A text adversarial sample defense method based on a generative adversarial network in an e-commerce comment scenario

Abstract

A text adversarial sample defense method based on a generative adversarial network in an e-commerce comment scenario belongs to the field of adversarial samples and comprises a training stage, an attack stage and a defense stage. The training stage comprises the following steps: 1. obtaining input data and predicted labels of a target model; 2. training a generator for generating perturbations by means of an attack method according to real data and corresponding labels; 3. mixing the perturbations and original data to obtain adversarial samples; and 4. inputting the real samples and the adversarial samples into a discriminator to train the discriminator for discriminating the generated data. The attack stage comprises the following steps: 1. generating the adversarial samples; 2. mixing the adversarial samples with real samples and inputting the mixed samples into a target model; and 3. predicting the accuracy of the target model. The defense stage comprises the following steps: 1. generating the adversarial samples; 2. mixing the adversarial samples with real samples; 3. using a discriminator as a filter to filter the adversarial samples; and 4. predicting the accuracy of the target model. The present application can generate more real adversarial sample data and can obtain corresponding defense methods very quickly and simply.

Description

Technical Field

[0001] This invention belongs to the field of natural language processing and adversarial examples in e-commerce review scenarios. Specifically, it designs a text adversarial defense method based on generative adversarial networks in e-commerce review scenarios. Background Technology

[0002] In recent years, with the booming development of information technology and the internet, my country's online shopping market has grown rapidly, and e-commerce has become an important engine driving my country's economic development. Because consumers cannot directly interact with physical goods when shopping online, brands, in order to retain customers and maintain the vitality of their platforms, score merchants based on descriptive information such as text and images provided by customers on e-commerce platforms, as well as historical customer reviews, and recommend high-quality merchants to customers to ensure efficient purchasing. However, over time, the accumulated review text information on e-commerce platforms continues to expand, becoming increasingly fragmented and massive. Manually performing sentiment analysis on e-commerce review text requires significant human and material resources. Therefore, deep learning natural language processing-related sentiment classification models are needed to assist brands in merchant analysis and recommendation.

[0003] However, researchers have found that deep learning models are highly susceptible to adversarial perturbations due to inherent problems such as poor interpretability and high-dimensional linearity. By adding specific, imperceptible small perturbations to benign samples, deep neural networks can misclassify these samples. For example, "This product is fantastic!" might be labeled positively by the classification model, while samples like "This product perfectly meets expectations" or "The product is great!", which incorporate small perturbations, might be labeled negatively. Therefore, adversarial examples are not only a problem in natural language processing, but also exist in e-commerce review scenarios. Many merchants use adversarial examples in the reviews of competing merchants to maliciously attack the online shopping platform's review classification model without the competing merchant's knowledge, aiming to maliciously lower the merchant's rating and exposure. Therefore, in e-commerce review scenarios, how to avoid the impact of adversarial examples on model classification and how to effectively defend against malicious attacks using adversarial examples are areas of significant research value.

[0004] Extensive literature review reveals substantial research on text adversarial examples both domestically and internationally. Defenses can be implemented at different granularity levels, including character-level, word-level, sentence-level, and multi-level mixed-level attacks. Based on different principles, text adversarial defenses can utilize general methods such as spell checking, unknown word detection, adversarial training, and model enhancement, or they can be theoretically analyzed to propose corresponding defense methods for specific attack methods. However, current adversarial defense methods have serious shortcomings in the e-commerce review scenario. Spell checking and unknown word detection both target words in the review, deleting incorrect or previously unseen words. While undeniably effective in countering adversarial examples, these methods suffer from two problems: technically, they can only detect character-level and word-level adversarial attacks; for sentence-level attacks, they are insufficient.

[0005] Sub-level adversarial attacks, namely those stemming from semantic changes, are completely ineffective with this method. From an application perspective, e-commerce reviews are not typically serious or formal scenarios; user input inevitably contains word errors or uses of emerging terms like internet slang. Therefore, using spell checking and unknown word detection for adversarial defense is inappropriate. Adversarial training and model augmentation both involve retraining existing classification models and adding more training sets to correctly classify similar data. However, this method requires additional time and resources to retrain the current model and can lead to overfitting. Theoretical analysis of a specific attack method lacks generalization ability, and new attack methods require additional manpower and research costs.

[0006] In view of the shortcomings of existing solutions, this invention proposes a text adversarial sample defense method based on generative adversarial networks, which should have the following advantages:

[0007] It is compatible with the informal nature of e-commerce review scenarios and is adapted to e-commerce review scenarios.

[0008] It can effectively defend against attacks at multiple levels, including character-level, word-level, and sentence-level.

[0009] It has little impact on the original target model.

[0010] It provides defensive methods against a variety of attacks without requiring additional time, manpower, or resources, and has good generalization capabilities. Summary of the Invention

[0011] To achieve the advantages mentioned above, this invention proposes a text adversarial sample defense method based on generative adversarial networks (GANs) for e-commerce review scenarios. This method can generate more realistic, richer, and closer adversarial samples by leveraging the generator of the GAN. At the same time, by utilizing the game between the generator and the discriminator of the GAN, a defense model that can identify the generated data, i.e., the adversarial samples, is obtained. This allows for efficient and accurate identification of adversarial samples, achieving the defense effect of the target model.

[0012] The solution of the present invention to the above-mentioned technical problems is:

[0013] The overall process of a text adversarial sample attack and defense framework based on generative adversarial networks in e-commerce review scenarios is shown in the appendix. Figure 1 As shown, the process comprises four stages: first, preparing the dataset required for the current invention; second, the training stage, in which the generative adversarial network is trained using the existing target model and real data samples to obtain the generator and discriminator; third, the adversarial sample generation stage, in which the generated adversarial sample data is input into the target model to affect the model's judgment accuracy and test the attack effect of the adversarial samples; and fourth, the defense stage against adversarial samples, in which the discriminator is used as a defense model to filter adversarial samples and minimize their impact on the target model.

[0014] Prepare data

[0015] The e-commerce review dataset used in this invention is a self-made dataset containing multiple data entries and their corresponding labels. The data sources are various products from seven categories—digital products, jewelry, food, books, clothing, personal care, and sports—from several well-known e-commerce platforms such as JD.com, Taobao, Pinduoduo, and Amazon China. After crawling and cleaning the data using web crawlers, 100,000 data entries were randomly selected as the dataset used in this invention. Each data entry in the dataset has a corresponding manually verified label. For example, the data "Used it for almost a month and came back to leave a follow-up review: The user experience is fantastic, it's simply amazing!" will be classified as "positive review" and labeled "1," while the data "Compares it to the original image by a hair's breadth, it's disgusting, the quality is extremely poor" will be classified as "negative review" and labeled "0." This dataset is a binary classification dataset, meaning it contains only "positive" and "negative" reviews, and only "1" and "0." 75% of this dataset will be used as the training set, and the remaining 25% will be used as the test set to evaluate the accuracy of the sentiment classification model.

[0016] Furthermore, to implement adversarial text examples, this invention requires the use of synonym replacement to replace some words in the original samples. For this purpose, a thesaurus is needed, containing commonly used Chinese words and providing synonyms. The Chinese thesaurus used in this invention is from [source missing]. https: / / github.com / guotong1988 / chinese_ dictionary .

[0017] Training phase

[0018] First, we need to train a model capable of sentiment classification for e-commerce reviews. Specifically, for the first... A data item, which contains text data. and its real label ,in This represents real-world data or labels. Now, we need to train an effective sentiment classifier. This makes the classifier predict the label. In this invention, the sentiment classification model used is TextCNN, which contains one convolutional layer, one pooling layer, and finally uses Softmax for classification and outputs the prediction results. The input to TextCNN is a series of word vectors, and the word vector encoding method used in this invention is One-Hot encoding. The word vectors are input to TextCNN, which outputs predicted probabilities after Softmax, and selects the one with the highest predicted probability as the predicted label.

[0019] After obtaining the actual input data and predicted labels, a generator needs to be trained to generate perturbations to the input data. The structure of the generative adversarial network is shown in Figure 2. To generate serialized data, this invention uses a reinforcement learning-based generative adversarial network. Furthermore, to ensure that the generated perturbations can deceive the target model, in addition to considering the discriminator's guidance "suggestions," the generator training process also incorporates methods for generating adversarial examples.

[0020] The training process for generative adversarial networks is as follows:

[0021] First, the generator needs to generate perturbations. The generator's input is real sample data. Its output is a set of perturbations, and the generated perturbations are used This indicates that since the generator and discriminator are trained in a game-theoretic process, their performance gradually increases with the number of training rounds. Therefore, in the initial stage of training, FGPM and RNN recurrent neural networks are introduced. FGPM proposes a fast gradient projection method based on synonym replacement. This method calculates the score for each replacement based on the product of the gradient magnitude and the projection distance between the original word and the candidate word in the gradient direction. In this invention, the input data for FGPM is the original data. That is, real comment data; based on the current sentiment classification model In the current input data gradient on and synonyms obtained from a thesaurus. Compared with the original data The maximum difference along the gradient direction yields the adversarial loss function:

[0022]

[0023] The role of a Recurrent Neural Network (RNN) is to ensure that the generated serialized data takes into account all preceding sequence data. This invention introduces an RNN into the generator of a Generative Adversarial Network (GAN) to select a synonym from the series of synonym statements output by the previous FGPM (Focused Generation Processing) that has the least impact on other words in the real data, and then replaces it. This ensures that the generated noise, while maintaining the attack effect, minimizes its impact on the original data. For the current serialized data output by the FGPM, the words at each position that potentially have an adversarial attack effect can be represented as follows: ,in Indicates the position in the original data. This indicates the ordinal number among potential alternative words at that position; for the word at that position in the original data, use... This indicates that the cross-entropy loss function is used to guide the training of the current RNN, as shown in the following formula:

[0024]

[0025] Among them, in the formula This represents the total number of synonyms that can be replaced at each position. The two loss functions above together constitute the generator's loss function, namely:

[0026]

[0027] Finally, the generator outputs a perturbation added to the original sample. .

[0028] Next, adversarial examples need to be generated; the perturbations generated in the previous step will be used to... By overlaying the original sample with the adversarial sample, we obtain the adversarial sample, i.e.:

[0029]

[0030] After obtaining the adversarial examples, they need to be fed into the discriminator to train it, and then the discriminator is used to optimize the generator. The discriminator is composed of an RNN, and its input is the original data. Adversarial examples with added noise The introduction of an RNN into the discriminator aims to evaluate the difference between the adversarial examples generated by the generator and the original samples from multiple aspects, including similarity, semantic fluency, and logical relevance. Here, an RNN is used to... and The judgment and generator use RNNs Training with the output of FGPM is not contradictory. First, the input data for both are different. Second, their purposes are different. The generator uses an RNN to find the most suitable synonym at the most appropriate position to generate noise, thereby generating adversarial examples that can deceive the discriminator as much as possible. The RNN in the discriminator is used to judge the "difference" between the adversarial example and the original sample, thus prompting the generator to generate better adversarial examples. In this invention, the loss function of the discriminator's RNN network still uses the cross-entropy loss function, that is:

[0031]

[0032] Since the discriminator's structure involves only one RNN network, the loss function of that network is the discriminator's loss function. After the discriminator's RNN network, a fully connected layer with an output layer of 1 is connected to ensure that the discriminator's final output is accurate for the current condition. Whether the result can be judged as real data, i.e., "the discriminator considers the current adversarial sample to be real data" or "the discriminator considers the current adversarial sample to be not real data", is represented by "1" and "0" respectively.

[0033] The steps above have explained the individual working principles and loss functions of the generator and discriminator. However, the generator and discriminator should be in a game-like process, and there should be a correlation between them. On the other hand, this invention focuses on defending against adversarial attacks on e-commerce text reviews. Therefore, the overall loss function will favor the training of the discriminator to obtain a better discriminator, thus leading to a more effective defense model in subsequent steps. The loss function of the entire generative adversarial network model is as follows:

[0034]

[0035] The latter part of the above formula, by inputting the generator's loss function into the discriminator's loss function, represents the adversarial examples generated by the generator that need to be input into the discriminator. Meanwhile, the discriminator's "guidance" directly affects the generator's loss function, thereby standardizing the generator's generation performance. To obtain a better discriminator, during training, it is desirable for the discriminator to classify as much of the generator's generated data as "the current adversarial sample is not real data," with the corresponding output label being "0." In this state, It will gradually tend towards 1, and then combine It is a logarithmic function with a maximum value of 1. Therefore, the closer the overall loss function is to 2, the better the discriminator performs.

[0036] The training of the entire generative adversarial network requires multiple iterations to obtain a generator and discriminator with satisfactory performance. The specific number of iterations and the settings of some network parameters in this invention will be described in detail in the implementation method section.

[0037] Attack Phase

[0038] While the main method of this invention is a text-based adversarial example defense method for e-commerce reviews, it is necessary to generate adversarial examples for attack before defense. Therefore, this chapter first introduces how to use a generator to generate adversarial examples and uses these adversarial examples to attack a sentiment classification model to verify the effectiveness of these examples.

[0039] The attack phase process is as follows:

[0040] First, we need to create mixed data; mixed data represents real data. and adversarial sample data The mixture, namely:

[0041]

[0042] Among them From real datasets, These are adversarial examples generated by a generator. The reason for using mixed data, rather than just adversarial examples, is because of the strategy employed in the subsequent defense phase after identifying adversarial examples. If the goal were simply to achieve better attack results, all adversarial examples could be used to attack the sentiment classification model, but this would render the defense methods ineffective.

[0043] Mixed data The data is input into a sentiment classification model, which serves as the target model, to obtain the prediction accuracy:

[0044]

[0045] This indicates the prediction accuracy of the sentiment classification model during the attack phase.

[0046] Defense phase

[0047] At this stage, the trained discriminator is used to identify the input data. The system identifies potential adversarial examples and removes data deemed "adversarial." The remaining data is then input into the sentiment classification model for prediction, thereby improving the prediction accuracy of the target model, defending against adversarial attacks, and reducing the impact of adversarial attacks on the target model.

[0048] The process for the defense phase is as follows:

[0049] Similar to the attack phase, the first step is to use a pre-trained generator to generate adversarial examples, which are then mixed with the original examples.

[0050]

[0051] Next, for the mixed original samples and adversarial samples, the previously trained discriminator filters out samples that the discriminator considers processed by the generator (i.e., data that the discriminator considers adversarial). For the data that can be identified by the discriminator, a sentiment classification model is used for prediction, minimizing the impact of adversarial samples on the target model. The formula is as follows:

[0052]

[0053] This represents the prediction accuracy of the sentiment classification model during the defense phase; where D represents the discriminator.

[0054] In e-commerce review scenarios, this approach can effectively prevent the impact of text adversarial examples on sentiment classification models. Simultaneously, it allows for efficient and convenient acquisition of defense methods against such attacks without expending additional time, manpower, and resources on model training and research. With minimal impact on the original model, it ensures high fidelity in sentiment classification, meaning that adversarial examples are very close to the original samples, effectively defending against adversarial examples and reducing the impact of malicious attacks. Attached Figure Description

[0055] Figure 1 This is a flowchart of the present invention.

[0056] Figure 2 This is a diagram of an embodiment of the present invention. Detailed Implementation

[0057] The invention will be further illustrated below with reference to an implementation example. This implementation example specifically describes the implementation process of a text adversarial sample defense method based on generative adversarial networks. This process completes the training of the model and a complete attack and defense process.

[0058] Training phase:

[0059] First, web crawlers are used to collect review data from e-commerce platforms to obtain a dataset. For user-entered reviews, a simple data cleaning process is performed to remove and modify non-compliant data, resulting in clean data. Next, tags need to be added. In this case, the simplest binary classification tagging is used: reviews are divided into praise and criticism to indicate whether the reviewer likes or dislikes the product. Finally, 100,000 data points are randomly selected as the dataset.

[0060] Based on the obtained data, the dataset is divided into a training set and a test set. In this case, 75% of the data is allocated to the training set and 25% to the test set.

[0061] Training the target model. In this case, TextCNN is used as the target model. The training run consists of 20 epochs, with 128 samples per batch. One-Hot word vector encoding is used to encode the input text data. The learning rate setting should consider the model's convergence speed. Experiments show that to balance slow convergence and explosive loss values, a learning rate between 0.01 and 0.001 is recommended; 0.001 is used in this case. The model is trained, and the model from each epoch is retained and tested using a test set. During this process, the model with the highest accuracy on the test set (95.2%) will be used as the target model in subsequent iterations.

[0062] Now, we need to train the generative adversarial network (GAN). In this case, the generator and discriminator are trained for 10 epochs, with a batch size of 64. Word vectors are encoded using One-Hot encoding to encode the input text data. Because both converge quickly, a smaller step size, i.e., a smaller learning rate, is needed to ensure effective model convergence. Therefore, the learning rate for both the generator and discriminator is set to 0.0001. To accelerate the initial convergence speed, the generator and discriminator need to be pre-trained separately for 10 epochs. After training, the model is saved for each epoch, and the deception success rate of the generator and the discrimination success rate of the discriminator are observed. Theoretically, after convergence, both the generator's deception success rate and the discriminator's discrimination success rate should be 0.5. However, in this case, the probabilities are 0.22 and 0.76, respectively.

[0063] Counterattack Phase:

[0064] The most accurate sentiment classification model previously used was selected as the target model. In this case, the target model has an accuracy of 95.2%.

[0065] Using the generator selected above, adversarial examples were generated and mixed with real examples. When these were input into the target model, the accuracy dropped to 54.5%, indicating that the adversarial examples had a significant impact on the target model.

[0066] Defense phase: Using the discriminator model selected above, the same mixed data of adversarial samples and real samples was input into the discriminator. The filtered data was then input into the target model. It was found that the accuracy of the target model improved to 87.2%, indicating that the discriminator model has a good defense effect against adversarial attacks.

Claims

1. A text adversarial sample defense method based on generative adversarial networks in e-commerce review scenarios, characterized in that, It consists of four stages, the first of which is preparing the necessary dataset; The second stage is the training stage, in which the generative adversarial network is trained using the existing target model and real data samples to obtain the generator and discriminator. The third stage is the adversarial sample generation stage. The generated adversarial sample data is input into the target model to affect the model's judgment accuracy and test the attack effect of the adversarial sample. Fourthly, in the defense phase against adversarial examples, a discriminator is used as a defense model to filter adversarial examples. Prepare data The e-commerce review dataset used contains multiple data entries and their corresponding tags. The data sources are various products from seven categories: digital products, jewelry, food, books, clothing, personal care, and sports products from multiple well-known e-commerce platforms. After web scraping and data cleaning, more than 100,000 data entries were randomly selected from all the data to form the dataset. Each data entry in the dataset has a corresponding manually verified tag. This dataset is a binary classification dataset, meaning it contains only "positive reviews" and "negative reviews," and only "1" and "0". 75% of this dataset will be used as the training set, and the remaining 25% will be used as the test set to evaluate the accuracy of the sentiment classification model. To implement adversarial text examples, it is necessary to use synonym replacement to replace some words in the original sample; for this purpose, a thesaurus is needed, which contains commonly used Chinese words and provides words that are synonyms with it; Training phase First, we need to train a model that can perform sentiment classification on e-commerce reviews; for the first... A data item, which contains text data. and its real label ,in Represents real data or labels; Now, we need to train an effective sentiment classifier. This makes the classifier predict the label. The sentiment classification model used is TextCNN, which contains a convolutional layer, a pooling layer, and finally uses Softmax for classification and output prediction results. The input of TextCNN is a series of word vectors, and the word vector encoding method used is One-Hot encoding. The word vectors are input into TextCNN, which outputs prediction probabilities after Softmax, and selects the one with the highest prediction probability as the predicted label. After obtaining the real input data and predicted labels, a generator needs to be trained to generate perturbations to the input data; in order to generate sequential data, a generative adversarial network based on reinforcement learning is used. The training process for generative adversarial networks is as follows: First, the generator needs to generate perturbations; the generator's input is real sample data. Its output is a set of perturbations, and the generated perturbations are used It is stated that since the generator and discriminator are trained in a game-like process, their performance will gradually increase with the increase of training rounds. Therefore, in the early stage of training, FGPM and RNN recurrent neural networks should be introduced. FGPM proposes a fast gradient projection method based on synonym replacement. This method calculates the score of each replacement based on the product of the gradient magnitude and the projection distance between the original word and the candidate word in the gradient direction. FGPM raw input That is, real comment data; based on the current sentiment classification model In the current input data gradient on and synonyms obtained from a thesaurus. Compared with the original data The maximum difference along the gradient direction yields the adversarial loss function: ； The purpose of a Recurrent Neural Network (RNN) is to ensure that the generated serialized data takes into account all preceding sequence data. Introducing an RNN into the generator of a Generative Adversarial Network (GAN) is to select the synonym from the series of synonyms output by the previous FGPM (Focus-Generative Prophecy Manager) that has the least impact on other words in the real data, and then replace it. This ensures that the generated noise has a minimal impact on the original data while maintaining the attack effect. For the current FGPM output serialized data, the words at each position that potentially have an adversarial attack effect can be represented as... ,in Indicates the position in the original data. This indicates the ordinal number among potential alternative words at that position; for the word at that position in the original data, use... This indicates that the cross-entropy loss function is used to guide the training of the current RNN, as shown in the following formula: ； Among them, in the formula This represents the total number of synonyms that can be replaced at each position; the two loss functions above together constitute the generator's loss function, namely: ； Finally, the generator outputs a perturbation added to the original sample. ; Next, adversarial examples need to be generated; the perturbations generated in the previous step will be used to... By overlaying the original sample with the adversarial sample, we obtain the adversarial sample, i.e.: ； After obtaining the adversarial examples, they need to be fed into the discriminator to train it, and then the discriminator is used to optimize the generator. The discriminator is composed of an RNN, and its input is the original data. Adversarial examples with added noise The introduction of RNN into the discriminator is to evaluate the difference between the adversarial samples generated by the generator and the original samples from multiple aspects, such as the similarity between the original samples and the adversarial samples, the semantic fluency, and the logical relevance. The loss function of the discriminator's RNN network still uses the cross-entropy loss function, that is: ； Since the discriminator's structure involves only one RNN network, the loss function of that network is the discriminator's loss function. After the discriminator's RNN network, a fully connected layer with an output layer of 1 is connected to ensure that the discriminator's final output is accurate for the current condition. Whether the result can be judged as real data, i.e., "the discriminator considers the current adversarial sample to be real data" or "the discriminator considers the current adversarial sample to be not real data", is represented by "1" and "0" respectively; The loss function for the entire generative adversarial network model is as follows: ； The latter part of the above formula, by inputting the generator's loss function into the discriminator's loss function, represents the adversarial examples generated by the generator that need to be input into the discriminator. Meanwhile, the discriminator's "guidance" directly affects the generator's loss function, thereby standardizing the generator's generation performance. To obtain a better discriminator, during training, it is desirable for the discriminator to classify as much of the generator's generated data as "the current adversarial sample is not real data," with the corresponding output label being "0." In this state, It will gradually tend towards 1, and then combine It is a logarithmic function with a maximum value of 1. Therefore, the closer the overall loss function is to 2, the better the discriminator performs. Attack Phase Before defense, it is necessary to generate adversarial examples for attack. First, we will introduce how to use the generator to generate adversarial examples and use these adversarial examples to attack the sentiment classification model to verify the effectiveness of these examples. The attack phase process is as follows: First, we need to create mixed data; mixed data represents real data. and adversarial sample data The mixture, namely: ； Among them From real datasets, These are adversarial examples generated using a generator; Mixed data The data is input into a sentiment classification model, which serves as the target model, to obtain the prediction accuracy: ； Defense phase At this stage, the trained discriminator is used to identify the input data. Data containing potential adversarial examples will be removed, and the remaining data will be input into the sentiment classification model for prediction. The process for the defense phase is as follows: Using a pre-trained generator, adversarial examples are generated and mixed with the original examples; For the mixed original samples and adversarial samples, the previously trained discriminator filters out samples that the discriminator considers processed by the generator (i.e., data that the discriminator considers adversarial). For the data that can be identified by the discriminator, a sentiment classification model is used for prediction; the formula is as follows: （9） This represents the prediction accuracy of the sentiment classification model during the defense phase; where D represents the discriminator.

Images