Elamur Research⌕
☰
home / papers / 2024 / Arabic Synonym BERT-based Adversarial Examples for Text Classification

Arabic Synonym BERT-based Adversarial Examples for Text Classification

Paper · 2024 · Norah Alshahrani, Saied Alshahrani, Esma Wali et al.

Summary

Studies of adversarial text attacks have focused almost entirely on English, and earlier Arabic work only perturbed individual characters. This paper presents the first word-level adversarial study for Arabic. The attack is black-box and synonym-based. A word is masked, an Arabic BERT proposes replacements through masked language modeling, and each candidate must pass a grammatical check and a semantic-similarity check before it is accepted. The victims are BERT, WordCNN and WordLSTM classifiers trained on two sentiment corpora: HARD, which is mostly Modern Standard Arabic, and MSDA, which is mostly dialectal. Four human raters judged whether the altered texts kept the grammar and meaning of the originals. The authors also measured how well attacks transfer from one model to another, and tested adversarial training as a defense. Fine-tuned BERT was the most fragile model, both to direct attacks and to examples transferred from other models. Adversarial training recovered only a few points of accuracy. The work shows that strong pretrained classifiers in a lower-resource language can be fooled by small, natural-looking word swaps.

Key points

  • Data: HARD has about 93K Booking.com hotel reviews in 4 classes, with numeric labels relabeled as Poor/Fair/Good/Excellent. MSDA has about 50K posts from X in 3 classes. Average lengths are 19.50 and 9.99 words.
  • Attack pipeline: AraBERT generates synonym candidates, CAMeLBERT checks grammatical agreement, and a Sentence-Transformers model checks semantic similarity against a threshold. Hyperparameters follow Jin et al. (2020).
  • BERT accuracy on HARD went from 88.59% to 73.9% under attack, and recovered to 76.51% after adversarial training.
  • BERT accuracy on MSDA went from 90.55% to 63.62% under attack, and recovered to 65.69% after adversarial training.
  • Transferability was scored with a delta measure, where higher means the examples transfer better. Fine-tuned BERT was the most affected by examples crafted on other models.
  • Code and trained models are released on GitHub (NorahAlshahrani/bert_synonym_attack).

Interesting ideas

  • I1. A masked LM proposes candidates freely, and two independent gates (a grammatical-category match and an embedding-similarity cutoff) reject anything that drifts, so generation stays cheap while quality is controlled by separate checkers.
  • I2. Each role is filled by a different model (generator, grammar judge, similarity judge), so no single model grades its own output.
  • I3. Examples crafted against one source model are evaluated on every other model, and a delta score shows which architectures share blind spots.
  • I4. Human judges rate grammatical similarity and semantic similarity as two separate axes instead of giving one overall quality score.
  • I5. The authors note that a black-box attack's measured impact is capped by the victim's existing error rate, because examples it already misclassifies cannot be removed without white-box access.

For Mova

How these ideas could serve Mova, our small open language model — its files, stages and tests:

  • I1 (learn): Mova could produce meaning-preserving variants of training sentences and use them as negative controls, where the frames and answers are expected to stay identical. Any change then flags a fragile step.
  • I2 (learn): This matches the witness-parser approach. The model that proposes silver edits should be kept distinct from the models that vote on accepting them.
  • I3 (tree): Mova could craft hard sentences that break the perceptron parser and test whether they also break gparse. Shared failures point to treebank or annotation issues rather than model issues.
  • I4 (back): Output of the text → graph → text compressor could be scored the same way, so fluent-but-wrong output is told apart from awkward-but-faithful output.
  • I5 (answer): Robustness reports for the readers should state baseline errors separately, so that degradation from perturbations is not mixed up with failures that were already there.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Clarkson UniversityPotsdam · United States5 works · 54 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksArts and Humanities · 17,450 worksLanguage and Linguistics · 17,296 works

🧭 Topics 1Research subjects and languages the work is about.Semitic languages · 3,066 works

Cite

Cite as Norah Alshahrani, Saied Alshahrani, Esma Wali and Jeanna Matthews. 2024. Arabic Synonym BERT-based Adversarial Examples for Text Classification. Proceedings of the 18th Conference of the European Chapter of the Association for Computational Linguistics: Student Research Workshop.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2024.eacl-srw.10

@inproceedings{alshahrani2024arabic,
  title = {{Arabic Synonym BERT-based Adversarial Examples for Text Classification}},
  author = {Norah Alshahrani, Saied Alshahrani, Esma Wali and Jeanna Matthews},
  booktitle = {Proceedings of the 18th Conference of the European Chapter of the Association for Computational Linguistics: Student Research Workshop},
  year = {2024},
  doi = {10.18653/v1/2024.eacl-srw.10},
  url = {https://doi.org/10.18653/v1/2024.eacl-srw.10}
}

References

54 references, 20 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Basemah Alshemali and Jugal Kalita. 2019. Adversarial Examples in Arabic. In 2019 International Conference on Computational Science and Computational Intelligence (CSCI), pages 371–376. find
  2. Basemah Alshemali and Jugal Kalita. 2021. Character-level Adversarial Examples in Arabic. In 2021 20th IEEE International Conference on Machine Learning and Applications (ICMLA), pages 9–14. find
  3. Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, and Kai-Wei Chang. 2018. Generating natural language adversarial examples. In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pages 2890–2896, Brussels, Belgium. Association for Computational Linguistics. ↗
  4. Wissam Antoun, Fady Baly, and Hazem Hajj. 2020. AraBERT: Transformer-based Model for Arabic Language Understanding. In Proceedings of the 4th Workshop on Open-Source Arabic Corpora and Processing Tools, with a Shared Task on Offensive Language Detection, pages 9–15, Marseille, France. European Language Resource Association. ↗
  5. Anurag Arnab, Ondrej Miksik, and Philip HS Torr. 2018. On the Robustness of Semantic Segmentation Models to Adversarial Attacks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 888–897. ElMehdi Boujou, Hamza Chataoui, Abdellah El Mekki, Saad Benjelloun, Ikram Chairi, and Ismail Berrada. find
  6. Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. In North American Chapter of the Association for Computational Linguistics.
  7. Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018. HotFlip: White-box adversarial examples for text classification. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pages 31–36, Melbourne, Australia. Association for Computational Linguistics. ↗
  8. Ashraf Elnagar, Yasmin S. Khalifa, and Anas Einea. 2018. Hotel Arabic-Reviews Dataset Construction for Sentiment Analysis Applications. In Intelligent Natural Language Processing: Trends and Applications, pages 35–52, Cham. Springer International Publishing. ↗
  9. Shi Feng, Eric Wallace, Alvin Grissom II, Mohit Iyyer, Pedro Rodriguez, and Jordan Boyd-Graber. 2018. Pathologies of Neural Models Make Interpretations Difficult. In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pages 3719–3728, Brussels, Belgium. Association for Computational Linguistics. Jules Gagnon-Marchand, Hamed Sadeghi, Md. find
  10. Akmal Haidar, and Mehdi Rezagholizadeh. 2019. SALSA-TEXT: Self Attentive Latent Space Based Adversarial Text Generation, page 119–131. Springer International Publishing. find
  11. Ji Gao, Jack Lanchantin, Mary Lou Soffa, and Yanjun Qi. 2018. Black-Box Generation of Adversarial Text Sequences to Evade Deep Learning Classifiers. In 2018 IEEE Security and Privacy Workshops (SPW), pages 50–56.
  12. Corey Kereliuk, Bob L Sturm, and Jan Larsen. 2015. Deep Learning and Music Adversaries. IEEE Transactions on Multimedia, 17(11):2059–2071. ↗
  13. Siddhant Garg and Goutham Ramakrishnan. 2020. BAE: BERT-based Adversarial Examples for Text Classification. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 6174–6181, Online. Association for Computational Linguistics.
  14. Yuan Gong and Christian Poellabauer. 2017. Crafting Adversarial Examples for Speech Paralinguistics Applications. arXiv preprint arXiv:1711.03280. ↗
  15. Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and Harnessing Adversarial Examples. arXiv preprint arXiv:1412.6572. ↗
  16. Shreya Goyal, Sumanth Doddapaneni, Mitesh M. Khapra, and Balaraman Ravindran. 2023. A Survey of Adversarial Defenses and Robustness in NLP. ACM Computing Surveys, 55(14s). ↗
  17. Michael Grosvald, Sarah Al-Alami, Ali Idrissi, R Stockwell, M O’Leary, Z XU, and ZL Zhou. 2019. Word Reading in Arabic: Influences of Diacritics and Ambiguity. In 36th West Coast Conference on Formal Linguistics, pages 176–181. Cascadilla Proceedings Project. find
  18. Awni Hannun, Carl Case, Jared Casper, Bryan Catanzaro, Greg Diamos, Erich Elsen, Ryan Prenger, Sanjeev Satheesh, Shubho Sengupta, Adam Coates, et al. 2014. Deep Speech: Scaling up End-To-End Speech Recognition. arXiv preprint arXiv:1412.5567. ↗
  19. Sepp Hochreiter and Jürgen Schmidhuber. 1997. Long Short-Term Memory. Neural Computation, 9(8):1735–1780. ↗
  20. Ling Huang, Anthony D. Joseph, Blaine Nelson, Benjamin I.P. Rubinstein, and J. D. Tygar. 2011. Adversarial Machine Learning. In Proceedings of the 4th ACM Workshop on Security and Artificial Intelligence, AISec ’11, page 43–58, New York, NY, USA. Association for Computing Machinery. find
  21. Yoon Kim. 2014. Convolutional Neural Networks for Sentence Classification. In Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 1746–1751, Doha, Qatar. Association for Computational Linguistics. ↗
  22. Jernej Kos, Ian Fischer, and Dawn Song. 2018. Adversarial Examples for Generative Models. In 2018 ieee security and privacy workshops (spw), pages 36–42. IEEE. find
  23. Atul Kumar, Sameep Mehta, and Deepak Vijaykeerthy. 2017. An Introduction to Adversarial Machine Learning. In Big Data Analytics, pages 293–299, Cham. Springer International Publishing. find
  24. Alexey Kurakin, Ian Goodfellow, and Samy Bengio. 2017a. Adversarial Examples in the Physical World. arXiv preprint arXiv:1607.02533. ↗
  25. Alexey Kurakin, Ian Goodfellow, and Samy Bengio. 2017b. Adversarial Machine Learning at Scale. arXiv preprint arXiv:1611.01236. ↗
  26. Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. 2016. Adversarial Machine Learning at Scale. ArXiv, abs/1611.01236. ↗
  27. Dianqi Li, Yizhe Zhang, Hao Peng, Liqun Chen, Chris Brockett, Ming-Ting Sun, and Bill Dolan. 2021. Contextualized Perturbation for Textual Adversarial Attack. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 5053–5069, Online. Association for Computational Linguistics. ↗
  28. Jinfeng Li, Shouling Ji, Tianyu Du, Bo Li, and Ting Wang. 2018. TextBugger: Generating Adversarial Text Against Real-world Applications. arXiv preprint arXiv:1812.05271. ↗
  29. Jiwei Li, Will Monroe, and Dan Jurafsky. 2017. Understanding Neural Networks through Representation Erasure. arXiv preprint arXiv:1612.08220. ↗
  30. Go Inoue, Bashar Alhafni, Nurpeiis Baimukan, Houda Bouamor, and Nizar Habash. 2021. The Interplay of Variant, Size, and Task Type in Arabic Pre-trained Language Models. In Proceedings of the Sixth Arabic Natural Language Processing Workshop, pages 92–104, Kyiv, Ukraine (Virtual). Association for Computational Linguistics.
  31. Linyang Li, Ruotian Ma, Qipeng Guo, Xiangyang Xue, and Xipeng Qiu. 2020. BERT-ATTACK: Adversarial attack against BERT using BERT. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 6193–6202, Online. Association for Computational Linguistics.
  32. Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2020. Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailment. Proceedings of the AAAI Conference on Artificial Intelligence, 34(05):8018– 8025.
  33. Bin Liang, Hongcheng Li, Miaoqiang Su, Pan Bian, Xirong Li, and Wenchang Shi. 2018. Deep Text Classification Can Be Fooled. In Proceedings of the Twenty-Seventh International Joint Conference on Artificial Intelligence. International Joint Conferences on Artificial Intelligence Organization. find
  34. Rensis Likert. 1932. A Technique for the Measurement of Attitudes. Archives of psychology. find
  35. Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. 2017. Delving into Transferable Adversarial Examples and Black-box Attacks. arXiv preprint arXiv:1611.02770. ↗
  36. Flávio Mello. 2020. A Survey on Machine Learning Adversarial Attacks. Journal of Information Security and Cryptography (Enigma), 7(1):1–7. ↗
  37. Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z. Berkay Celik, and Ananthram Swami. 2017. Practical Black-Box Attacks against Machine Learning. In Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, ASIA CCS ’17, page 506–519, New York, NY, USA. Association for Computing Machinery. ↗
  38. Nicolas Papernot, Patrick McDaniel, Ananthram Swami, and Richard Harang. 2016. Crafting Adversarial Input Sequences for Recurrent Neural Networks. In MILCOM 2016-2016 IEEE Military Communications Conference, pages 49–54. IEEE. find
  39. Jeffrey Pennington, Richard Socher, and Christopher Manning. 2014. GloVe: Global Vectors for Word Representation. In Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 1532–1543, Doha, Qatar. Association for Computational Linguistics. ↗
  40. Nikolaos Pitropakis, Emmanouil Panaousis, Thanassis Giannetsos, Eleftherios Anastasiadis, and George Loukas. 2019. A Taxonomy and Survey of Attacks Against Machine Learning. Computer Science Review, 34:100199. ↗
  41. Shilin Qiu, Qihe Liu, Shijie Zhou, and Wen Huang. 2022. Adversarial Attack and Defense Technologies in Natural Language Processing: A Survey. Neurocomputing, 492:278–307. ↗
  42. Nils Reimers and Iryna Gurevych. 2020. Making Monolingual Sentence Embeddings Multilingual using Knowledge Distillation. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 4512–4525, Online. Association for Computational Linguistics.
  43. Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. 2019. Generating Natural Language Adversarial Examples through Probability Weighted Word Saliency. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pages 1085– 1097, Florence, Italy. Association for Computational Linguistics. ↗
  44. Marco Tulio Ribeiro, Tongshuang Wu, Carlos Guestrin, and Sameer Singh. 2020. Beyond Accuracy: Behavioral Testing of NLP Models with CheckList. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 4902– 4912, Online. Association for Computational Linguistics. ↗
  45. Saeid Samizade, Zheng-Hua Tan, Chao Shen, and Xiaohong Guan. 2020. Adversarial Example Detection by Classification for Deep Speech Recognition. In ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 3102–3106. IEEE. ↗
  46. Ashish Shrivastava, Tomas Pfister, Oncel Tuzel, Joshua Susskind, Wenda Wang, and Russell Webb. 2017. Learning from Simulated and Unsupervised Images through Adversarial Training. In 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 2242–2251. find
  47. Kaitao Song, Xu Tan, Tao Qin, Jianfeng Lu, and Tie-Yan Liu. 2020. MPNet: Masked and Permuted Pre-training for Language Understanding. In Advances in Neural Information Processing Systems, volume 33, pages 16857–16867. Curran Associates, Inc. ↗
  48. Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2014. Intriguing Properties of Neural Networks. arXiv preprint arXiv:1312.6199. ↗
  49. Rey Reza Wiyatno, Anqi Xu, Ousmane Dia, and Archy de Berker. 2019. Adversarial Examples in Modern Machine Learning: A Review. arXiv preprint arXiv:1911.05268. ↗
  50. Ying Xu, Xu Zhong, Antonio Jimeno Yepes, and Jey Han Lau. 2021. Grey-box Adversarial Attack And Defence For Sentiment Classification. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 4078–4087, Online. Association for Computational Linguistics. ↗
  51. Yuan Zang, Fanchao Qi, Chenghao Yang, Zhiyuan Liu, Meng Zhang, Qun Liu, and Maosong Sun. 2020. Word-level Textual Adversarial Attacking as Combinatorial Optimization. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics. Association for Computational Linguistics.
  52. Piotr Żelasko, Sonal Joshi, Yiwen Shao, Jesus Villalba, Jan Trmal, Najim Dehak, and Sanjeev Khudanpur. 2021. Adversarial Attacks and Defenses for Speech Recognition Systems. arXiv preprint arXiv:2103.17122. ↗
  53. Wei Emma Zhang, Quan Z. Sheng, Ahoud Alhazmi, and Chenliang Li. 2020. Adversarial Attacks on Deep-learning Models in Natural Language Processing: A Survey. ACM Transactions on Intelligent Systems and Technology, 11(3). ↗
  54. Yu Zhang, Kun Shao, Junan Yang, and Hui Liu. 2021. Black-Box Universal Adversarial Attack on Text Classifiers. In 2021 2nd Asia Conference on Computers and Communications (ACCC), pages 1–5. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/alshahrani-2024-arabic-synonym-bert-based-adversarial/