面向中文文本分类的对抗样本生成方法

Adversarial Examples Generation Method for Chinese Text Classification

针对深度神经网络鲁棒性问题,提出了一种面向中文文本分类的黑盒对抗样本生成方法WordBeguiler。该方法结合汉字的字形、字音特征构建对抗搜索空间,设计了新的扰动定位方式寻找影响分类结果的重要字或词组,并根据概率权重选取的方法确定修改策略生成对抗样本。使用两个主流的模型卷积神经网络(CNN)和双向长短期记忆网络(BiLSTM)在不同分类数据集上验证其有效性和可转移性。实验结果表明,与其他攻击方法相比,WordBeguiler具有攻击成功率高、扰动率低的优势,同时既保留了原始语义也一定程度上保证了语法正确性,并且可以有效地转移到BERT模型中。

Aiming at the robustness of deep neural networks,a black-box adversarial example generation method for Chinese text classification,i.e.,WordBeguiler is proposed,which combines Chinese character shape and phonetic features to construct the adversarial search space,finds important words or phrases that affect the classification results by designing new perturbation localization methods,and determines modification strategies to generate adversarial examples according to the method of probability weights selection.Two mainstream models,convolutional neural network(CNN)and bidirectional long short-term memory network(BiLSTM),are used to verify their effectiveness and transferability on different classification data sets.The experimental results show that WordBeguiler has the advantage of a higher attack success rate and lower perturbation rate compared to other attack methods while retaining the original semantics and ensuring the grammatical correctness to a certain extent,and can be effectively transferred to the BERT model.