摘要：

随着海量数据的积累以及计算能力的不断提高, 深度神经网络(DNN)已广泛应用于图像识别、文本分类等各个领域。然而, 有研究表明, 基于DNN的文本分类模型经常受到攻击者恶意构造的对抗样本攻击, 攻击者可以通过删除和修改原始文本、插入混淆语句以及加入标点符号等方式使得模型分类结果发生改变。现有的对抗样本生成方法大多以牺牲隐蔽性为代价, 采用多类型替换池杂糅的方式来提高攻击准确率, 无法兼顾攻击成功率和对抗样本的隐蔽性。为解决此问题, 提出一种针对对抗样本隐蔽性进行设计的中文对抗样本生成方法WordReproduction, 通过汉字本身词性并结合字词级维度来计算汉字的显著性得分, 在关键字词替换模块中利用形近字向量空间、字形拆分候选池和词语倒置3种字形替换方法, 分别对关键字和词进行替换, 并根据汉字的形态特征设计字形相似度评估算法, 更好地量化对抗样本与原文之间的相似程度。实验结果表明, WordReproduction方法生成的对抗样本在攻击成功率和字形相似度上均优于基线方法, 在情感分类场景的Transformer模型上, 相比WordHandling方法, WordReproduction的攻击成功率和字形相似度得分分别提高了51.64百分点和0.53, 其生成的对抗样本不仅能够误导模型的分类结果, 而且具有较高的隐蔽性, 使得人类阅读者很难察觉。

关键词: 深度神经网络, 文本分类, 对抗样本生成, 字形替换, 相似度评估

Abstract:

With the accumulation of massive amounts of data and continuous improvements in computing power, Deep Neural Networks (DNN) have been widely used in various tasks such as image recognition and text classification. However, studies have shown that DNN-based text classification models are often subjected to adversarial sample attacks that are maliciously constructed by attackers. Attackers can alter the classification results of a model by deleting or modifying the original text, inserting obfuscated statements, or adding punctuation marks. Most existing adversarial sample generation methods sacrifice concealment and adopt a hybrid approach involving a variety of replacement pools to improve attack accuracy, which cannot balance the attack success rate and the concealment of adversarial samples. To solve this problem, this study proposes a Chinese adversarial sample generation method called WordReproduction, which is designed to conceal adversarial samples. The saliency score of the Chinese characters is calculated by combining the parts-of-speech of the characters themselves with the word level dimension. In the keyword replacement module, three glyph replacement methods are used to replace keywords and words: near-word vector space, glyph splitting candidate pool, and word inversion. Based on the morphological characteristics of Chinese characters, the study also designs a glyph similarity evaluation algorithm to better quantify the similarity between adversarial samples and the original text. Experimental results show that the adversarial samples generated by WordReproduction are superior to those generated by the baseline method in terms of the attack success rate and glyph similarity. When using the Transformer model for sentiment classification, compared with the WordHandling method, the attack success rate and glyph similarity score of WordReproduction increase by 51.64 percentage points and 0.53, respectively. The generated adversarial samples not only mislead the classification results of the model but also have high concealment, making them difficult for human readers to detect.

Key words: Deep Neural Network (DNN), text classification, adversarial sample generation, glyph replacement, similarity assessment