Generating Adversarial Texts by the Universal Tail Word Addition Attack

Deep neural networks (DNNs) are vulnerable to adversarial examples, which can mislead models without affecting normal judgment of humans. In the image field, such adversarial examples involve small perturbations that humans rarely notice. However, in the text domain, adversarial examples are more easily recognized due to the discrete nature of text. Existing textual adversarial attacks construct adversarial texts by replacing words or adding meaningless characters, often resulting in grammatical errors. In this paper, we propose a black-box attack method, Universal Tail Word Addition Attack (UTWAA), against textual sentiment analysis models. UTWAA adopts an ensemble strategy to select the most effective words for appending to the end of the original input, avoiding grammatical errors and making the adversarial texts less detectable by humans. We conduct extensive experiments on two datasets and six models; 10 volunteers are also invited to judge the generated texts. Results show that UTWAA achieves a high attack success rate with minimal word addition rate. By adding less than 4% of the words, the attack success rate exceeds 95%. Human evaluation indicates a 98% similarity between the adversarial texts and the original texts. Additionally, the method demonstrates good transferability in attacking state-of-the-art models.