Black-Box Generation of Adversarial Text Sequences to Evade Deep Learning Classifiers (2018-01-13T00:00:00.000000Z)

TL;DR

A novel algorithm is presented, DeepWordBug, to effectively generate small text perturbations in a black-box setting that forces a deep-learning classifier to misclassify a text input.

Abstract

Although various techniques have been proposed to generate adversarial samples for white-box attacks on text, little attention has been paid to a black-box attack, which is a more realistic scenario. In this paper, we present a novel algorithm, DeepWordBug, to effectively generate small text perturbations in a black-box setting that forces a deep-learning classifier to misclassify a text input. We develop novel scoring strategies to find the most important words to modify such that the deep classifier makes a wrong prediction. Simple character-level transformations are applied to the highest-ranked words in order to minimize the edit distance of the perturbation. We evaluated DeepWordBug on two real-world text datasets: Enron spam emails and IMDB movie reviews. Our experimental results indicate that DeepWordBug can reduce the classification accuracy from 99% to 40% on Enron and from 87% to 26% on IMDB. Our results strongly demonstrate that the generated adversarial sequences from a deep-learning model can similarly evade other deep models.

Authors

Jack Lanchantin

4 papers

Ji Gao

1 papers

M. Soffa

2 papers

TL;DR

Abstract

Authors

References33 items

Towards Crafting Text Adversarial Samples

Deep Text Classification Can be Fooled

Cleverhans V0.1: an Adversarial Machine Learning Library

Google's Neural Machine Translation System: Bridging the Gap between Human and Machine Translation

Towards Evaluating the Robustness of Neural Networks

Crafting adversarial input sequences for recurrent neural networks

Practical Black-Box Attacks against Machine Learning

Practical Black-Box Attacks against Deep Learning Systems using Adversarial Examples

End-to-End Relation Extraction using LSTMs on Sequences and Tree Structures

The Limitations of Deep Learning in Adversarial Settings

Semi-supervised Sequence Learning

Character-level Convolutional Networks for Text Classification

Explaining and Harnessing Adversarial Examples

Deep neural networks are easily fooled: High confidence predictions for unrecognizable images

GloVe: Global Vectors for Word Representation

Neural Machine Translation by Jointly Learning to Align and Translate

Intriguing properties of neural networks

Recursive Deep Models for Semantic Compositionality Over a Sentiment Treebank

Efficient Estimation of Word Representations in Vector Space

Parsing Natural Scenes and Natural Language with Recursive Neural Networks

Learning Word Vectors for Sentiment Analysis

A unified architecture for natural language processing: deep neural networks with multitask learning

Can machine learning be secure?

Adversarial learning

Adversarial classification

Long Short-Term Memory

Learning representations by back-propagating errors

White , and S . P . Liversedge . ” Raeding wrods with jubmled lettres : There is a cost . ” ( 2006 ) .

Spam Filtering with Naive Bayes - Which Naive Bayes?

Good Word Attacks on Statistical Spam Filters

GradientBased Learning Applied to Document Recognition

Gradient-based learning applied to document recognition

Binary codes capable of correcting deletions, insertions, and reversals

Field of Study

Journal Information

Name

Page