversarial examples is also called word substitution adversarial algorithms.Word substitution adversarial algorithms are generally divided into two parts: one is the synonym replacement word set of words,and the other is the search algorithm.In general,the replacement word set affects the quality of the adversarial example.Search algorithm is the impact of search efficiency and success rate.It is found that it is difficult for the current adversarial algorithms to reach a balance in terms of attack efficiency and success rate through a simple way.This paper mainly discusses and studies this problem,and aims to find an adversarial attack algorithm that can effectively improve the success rate of adversarial attacks under the premise of sacrificing a small amount of adversarial efficiency.Greedy With Word Importance Rank(WIR)is one of the most popular search algorithms in word replacement adversarial algorithms,which is characterized by high efficiency and low success rate in generating adversarial examples.This paper analyzes the principle,advantages and disadvantages of WIR series algorithms,and proposes the Random Reorder Strategy(RRS)and Cycle Reorder Strategy(CRS).Through the comparison experiments of different adversarial algorithms in different scenarios in this paper,the following conclusions are drawn:The improved WIR algorithms UNKCRS and UNKRRS using RRS and CRS can significantly improve the success rate of confrontation under the premise of sacrificing a small amount of attack efficiency.Compared with RRS,the improved WIR algorithm UNKCRS using CRS has better performance.Compared with long text classification attack,UNKRRS and UNKCRS are more effective and stable in short text classification attack. |
