Semantically Improved Adversarial Attack Based on Masked Language Model via Context Preservation

In masked language model (MLM) based attacks, candidate adversarial examples are flexibly generated according to the context, but how to balance imperceptibility and success rate of attacks remains a challenge. To pursue imperceptibility, external semantic constraints are imposed on candidate word generation, whereby the search space is restricted and the success rate of attacks drops. To address this issue, a semantically improved adversarial attack denoted by SAM-CP is proposed by generating high-quality candidate words satisfying the semantic constraints. In particular, linguistic constraints are adopted so that high-quality semantic candidates can be generated as fine-tuning labels instead of manual annotation. Extensive experimental results on three open-source datasets demonstrate that SAM-CP significantly improves the semantic consistency of generated adversarial samples by adopting different MLMs, respectively. Without compromising text quality, the ability to use SAM-CP to deceive state-of-the-art text classifiers is evaluated. Visit https://github.com/HugoTianX/SAM-CP for details and codes.