Multi-Level Chinese Adversarial Example Generation Method Based on Glyph and Semantic

doi:10.19678/j.issn.1000-3428.0070755

Abstract

Abstract:

Deep neural network language models are vulnerable to adversarial example attacks during application. To address this issue, adversarial examples are typically generated by adding minor perturbations to the original samples to mislead the model into making incorrect decisions. By studying generation methods for adversarial examples, the robustness of the models can be evaluated. Most existing Chinese adversarial example generation methods focus on improving the attack success rate of adversarial examples while overlooking quality indicators such as their stealthiness. Therefore, focusing on Chinese text adversarial example generation techniques and incorporating the unique characteristics of Chinese in terms of glyph structure and semantic features, a multi-level adversarial example generation method called CMSPSO is proposed that combines Chinese character glyphs and semantic information. The CMSPSO utilizes the Particle Swarm Optimization (PSO) algorithm to search for appropriate replacement combinations in a predesigned replacement knowledge base to generate adversarial examples. CMSPSO-M combines the multilingual visually similar character features of Chinese characters, calculates the similarity of visually similar characters through a trained Siamese Neural Network (SNN), and constructs a high-quality visual replacement character knowledge base to generate character-level adversarial examples. CMSPSO-S constructs a semantic replacement word knowledge base based on HowNet and WordNet to generate word-level adversarial examples and evaluates them using attack effectiveness and attack cost metrics. The experimental results demonstrate that CMSPSO exhibits significant attack effectiveness across multiple models and datasets, particularly on the XNLI dataset, where CMSPSO-M achieves an attack success rate of 84.22% against the RoBERTa model. Additionally, CMSPSO shows distinct advantages in terms of attack cost metrics, outperforming the baseline methods in terms of overall performance.

Key words: textural adversarial example, Chinese feature, Chinese text classification, deep neural network, artificial intelligence

摘要：

深度神经网络语言模型在应用过程中容易受到对抗样本攻击, 对此, 通常在原始样本中添加微小扰动生成对抗样本, 以误导模型做出错误决策。通过研究对抗样本的生成方法, 可以发现并评估模型的鲁棒性缺陷。现有的中文对抗样本生成方法大多关注如何提升对抗样本的攻击成功率, 而忽略了对抗样本的隐蔽性等质量指标。为此, 关注中文文本对抗样本生成技术, 结合中文在字形结构和语义特征方面的独特性, 提出一种结合汉字字形和语义信息的多级对抗样本生成方法CMSPSO。CMSPSO通过利用粒子群优化(PSO)算法, 在预先设计的替换知识库中搜索合适的替换组合以生成对抗样本。其中, CMSPSO-M结合汉字的多语言形近字特征, 通过训练的孪生神经网络(SNN)计算形近字相似度, 构建高质量的视觉替换字知识库, 以生成字符级对抗样本; CMSPSO-S基于HowNet和WordNet构建语义替换词知识库, 以生成词级对抗样本, 并通过攻击效果和攻击代价指标进行评估。实验结果表明, CMSPSO在多个模型和数据集上均展现出显著的攻击效果, 尤其在XNLI数据集上, CMSPSO-M对RoBERTa模型的攻击成功率达到84.22%。此外, 在攻击代价指标方面, CMSPSO也表现出明显优势, 整体性能优于基线方法。

关键词: 文本对抗样本, 中文特征, 中文文本分类, 深度神经网络, 人工智能

SUN Yu, WANG Hongjie, DU Yanhui, LIU Nan. Multi-Level Chinese Adversarial Example Generation Method Based on Glyph and Semantic[J]. Computer Engineering, 2026, 52(7): 287-301.

孙宇, 王红杰, 杜彦辉, 刘楠. 基于字形和语义的多级中文对抗样本生成方法[J]. 计算机工程, 2026, 52(7): 287-301.

/ Recommend / Download Citations

URL: https://www.ecice06.com/EN/10.19678/j.issn.1000-3428.0070755

https://www.ecice06.com/EN/Y2026/V52/I7/287

Figures/Tables 16

Fig.1 Chinese language features

Fig.2 Structure of CMSPSO

Fig.3 Structure of SNN model

Fig.4 The feature extraction process of VGG16

Fig.5 The impact of particle swarm size on attack success rate

Fig.6 The impact of inertia weight on attack success rate

Fig.7 The impact of initial learning factor on attack success rate

References 36

1	PRAFUL B J . A comprehensive survey of deep learning techniques natural language processing. European Journal of Technology, 2023, 7(1): 58- 66. doi: 10.47672/ejt.1473
2	WANG X Z, WANG H H, YANG D Y. Measure and improve robustness in NLP models: a survey[EB/OL]. [2024-08-05]. https://arxiv.org/abs/2112.08313.
3	GOYAL S , DODDAPANENI S , KHAPRA M M , et al. A survey of adversarial defenses and robustness in NLP. ACM Computing Surveys, 2023, 55(14): 1- 39.
4	SZEGEDY C, ZAREMBA W, SUTSKEVER I, et al. Intriguing properties of neural networks[EB/OL]. [2024-08-05]. https://arxiv.org/abs/1312.6199.
5	HENDRYCKS D, ZHAO K, BASART S, et al. Natural adversarial examples[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Washington D.C., USA: IEEE Press, 2021: 15257-15266.
6	SHARIF M , BHAGAVATULA S , BAUER L , et al. A general framework for adversarial examples with objectives. ACM Transactions on Privacy and Security, 2019, 22(3): 1- 30.
7	WANG W Q, WANG R, WANG L N, et al. Towards a robust deep neural network in texts: a survey[EB/OL]. [2024-08-05]. https://arxiv.org/abs/1902.07285.
8	仝鑫, 王斌君, 王润正, 等. 面向自然语言处理的深度学习对抗样本综述. 计算机科学, 2021, 48(1): 258- 267.
	TONG X , WANG B J , WANG R Z , et al. Survey on adversarial sample of deep learning towards natural language processing. Computer Science, 2021, 48(1): 258- 267.
9	尹思纯. 中国书法在日本的传播及其对中文教学的影响研究[D]. 镇江: 江苏大学, 2022.
	YIN S C. The dissemination of Chinese calligraphy and its influence on Chinese language teaching in Japan[D]. Zhenjiang: Jiangsu University, 2022. (in Chinese)
10	QI F C, YANG C H, LIU Z Y, et al. OpenHowNet: an open sememe-based lexical knowledge base[EB/OL]. [2024-08-05]. https://arxiv.org/abs/1901.09957.
11	FELLBAUM C. WordNet[EB/OL]. [2024-08-05]. https://wordnet.princeton.edu/.
12	MARINI F , WALCZAK B . Particle Swarm Optimization (PSO): a tutorial. Chemometrics and Intelligent Laboratory Systems, 2015, 149, 153- 165. doi: 10.1016/j.chemolab.2015.08.020
13	KOCH G R. Siamese neural networks for one-shot image recognition[EB/OL]. [2024-08-05]. https://www.cs.cmu.edu/~rsalakhu/papers/oneshot1.pdf.
14	GARG S, RAMAKRISHNAN G. BAE: BERT-based adversarial examples for text classification[EB/OL]. [2024-08-05]. https://arxiv.org/abs/2004.01970.
15	XIAO C W, LI B, ZHU J Y, et al. Generating adversarial examples with adversarial networks[EB/OL]. [2024-08-05]. https://arxiv.org/abs/1801.02610.
16	ZANG Y, QI F C, YANG C H, et al. Word-level textual adversarial attacking as combinatorial optimization[EB/OL]. [2024-08-05]. https://arxiv.org/abs/1910.12196.
17	JIN D , JIN Z J , ZHOU J T , et al. Is BERT really robust? A strong baseline for natural language attack on text classification and entailment. Proceedings of the AAAI Conference on Artificial Intelligence, 2020, 34(5): 8018- 8025. doi: 10.1609/aaai.v34i05.6311
18	REN S H, DENG Y H, HE K, et al. Generating natural language adversarial examples through probability weighted word saliency[C]//Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics. Washington D.C., USA: IEEE Press, 2019: 1085-1097.
19	XU X L, KONG K Y, LIU N, et al. An LLM can fool itself: a prompt-based adversarial attack[EB/OL]. [2024-08-05]. https://arxiv.org/abs/2310.13345.
20	仝鑫, 王罗娜, 王润正, 等. 面向中文文本分类的词级对抗样本生成方法. 信息网络安全, 2020, 20(9): 12- 16.
	TONG X , WANG L N , WANG R Z , et al. A generation method of word-level adversarial samples for Chinese text classiifcation. Netinfo Security, 2020, 20(9): 12- 16.
21	弓燕, 张晓琳, 刘月峰, 等. 面向中文文本分类的对抗样本生成方法. 电子器件, 2023, 46(5): 1349- 1356.
	GONG Y , ZHANG X L , LIU Y F , et al. Adversarial examples generation method for Chinese text classification. Chinese Journal of Electron Devices, 2023, 46(5): 1349- 1356.
22	李相葛, 罗红, 孙岩. 基于汉语特征的中文对抗样本生成方法. 软件学报, 2023, 34(11): 5143- 5161.
	LI X G , LUO H , SUN Y . Adversarial sample generation method based on Chinese features. Journal of Software, 2023, 34(11): 5143- 5161.
23	张云婷, 叶麟, 唐浩林, 等. 基于掩码语言模型的中文BERT攻击方法. 软件学报, 2024, 35(7): 3392- 3409.
	ZHANG Y T , YE L , TANG H L , et al. Chinese BERT attack method based on masked language model. Journal of Software, 2024, 35(7): 3392- 3409.
24	陈鸣, 杜庆治, 邵玉斌, 等. 基于音形码的汉字相似度比对算法. 信息技术, 2018(11): 73- 75.
	CHEN M , DU Q Z , SHAO Y B , et al. Chinese characters similarity comparison algorithm based on phonetic code and shape code. Information Technology, 2018(11): 73- 75.
25	ZHANG L J , ZHANG Y Y , LIU Z W , et al. The role of orthographic and phonological processing during reading Chinese sentences: evidence from eye movements. Frontiers in Psychology, 2023, 14, 1148815. doi: 10.3389/fpsyg.2023.1148815
26	TAYLOR I, TAYLOR M M. Writing and literacy in Chinese, Korean, and Japanese[M]. Amsterdam, Netherland: John Benjamins, 2014.
27	WANG Y X, KEULEERS E. Simplified Chinese character distance based on ideographic description sequences[C]//Proceedings of the 2nd Workshop on Computation and Written Language (CAWL) @ LREC-COLING 2024. Washington D.C., USA: IEEE Press, 2024: 59-66.
28	NIU Y L, XIE R B, LIU Z Y, et al. Improved word representation learning with sememes[C]//Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics. Washington D.C., USA: IEEE Press, 2017: 2049-2058.
29	RANA S , JASOLA S , KUMAR R . A review on particle swarm optimization algorithms and their applications to data clustering. Artificial Intelligence Review, 2011, 35(3): 211- 222. doi: 10.1007/s10462-010-9191-9
30	孙茂松, 李景阳, 郭志芃, 等. THUCTC: 一个高效的中文文本分类工具包[EB/OL]. [2024-08-15]. http://thuctc.thunlp.org/.
	SUN M S, LI J Y, GUO Z P, et al. THUCTC: an efficient Chinese text classifier[EB/OL]. [2024-08-15]. http://thuctc.thunlp.org/. (in Chinese)
31	CONNEAU A, LAMPLE G, RINOTT R, et al. XNLI: evaluating cross-lingual sentence representations[EB/OL]. [2024-08-15]. https://arxiv.org/abs/1809.05053.
32	ZENG G Y, QI F C, ZHOU Q R, et al. OpenAttack: an open-source textual adversarial attack toolkit[EB/OL]. [2024-08-15]. https://arxiv.org/abs/2009.09191.
33	RUBLEE E, RABAUD V, KONOLIGE K, et al. ORB: an efficient alternative to SIFT or SURF[C]//Proceedings of the International Conference on Computer Vision. Washington D.C., USA: IEEE Press, 2012: 2564-2571.
34	KARAMI E, PRASAD S, SHEHATA M. Image matching using SIFT, SURF, BRIEF and ORB: performance comparison for distorted images[EB/OL]. [2024-08-15]. https://arxiv.org/abs/1710.02726.
35	AGBEMUKO D I , OKOKPUJIE I P , SALAMI M J E , et al. Automated data extraction and character recognition for handwritten test scripts using image processing and convolutional neural networks. Nigerian Journal of Technological Development, 2025, 21(4): 97- 115. doi: 10.4314/njtd.v21i4.2829
36	DUBEY R, DAS I. Handwritten image detection using DCGAN with SIFT and ORB optical features[C]//Proceedings of the 6th International Conference on Information Systems and Computer Networks (ISCON). Washington D.C., USA: IEEE Press, 2023: 1-6.

[1]	ZHENG Desheng, ZHENG Shuntian, LI Xiaoyu, YIN Hao, WANG Cong. CBA: Black Box Attack Method Based on Circular Geometric Properties [J]. Computer Engineering, 2026, 52(7): 313-330.
[2]	ZHAO Shuxu, ZHOU Hongze, WANG Xiaolong. Optimization of Optimal Coalition Structure Generation Strategy Based on Improved DQN [J]. Computer Engineering, 2026, 52(5): 117-128.
[3]	WANG Wen, YANG Kuiwu, TONG Songsong, WEI Jianghong, XUE Yan, ZHOU Rongkui. Research on Watermarking Attack of Deep Neural Network Models [J]. Computer Engineering, 2026, 52(4): 22-38.
[4]	LIAO Yong, HAN Xiaojin, LIU Jinlin, WANG Hao. Research Progress of Interpretable Artificial Intelligence [J]. Computer Engineering, 2026, 52(3): 41-61.
[5]	WANG Yi, LI Zhi, ZHANG Li, SHI Xueli, LIU Dengbo, LU Yu. Frequency-Domain Quantification Adversarial Attacks Based on Remote Sensing Image Scene Classification [J]. Computer Engineering, 2026, 52(1): 266-281.
[6]	WANG Chundong, ZHAO Zhihang, YANG Weijie, FANG Shunyao. Adversarial Sample Generation Method for Chinese Text Based on Word Reproduction [J]. Computer Engineering, 2026, 52(1): 303-313.
[7]	LIU Juan, HU Xuelian, ZHU Meirong, FENG Menglan, WEN Suyue. Research on Application Effect of Virtual Teachers in Teaching Animation Supported by AIGC [J]. Computer Engineering, 2025, 51(8): 341-353.
[8]	XIA Niming, ZHANG Jie. Chinese Adversarial Examples Generation Based on Adaptive Beam Search Algorithm [J]. Computer Engineering, 2025, 51(8): 131-140.
[9]	TIAN Qing, WANG Bin, ZHOU Zixiao. Survey on Unsupervised Person Re-Identification [J]. Computer Engineering, 2025, 51(7): 12-30.
[10]	WANG Hao, GAO Jintao, WANG Jie. Review of Multi-table Join Order Selection in Databases Based on Machine Learning [J]. Computer Engineering, 2025, 51(7): 31-46.
[11]	GUO Peilin, ZHANG De, WANG Huaixiu. Exploring the Impact of Skip Connection Structures on the Deep Neural Networks Feature Extraction Based on Feature Visualization [J]. Computer Engineering, 2025, 51(4): 149-157.
[12]	LIU Yunxiang, LIANG Zhichao. A Highly Efficient Traffic Prediction Model for Continuous Time-series Graph Attention Networks [J]. Computer Engineering, 2025, 51(4): 350-359.
[13]	QI Fenglin, SHEN Jiajie, WANG Maoyi, ZHANG Kai, WANG Xin. Review of Application of Artificial Intelligence in University Informatization [J]. Computer Engineering, 2025, 51(4): 1-14.
[14]	ZHAO Hong, SONG Furong, LI Wengai. Research on Image Adversarial Example Generation Method Based on SE-AdvGAN [J]. Computer Engineering, 2025, 51(2): 300-311.
[15]	ZHANG Shuhua, WANG Jiye, ZHAO Chuanqi, CHEN Hongming, GUO Yongwen. Hardware Acceleration Design for Edge Intelligence of Transmission Lines [J]. Computer Engineering, 2025, 51(2): 213-222.

Please choose a citation manager

Content to export