基于汉语特征的中文对抗样本生成方法  

Adversarial Sample Generation Method Based on Chinese Features

作　　者：李相葛 罗红[1] 孙岩[1] LI Xiang-Ge;LUO Hong;SUN Yan(School of Computer Science(National Pilot Software Engineering School),Beijing University of Posts and Telecommunications,Beijing 100876,China)

机构地区：[1]北京邮电大学计算机学院(国家示范性软件学院),北京100876

出　　处：《软件学报》2023年第11期5143-5161,共19页Journal of Software

基　　金：国家自然科学基金(62172051,61877005)。

摘　　要：深度神经网络容易受到来自对抗样本的攻击,例如在文本分类任务中修改原始文本中的少量字、词、标点符号即可改变模型分类结果.目前NLP领域对中文对抗样本的研究较少且未充分结合汉语的语言特征.从中文情感分类场景入手,结合了汉语象形、表音等语言特征,提出一种字词级别的高质量的对抗样本生成方法CWordCheater,涵盖字音、字形、标点符号等多个角度.针对形近字的替换方式,引入ConvAE网络完成汉字视觉向量的嵌入,进而生成形近字替换候选池.同时提出一种基于USE编码距离的语义约束方法避免对抗样本的语义偏移问题.构建一套多维度的对抗样本评估方法,从攻击效果和攻击代价两方面评估对抗样本的质量.实验结果表明,CWordAttacker在多个分类模型和多个数据集上能使分类准确率至少下降27.9%,同时拥有更小的基于视觉和语义的扰动代价.Deep neural networks are vulnerable to attacks from adversarial samples.For instance,in a text classification task,the model can be fooled by modifying a few characters,words,or punctuation marks in the original text to change the classification result.Currently,studies of Chinese adversarial samples are limited in the field of natural language processing(NLP),and they fail to give due consideration to the language features of Chinese.This study proposes CWordCheater,a character-level and word-level high-quality method to generate adversarial samples covering the aspects of pronunciation,glyphs,and punctuation marks by approaching from the Chinese sentiment classification scenarios and taking into account the pictographic,alphabetic,and other language features of Chinese.The ConvAE network is adopted to embed Chinese visual vectors for the replacement modes of visually similar characters and further obtain the candidate pool of such characters for replacement.Moreover,a semantic constraint method based on universal sentence encoder(USE)distance is proposed to avoid the semantic offset in the adversarial sample.Finally,the study proposes a set of multi-dimensional evaluation methods to evaluate the quality of adversarial samples from the two aspects of attack effect and attack cost.Experiment results show that CWordAttacker can reduce the classification accuracy by at least 27.9%on multiple classification models and multiple datasets and has a lower perturbation cost based on vision and semantics.

关 键 词：中文情感分类 对抗样本 汉语特征 

分 类 号：TP18[自动化与计算机技术—控制理论与控制工程]