Natural adversarial example generation method and related device for text classifier

Abstract

The disclosure provides a natural adversarial sample generation method and related devices for text classifiers, which map the discrete vector corresponding to the text sample into a continuous space, and use the gradient to find a general disturbance in the continuous space, and control the update of the noise Threshold to further balance the relationship between attack rate and naturalness. Generating adversarial samples through this general perturbation can ensure that any sample in the sample set has good natural language characteristics after adding general perturbation, and maintains a high degree of similarity with the original sample, thus efficiently and accurately realizing text classification. Generation of natural adversarial examples for machines.

Description

technical field [0001] The present disclosure relates to the technical field of adversarial examples, in particular to a method for generating natural adversarial examples for text classifiers and related devices. Background technique [0002] Adversarial examples have been deeply researched and widely used in the field of computer vision. For example, a model receiving an image input can be made to produce a completely wrong output by adding a well-designed perturbation to the input, while the perturbation itself is so small that it is not even visible to the human eye. [0003] The effect of adversarial examples often means that the model uses unrobust features, which makes the model itself unrobust. Adversarial training uses data enhancement to mix adversarial samples into the training set in proportion, and the model trained on the new data set no longer uses these unrobust features, which will make the model more robust. [0004] How to effectively construct adversari...

AI Technical Summary

Problems solved by technology

First of all, since the sentence space is discrete, it is very difficult to perturb along the gradient direction. The gradient direction represents the most effective perturbation direction. If the gradient cannot be effectively used, the adversarial samples cannot be efficiently generated; secondly, the operation of adding, deleting and modifying words It is difficult to guarantee the fluency of sentences

That is to say, in the existing technology, if you want to apply the adversarial example in the field of natural language processing, there are problems that the gradient is difficult to use and the fluency of the sentence is difficult to guarantee.

Images