Elamur Research
☰
home / papers / 2020 / TextAttack: A Framework for Adversarial Attacks, Data Augmentation, and Adversarial Training in NLP

TextAttack: A Framework for Adversarial Attacks, Data Augmentation, and Adversarial Training in NLP

Written for the Research library (claude-opus-5-5) from the paper text, in our own words: the license "arXiv — non-exclusive license to distribute" does not allow redistributing the text itself. Original — arxiv.org/pdf/2005.05909

Summary

Research on adversarial attacks against NLP models has been fragmented. Each attack lives in its own codebase and is tested on different victim models and data samples. This makes fair comparison hard and reimplementation slow and error-prone. The authors address this with TextAttack, an open-source Python library. It treats every attack as a combinatorial search assembled from four interchangeable parts:

  • a goal function that defines success,
  • constraints that keep perturbations valid,
  • a transformation that proposes edits,
  • a search method that explores candidates.

With this decomposition, 16 published attacks are reimplemented as reusable "recipes." Researchers can also create new attacks by swapping in a single component, such as retargeting TextFooler at translation models. The library connects to HuggingFace transformers and nlp and ships dozens of pretrained models. The same components drive data augmentation and adversarial training. Experiments show two benefits:

  • Augmentation mainly helps when training data are scarce.
  • Adversarial training raises an LSTM's accuracy under attack.

The framework lowers the entry barrier for robustness research and enables standardized benchmarking.

Key points

  • Includes 16 attack recipes, among them textfooler, deepwordbug, bae, bert-attack, pwws, pso, hotflip and seq2sick. It also provides 82 pretrained models (word-level LSTM/CNN, BERT and other transformers) and supports all nine GLUE tasks, plus translation and summarization.
  • An AttackedText object keeps the original text alongside its tokenization. This avoids capitalization and segmentation errors such as "aren't" turning into "aren'too".
  • Caching of model outputs and constraint checks alone makes the Alzantot et al. (2018) genetic algorithm about 5× faster.
  • The data augmentation recipes are EDA and Embedding. On rotten tomatoes with WordCNN, they give the largest gains with very small training sets.
  • Adversarial training was tested on an LSTM trained on 3k sst2 samples:
    • Training against deepwordbug for 75 epochs raised accuracy under deepwordbug attack from 23.46% to 44.74%.
    • Training against textfooler raised accuracy under textfooler attack from 2.23% to 29.63%.
    • In both cases, clean accuracy dropped somewhat.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

Fields: Other

Cited by

301 papers of our library cite it (of the 140673 whose bibliographies we read); 11 of them have a page here, 290 not yet.

Cite

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.48550/arxiv.2005.05909 · arXiv 2005.05909

@misc{morris2020textattack,
  title = {{TextAttack: A Framework for Adversarial Attacks, Data Augmentation, and Adversarial Training in NLP}},
  author = {Morris, John X. and Lifland, Eli and Yoo, Jin Yong and Grigsby, Jake and Jin, Di and Qi, Yanjun},
  year = {2020},
  doi = {10.48550/arxiv.2005.05909},
  eprint = {2005.05909},
  archivePrefix = {arXiv},
  url = {https://doi.org/10.48550/arxiv.2005.05909}
}

References

39 references, 18 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Abhaya Agarwal and Alon Lavie. 2008. Meteor, m-bleu and m-ter: Evaluation metrics for high-correlation with human rankings of machine translation output. In WMT@ACL. find
  2. Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani B. Srivastava, and Kai-Wei Chang. 2018. Generating natural language adversarial examples. ArXiv, abs/1804.07998. find our card
  3. Daniel Matthew Cer, Yinfei Yang, Sheng yi Kong, Nan Hua, Nicole Limtiaco, Rhomni St. John, Noah Constant, Mario Guajardo-Cespedes, Steve Yuan, Chris Tar, Yun-Hsuan Sung, Brian Strope, and Ray Kurzweil. 2018. Universal sentence encoder. ArXiv, abs/1803.11175. find our card
  4. Minhao Cheng, Jinfeng Yi, Pin-Yu Chen, Huan Zhang, and Cho-Jui Hsieh. 2018. Seq2sick: Evaluating the robustness of sequence-to-sequence models with adversarial examples. find
  5. Alexis Conneau, Douwe Kiela, Holger Schwenk, Loı̈c Barrault, and Antoine Bordes. 2017. Supervised learning of universal sentence representations from natural language inference data. In EMNLP. find our card
  6. Zhendong Dong, Qiang Dong, and Changling Hao. 2006. Hownet and the computation of meaning. find
  7. Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2017. Hotflip: White-box adversarial examples for text classification. In ACL. find our card
  8. Shi Feng, Eric Wallace, Alvin Grissom II, Mohit Iyyer, Pedro Rodriguez, and Jordan Boyd-Graber. 2018. Pathologies of neural models make interpretations difficult. find
  9. Ji Gao, Jack Lanchantin, Mary Lou Soffa, and Yanjun Qi. 2018. Black-box generation of adversarial text sequences to evade deep learning classifiers. 2018 IEEE Security and Privacy Workshops (SPW), pages 50–56. find our card
  10. Siddhant Garg and Goutham Ramakrishnan. 2020. Bae: Bert-based adversarial examples for text classification. find our card
  11. Ari Holtzman, Jan Buys, Maxwell Forbes, Antoine Bosselut, David Golub, and Yejin Choi. 2018. Learning to write with cooperative discriminators. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 1638–1649, Melbourne, Australia. A… find our card
  12. Robin Jia and Percy Liang. 2017. Adversarial examples for evaluating reading comprehension systems. In Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing, pages 2021–2031, Copenhagen, Denmark. Association for Computational Linguistics. find our card
  13. Robin Jia, Aditi Raghunathan, Kerem Göksel, and Percy Liang. 2019. Certified robustness to adversarial word substitutions. In EMNLP/IJCNLP. find our card
  14. Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2019. Is bert really robust? natural language attack on text classification and entailment. ArXiv, abs/1907.11932. find our card
  15. Rafal Józefowicz, Oriol Vinyals, Mike Schuster, Noam Shazeer, and Yonghui Wu. 2016. Exploring the limits of language modeling. ArXiv, abs/1602.02410. find
  16. James Kennedy and Russell Eberhart. 1995. Particle swarm optimization. In Proceedings of ICNN’95-International Conference on Neural Networks, volume 4, pages 1942–1948. IEEE. find
  17. Ryan Kiros, Yukun Zhu, Ruslan Salakhutdinov, Richard S. Zemel, Raquel Urtasun, Antonio Torralba, and Sanja Fidler. 2015. Skip-thought vectors. ArXiv, abs/1506.06726. — [arXiv:1506.06726](https://arxiv.org/abs/1506.06726) find
  18. Volodymyr Kuleshov, Shantanu Thakoor, Tingfung Lau, and Stefano Ermon. 2018. Adversarial examples for natural language classification problems. find
  19. Bogdan Kulynych, Jamie Hayes, Nikita Samarin, and Carmela Troncoso. 2018. Evading classifiers in discrete domains with provable optimality guarantees. CoRR, abs/1810.10939. — [arXiv:1810.10939](https://arxiv.org/abs/1810.10939) find
  20. Jinfeng Li, Shouling Ji, Tianyu Du, Bo Li, and Ting Wang. 2019. Textbugger: Generating adversarial text against real-world applications. ArXiv, abs/1812.05271. find our card
  21. Linyang Li, Ruotian Ma, Qipeng Guo, Xiangyang Xue, and Xipeng Qiu. 2020. Bert-attack: Adversarial attack against bert using bert. find our card
  22. Paul Michel, Xian Li, Graham Neubig, and Juan Miguel Pino. 2019. On evaluation of adversarial perturbations for sequence-to-sequence models. CoRR, abs/1903.06620. find
  23. George Armitage Miller, Richard Beckwith, Christiane Fellbaum, Derek Gross, and Katherine J. Miller. 1990. Introduction to wordnet: An on-line lexical database. International Journal of Lexicography, 3:235–244. find
  24. Nikola Mrkšić, Diarmuid O Séaghdha, Blaise Thomson, Milica Gašić, Lina Rojas-Barahona, Pei-Hao Su, David Vandyke, Tsung-Hsien Wen, and Steve Young. 2016. Counter-fitting word vectors to linguistic constraints. arXiv preprint arXiv:1603.00892. find
  25. Daniel Naber et al. 2003. A rule-based style and grammar checker. Citeseer. find
  26. Nicolas Papernot, Fartash Faghri, Nicholas Carlini, Ian Goodfellow, Reuben Feinman, Alexey Kurakin, Cihang Xie, Yash Sharma, Tom Brown, Aurko Roy, Alexander Matyasko, Vahid Behzadan, Karen Hambardzumyan, Zhishuai Zhang, Yi-Lin Juang, Zhi Li, Ryan Sheatsley, Abhibhav Garg, Jonathan Uesato, Willi Gier… — [arXiv:1610.00768](https://arxiv.org/abs/1610.00768) find
  27. Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. 2001. Bleu: a method for automatic evaluation of machine translation. In ACL. find our card
  28. Maja Popovic. 2015. chrf: character n-gram f-score for automatic mt evaluation. In WMT@EMNLP. find our card
  29. Danish Pruthi, Bhuwan Dhingra, and Zachary C. Lipton. 2019. Combating adversarial misspellings with robust word recognition. find our card
  30. Alec Radford, Jeff Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. 2019. Language models are unsupervised multitask learners. find
  31. Nils Reimers and Iryna Gurevych. 2019. Sentence-bert: Sentence embeddings using siamese bert-networks. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing. Association for Computational Linguistics. find
  32. Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. 2019. Generating natural language adversarial examples through probability weighted word saliency. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pages 1085–1097, Florence, Italy. Association for Computati… find our card
  33. Samson Tan, Shafiq Joty, Min-Yen Kan, and Richard Socher. 2020. It’s morphin’ time! Combating linguistic discrimination with inflectional perturbations. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 2920–2935, Online. Association for Computational… find
  34. Eric Wallace, Jens Tuyls, Junlin Wang, Sanjay Subramanian, Matthew Gardner, and Sameer Singh. 2019. Allennlp interpret: A framework for explaining predictions of nlp models. ArXiv, abs/1909.09251. find
  35. Xiaosen Wang, Hao Jin, and Kun He. 2019. Natural language adversarial attacks and defenses in word level. find
  36. Jason W. Wei and Kai Zou. 2019. EDA: easy data augmentation techniques for boosting performance on text classification tasks. CoRR, abs/1901.11196. find our card
  37. Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pier-ric Cistac, Tim Rault, R’emi Louf, Morgan Funtowicz, and Jamie Brew. 2019. Transformers: State-ofthe-art natural language processing. find
  38. Yuan Zang, Fanchao Qi, Chenghao Yang, Zhiyuan Liu, Meng Zhang, Qun Liu, and Maosong Sun. 2020. Word-level textual adversarial attacking as combinatorial optimization. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 6066–6080, Online. Association for… find our card
  39. Tianyi Zhang*, Varsha Kishore*, Felix Wu*, Kilian Q. Weinberger, and Yoav Artzi. 2020. Bertscore: Evaluating text generation with bert. In International Conference on Learning Representations. find