With the widespread use of Chinese, the research on an adversarial example for Chinese text classification is becoming increasingly urgent. A qualified text classification adversarial example must be able to deceive both the classifier and human observers. To solve this problem, we propose a new kind of Chinese text classification adversarial example generation strategy: similar word replacement (SWR). First, similar words in Chinese are divided into semantically similar words and appearance-similar words, and their generation methods are designed, respectively. Second, for target and non-target attacks, keyword ranking and adversarial example generation algorithms are designed. Then, a qualified adversarial example generation method based on SWR is proposed, which can generate a high-quality Chinese text classification adversarial example. The adversarial examples generated by the algorithm are sufficiently deceptive, and they have achieved obvious results on both long text and short text for two-category and multi-category datasets when attacking the Chinese text classifiers based on CNN and RNN. The evaluation group has given a higher value than other modification strategies in terms of three subjective indicators: original intention retention, modification concealment, and strategy concealment.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Similar Word Replacement: A New Adversarial Example Generation Strategy for Chinese Text Classification

  • Fangzhou Yuan,
  • Hongjun Wang,
  • Bingchuan Wang,
  • Yuan Yuan,
  • Mingfeng Lu

摘要

With the widespread use of Chinese, the research on an adversarial example for Chinese text classification is becoming increasingly urgent. A qualified text classification adversarial example must be able to deceive both the classifier and human observers. To solve this problem, we propose a new kind of Chinese text classification adversarial example generation strategy: similar word replacement (SWR). First, similar words in Chinese are divided into semantically similar words and appearance-similar words, and their generation methods are designed, respectively. Second, for target and non-target attacks, keyword ranking and adversarial example generation algorithms are designed. Then, a qualified adversarial example generation method based on SWR is proposed, which can generate a high-quality Chinese text classification adversarial example. The adversarial examples generated by the algorithm are sufficiently deceptive, and they have achieved obvious results on both long text and short text for two-category and multi-category datasets when attacking the Chinese text classifiers based on CNN and RNN. The evaluation group has given a higher value than other modification strategies in terms of three subjective indicators: original intention retention, modification concealment, and strategy concealment.