This paper describes the submission of TextTrojaners for the CheckThat! 2024 lab task 6: Robustness of Credibility Assessment with Adversarial Examples [1]. We achieved the second best results on the BODEGA evaluation metric. Our approach BeamAttack is a novel algorithm for generating adversarial examples in natural language processing through the application of beam search. To further improve the search process, we integrate a semantic filter that prioritizes examples with the highest semantic similarity to the original sample, enabling early termination of the search. Additionally, we leverage a model interpretability technique, LIME, to determine the priority of word replacements, along with existing methods such as that determine word importance through the model's logits. Our approach also allows for skipping and removing words, enabling the discovery of minimal modifications that flip the label. Furthermore, we utilize a masked language model to predict contextually plausible alternatives to the words to be replaced, enhancing the coherence of the generated adversarial examples. BeamAttack demonstrates state-of-the-art performance, outperforming existing methods with scores of up to 0.90 on the BiLSTM, 0.84 on BERT, and 0.82 on the RoBERTa classifier 1.
Social media platforms increasingly rely on machine learning algorithms for content filtering to identify
misleading, harmful, or illegal content. Despite advancements, these models remain vulnerable to
adversarial attacks, wherein the input text is manipulated to deceive the model, even after undergoing
adversarial training [
We participated in “Task 6: Robustness of Credibility Assessment with Adversarial Examples
(InCrediblAE)” at the ‘CheckThat! lab’ during CLEF 2024, which was designed to assess the robustness of
popular text classification methods used in credibility assessment tasks [
Previous research on grey-box adversarial attacks on text classification systems has explored
modifications at the character [
We introduce BeamAttack, our word-level adversarial attack and submission to the shared task.
At its core, BeamAttack employs a beam search algorithm to identify optimal word substitutions,
thereby enabling the generation of multiple alternative adversarial text hypotheses capable of
lfipping the model’s classification. Leveraging techniques from existing literature and innovative
approaches, BeamAttack integrates a Masked Language Model (MLM), specifically RoBERTa [
Our contributions include the following:
• We employ a beam search algorithm to explore combinations of multiple word substitutions,
optimizing for the output logits of classifier models. This approach significantly expands the
search space compared to the greedy search commonly used in the literature and allows for the
generation of multiple alternative adversarial samples in a single run. While beam search has
been utilized in white-box attacks by Ebrahimi et al. [
In the following sections, we will present the details of our approach addressing the challenge of robustness in credibility assessment. Section 2 provides an overview of related work in the field of NLP adversarial attacks, highlighting the fundamental principles of various attack methods and their applications. Section 3 describes the specific task we participate in, namely “Task 6: Robustness of Credibility Assessment with Adversarial Examples (InCrediblAE)”, and outlines the datasets and victim models used in our experiments. In Section 4, we present our algorithm and methodology for generating adversarial examples. The results of our experiments are presented in Section 5, where we evaluate the efectiveness of our algorithm in attacking the victim models. In Section 6, we conduct an ablation study to analyze the impact of hyper-parameters on our algorithm’s performance. Finally, we conclude our paper in Section 7 and outline limitations and potential avenues for future work in Section 8.
Despite their powerful capabilities, neural networks sufer from a lack of interpretability, making it
dificult to predict their behavior, which can raise security concerns. Szegedy et al. [
An adversarial sample is generated from the original sample by applying the smallest possible change
that leads to a misclassification by the target model, known as the victim classifier. The goal is to alter
the sample just enough to trick the classifier into making an incorrect prediction. A formal definition
for adversarial samples or examples can be found in [
While much of the existing research focuses on adversarial attacks in image classification [
Adversarial attacks in NLP can be classified in three categories: white-box attacks, black-box attacks,
and grey-box attacks. White-box attacks are also called gradient-based attacks, since the adversary (the
attacker) has access to the weights and thus the gradients of the victim model [
Black-box attacks are the more realistic scenario, where the adversary only has access to the prediction
of the victim for any given input samples. Most algorithms assume an infinite number of queries to
ifnd the best perturbation [
Przybyła et al. [
We can also distinguish between targeted and untargeted attacks. In a targeted attack, the attacker aims to mislead the model into a specific incorrect class or label. In an untargeted attack, the attacker aims to mislead the model into any incorrect class or label, without a specific target in mind. The shared task at hand, InCrediblAE, focuses solely on untargeted attacks.
Adversarial attacks in NLP difer fundamentally from those in computer vision due to the symbolic and discrete nature of text versus the continuous nature of images. This discreteness complicates the creation of adversarial examples in NLP, as modifications must preserve the grammatical and semantic integrity of the text while still deceiving the model. Consequently, NLP adversarial attacks often focus on specific granularities of modification, such as characters, words, subwords, or entire sentences.
Character-level methods involve changing individual characters in the adversarial text [
Sentence-level methods modify longer passages of a text, including paraphrasing entire sentences in
a constrained manner to create adversarial samples [
Word-level methods modify the original text by removing, adding, or substituting words, often
combining these techniques to create adversarial examples [
Most of the recent work in adversarial text is based on search algorithms that first rank the words in an input sequence by their importance scores and then search the space of possible replacements for each word according to this pre-computed ranking. This common approach requires a method for calculating word importance scores to determine the optimal order for word replacement, a strategy for selecting suitable word replacements, and a search strategy for iterative word replacement to guide the process of finding the most efective substitutions.
The replacement strategies involve replacing selected words with out-of-vocabulary words [
The methods for calculating the word importance scores involve grey-box methods utilizing the
change in the output probabilities of the victim model, when some words are masked or removed [
One of the most common search strategies is greedy search where each word is replaced sequentially
in the order of the word importance [
Other search strategies with a larger search space include evolutionary algorithms [
The CheckThat! lab at CLEF 2024 [34] introduced a novel task designed to assess the robustness of
popular text classification approaches. The task 6 [
The basic statistics of the provided datasets are summarized in Table 1. Each dataset is divided into three subsets: training, development (dev), and attack. The training and dev subsets are used to train the classifier, while the attack subset serves as the evaluation dataset, where the efectiveness of our attack is measured. Each dataset is designed for a binary classification task, and therefore, the positive rate corresponds to the portion of samples belonging to class 1, and is therefore also a measure of class imbalance. Notably, we observed significant variations in the length of samples across the datasets, measured in terms of the number of characters, which are also reported in the table.
Next, we briefly outline the diferent text domains. All except C19 are already published and described
in the CheckThat! lab at CLEF 2023 [
For each domain, the organizers provided three classifiers, each trained in a binary classification setup on the training split of the corresponding dataset.
The evaluation process is designed to assess the efectiveness of generated adversarial examples in altering the victim’s decision while preserving the original meaning. Driven by the formulation of the shared task itself, our approach employs an untargeted attack strategy (see Section 2.1). This means that, for every sample, we aim to alter the victim’s decision by flipping it to the opposite of its original prediction.
To quantify the success of an attack, InCrediblAE uses the BODEGA score [
Our approach focuses on word-level attacks, a well-regarded technique in recent literature for its balance between edit distance and semantic similarity. We aim to improve upon this by evaluating and addressing the shortcomings of previous techniques.1
We redefine previous word-level attacks, such as HotFlip [
BeamAttack combines three components: a method for calculating a ranking of words to determine their replacement order, a word replacement strategy, and the beam search algorithm to explore the search space of possible word replacement combinations. The algorithm overview is given in Figure 1. Most existing techniques employ greedy search algorithms, selecting the first word(s) that efectively alters the model’s prediction. This greedy strategy can lead to sub-optimal adversarial samples, requiring more word changes than necessary.
Our approach adopts beam search as a replacement for greedy search, leveraging its eficacy as a decoding strategy for language models. Beam search explores multiple potential solutions concurrently, structured in a tree-like fashion, where each node represents a partial solution and branches signify possible extensions. At each step, beam search maintains a predefined number of the most promising partial solutions, known as the beam size . This parameter balances exploration and computational eficiency: larger values increase the likelihood of finding optimal or near-optimal solutions but elevate computational complexity, while smaller values reduce demands at the cost of potentially overlooking superior solutions.
In our approach, beam search operates by iteratively expanding the most promising nodes until a final solution is reached. The root node represents the input text, and subsequent nodes denote candidate adversarial texts. At each depth, one word is replaced, with branching occurring when alternative words are considered for replacement. To manage computational complexity, we decouple the number of alternatives evaluated at each depth (branching factor ) from the number of branches retained after pruning. At each depth beyond the first, × nodes are evaluated, with replacements per alternative from the previous depth and nodes from the previous depth, since we prune down to the nodes retained from the previous depth post-pruning.
Selection of promising nodes is based on their efectiveness in reducing the predicted probability of the original class while increasing the probability of the target class. This objective guides branch pruning during the search process. The search continues until cumulative changes are suficient to alter the model’s classification for a designated number of hypotheses. To preserve semantic similarity to the original sample, we introduce the hypothesis count ℎ: the search extends until at least ℎ branches flip the model classification. The final adversarial sample is chosen as the node with the highest semantic similarity to the original sample, as measured by Bleurt scores [35], among the selected hypotheses.
For each individual replacement, we enable the option to either keep the word intact or remove it altogether at any depth of the beam search. This added flexibility allows us to preserve the original word if replacements have no impact on changing the probability, thus reducing similarity and edit distances. Conversely, removing the word entirely may be the best strategy to confuse the model in more challenging cases.
To maximize text fluency, we use a masked language model to suggest replacements for any given word. This approach leverages the model’s pretraining to ensure that the replacements are likely to be coherent with the rest of the text. We primarily use RoBERTa-Large for this purpose. 1The pseudocode for the algorithm can be found in the Appendix 1.
For each depth of beam search, we evaluate the top (branching factor) highest likelihood word replacements as suggested by the masked language model. This strategy ensures that the potential replacements not only fit well within the context of the sentence but also maintain the overall semantic coherence of the text.
To determine the order in which words should be replaced, we use two diferent techniques to identify
the most important words for the model’s decision: LIME [
LIME is an explainability algorithm that provides local explanations for model predictions. It works by perturbing the input data and observing the changes in the output. Specifically, for each word in the input sentence, LIME generates a set of perturbed versions of the sentence with that word replaced by various alternatives. It then fits a simple, interpretable model to these perturbed instances to estimate the importance of each word based on how much the model’s output changes.
Logit-based importance scores, on the other hand, measure the influence of each word on the model’s output logits directly. Let = [0, . . . , , . . .] denote the input sentence, and () represent the logit output by the target model for the correct label . The importance score for each word is defined as the diference in logits when the word is masked:
= () − ( ∖ ), where ∖ is the sentence with replaced by a [MASK] token. This score quantifies how much the presence of contributes to the model’s prediction.
Our approach is specifically designed to maximize the risk of incorrect model predictions by exploiting the vulnerabilities in the model’s decision-making process. We achieve this by identifying the most susceptible words in the input text and strategically replacing them with semantically consistent alternatives. This targeted approach enables us to efectively manipulate the model’s decision while preserving the overall coherence of the text. Moreover, by focusing on the most critical words, we increase the likelihood of achieving our goal with a minimal number of word replacements, thereby maintaining the semantic integrity of the original text.
For each dataset and victim model combination, we determined a diferent set of hyperparameters for our BeamAttack approach. To achieve this, we employed an informed random search on subsets of 10-50 samples for each task and victim model. Our search strategy was guided by intuition and initial observations, allowing us to efectively fine-tune the hyperparameters. We considered the following ranges for the hyperparameter values: 1. Beam size : We tested values between 10 to 100, increasing in steps of 5 (i.e., 10, 15, 20, ...). We increased the beam size until the improvement in the BODEGA score became negligible (less than 1 point). Figure 2 illustrates how this approach led to convergence. 2. Branching factor : We tested a range of values similar to the chosen values, within a range of -20 to +20 around the selected values. 3. Hypothesis count ℎ: Based on initial experiments, we decided to test hypothesis counts of 5, 10, and 20. This decision was made considering the dificulty of the task at hand and the BODEGA scores obtained during the hyper-parameter search. We observed that further increasing ℎ did not significantly improve the scores, as explained in Section 6.4. 4. Word importance scoring method: We compared the results of both word importance scoring methods, LIME and logit-based, in the initial experiments of each dataset and victim model combination. RoBERTa RoBERTa RoBERTa RoBERTa RoBERTa
Pr2 FC RD HN C19 PR2 FC RD HN C19 PR2 FC RD HN C19
This chapter outlines the computational resources utilized and the hyper-parameter tuning strategies employed to optimize our BeamAttack approach, which demanded substantial computational power. To overcome the limitations imposed by computational and time constraints, we resorted to a random search strategy to determine the optimal parameter set for each scenario, recognizing that this approach may not necessarily result in the identification of the globally optimal combination. We primarily used Kaggle’s free GPU infrastructure, which ofers NVIDIA Tesla P100s and T4x 4. We report the running time statistics for the final runs of each model and dataset combination in Table 3.
The outcomes of this shared task and a comparison with those reported by Przybyła et al. [
Our algorithm outperforms all other algorithms on BERT and BiLSTM victims, demonstrating the superior efectiveness of BeamAttack. While other algorithms may generate adversarial samples with better character or semantic scores in specific tasks, they fail to achieve this consistently across the entire dataset. Moreover, our confusion scores are always superior to those of other techniques.
Nevertheless, our algorithm needs many victim queries to achieve this goal. For example, in the task RD on the BERT classifier (see Table 4), our BeamAttack takes roughly double the number of queries 2FacebookAI/roberta-large model from Hugging Face: https://huggingface.co/FacebookAI/roberta-large 3vinai/bertweet-large model from Hugging Face: https://huggingface.co/vinai/bertweet-large 4For the submission phase, we used an NVIDIA Tesla T4 GPU. compared to the Genetic algorithm. This highlights a trade-of between the quality of the generated adversarial samples and the computational resources required to achieve them.
In summary, our BeamAttack algorithm has shown exceptional capability in producing high-quality adversarial samples that are highly efective in deceiving victims, thereby surpassing the performance of other algorithms when tested on BERT and BiLSTM victims.
We conducted a small-scale ablation study to investigate the impact of various hyper-parameters on the performance of our BeamAttack algorithm, shedding some light on the relationship between these parameters and the algorithm’s efectiveness. Specifically, we investigate the impact of logit-based versus LIME, beam size , branching factor and the hypothesis count ℎ on the algorithm’s performance, exploring each of these parameters in the context of specific scenarios of task and victim model. The full results of the ablation studies can be found in the Appendix B.
Besides the logit-based approach from BERT-Attack [
We report some comparisons of LIME in the appendix in Table 7. From this table, we can gather multiple insights. For instance, for the BERT victim the choice of importance method depends on the task dataset, with RD favoring the logit-based method and FC preferring LIME. For the BiLSTM, the logit-based method is superior on all datasets. For RoBERTa, which is architecturally similar to BERT, the choice of importance method also depends on the dataset, with FC favoring LIME.
Furthermore, we observed that for the RoBERTa victim and C19 task, the choice between LIME and logit-based depends on other hyper-parameters such as beam size, branching factors, and hypothesis count. More specifically, our results suggest transformer-based classifiers, namely classifiers BERT and RoBERTa are generally more vulnerable to LIME over logit-based for the HN and FC datasets. Both these datasets classify whether a statement contains facts, with HN using subtle clues in writing styles and FC using external knowledge from Wikipedia. We leave the investigation behind this observation PR FC RD
Method BAE 0.34 BERT-ATTACK 0.60 DeepWordBug 0.22 Genetic 0.40 SememePSO 0.16 PWWS 0.38 SCPN 0.00 TextFooler 0.39 BeamAttack (Ours) 0.84 BAE 0.11 BERT-ATTACK 0.43 DeepWordBug 0.28 Genetic 0.50 SememePSO 0.41 PWWS 0.47 SCPN 0.09 TextFooler 0.43 BeamAttack (Ours) 0.69 BAE 0.34 BERT-ATTACK 0.53 DeepWordBug 0.44 Genetic 0.52 SememePSO 0.44 PWWS 0.48 SCPN 0.09 TextFooler 0.46 BeamAttack (Ours) 0.79 BAE 0.07 BERT-ATTACK 0.18 DeepWordBug 0.16 Genetic 0.20 SememePSO 0.10 PWWS 0.16 SCPN 0.01 TextFooler 0.16
BeamAttack (Ours) 0.59 C19
BeamAttack (Ours) 0.71 con to future work.
Our results suggest that exploring explainable AI frameworks for adversarial attacks is a promising direction of research. However, our experiments show that LIME only improved upon the logit-based approach on a few datasets. Additionally, LIME requires more queries, and when the improvement was marginal, we opted for the logit-based approach due to resource constraints.
BAE 0.48 BERT-ATTACK 0.64 DeepWordBug 0.41 Genetic 0.44 SememePSO 0.21 PWWS 0.44 SCPN 0.00 TextFooler 0.43 BeamAttack (Ours) 0.90 BAE 0.15 BERT-ATTACK 0.53 DeepWordBug 0.29 Genetic 0.54 SememePSO 0.47 PWWS 0.53 SCPN 0.12 TextFooler 0.51 BeamAttack (Ours) 0.70 BAE 0.36 BERT-ATTACK 0.60 DeepWordBug 0.48 Genetic 0.61 SememePSO 0.53 PWWS 0.57 SCPN 0.08 TextFooler 0.55 BeamAttack (Ours) 0.76 BAE 0.09 BERT-ATTACK 0.29 DeepWordBug 0.16 Genetic 0.32 SememePSO 0.15 PWWS 0.29 SCPN 0.01 TextFooler 0.24
BeamAttack (Ours) 0.83 C19
BeamAttack (Ours) 0.72
Con 6.2. Beam Size We also conducted an experiment to investigate the efect of the beam size on our algorithm’s performance. Specifically, we experimented on a subset of 30 samples from the PR2 dataset using the RoBERTa victim model. The results are presented in Figure 2, with the exact scores provided in Appendix Table 8. Our analysis reveals a consistent improvement in all scores as the beam size increases.
However, we encountered a significant limitation. As shown in the table, a beam size of 100 requires 16,500 queries per sample, which is impractical for limited GPU setup. Therefore, we sought an optimal
Con trade-of where the scores would reach a plateau. In the case of PR2 and RoBERTa, we determined that a beam size of 60 strikes a reasonable balance between performance and computational feasibility.
We further explored the impact of the branching factor on our algorithm’s performance, using a ifxed beam size of 40. We conducted an experiment on a subset of 30 samples from the PR2 dataset, employing the RoBERTa victim model. The results are illustrated in Figure 3, which displays the scores against varying branching factors. The exact scores can be found in Appendix Table 9. Our analysis reveals that increasing the branching factor leads to a slight improvement in the BODEGA score.
Our algorithm’s flexibility in replacing, skipping, or removing words, combined with the use of a masked language model, ensures that the resulting sentence remains semantically correct. The beam search approach enables us to eficiently query for multiple adversarial samples and use the one that is most semantically close to our original sentence.
We conducted an ablation study on the hypothesis count ℎ, which defines how many adversarial samples to use before selecting the closest. We explored diferent scenarios, incrementing the parameter from 10 to 20, but observed only minimal efects, resulting in a negligible improvement or deterioration of less than 1% in the BODEGA score. We provide a small-scale report of our findings for the RoBERTa victim and various tasks in the appendix (Table 10). Notably, in some cases, it came at the cost of requiring more queries. Therefore, we opted to maintain a constant value of 10 for the hypothesis count in most cases.
We acknowledge that a more comprehensive investigation of this parameter could have potentially yielded further improvements.
The LIME explainability method itself presents several hyper-parameters that can be optimized. Although tuning these parameters was not our primary focus, we recognized their potential impact on our approach. Due to time constraints, we initially chose to keep the parameters fixed, but we later realized that adjusting them could have a significant efect on our algorithm’s performance. The complete documentation of parameters can be found here5.
Specifically, we found that by reducing the number of samples used by LIME, we could substantially decrease the number of victim model queries required without compromising our algorithm’s performance. Notably, by setting the number of samples to 500, a significant reduction of 4500 queries per explanation was achieved, compared to LIME’s default setting of 5000. This adjustment may come at the cost of reduced performance for longer samples, highlighting the need for further exploration of these parameters in future work.
In future studies, researchers could explore matching the explainability model better to the victim model. This could involve trying out diferent kernel sizes or entirely diferent kernels. We think this adjustment could improve the eficency of generating an explanation.
In this shared task, we introduced BeamAttack, an innovative adversarial text generation method that combines multiple techniques from the literature with novel approaches. At the core of BeamAttack lies the beam search algorithm, which serves as a fundamental tool in optimizing adversarial text generation.
Our method leverages a Masked Language Model (MLM), specifically RoBERTa, to produce contextually appropriate word substitutions. Notably, RoBERTa’s ability to generate alternative words with typos and controversial connotations significantly enhances BeamAttack’s efectiveness. 5Code Documentation of LimeTextExplainer.
LimeTextExplainer
https://lime-ml.readthedocs.io/en/latest/lime.html#lime.lime_text.
Additionally, we integrate LIME, an interpretability method, to calculate the contribution of each word to the model’s classification. Our experiments demonstrate significant improvements in attack efectiveness, particularly in specific task contexts.
The key feature of BeamAttack is its utilization of beam search, which enables the identification of optimal word-level modifications. Unlike previous methods relying on simplistic greedy search approaches, BeamAttack’s beam search strategy allows for more nuanced modification decisions. Moreover, by incorporating the capability to skip or remove words, inspired by prior work, we enhance the algorithm’s flexibility in exploring potential solutions.
Furthermore, BeamAttack’s beam search produces multiple alternative adversarial text hypotheses capable of flipping the model’s classification. By selecting the hypothesis with the highest semantic similarity to the input text, our method efectively filters out dissimilar or contradictory hypotheses.
In summary, BeamAttack’s eficacy is significantly attributed to its beam search component, which plays a crucial role in optimizing adversarial text generation. The flexibility provided by tunable hyper-parameters allows users to prioritize semantic or character similarity based on their specific requirements.
Our word replacement strategy in BeamAttack is currently limited to methods of substituting and removing words. Removing a word can sometimes result in syntactically incorrect and nonsensical sentences, especially since RoBERTa is not utilized for this operation. This decreases the coherence of the context after the change. To enhance the quality of our outputs, we recommend exploring the integration of word insertion techniques into the beam search process. This approach could potentially improve the syntactic and semantic integrity of the sentences.
The BeamAttack approach strives to maintain semantic similarity to the original sample via semantic ifltering. However, there could be a benefit to scoring the beams at each step of the beam search, rather than solely relying on selecting the hypothesis with the highest semantic score.
Moreover, while RoBERTa provides context-based alternatives, these alternatives solely depend on the context rather than the word to be replaced itself. This limitation may impact the performance of the beam search, potentially resulting in alternatives that are opposite in meaning to the word to be replaced. To address this, potential solutions include prompting Language Models (LLMs) to produce word candidates at each step of the beam search or filtering out produced alternatives based on similarity to the word to be replaced. However, these approaches may introduce trade-ofs and require careful consideration to maintain performance.
In our experiments, we limited ourselves to the use of the Explainable AI method LIME. However, we suggest that future research should explore the potential of diverse Explainable AI methods to uncover vulnerabilities in the victim’s decision-making process. Our experience with LIME has demonstrated the value of these approaches, but we believe that Explainable AI frameworks could provide even more insightful explanations. By leveraging these techniques, researchers may be able to identify more efective strategies for generating adversarial examples, ultimately leading to more robust and reliable machine learning models.
We would like to express our gratitude to the Department of Computational Linguistics at the University of Zurich (UZH) for the valuable advice and guidance they ofered throughout our research. Additionally, we appreciate their eforts in providing us with access to a GPU during the evaluation phase of our project. For more information about the department, please visit their website at https://www.cl.uzh.ch/en.html. [32] D. Lee, S. Moon, J. Lee, H. O. Song, Query-eficient and scalable black-box adversarial attacks on discrete sequential data via bayesian optimization, 2022. arXiv:2206.08575. [33] S. Ren, Y. Deng, K. He, W. Che, Generating natural language adversarial examples through probability weighted word saliency, in: A. Korhonen, D. Traum, L. Màrquez (Eds.), Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, Association for Computational Linguistics, Florence, Italy, 2019, pp. 1085–1097. URL: https://aclanthology.org/ P19-1103. doi:10.18653/v1/P19-1103. [34] A. Barrón-Cedeño, F. Alam, T. Chakraborty, T. Elsayed, P. Nakov, P. Przybyła, J. M. Struß, F. Haouari, M. Hasanain, F. Ruggeri, X. Song, R. Suwaileh, The clef-2024 checkthat! lab: Check-worthiness, subjectivity, persuasion, roles, authorities, and adversarial robustness, in: N. Goharian, N. Tonellotto, Y. He, A. Lipani, G. McDonald, C. Macdonald, I. Ounis (Eds.), Advances in Information Retrieval, Springer Nature Switzerland, Cham, 2024, pp. 449–458. [35] T. Sellam, D. Das, A. Parikh, BLEURT: Learning robust metrics for text generation, in: D. Jurafsky, J. Chai, N. Schluter, J. Tetreault (Eds.), Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, Association for Computational Linguistics, Online, 2020, pp. 7881–7892.
URL: https://aclanthology.org/2020.acl-main.704. doi:10.18653/v1/2020.acl-main.704.
Input: = [0, 1, . . . , ] // input tokenized sentence, // gold-label, // beam size, // branching factor, // hypothesis count, // the target model to attack Output: // adversarial sample Initialize the beam as a priority queue with the original sentence and its score ← PriorityQueue() .((, ._()[ ])) begin FCalculateWordImportance _ ← [] foreach word in do _ ← LIME_importance(, , ) _
_.((, _ + _)) end return _ end end masked_language_model.predict(, , ) return ← logit_importance(, , )
CalculateWordImportance(, ) Sort _ by descending order while beam is not empty do _ ← [] foreach (, ) in beam do foreach word in _ do ← GetTopReplacements( , , ) foreach replacement in replacements do ← with replaced by replacement _ ← ._()[ ] _.((, _)) begin FLogit_importance _ ← with replaced by [MASK] return ._()[ ] − ._(_)[ ]
Algorithm 1: BeamAttack end end end
end end end ← end end end return _ begin FLIME_importance
Input: , , return LIME_score end end Sort _ by score ← top items from _ Check for success: foreach (, ) in beam do if model.predict() ̸= then
_.((, )) end if length of _ ≥ then break
SelectBestCandidate(_) return if _ is not empty, otherwise return None begin FSelectBestCandidate _ ← None _ ← −∞ foreach (, ) in _ do ← Bleurt_score(, ) if > _ then
_ ← _ ←
RD RD FC FC FC FC HN HN FC FC 1.0 1.0 1.0 1.0 1.0