Overview

We propose a reinforcement learning based approach towards generating adversarial examples in black-box settings. We introduce a black-box non-targeted attack strategy by combining ideas of substitute network and adversarial example generation. We introduce an encoder-decoder that operates over words and characters of an input text and empowers the model to introduce word and character-level perturbations. We adopt a self-critical sequence training technique to train our model to generate examples that can fool or increase the probability of misclassification in text classifiers. We demonstrate that our method is able to fool well-trained models for (a) IMDB sentiment classification task and (b) AG’s news corpus news categorization task with significantly high success rates. We find that the adversarial examples generated are semantics-preserving perturbations to the original text.

Datasets

We first perform supervised pretraining using paraphrase datasets by randomly sampling parallel texts and augmenting them using simple character-transformations (eg. random insertion, deletion or replacement) to words in the text. We then use reforcement training specific to the dataset under consideration. The pretraining and evaluation datasets used in our work are listed below.

• For Pre-training:
  • Quora Question Pairs Dataset
  • Twitter URL paraphrasing corpus -- Link 1 Sample
  • ParaNMT-50 Dataset
• For Evaluation:
  • IMDB Sentiment Dataset
  • AG's News Corpus

Contact

Have a question or comment? Please contact me at pralav [at] media [dot] mit [dot] edu

**The code for this work is part of another project and can't be released currently. We will be releasing the code after the other project is complete. Watch this space for updates on this project!