A text adversarial attack method based on hybridization of style transfer and whale optimization algorithm

Abstract

The application discloses a text adversarial attack method based on style transfer and whale optimization algorithm hybridization, and belongs to the field of text adversarial attack, and comprises the following steps: constructing a three-stage module and an improved style transfer module; generating a text adversarial sample through a semantic-based adversarial sample generation model, and inputting the text adversarial sample into the improved style transfer module and the three-stage module respectively for attack; and if the improved style transfer attack fails, entering the attack of the three-stage module. The application solves the problems of poor attack success rate, difficulty in searching for effective adversarial samples and easy deviation from semantics of existing single models; and the fusion model is used for attack in the field of text adversarial attack for the first time, so that the attack success rate is improved.

Description

Technical Field

[0001] This invention relates to the field of text adversarial attacks, specifically to a text adversarial attack method based on a hybrid of style transfer and whale optimization algorithm. Background Technology

[0002] Adversarial attacks pose a common threat to deep learning, revealing its vulnerabilities. Compared to image data, text data is characterized by data discretization, complex syntax, and semantic abstraction, making the generation of adversarial examples particularly challenging. Therefore, existing attack methods targeting images are difficult to directly apply to the text domain, and adversarial attacks against text remain highly challenging.

[0003] There are some effective text adversarial attack methods, but these attacks all use a single attack method and sometimes perform poorly on some datasets or models. They still have some problems, such as poor attack success rate on some models, difficulty in finding effective adversarial samples when the search space is large or small, and easy deviation from semantics when style transfer is used.

[0004] The attack performance of a single model has reached its limit, and it is difficult to make further improvements. Therefore, it is necessary to design new text adversarial attack methods to solve the problems of existing model attacks and achieve effective text adversarial attacks. Summary of the Invention

[0005] The purpose of this invention is to address the aforementioned problems by providing a text adversarial attack method based on a hybrid of style transfer and whale optimization algorithm. This method solves the problems of poor attack success rate, difficulty in finding effective adversarial samples, and easy deviation from semantics inherent in existing text adversarial attack methods using a single model. For the first time, this invention uses a fusion model in the field of text adversarial attacks, serially fusing style transfer and whale optimization algorithm to construct a three-stage model. The three-stage model and the improved style transfer are then fused in parallel to improve the attack success rate.

[0006] The technical solution of the present invention is as follows:

[0007] This invention discloses a text adversarial attack method based on a hybrid of style transfer and whale optimization algorithm, comprising the following steps:

[0008] Constructing a three-stage module and an improved style transfer module: After updating the original whale optimization algorithm, a mutation operation is performed on each adversarial example, and the improved Metropolis criterion is applied to obtain the improved whale optimization algorithm WOA; the improved whale optimization algorithm WOA and the style transfer algorithm are fused to construct a three-stage module; after style transfer, a mutation operation is performed on the generated samples to construct the improved style transfer module.

[0009] Text adversarial attack: Text adversarial samples are generated using a semantic primitive-based adversarial sample generation model. These text adversarial samples are then input into the improved style transfer module and the three-stage module for attack. If the improved style transfer attack fails, the attack proceeds to the three-stage module.

[0010] Furthermore, in the three-stage module, the text adversarial sample is processed sequentially by the improved Whale Optimization Algorithm (WOA) and the style transfer algorithm. Then, the sample is regenerated based on semantic primitives and iteratively searched and updated in the improved Whale Optimization Algorithm (WOA). If an adversarial sample is successfully attacked at any time, the adversarial sample is directly output and the attack stops.

[0011] Furthermore, the improved Metropolis criterion formula is as follows:

[0012]

[0013] Among them, y new y is the output of the target attack model after the new adversarial sample is input, q is the output of the model before mutation, and q is the probability of accepting a degraded individual. The value of T is dynamically adjusted with the number of iterations, and is also affected by the length of the input sentence.

[0014] Furthermore, the mutation operation involves randomly selecting a word that meets the requirements for generating a replacement word from a semantic primitive and replacing it to generate a new adversarial example.

[0015] Furthermore, adversarial example generation methods based on semantic primitives include:

[0016] S1: Based on the input sentence, analyze the part of speech of each word and find synonyms for the content words in the sentence using semantic primitives;

[0017] S2: After finding a suitable replacement word, replace the words in the original sample. Replace only the word at one position each time to obtain multiple adversarial samples.

[0018] Furthermore, the improved Whale Optimization Algorithm (WOA) specifically includes:

[0019] Initialization: Obtain N3 adversarial examples S = {S} generated through semantic primitives. 1 ,···,S N Each adversarial example is denoted as S. i , i∈{1,···,N}; and simultaneously randomly initialize the positions X={X 1 ,···,X N}, dimension Initialize randomly between -V and V;

[0020] Record: Calculate the prediction score of the current adversarial example and record the position X of the current best individual. * And the optimal adversarial example S * ;

[0021] Update: First, update each dimension of each whale according to the update method in the original whale optimization algorithm; second, update all positions again after the original whale optimization algorithm performs the update; update the adversarial examples; after the update step is completed, perform a mutation operation on each adversarial example and process it according to the Metropolis criterion.

[0022] Termination: The termination condition is set when the prediction result of the target attack model is different from the original label, that is, the predicted label has changed.

[0023] Furthermore, the formula for updating all positions again is:

[0024]

[0025] in, This represents the d-th word of the n-th sample. This represents the d-th word of the optimal sample. This represents the d-th dimension of the n-th sentence. Defined as follows:

[0026]

[0027] ω represents the inertia weight, which is set to decrease as the number of iterations increases.

[0028] Furthermore, the formula for the inertia weight ω is as follows:

[0029]

[0030] Where, 0 < ω min <ω max <1, where max_iters and i are the maximum number of iterations and the current number of iterations, respectively.

[0031] Furthermore, the adversarial examples are updated using a probabilistic approach, specifically by using the sigmoid function to convert the value at each position into a probability, denoted as σ(x).

[0032]

[0033] The probability is used to determine whether the current sample should be modified towards the globally optimal sample; the final update method for adversarial examples in each dimension is as follows:

[0034]

[0035] Where P represents the transformation probability of the corresponding vector. r is a random number between 0 and 1.

[0036] Furthermore, in the three-stage module, the input obtains N adversarial examples through semantic primitives, which are then searched and updated using the improved Whale Optimization Algorithm (WOA). After one round of iteration, the worst-performing sample is selected and input into the style transfer model to obtain the style-transferred sample. The new adversarial examples are then iteratively searched and updated using the improved Whale Optimization Algorithm (WOA) until the maximum number of iterations is reached or an adversarial example that has been successfully attacked is found. If no effective adversarial example is found when the maximum number of iterations is reached, the process returns to the first improved Whale Optimization Algorithm (WOA) step to start the next round of iterations until the maximum number of iterations is reached.

[0037] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0038] 1. This invention proposes an improved Whale Optimization Algorithm (WOA), which solves the problem that the Whale Optimization Algorithm is prone to getting trapped in local optima. It is the first to introduce the Whale Optimization Algorithm into text adversarial attacks and improves the shortcomings of the Whale Optimization Algorithm in text adversarial attacks by introducing mutation and Metropolis criteria to enhance its search ability and attack effect.

[0039] 2. This invention proposes a three-stage model that integrates the improved whale optimization algorithm and style transfer algorithm, expanding the search space for adversarial examples and further avoiding getting trapped in local optima.

[0040] 3. This invention is the first to use a fusion model for attack in the field of text adversarial attacks, providing a new attack strategy for text adversarial attacks that is superior to single-model attacks.

[0041] 4. This invention proposes a novel hybridization method that performs parallel hybridization of the three-stage model and the style transfer algorithm, thereby improving the attack effect.

[0042] 5. The effectiveness of the model was evaluated on five datasets. The experimental results show that the model of the present invention not only effectively improves the attack success rate, but also achieves good results in tests on syntax error increase rate, semantic consistency, and transferability. Attached Figure Description

[0043] The present invention will be described by way of example and with reference to the accompanying drawings, wherein:

[0044] Figure 1 This is a schematic diagram of the hybrid model structure for text style transfer and improved WOA in the embodiment.

[0045] Figure 2 This is a schematic diagram of the adversarial sample generation model based on semantic primitives in the embodiment.

[0046] Figure 3 This is a schematic diagram of the style transfer model structure in the embodiment.

[0047] Figure 4 This is a schematic diagram of the improved WOA model structure in the embodiment.

[0048] Figure 5 This is a schematic diagram illustrating the semantic similarity of sentences before and after the attack in the embodiment.

[0049] Figure 6 This is a schematic diagram of a migration attack performed on the SST-2 dataset in the embodiment.

[0050] Figure 7 This is a schematic diagram of the population size - maximum number of iterations - attack success rate curve in the embodiment. Detailed Implementation

[0051] All features disclosed in this specification, or all steps in all disclosed methods or processes, may be combined in any way, except for mutually exclusive features and / or steps.

[0052] Any feature disclosed in this specification (including any appended claims and abstract) may be replaced by other equivalent or similar features, unless specifically stated otherwise. That is, unless specifically stated otherwise, each feature is merely one example of a series of equivalent or similar features.

[0053] The features and performance of the present invention will be further described in detail below with reference to embodiments.

[0054] This invention discloses a text adversarial attack method based on a hybrid of style transfer and whale optimization algorithm, comprising the following steps:

[0055] Constructing a three-stage module and an improved style transfer module: After updating the original whale optimization algorithm, a mutation operation is performed on each adversarial example, and the improved Metropolis criterion is applied to obtain the improved whale optimization algorithm WOA; the improved whale optimization algorithm WOA and the style transfer algorithm are fused to construct a three-stage module; after style transfer, a mutation operation is performed on the generated samples to construct the improved style transfer module.

[0056] Text adversarial attack: Text adversarial samples are generated using a semantic primitive-based adversarial sample generation model. These text adversarial samples are then input into the improved style transfer module and the three-stage module for attack. If the improved style transfer attack fails, the attack proceeds to the three-stage module.

[0057] like Figure 1 As shown, this invention discloses a hybrid model based on style transfer and an improved WOA, called STRAP-WOA. It mainly consists of three parts: adversarial sample generation based on semantic primitives, an improved WOA algorithm, and style transfer. The attack process is divided into two main parts: an improved style transfer attack and a three-stage attack. First, a batch of adversarial samples is generated by the semantic primitive-based adversarial sample generation module, and then the adversarial samples are input into the left and right parts respectively. The left half is the improved style transfer attack; if the attack fails, it proceeds to the three-stage model attack. In the three-stage attack in the right half, the samples are processed sequentially by the WOA algorithm and the style transfer module, and then the samples are regenerated using semantic primitives and iteratively searched and updated in the WOA algorithm. In the above process, if a successfully attacked adversarial sample exists at any time, the adversarial sample is directly output and the algorithm stops.

[0058] like Figure 2 As shown, a semantic primitive-based adversarial sample generation model is disclosed. The specific adversarial sample generation method is as follows: First, based on the input sentence, the part-of-speech of each word is analyzed, and synonyms are found for the content words using semantic primitives. For example, the synonyms for "love" are "like" and "enjoy," and for "movie" are "picture," "film," and "cinema." There are no synonyms for "I" and "this." After finding suitable synonyms, the words in the original sample are replaced, resulting in multiple adversarial samples. In actual attacks, to reduce potential grammatical errors and to maintain semantic similarity between the adversarial samples and the original samples as much as possible, only one word position is replaced at a time.

[0059] like Figure 3As shown, a style transfer model is disclosed. In this invention, a style transfer method is chosen as part of the sentence-level attack; any style transfer model can be used. In this embodiment, a style transfer model called STRAP (StyleTransfer via Paraphrasing) is employed. STRAP is an unsupervised text style transfer model based on paraphrasing, which can effectively perform text style transfer, has high style control accuracy and semantic preservation ability, and outperforms many state-of-the-art models; moreover, it does not change task-related attributes in the text, such as sentiment, which is necessary for attacking certain tasks (such as sentiment classification tasks).

[0060] Using STRAP requires only three steps: (1) Generate normalized paraphrases of sentences in different styles by using paraphrasing models trained on GPT-2 and back-translated text, thereby creating a set of pseudo-parallel data; (2) Train multiple back-paraphrasing models of specific styles (also based on GPT-2) to learn how to convert the above-mentioned normalized paraphrases back to the original style; (3) Perform text style transfer using the back-paraphrasing model of the target style.

[0061] STRAP can generate various styles, such as Shakespeare, English Tweets, Bible, Romantic Poetry, and Lyrics. In this embodiment, Shakespeare style is preferred as the transfer target. For each generated adversarial example, its semantic similarity to the original sample before style transfer is calculated. Only if the similarity is greater than h is the sample accepted. Otherwise, the sample is regenerated until the required number of adversarial examples N1 or the maximum number of attempts N2 is reached. Sentence-to-sentence similarity is calculated using Sentence-BERT.

[0062] After style transfer, the algorithm first checks if any of the generated style-transferred samples have been successfully attacked. If not, a mutation operation is performed on the generated samples. Mutation involves randomly selecting a word that meets the semantic primitive's requirements for generating replacement words and replacing it, generating a new adversarial sample. This new adversarial sample is then processed using the Metropolis criterion. If the mutated adversarial sample is better, it is retained; otherwise, a worsening individual is accepted with probability q. To adapt to this algorithm, the modified Metropolis criterion formula is as follows:

[0063]

[0064] Among them, y newy is the output of the new adversarial sample after it is input into the target attack model, y is the output of the model before mutation, and the value of T is dynamically adjusted with the number of iterations, and is also affected by the length of the input sentence.

[0065]

[0066] like Figure 4 As shown, an improved model structure for WOA is disclosed, which improves upon the original Whale Optimization Algorithm (WOA). The original Whale Optimization Algorithm (WOA) is a swarm intelligence algorithm. This algorithm simulates the bubble net hunting behavior of humpback whales, where the position of each humpback whale represents a feasible solution. The specific steps of the original Whale Optimization Algorithm are as follows:

[0067] (1) Initialization. At the beginning of the algorithm, the positions of the N whales are randomly initialized, so that they are randomly distributed in the search space. The position vector of each whale is X. n , n∈{1,···,N}.

[0068] (2) Recording. Each position in the search space corresponds to a score. Depending on the task, the position with the highest or lowest score is recorded as the global optimal position, and the whale at the optimal position is recorded as X. * .

[0069] (3) Termination. If the score of the current global optimal position reaches the expected score, the algorithm terminates and outputs the global optimal position as the search result.

[0070] (4) Update. Otherwise, whales update their positions according to the rules. The update process can be summarized in the following three steps:

[0071] (a) Encircling prey. In nature, humpback whales are usually gregarious. During the hunt, humpback whales will surround their prey in groups.

[0072] (b) Bubble-net hunting pattern. Based on the hunting behavior of humpback whales, they swim towards their prey in a spiral motion. As they approach their prey in a spiral shape, the humpback whale also contracts its encirclement. Given the asynchronous nature of each humpback whale's behavior, it is assumed that the probability p of choosing the contraction encirclement mechanism is the same as the probability of choosing the spiral model to update the whale's position, both being 50%.

[0073] (c) Random movement during feeding. While feeding in a group, humpback whales also move randomly based on each other's positions. Group search is a process of approaching the optimal value, representing a local search; while random movement approaches a random individual, thus representing a global search by the humpback whale.

[0074] After the update is complete, the algorithm returns to the recording step.

[0075] In this embodiment, the improved WOA algorithm includes: for the initialization part, firstly obtaining N3 adversarial samples S = {S} generated through semantic primitives. 1 ,···,S N Each adversarial example is denoted as S. i , i∈{1,···,N}. Simultaneously, randomly initialize the positions X={X... 1 ,···,X N}, dimension Initialize randomly between -V and V.

[0076] For the recording part, calculate the prediction score of the current adversarial example and record the position X of the current best individual. * And the optimal adversarial example S * .

[0077] For the update part, we first update each dimension of each whale using the update method from the original WOA. Considering the search space is discrete, we will update all positions again after the WOA update, using the following formula:

[0078]

[0079] in This represents the d-th word of the n-th sample. This represents the d-th word of the optimal sample. Defined as follows:

[0080]

[0081] ω represents the inertia weight, which is set to decrease as the number of iterations increases. The purpose is to allow the whales to explore more locations early on and quickly gather around the optimal location in the final stage. The formula for ω is as follows:

[0082]

[0083] Where 0 < ω min <ω max <1, where max_iters and i are the maximum number of iterations and the current number of iterations, respectively.

[0084] The position updates must also correspond to the discrete search space. A probabilistic approach is preferred for updating adversarial examples. The sigmoid function is used to convert the value at each position into a probability, denoted as σ(x).

[0085]

[0086] Let P represent the transformation probability of the corresponding vector. in Then, based on probability, it is determined whether the current sample should be modified towards the globally optimal sample. Finally, the adversarial example update method for each dimension is as follows, where r is a random number between 0 and 1:

[0087]

[0088] To further enhance the search in the unexplored space, a mutation operation is performed on each adversarial example after the update step, and processed according to the Metropolis criterion.

[0089] For the termination step, the termination condition is set to the point that the prediction result of the target attack model is different from the original label, that is, the predicted label has changed.

[0090] In the three-stage module, N adversarial examples are first obtained through semantic primitives and then entered into the improved WOA module for searching and updating. After one round of iteration, the worst-performing example is selected and input into the style transfer module to obtain the style-transferred sample. Then, the best individual from the sample is selected and input into the adversarial example generation module to obtain a new batch of adversarial examples. These new adversarial examples are then input into the improved WOA for iterative searching and updating until the maximum number of iterations is reached or a successfully attacked adversarial example is found. If no effective adversarial example is found after reaching the maximum number of iterations, the process returns to the first WOA step to begin the next round of iterations, until the maximum number of iterations is reached.

[0091] The reason for choosing the worst sample instead of the best sample is that the WOA search strategy suffers from getting stuck in local optima, a problem that cannot be completely avoided even with improvements. Choosing the best sample each time could lead to WOA outputting the same sample every time it gets stuck in a local optimum, while choosing the worst sample can maintain the diversity of generated adversarial examples as much as possible, allowing the algorithm to explore more of the search space.

[0092] Experiments and performance evaluation

[0093] 1.1. Dataset and Target Attack Model

[0094] The following benchmark datasets were selected for testing. For sentiment analysis, the SST-2 and IMDB datasets were chosen. Both are binary sentiment classification datasets. For natural language inference tasks, the Stanford Natural Language Inference (SNLI) dataset was selected. Each sample in SNLI consists of a premise-hypothesis sentence pair and is labeled with one of three relations: inclusion, contradiction, or neutral. The Hate Speech dataset is a binary classification dataset for hate speech detection. The AG'sNews dataset is a four-class classification dataset for news type classification. See Table 1-1 for detailed information on the datasets.

[0095] Table 1-1 Dataset Details

[0096]

[0097] For the targeted attack model, several widely used general sentence encoding models were selected: Bi-LSTM, BERT, ALBERT, and DistilBERT. BiLSTM has a 128-dimensional hidden layer and uses 300-dimensional pre-trained GloVe word embeddings. BERT (bert-base-uncased), ALBERT (albert-base-v2), and DistilBERT (distilbert-base-uncased) models were downloaded from the pre-trained model library provided by Transformers. BiLSTM used the training model provided by Zang et al. Two versions of the BERT model were used for testing: one was the training model provided by Zang et al., denoted as BERT. base Another BERT (bert-base-uncased) comes from Transformers and is denoted as BERT. The accuracy (ACC) of each model on the relevant datasets is shown in Table 1-2.

[0098] 1.2. Baseline Model

[0099] To evaluate the effectiveness of the algorithm, several open-source and representative algorithms were selected for comparison, including word-level and sentence-level black-box text adversarial attack algorithms. For word-level text attacks, PSO (based on semantic primitives and particle swarm optimization) and BESA (based on BERT and simulated annealing) were chosen. For sentence-level text attacks, StyleAdv (based on style transfer) was selected.

[0100] 1.3. Evaluation Indicators

[0101] The main evaluation metrics in this paper include attack success rate, quality of adversarial samples, semantic consistency between adversarial samples and original samples, and number of queries.

[0102] 1.4. Experimental Parameters

[0103] For the STRAP-WOA algorithm, V is set to 5, ω max and ω min The values ​​were set to 0.8 and 0.2. When the input sentence length was less than 40, b1 = 0.5; otherwise, b1 = 0.1. b2 was fine-tuned according to different tasks, ranging from 0.1 to 0.5. The semantic similarity threshold h was set to 0.9, the number of iterations max_iters_1 and max_iters_2 were set to 20 and 10, the number of style transfer samples N1 and the maximum number of attempts N2 were set to 5 and 10, and the initial population size N3 was set to 60. The baseline model used the default values ​​from the open-source code provided in the paper without further optimization. To speed up the evaluation, 1000 correctly classified samples were randomly selected from the test set for attack.

[0104] 1.5. Attack Effects and Analysis

[0105] 1.5.1 Attack Success Rate

[0106] This section evaluates the adversarial attack success rate of various models, categorized by word-level and sentence-level attack methods. The results are shown in Tables 1-2(a) and (b), with bolded content indicating the best performance. The experimental results show that the STRAP-WOA adversarial attack algorithm performs best on all experimental data except for a slightly worse performance on SST-2+BiLSTM compared to BESA. The attack success rate on some datasets can even reach 100%, fully demonstrating the effectiveness of the STRAP-WOA model. This also proves that the vulnerability of DNNs objectively exists.

[0107] Table 1-2(a) Success rates of different models in word-level attacks

[0108]

[0109] Table 1-2(b) Success rates of different models in sentence-level attacks

[0110]

[0111] 1.5.2. Adversarial Sample Quality

[0112] To further test the quality of the generated adversarial examples and analyze the model in more detail, this section presents an automated evaluation of the quality of the adversarial examples generated by the model. The results are shown in Tables 1-3.

[0113] As shown in the table, our proposed STRAP-WOA model performs well on most datasets, achieving optimal syntax error increase rates except for the IMDB dataset and the SST-2+DistilBERT combination. Some results even show negative values, indicating that some syntax errors in the original text have been corrected. Furthermore, there are significant differences in syntax error increase rates among different models, which is also influenced by the number of syntax errors in the original samples. When the number of syntax errors in the original samples is low, even small changes in errors can lead to a large syntax error increase rate.

[0114] Regarding PPL (Problem-Based Probability), other models performed best. Overall, the STRAP-WOA model's performance was still acceptable, with a relatively small gap compared to the best PPL. A smaller PPL indicates that the adversarial examples generated by each model are common word sequence combinations, while a larger PPL indicates a lower probability of such word combinations occurring in the sentence. However, this does not necessarily prove that the sentence has a problem; therefore, a PPL within a certain range can be considered as a grammatically correct sentence.

[0115] Table 1-3(a) Quality assessment results of adversarial examples in word-level attacks

[0116]

[0117] Table 1-3(b) Quality assessment results of adversarial samples in sentence-level attacks

[0118]

[0119]

[0120] 1.5.3. Semantic Consistency

[0121] This section tests the semantic similarity between adversarial samples and original samples, which can, to some extent, simulate human judgment of whether two texts have the same meaning. Figure 5 The similarity between two sentences before and after the attack was tested on all datasets, and the results are presented as box plots.

[0122] from Figure 5As can be seen, the adversarial examples generated by the STRAP-WOA algorithm have a high similarity to the original samples, with an average of 81%, and a shorter bin, meaning a smaller range of similarity fluctuations. The best sample achieves a similarity of over 0.99. Overall, the best performing algorithm is the PSO method, which has the highest average value, the second shortest bin length, and higher upper and lower quartiles. However, our method does not show a significant difference compared to it. The StyleAdv algorithm performs the worst, mainly due to a wider range of data fluctuations and a relatively lower average value.

[0123] 1.5.4. Number of Queries

[0124] This section tests the average number of queries against the target attack model under the condition of a successful attack, and the results are shown in Table 1-4. First, the results of the word-level attack are shown in Table 1-4(a). It can be seen that although our query count was not the lowest, it was still higher than that of BERT. base Aside from the +IMDB combination, our STRAP-WOA's average query count is not significantly different from the best results, and our model performs better in attack success rate tests. We believe that a slight increase in query count in exchange for a higher attack success rate is acceptable. For sentence-level attacks, StyleAdv performs very well in this test because its attack method limits the maximum number of queries to 50. However, simply limiting the number of queries to an extremely low value is not a very reasonable approach, which limits the model's performance in attack success rate, and is one reason why StyleAdv performs poorly in attack success rate tests.

[0125] Table 1-4(a) Average number of queries for different models in word-level attacks

[0126]

[0127]

[0128] Table 1-4(b) Average number of queries for different models in sentence-level attacks

[0129]

[0130] 1.6. Migration

[0131] The transferability of adversarial examples reflects whether an attack model can attack a deep neural network without accessing it; that is, whether adversarial examples generated to mislead a classifier F can also fool an unknown classifier F′. Transferability is also a widely used evaluation metric in adversarial attacks. This section evaluates the transferability of various attack methods on the SST-2 dataset. Specifically, using adversarial examples generated when attacking BERT, transfer attacks are performed on three unknown models (BiLSTM, ALBERT, and DistilBERT). The classification accuracy of the three models on the original samples and adversarial examples is as follows: Figure 6 As shown, lower accuracy means higher transferability, i.e., lower data is better.

[0132] from Figure 6 As can be seen, StyleAdv exhibits the best transferability, followed by BESA and STRAP-WOA, with PSO being the last. However, good transferability is closely related to similarity. As the semantic consistency test in the previous section showed, the adversarial examples generated by StyleAdv performed poorly. This indicates that some of these samples deviated significantly from the semantics of the original samples, and the truth value expressed by their sentences may have changed. These samples would be misclassified in any model's test. Therefore, good semantic consistency is a prerequisite for evaluating transferability. In the results other than StyleAdv, STRAP-WOA's performance was not significantly different from BESA; for example, its accuracy was 5% lower on ALBERT and only 1% lower on BiLSTM.

[0133] 1.7. Parameter Tuning Process

[0134] This section primarily demonstrates the adjustment process for relevant parameters of the WOA algorithm, mainly adjusting the maximum number of iterations (max_iters_1) and the population size (N3), and recording the impact of different parameters on the model's attack success rate. The test conditions are based on BERT... base The attack success rate was calculated by randomly selecting 500 correctly classified SST-2 samples under the model. Experimental results are shown below. Figure 7 .

[0135] from Figure 7 As can be seen, the attack success rate of the model gradually increases with the increase of the maximum number of iterations and the population size. Finally, we chose max_iters_1 = 20 and N3 = 60 as the final parameters.

[0136] 1.8. Ablation Experiment

[0137] This section analyzes the role of each module in our proposed hybridization model to ensure the effectiveness of each improvement. The model improvement is divided into three stages: first, testing the attack success rate based on the original WOA; second, addressing the shortcomings of WOA by proposing an improved WOA algorithm, denoted as IWOA in this section; and finally, fusing IWOA with the style transfer model to obtain the final hybridization model, STRAP-WOA. The attack success rates of the model in each of the three stages are shown in Tables 1-5.

[0138] As shown in the table, each improvement effectively increased the model's attack success rate, indicating that each improvement was effective. The reason for this is that the original WOA algorithm suffers from problems such as being prone to getting trapped in local optima, and the crossover between populations is not very high, resulting in poor performance in text adversarial attacks. Improvements to WOA were made from several angles, including adding extra mutations to the algorithm, increasing inertia weights, and accepting some degraded samples according to the Metropolis criterion. It was then determined that simple word-level mutations alone could not achieve further improvement, so style transfer was introduced. Text style, as a characteristic independent of sentence and grammar, is rarely considered in general tasks, but it can affect the model. Therefore, using style transfer as a further mutation of sentences can effectively expand the algorithm's search space. Experiments also demonstrated the effectiveness of the model after incorporating style transfer.

[0139] Table 1-5 Attack success rates of models at different stages

[0140]

[0141] This invention proposes a hybrid model, STRAP-WOA, based on style transfer and an improved WOA algorithm. This model effectively integrates the improved WOA algorithm and the improved style transfer method, leveraging the advantages of each. Two fusion mechanisms for style transfer and whale optimization algorithms are proposed: first, a three-stage model that serially fuses style transfer and whale optimization; then, a parallel fusion of the three-stage model and the improved style transfer. This is also the first time a fusion model has been used in the field of text adversarial attacks, and the fusion concept provides a new attack approach for text adversarial attacks. The effectiveness of the model is evaluated by comparing it with representative baseline models on common datasets. Experimental results show that STRAP-WOA achieves the highest attack success rate in most tests, while exhibiting a lower increase in syntax errors, higher semantic similarity, and good performance in transfer attacks.

[0142] The embodiments described above merely illustrate specific implementation methods of this application, and while the descriptions are detailed and specific, they should not be construed as limiting the scope of protection of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the technical solution of this application, and these modifications and improvements all fall within the scope of protection of this application.

Claims

1. A text adversarial attack method based on hybridization of style transfer and whale optimization algorithm, characterized in that, The method comprises the following steps: Constructing a three-stage module and an improved style transfer module: performing a mutation operation on each adversarial sample after updating the original whale optimization algorithm, and processing it through an improved Metropolis criterion to obtain an improved whale optimization algorithm WOA; and fusing the improved whale optimization algorithm WOA and the style transfer algorithm to construct the three-stage module; After style transfer, a mutation operation is performed on the generated sample to construct an improved style transfer module; Text adversarial attack: generating text adversarial samples through a semantic-based adversarial sample generation model, and inputting the text adversarial samples into the improved style transfer module and the three-stage module for attack, respectively; If the improved style transfer attack fails, the attack enters the three-stage module; In the three-stage module, the text adversarial sample is processed through the improved whale optimization algorithm WOA and the style transfer algorithm in turn, and then the sample is regenerated based on the semantic and iteratively searched and updated in the improved whale optimization algorithm WOA; if there is an adversarial sample that attacks successfully at any time, the adversarial sample is directly output and the attack is stopped.

2. The method of claim 1, wherein the method is based on style transfer hybridized with whale optimization algorithm. The improved Metropolis criterion formula is as follows: wherein, is the output of the target attack model after the new adversarial sample is input, is the output of the model before mutation, is the probability of accepting a deteriorated individual, The value of T is dynamically adjusted with the number of iterations, and is also affected by the length of the input sentence.

3. The method of claim 1, wherein the method is based on style transfer hybridized with whale optimization algorithm. Mutation operation: randomly selecting a word that meets the requirement of generating a replacement word based on the semantic to replace it to generate a new adversarial sample.

4. The method of claim 1, wherein the method is based on style transfer hybridized with whale optimization algorithm. The adversarial sample generation method of the semantic-based adversarial sample generation model comprises: S1: analyzing the part of speech of each word according to the input sentence, and finding synonyms for the content words through the semantic; S2: after finding the appropriate replacement word, replacing the word in the original sample, and replacing only one position each time, a plurality of adversarial samples are obtained.

5. The method of claim 1, wherein the method is based on style transfer hybridized with whale optimization algorithm. The improved whale optimization algorithm WOA specifically comprises: Initialization: get N3 adversarial samples generated by the radicals , each adversarial sample is recorded as , ; at the same time, the positions of N3 whales are randomly initialized , dimension is randomly initialized between to ; Record: Calculate the prediction score of the current adversarial sample, record the position of the current optimal individual and the optimal adversarial sample ; Update: first, update each dimension of each whale according to the update method in the original whale optimization algorithm; second, update all positions again after the original whale optimization algorithm performs the update; update the adversarial sample; after the update step is completed, perform a mutation operation on each adversarial sample and process it through the Metropolis criterion; Termination: the termination condition is set as that the prediction result of the target attack model is different from the original label, that is, the predicted label changes.

6. The method of claim 5, wherein the style transfer and whale optimization algorithm hybrid-based text adversarial attack method is characterized by, The formula for updating all positions again is: wherein, a dth word representing an nthsample, a dth word representing an optimal sample, a dth dimension representing an nthsentence, is defined as follows: ， representing an inertia weight, the inertia weight being set to decrease with an increase in the iteration number.

7. The method of claim 6, wherein the method is characterized by, Inertial weight The formula is as follows: wherein, , and are the maximum number of iterations and the current number of iterations, respectively.

8. The method of claim 5, wherein the style transfer and whale optimization algorithm hybrid-based text adversarial attack method is characterized by, The updating of the adversarial sample adopts a probability-based method, specifically including: using a Sigmoid function to convert the value of each position into a probability, denoted as , According to the probability, determine whether the current sample changes towards the global optimal sample; finally, the update method of the adversarial sample in each dimension is as follows: where P represents the transition probability of the corresponding vector, , r is a random number between 0 and 1.

9. The method of claim 1, wherein the method is characterized by, In the three-stage module, N adversarial samples are obtained through the semantic, iteratively searched and updated through the improved whale optimization algorithm WOA, and after one round of iteration, the worst sample is selected and input into the style transfer model to obtain the sample after style transfer; the new adversarial sample is iteratively searched and updated through the improved whale optimization algorithm WOA until the maximum number of iterations is reached or there is an adversarial sample that attacks successfully; If no effective adversarial sample is searched when the maximum number of iterations is reached, return to the first improved whale optimization algorithm WOA step to start the next round of iteration until the maximum number of iterations is reached.

Images