Elamur Research
☰
home / papers / 2020 / BAE: BERT-based Adversarial Examples for Text Classification

BAE: BERT-based Adversarial Examples for Text Classification

Written for the Research library (claude-opus-5-5) from the paper text. Original — aclanthology.org/2020.emnlp-main.498.pdf

Summary

Text classifiers can be fooled by small edits that humans barely notice. Earlier attacks, such as TextFooler, swap words for synonyms from a fixed embedding space. They ignore sentence context, so the substitutions are often awkward or out of place. Garg and Ramakrishnan propose BAE, a soft-label black-box attack that uses the BERT masked language model to produce context-aware perturbations.

BAE ranks tokens by how much deleting each one lowers the probability of the correct label. It then either masks a token (replace) or adds a mask next to it (insert), and lets BERT-MLM propose candidates. Candidates are filtered by Universal Sentence Encoder similarity, and replacements must also match the original token's part of speech. The paper defines four modes: BAE-R, BAE-I, BAE-R/I and BAE-R+I.

The authors attacked word-LSTM, word-CNN and fine-tuned BERT on seven datasets. BAE nearly always beat TextFooler, cutting accuracy by roughly 40–80% while keeping USE similarity higher. In human evaluation, BAE outputs were judged more natural and better at preserving sentiment. This makes BAE a stronger and more realistic tool for testing NLP robustness.

Key points

  • Datasets: Amazon, Yelp, IMDB, MR (sentiment), MPQA (opinion polarity), Subj (subjectivity) and TREC (question type). The victim models were word-LSTM, word-CNN and BERT base-uncased.
  • Settings: the top K=50 BERT-MLM candidates are kept, with a USE cosine-similarity threshold of 0.8. TextFooler serves as the baseline.
  • BAE-R+I was the strongest mode in all but one case. For example, it lowered word-LSTM accuracy on Amazon from 88.0% to 4.0% (TextFooler reached 31.0%). It also cut BERT accuracy on TREC from 97.6% to 20.2%. BERT was more robust overall than word-LSTM and word-CNN.
  • Human evaluation used 3 annotators on Amazon, IMDB and MR against the BERT classifier. Naturalness (Likert 1–5) was about 3.84–3.91 for BAE-R versus 3.17–3.41 for TextFooler. Insertions in BAE-R+I strengthened the attack but slightly reduced naturalness, even though its USE scores were higher. This exposes the limits of USE as a measure of meaning preservation.
  • An ablation showed that insert operations matter more than replace operations for successful attacks. BAE is available in the TextAttack library.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

Fields: Natural language processing

Cited by

187 papers of our library cite it (of the 140673 whose bibliographies we read); 4 of them have a page here, 183 not yet.

Cite

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2020.emnlp-main.498

@inproceedings{garg2020bae,
  title = {{BAE: BERT-based Adversarial Examples for Text Classification}},
  author = {Garg, Siddhant and Ramakrishnan, Goutham},
  booktitle = {Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)},
  year = {2020},
  doi = {10.18653/v1/2020.emnlp-main.498},
  url = {https://doi.org/10.18653/v1/2020.emnlp-main.498}
}

References

27 references, 10 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, and Kai-Wei Chang. 2018. Generating natural language adversarial examples. In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing. Association for Computational Linguistics. find our card
  2. Daniel Cer, Yinfei Yang, Sheng-yi Kong, Nan Hua, Nicole Limtiaco, Rhomni St. John, Noah Constant, Mario Guajardo-Cespedes, Steve Yuan, Chris Tar, Yun-Hsuan Sung, Brian Strope, and Ray Kurzweil. 2018. Universal sentence encoder. find our card
  3. Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2018. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805. find
  4. Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018. HotFlip: White-box adversarial examples for text classification. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics, pages 31–36, Melbourne, Australia. Association for Computational Linguistics. find our card
  5. Shi Feng, Eric Wallace, Mohit Iyyer, Pedro Rodriguez, Alvin Grissom II, and Jordan L. Boyd-Graber. 2018. Right answer for the wrong reason: Discovery and mitigation. CoRR, abs/1804.07781. find
  6. Ji Gao, Jack Lanchantin, Mary Lou Soffa, and Yanjun Qi. 2018. Black-box generation of adversarial text sequences to evade deep learning classifiers. CoRR, abs/1801.04354. find our card
  7. Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and harnessing adversarial examples. In International Conference on Learning Representations. find our card
  8. Sepp Hochreiter and Jürgen Schmidhuber. 1997. Long short-term memory. Neural Com., 9(8):1735–1780. find
  9. Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2019. Is bert really robust? natural language attack on text classification and entailment. arXiv preprint arXiv:1907.11932. find our card
  10. Yoon Kim. 2014. Convolutional neural networks for sentence classification. In Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing, pages 1746–1751. find our card
  11. Alexey Kurakin, Ian Goodfellow, and Samy Bengio. 2017. Adversarial examples in the physical world. ICLR Workshop. find
  12. Jiwei Li, Will Monroe, and Dan Jurafsky. 2016. Understanding neural networks through representation erasure. CoRR, abs/1612.08220. — [arXiv:1612.08220](https://arxiv.org/abs/1612.08220) find
  13. Xin Li and Dan Roth. 2002. Learning question classifiers. In Proceedings of the 19th International Conference on Computational Linguistics - Volume 1, COLING ’02, pages 1–7, Stroudsburg, PA, USA. Association for Computational Linguistics. find
  14. Bin Liang, Hongcheng Li, Miaoqiang Su, Pan Bian, Xirong Li, and Wenchang Shi. 2017. Deep text classification can be fooled. CoRR, abs/1704.08006. — [arXiv:1704.08006](https://arxiv.org/abs/1704.08006) find
  15. John X. Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, Di Jin, and Yanjun Qi. 2020. Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp. find our card
  16. Nikola Mrkšić, Ivan Vulić, Diarmuid Ó Séaghdha, Ira Leviant, Roi Reichart, Milica Gašić, Anna Korhonen, and Steve Young. 2017. Semantic specialization of distributional word vector spaces using monolingual and cross-lingual constraints. Transactions of the Association for Computational Lingui… find
  17. Nikola Mrkšić, Diarmuid Ó Séaghdha, Blaise Thomson, Milica Gašić, Lina Rojas-Barahona, Pei-Hao Su, David Vandyke, Tsung-Hsien Wen, and Steve Young. 2016. Counter-fitting word vectors to linguistic constraints. In Proceedings of HLT-NAACL. find
  18. Bo Pang and Lillian Lee. 2004. A sentimental education: Sentiment analysis using subjectivity. In Proceedings of ACL, pages 271–278. find
  19. Bo Pang and Lillian Lee. 2005. Seeing stars: Exploiting class relationships for sentiment categorization with respect to rating scales. In Proceedings of ACL. find
  20. Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z. Berkay Celik, and Ananthram Swami. 2017. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, ASIA CCS ’17, pages 506–519, New York, NY, USA.… find
  21. Alec Radford, Jeff Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. 2019. Language models are unsupervised multitask learners. find
  22. Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. 2019. Generating natural language adversarial examples through probability weighted word saliency. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics. Association for Computational Linguistics. find our card
  23. Prathusha K Sarma, Yingyu Liang, and Bill Sethares. 2018. Domain adapted word embeddings for improved sentiment classification. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics, pages 37–42. find
  24. Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2014. Intriguing properties of neural networks. In International Conference on Learning Representations. find our card
  25. Janyce Wiebe and Theresa Wilson. 2005. Annotating expressions of opinions and emotions in language. Language Resources and Evaluation. find
  26. Wei Emma Zhang, Quan Z. Sheng, and Ahoud Abdul-rahmn F. Alhazmi. 2019. Generating textual adversarial examples for deep learning models: A survey. CoRR, abs/1901.06796. — [arXiv:1901.06796](https://arxiv.org/abs/1901.06796) find
  27. Zhengli Zhao, Dheeru Dua, and Sameer Singh. 2018. Generating natural adversarial examples. In International Conference on Learning Representations. find