Black box adversarial text generation method based on attention mechanism and locality sensitive hashing

Abstract

The invention discloses a black box adversarial text generation method based on an attention mechanism and locality sensitive hashing. The method comprises the steps of initializing an adversarial text based on the attention mechanism, deleting redundant noise in the adversarial text, and optimizing the adversarial text based on the locality sensitive hashing to obtain an optimal adversarial text. According to the method, an attention mechanism is introduced in an adversarial text initialization stage, and words with high importance to an original text are preferentially disturbed, so that the number of times of querying a target model in the adversarial text initialization stage is reduced; a locality sensitive hashing method is introduced in the transition word searching process and the updating direction estimating process in the confrontation text optimizing stage, and candidate texts are clustered according to sentence-level vector similarity, so that the number of times of querying a target model in the confrontation text optimizing stage is reduced. The combination of the two can effectively reduce the number of times of querying the target model in the whole adversarial text generation process.

Description

Technical Field

[0001] The present invention relates to an adversarial text generation method, and in particular to a black box adversarial text generation method based on attention mechanism and local sensitive hashing. Background Art

[0002] In recent years, the field of natural language processing has developed rapidly, especially the emergence of large language models such as GPT-4, which has pushed the development of this field to a new level. Natural language processing technology has therefore been widely used in a series of real scenarios such as sentiment analysis, text generation, and multi-round dialogue systems. However, existing studies have shown that existing natural language processing models face severe threats from adversarial attacks.

[0003] Adversarial attack is a security threat in the model reasoning stage. The attacker constructs adversarial samples by adding tiny noises that do not affect human judgment to the input samples, thereby causing the artificial intelligence model to produce incorrect outputs. Specifically, taking the text classification task as an example, given an original text x consisting of n words = [w 1 ,w 2 ,…,w n ], the text classification model F correctly classifies it, that is, F(x) = y. In the adversarial attack, the attacker adds special tiny noise ∈ to x to generate adversarial text x * =x+∈, for humans, x * is semantically similar to x, but is misclassified by F, i.e., F(x * )≠F(x).

[0004] In recent years, in order to verify the robustness of existing natural language processing models in the face of adversarial samples and discover their potential security vulnerabilities, researchers have proposed different adversarial text generation methods. However, due to the particularity of text samples themselves (discreteness, presence of semantic information, and easy detection by the human eye), it is still a huge challenge to generate adversarial text with high semantic similarity and low perturbation rate in a black box scenario where only the output label of the target model can be obtained.

[0005] At present, according to the different access capabilities to the target model, the existing adversarial attack methods for natural language processing models can be divided into white-box attack and black-box attack methods. Among them, the white-box attack method means that the attacker has full access to the target model and can obtain all the information of the target model, including the model architecture, parameters, gradients, etc., and use this information to generate adversarial text. Therefore, this type of attack method can usually generate adversarial samples with strong attack capabilities. In the black-box attack scenario, the attacker can only obtain the probability distribution of the target model for the input text (called soft label setting) or the final label (called hard label setting). Therefore, the attack capability of the adversarial text generated by this type of attack method is generally lower than that of the adversarial text generated by the white-box attack. However, since the black-box attack method does not need to obtain information about the target model, the black-box attack method is more suitable for application in the real world to verify the robustness of existing artificial intelligence systems.

[0006] Compared with the soft label setting, it is more challenging to generate adversarial text under the hard label setting where only the final label output by the target model can be obtained. At present, researchers have proposed some black-box adversarial text generation methods under the hard label setting. For example, Maheshwary et al. first proposed a three-stage strategy of "initialization-search space reduction-population-based optimization". In the third stage, the "population-based optimization" stage uses a genetic algorithm to iterate the three processes of "selection-hybridization-mutation" to make the adversarial text as close to the decision boundary of the target model as possible while ensuring the ability to attack, thereby optimizing the semantic similarity between the adversarial text and the original text. However, the optimization process based on the genetic algorithm needs to maintain a large number of candidate samples, which leads to the need for a large number of queries to the target model, and thus cannot meet the requirements of verifying the robustness of the natural language processing model in real scenarios with a limited number of queries. Liu et al. proposed the SSPAttack method, which follows the random initialization strategy proposed by Maheshwary et al. and proposes an optimization strategy that iteratively executes the two processes of "removing unnecessary replacement words" and "pushing replacement words to the original words". Liu et al. proposed HQA-Attack, which is an improvement on SSPAttack.

[0007] However, these methods still have the following problems:

[0008] (1) Existing black-box adversarial text generation methods under hard label settings generally require a large number of queries to the target model, which cannot meet the needs of verifying the robustness of natural language processing models in real scenarios with limited query times. Methods such as SSPAttack and HQA-Attack only need to maintain one candidate sample during the adversarial text generation process. Although they reduce the number of queries to the target model to a certain extent compared to population-based optimization methods that need to maintain multiple candidate samples, there is still room for reduction in the number of queries required.

[0009] (2) Compared with the method proposed by Maheshwary et al., SSPAttack and HQA-Attack only need to maintain one candidate sample in the adversarial text generation process, thus reducing the number of queries to the target model to a certain extent and increasing the number of available rows for verifying the robustness of natural language models in real scenarios. However, a large number of random selection strategies are used in the optimization process, which to a certain extent leads to the problem of obtaining suboptimal solutions and increasing the number of queries to the target model. Therefore, the semantic similarity and perturbation rate of adversarial text need to be further improved. Summary of the invention

[0010] The purpose of the present invention is to provide a solution to the above-mentioned problem, which is to generate adversarial text with high semantic similarity and low perturbation rate with as few queries as possible in a black-box scenario with hard label settings, thereby satisfying the requirement of verifying the robustness of existing natural language processing models in the face of adversarial attacks in real scenarios with limited query times. A black-box adversarial text generation method based on attention mechanism and local sensitive hashing is proposed.

[0011] In order to achieve the above-mentioned purpose, the technical solution adopted by the present invention is as follows: a black box adversarial text generation method based on attention mechanism and local sensitive hashing is used to generate a text according to the original text x=[w 1 ,…,w i ,…,w n ] Generate adversarial text for the target model F, w i is the word at position i in x, 1≤i≤n, the true classification label of the original text x is y, and the target model F is used to output the classification recognition result F(·) of the text, including the following steps;

[0012] S1, initialize the adversarial text based on the attention mechanism to obtain the second adversarial text x 2 , including steps S11 to S15;

[0013] S11, process each word in x in turn, if w i If the part of speech of word i is a noun, verb, adjective or adverb, it is marked as a perturbed word, i is added to the initial perturbed word position list I, and the position i added for the jth time is marked as hj , we get I = [h 1 ,…,h j ,…,h m ], 1≤j≤m, m is the total number of perturbable words in x;

[0014] S12, input x into the pre-trained attention model A, and get each h j The corresponding word attention score Normalization get The normalized value e j , forming a normalized table E = [e 1 ,…,e j ,…,e m ];

[0015] S13, non-repeated sampling of elements in I with probability distribution E to obtain the first perturbed word position list For I 1 The jth element in ;

[0016] S14, let the first adversarial text x 1 =x, press I 1 Sequence, for x 1 The perturbed words in are replaced with their synonyms, and then the target model F is used to perform the perturbed words on x 1 Identify and get the recognition result F(x 1 );

[0017] S15, determine F(x 1 ), if F(x 1 )=y, repeat S14 until F(x 1 )≠y;

[0018] If F(x 1 )≠y, then x 1 Marked as the second adversarial text x 2 , where n words are marked as w ′ 1 ~w ′ n , we get x 2 =[w ′ 1 ,…,w i ′ ,…,w ′ n ],w i ′ For x 2 The word in position i in the middle;

[0019] S2, delete the second adversarial text x2 The redundant noise in the third adversarial text x 3 ;

[0020] S3, optimizes the third adversarial text x based on local sensitive hashing 3 , get the optimal adversarial text x * , including steps S31 to S34;

[0021] S31, determining the optimization sequence, including steps S31.1 to S31.4;

[0022] S31.1, for x 3 For each word in w i ′ ≠w i , then add i to the second perturbed word position list I 2 In the example, the position i of the kth addition is marked as get For x 3 The total number of words that are different from x;

[0023] S31.2, yes Find x 3 and the corresponding word in x, calculate the cosine distance between the two words Get the cosine distance list

[0024] S31.3, Calculation The sampling probability Get the sampling probability list

[0025] S31.4, with P as the probability distribution over I 2 The elements in are sampled non-repeatedly to obtain the third perturbed word position list For I 3 The kth element in 3 The middle position is The words are marked as Get x 3 The optimized order list of perturbed words in

[0026] S32, search transition words, including S32.1 to S32.5;

[0027] S32.1, replace the corresponding The word is recorded as Use its synonym set Generate a list of candidate texts R is the total number of synonyms, for The rth synonym in For use Replace x 3 middle The candidate text obtained;

[0028] Input Sub into the pre-trained sentence-level vector encoding model to obtain the sentence-level vector list Sen = [V (1) ,…,V (r) ,…,V (R) ],V (r) is the sentence-level vector encoding model pair The sentence-level vector obtained by encoding;

[0029] S32.2, Sen and Input into the local sensitive hashing model, and get a set B containing ∈ clusters = {b 1 ,…,b l ,…,b ∈}, 1≤l≤∈, b l is the lth cluster, containing the positions of θ candidate texts The word, 1≤s≤θ, Yes l The sth word in ;

[0030] S32.3, from each b l A random word is selected from Constructing an initial transition word candidate list Select the word that makes the generated candidate text meet the attack requirements and has the highest semantic similarity with the original text x as the initial transition word from In the cluster where x is located, find the word that makes the generated candidate sample meet the requirements of the adversarial attack and has the highest semantic similarity with the original text x as the final transition word

[0031] S32.4, with Replace x 3 In Get candidate text And calculate The semantic similarity score with the original text x

[0032] S33, estimating the update direction, including steps S33.1 to S33.5;

[0033] S33.1, use Synonyms of Generate a list of candidate texts for The rth synonym in For use Replace x 3 middle The candidate text obtained; input M into the pre-trained sentence-level vector encoding model to obtain a sentence-level vector list is the sentence-level vector encoding model pair The sentence-level vector obtained by encoding;

[0034] S33.2, and Input into the local sensitive hashing model to obtain a set of β clusters 1≤q≤β, for The qth cluster in the qth cluster contains the positions of n candidate texts. The word, 1≤t≤η, yes The tth word in ;

[0035] S33.3, from each A random word is selected from Constructing a list of candidate words use Each of Replace x respectively 3 In Get a list of candidate texts It is used Replace x 3 In The candidate text obtained;

[0036] S33.4, calculation Each of Semantic similarity score with x Get the semantic similarity score list Cr = [c 1 ,…,c q ,…,c β ], and calculate c q The normalized semantic similarity score difference α q , in, Yes The value of takes the absolute value;

[0037] S33.5, calculate and update the direction vector u;

[0038]

[0039] In the formula, for middle The word vector of For x 3 middle The word vector of

[0040] S34, update the third confrontation text x 3 , get the optimal adversarial text x * , including S34.1 to S34.4;

[0041] S34.1, The rth word in The word vector is calculate The cosine distance between and u, R words have a total of R cosine distances, The R words in the list are rearranged in descending order of cosine distance to obtain a list of synonyms. is the rth word in Q;

[0042] S34.2, in the order of the words in Q, use Replace x 3 In Get candidate text calculate The semantic similarity score between The adversarial attack score like and Use Replace x 3 In Otherwise, keep x 3 In constant;

[0043] S34.3, press The order of the inner elements is x 3 Each Execute steps S32 to S34.2;

[0044] S34.4, iterate steps S2 to S34.3 for τ times, and finally obtain x 3 As the optimal adversarial text x * .

[0045] Preferably, the attention model A is Hierarchical Attention Networks, and the sentence-level vector encoding model is Universal Sentence Encoder.

[0046] As a preferred embodiment: in S14, x 1 middle The corresponding perturbed words can be replaced with synonyms by replacing x 1 middle The corresponding perturbed words are marked as from Synonyms of Randomly select a synonym from Replace x 1 In

[0047] As a preferred embodiment: Step S2 is specifically,

[0048] S21, find an optimal word w according to the following formula * ;

[0049]

[0050] In the formula, is the argmax function, x ′ (w i ) is used for i Replace x 2 w in i ′ The candidate text obtained after that, S(·,·) is the semantic similarity score, Adv(F,x,x ′ (w i )) is x ′ (w i )’s adversarial attack score, when F(x ′ (w i ))≠F(x), Adv(F,x,x ′ (w i ))=1, otherwise, Adv(F,x,x ′ (w i ))=0;

[0051] S22, w * The position in x is denoted as o, and x 2 The word at position o in the * ′ , use w * Replace x 2 w in * ′ Get candidate text x ′ (w * ), calculate x ′ (w * )’s adversarial attack score Adv(F,x,x ′ (w * ));

[0052] S23, judge Adv(F,x,x ′ (w * ))'s value;

[0053] If Adv(F,x,x ′ (w * ))=1, then use w * Replace x 2 w in * ′ , and repeat steps S21 to S22 until Adv(F,x,x ′ (w * ))=0;

[0054] If Adv(F,x,x ′ (w * ))=0, then x 2 As the third confrontation text x 3 .

[0055] As a preferred embodiment: In S31.2, calculate the cosine distance The method is;

[0056] according to x 3 The word vector of the word at the corresponding position in is marked as Mark the word vector of the word at the corresponding position in x as Calculate cosine distance Among them, cos(·,·) is the cosine similarity function;

[0057] S31.3, calculated according to the following formula The sampling probability

[0058]

[0059] As a preferred embodiment: In S32.3, select according to the following formula

[0060]

[0061] Where argmax[·] is the argmax function, For use Replace x 3 In The candidate text obtained after that, S(·,·) is the semantic similarity score, for The adversarial attack score is hour, otherwise

[0062]

[0063] Will The cluster is recorded as cluster The final transition word is obtained according to the following formula

[0064]

[0065] In the formula, It is used Replace x 3 In The candidate text obtained later is yes The adversarial attack score is hour, otherwise,

[0066] The idea of ​​the present invention is:

[0067] (1) The present invention introduces an attention mechanism in the initialization adversarial text stage to obtain the importance of the perturbed words to the original text, and adds perturbations to the perturbed words in order from high to low importance, thereby obtaining an initial adversarial text with the ability to resist attacks.

[0068] (2) The present invention introduces a local sensitive hashing method in the two processes of searching for transition words and estimating the update direction in the stage of optimizing the adversarial text. In the process of searching for transition words, all candidate texts are first clustered according to sentence-level vector similarity, and then candidate texts are selected from each cluster to query the target model. Then, all candidate texts in the cluster where the candidate text that meets the adversarial attack requirements and has the highest semantic similarity with the original text is located are selected and used to query the target model again. Finally, the candidate text that meets the adversarial attack requirements and has the highest semantic similarity with the original text is used as the new adversarial text, and the corresponding replacement word is determined as the transition word. In the process of estimating the update direction, all candidate texts are first clustered according to sentence-level vector similarity, and then candidate texts are selected from each cluster to obtain the semantic similarity score between the selected candidate text and the original text, so as to obtain the update direction vector based on these semantic similarity scores.

[0069] Compared with the prior art, the advantages of the present invention are:

[0070] (1) The present invention introduces an attention mechanism in the stage of initializing the adversarial text, thereby adding perturbations to the perturbed words in order from high to low importance. Compared with the random initialization strategy in the existing method, the present invention can effectively reduce the number of perturbation words in the adversarial text, that is, reduce the perturbation rate of the adversarial text and improve the imperceptibility of the adversarial text.

[0071] (2) The present invention introduces the local sensitive hashing method in the two processes of searching transition words and estimating the update direction in the stage of optimizing the adversarial text, so as to cluster the candidate texts according to the sentence-level vector similarity, and then select the candidate text from each cluster for the subsequent optimization process. Compared with the random selection strategy of candidate text in the existing method, the present invention can reduce the risk of obtaining a suboptimal solution and can more efficiently find the optimal adversarial text with higher semantic similarity.

[0072] (3) The attention mechanism and local sensitive hashing method introduced in the present invention, the former reduces the number of queries to the target model in the initialization adversarial text stage by preferentially perturbing words that are important to the original text, and the latter reduces the number of queries to the target model in the adversarial text optimization stage by clustering candidate texts according to sentence-level vector similarity. The combination of the two can effectively reduce the number of queries to the target model in the entire adversarial text generation process. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0074] The present invention will be further described below in conjunction with the accompanying drawings.

[0075] Example 1: See Figure 1 , a black-box adversarial text generation method based on attention mechanism and local sensitive hashing, used to generate 1 ,…,w i ,…,w n ] Generate adversarial text for the target model F, w i is the word at position i in x, 1≤i≤n, the true classification label of the original text x is y, and the target model F is used to output the classification recognition result F(·) of the text, including the following steps;

[0076] S1, initialize the adversarial text based on the attention mechanism to obtain the second adversarial text x 2 , including steps S11 to S15;

[0077] S11, process each word in x in turn, if w i If the part of speech of word i is a noun, verb, adjective or adverb, it is marked as a perturbed word, i is added to the initial perturbed word position list I, and the position i added for the jth time is marked as h j , we get I = [h 1 ,…,h j ,…,h m ], 1≤j≤m, m is the total number of perturbable words in x;

[0078] S12, input x into the pre-trained attention model A, and get each hj The corresponding word attention score Normalization get The normalized value e j , forming a normalized table E = [e 1 ,…,e j ,…,e m ];

[0079] S13, non-repeated sampling of elements in I with probability distribution E to obtain the first perturbed word position list For I 1 The jth element in ;

[0080] S14, let the first adversarial text x 1 =x, press I 1 Sequence, for x 1 The perturbed words in are replaced with their synonyms, and then the target model F is used to perform the perturbed words on x 1 Identify and get the recognition result F(x 1 );

[0081] S15, determine F(x 1 ), if F(x 1 )=y, repeat S14 until F(x 1 )≠y;

[0082] If F(x 1 )≠y, then x 1 Marked as the second adversarial text x 2 , where n words are marked as w ′ 1 ~w ′ n , we get x 2 =[w ′ 1 ,…,w i ′ ,…,w ′ n ],w i ′ For x 2 The word in position i in the middle;

[0083] S2, delete the second adversarial text x 2 The redundant noise in the third adversarial text x 3 ;

[0084] S3, optimizes the third adversarial text x based on locality sensitive hashing 3 , get the optimal adversarial text x * , including steps S31 to S34;

[0085] S31, determining the optimization sequence, including steps S31.1 to S31.4;

[0086] S31.1, for x 3 For each word in w i ′ ≠w i , then add i to the second perturbed word position list I 2 In the example, the position i of the kth addition is marked as get For x 3 The total number of words that are different from x;

[0087] S31.2, yes Find x 3 and the corresponding word in x, calculate the cosine distance between the two words Get the cosine distance list

[0088] S31.3, Calculation The sampling probability Get the sampling probability list

[0089] S31.4, with P as the probability distribution over I 2 The elements in are sampled non-repeatedly to obtain the third perturbed word position list For I 3 The kth element in 3 The middle position is The words are marked as Get x 3 The optimized order list of perturbed words in

[0090] S32, search transition words, including S32.1 to S32.5;

[0091] S32.1, replace the corresponding The word is recorded as Use its synonym set Generate a list of candidate texts R is the total number of synonyms, for The rth synonym in For use Replace x 3 middle The candidate text obtained;

[0092] Input Sub into the pre-trained sentence-level vector encoding model to obtain the sentence-level vector list Sen = [V (1) ,…,V (r) ,…,V (R) ],V (r) is the sentence-level vector encoding model pair The sentence-level vector obtained by encoding;

[0093] S32.2, Sen and Input into the local sensitive hashing model, and get a set B containing ∈ clusters = {b 1 ,…,b l ,…,b ∈}, 1≤l≤∈, b l is the lth cluster, containing the positions of θ candidate texts The word, 1≤s≤θ, Yes l The sth word in ;

[0094] S32.3, from each b l A random word is selected from Constructing an initial transition word candidate list Select the word that makes the generated candidate text meet the attack requirements and has the highest semantic similarity with the original text x as the initial transition word from In the cluster where x is located, find the word that makes the generated candidate sample meet the requirements of the adversarial attack and has the highest semantic similarity with the original text x as the final transition word

[0095] S32.4, with Replace x 3 In Get candidate text And calculate The semantic similarity score with the original text x

[0096] S33, estimating the update direction, including steps S33.1 to S33.5;

[0097] S33.1, use Synonyms of Generate a list of candidate texts for The rth synonym in For use Replace x 3 middle The candidate text obtained; input M into the pre-trained sentence-level vector encoding model to obtain a sentence-level vector list is the sentence-level vector encoding model pair The sentence-level vector obtained by encoding;

[0098] S33.2, and Input into the local sensitive hashing model to obtain a set of β clusters 1≤q≤β, for The qth cluster in the qth cluster contains the positions of n candidate texts. The word, 1≤t≤η, yes The tth word in ;

[0099] S33.3, from each A random word is selected from Constructing a list of candidate words use Each of Replace x respectively 3 In Get a list of candidate texts It is used Replace x 3 In The candidate text obtained;

[0100] S33.4, calculation Each of Semantic similarity score with x Get the semantic similarity score list Cr = [c 1 ,…,c q ,…,c β ], and calculate c q The normalized semantic similarity score difference α q , in, Yes The value of takes the absolute value;

[0101] S33.5, calculate and update the direction vector u;

[0102]

[0103] In the formula, for middle The word vector of For x 3 middle The word vector of

[0104] S34, update the third confrontation text x 3 , get the optimal adversarial text x * , including S34.1 to S34.4;

[0105] S34.1, The rth word in The word vector is calculate The cosine distance between and u, R words have a total of R cosine distances, The R words in the list are rearranged in descending order of cosine distance to obtain a list of synonyms. is the rth word in Q;

[0106] S34.2, in the order of the words in Q, use Replace x 3 In Get candidate text calculate The semantic similarity score between The adversarial attack score like and Use Replace x 3 In Otherwise, keep x 3 In constant;

[0107] S34.3, press The order of the inner elements is x 3 Each Execute steps S32 to S34.2;

[0108] S34.4, iterate steps S2 to S34.3 for τ times, and finally obtain x 3 As the optimal adversarial text x * .

[0109] The attention model A is Hierarchical Attention Networks, and the sentence-level vector encoding model is Universal Sentence Encoder.

[0110] In S14, x 1 middle The corresponding perturbed words can be replaced with synonyms by replacing x 1 middle The corresponding perturbed words are marked as from Synonyms of Randomly select a synonym from Replace x 1 In

[0111] Step S2 specifically includes:

[0112] S21, find an optimal word w according to the following formula * ;

[0113]

[0114] In the formula, is the argmax function, x ′ (w i ) is used for i Replace x 2 w in i ′ The candidate text obtained after that, S(·,·) is the semantic similarity score, Adv(F,x,x ′ (w i )) is x ′ (w i )’s adversarial attack score, when F(x ′ (w i ))≠F(x), Adv(F,x,x ′ (w i ))=1, otherwise, Adv(F,x,x ′ (w i ))=0;

[0115] S22, w * The position in x is denoted as o, and x 2 The word at position o in the * ′ , use w * Replace x 2 w in * ′ Get candidate text x ′ (w * ), calculate x ′ (w * )’s adversarial attack score Adv(F,x,x ′ (w * ));

[0116] S23, judge Adv(F,x,x ′ (w * ))'s value;

[0117] If Adv(F,x,x ′ (w * ))=1, then use w* Replace x 2 w in * ′ , and repeat steps S21 to S22 until Adv(F,x,x ′ (w * ))=0;

[0118] If Adv(F,x,x ′ (w * ))=0, then x 2 As the third confrontation text x 3 .

[0119] In S31.2, calculate the cosine distance The method is;

[0120] according to x 3 The word vector of the word at the corresponding position in is marked as Mark the word vector of the word at the corresponding position in x as Calculate cosine distance Among them, cos(·,·) is the cosine similarity function;

[0121] S31.3, calculated according to the following formula The sampling probability

[0122]

[0123] In S32.3, select

[0124]

[0125] Where argmax[·] is the argmax function, For use Replace x 3 In The candidate text obtained after that, S(·,·) is the semantic similarity score, for The adversarial attack score is hour, otherwise

[0126]

[0127] Will The cluster is recorded as cluster The final transition word is obtained according to the following formula

[0128]

[0129] In the formula, It is used Replace x 3 In The candidate text obtained later is yes The adversarial attack score is hour, otherwise,

[0130] Example 2: See Figure 1 On the basis of Example 1, 1000 test texts in the SST-2 dataset are used as the original texts, and the BERT model fine-tuned using the training set of the SST-2 dataset is used as the target model. The comparison of the number of queries, semantic similarity, and perturbation rate between this method and the existing methods is shown in Table 1:

[0131] Table 1. Comparison of evaluation indexes of the present invention and existing methods

[0132]

[0133] It can be seen from the table that while maintaining the same attack success rate as the HQA-Attack method, our method has achieved better results than the existing methods in terms of the number of queries, semantic similarity, and perturbation rate. This shows the advantage of the method in generating high-quality adversarial text with as few queries as possible.

[0134] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A black-box adversarial text generation method based on attention mechanism and local sensitive hashing is used to generate a text based on the original text x = [w1, ..., w i ,…,w n ] Generate adversarial text for the target model F, w i is the word at position i in x, 1≤i≤n, the true classification label of the original text x is y, and the target model F is used to output the classification recognition result F(·) of the text, which is characterized by: The steps include: S1, initialize the adversarial text based on the attention mechanism to obtain the second adversarial text x 2 , including steps S11 to S15; S11, process each word in x in turn, if w i If the part of speech of word i is a noun, verb, adjective or adverb, it is marked as a perturbed word, i is added to the initial perturbed word position list I, and the position i added for the jth time is marked as h j , we get I = [h1,…,h j ,…,h m ], 1≤j≤m, m is the total number of perturbable words in x; S12, input x into the pre-trained attention model A, and get each h j The corresponding word attention score Normalization get The normalized value e j , forming a normalized table E = [e1, ..., e j ,…,e m ]; S13, non-repeated sampling of elements in I with probability distribution E to obtain the first perturbed word position list For I 1 The jth element in ; S14, let the first adversarial text x 1 =x, press I 1 Sequence, for x 1 The perturbed words in are replaced with their synonyms, and then the target model F is used to perform the perturbed words on x 1 Identify and get the recognition result F(x 1 ); S15, determine F(x 1 ), if F(x 1 )=y, repeat S14 until F(x 1 )≠y; If F(x 1 )≠y, then x 1 Marked as the second adversarial text x 2 , where n words are marked as w′1~w′ n , we get x 2 =[w′1,…,w′ i ,…,w′ n ],w′ i For x 2 The word in position i in the middle; S2, delete the second adversarial text x 2 The redundant noise in the third adversarial text x 3 ; S3, optimizes the third adversarial text x based on local sensitive hashing 3 , obtaining the optimal adversarial text x*, including steps S31 to S34; S31, determining the optimization sequence, including steps S31.1 to S31.4; S31.1, for x 3 For each word in w′ i ≠w i , then add i to the second perturbed word position list I 2 In the example, the position i of the kth addition is marked as get For x 3 The total number of words that are different from x; S31.2, yes Find x 3 and the corresponding word in x, calculate the cosine distance between the two words Get the cosine distance list S31.3, Calculation The sampling probability Get the sampling probability list S31.4, with P as the probability distribution over I 2 The elements in are sampled non-repeatedly to obtain the third perturbed word position list For I 3 The kth element in 3 The middle position is The words are marked as Get x 3 The optimized order list of perturbed words in S32, search transition words, including S32.1 to S32.5; S32.1, replace the corresponding The word is recorded as Use its synonym set Generate a list of candidate texts R is the total number of synonyms, for The rth synonym in For use Replace x 3 middle The candidate text obtained; Input Sub into the pre-trained sentence-level vector encoding model to obtain the sentence-level vector list Sen = [V (1) , …, V (r) , …, V (R) ],V (r) is the sentence-level vector encoding model pair The sentence-level vector obtained by encoding; S32.2, Sen and Input into the local sensitive hashing model, and obtain a set B containing ∈ clusters = {b1, ..., b l , …, b ∈ }, 1≤l≤∈, b l is the first cluster, containing the positions of θ candidate texts. The word, Yes l The sth word in ; S32.3, from each b l A random word is selected from Constructing an initial transition word candidate list Select the word that makes the generated candidate text meet the attack requirements and has the highest semantic similarity with the original text x as the initial transition word from In the cluster where x is located, find the word that makes the generated candidate sample meet the requirements of the adversarial attack and has the highest semantic similarity with the original text x as the final transition word S32.4, with Replace x 3 In Get candidate text And calculate The semantic similarity score with the original text x S33, estimating the update direction, including steps S33.1 to S33.5; S33.1, use Synonyms of Generate a list of candidate texts for The rth synonym in For use Replace x 3 middle The candidate text obtained; input M into the pre-trained sentence-level vector encoding model to obtain a sentence-level vector list is the sentence-level vector encoding model pair The sentence-level vector obtained by encoding; S33.2, and Input into the local sensitive hashing model to obtain a set of β clusters 1≤q≤β, for The qth cluster in the qth cluster contains the positions of n candidate texts. The word, 1≤t≤η, yes The tth word in ; S33.3, from each A random word is selected from Constructing a list of candidate words use Each of Replace x respectively 3 In Get a list of candidate texts It is used Replace x 3 In The candidate text obtained; S33.4, calculation Each of Semantic similarity score with x Get the semantic similarity score list Cr = [c1, ..., c q , …, c β ], and calculate c q The normalized semantic similarity score difference α q , in, Yes The value of takes the absolute value; S33.5, calculate and update the direction vector u; In the formula, for middle The word vector of For x 3 middle The word vector of S34, update the third confrontation text x 3 , get the optimal adversarial text x*, including S34.1~S34.4; S34.1, The rth word in The word vector is calculate The cosine distance between and u, R words have a total of R cosine distances, The R words in the list are rearranged in descending order of cosine distance to obtain a list of synonyms. is the rth word in Q; S34.2, in the order of the words in Q, use Replace x 3 In Get candidate text calculate The semantic similarity score between The adversarial attack score like and Use Replace x 3 In Otherwise, keep x 3 In constant; S34.3, press The order of the inner elements is x 3 Each Execute steps S32 to S34.2; S34.4, iterate steps S2 to S34.3 for τ times, and finally obtain x 3 As the optimal adversarial text x*.

2. The black-box adversarial text generation method based on attention mechanism and local sensitive hashing according to claim 1 is characterized in that: The attention model A is HierarchicalAttention Networks, and the sentence-level vector encoding model is Universal Sentence Encoder.

3. The black-box adversarial text generation method based on attention mechanism and local sensitive hashing according to claim 1 is characterized in that: In S14, x 1 middle The corresponding perturbed words can be replaced with synonyms by replacing x 1 middle The corresponding perturbed words are marked as from Synonyms of Randomly select a synonym from Replace x 1 In 4. The black-box adversarial text generation method based on attention mechanism and local sensitive hashing according to claim 1 is characterized in that: Step S2 specifically includes: S21, find an optimal word w according to the following formula * ; In the formula, is the argmax function, x′(w i ) is used for i Replace x 2 w′ i The candidate text obtained after that, S(·,·) is the semantic similarity score, Adv(F,x,x′(w i )) is x′(w i )’s adversarial attack score, when F(x′(w i ))≠F(x), Adv(F, x, x′(w i ))=1, otherwise, Adv(F,x,x′(w i ))=0; S22, w * The position in x is denoted as o, and x 2 The word at position o in * , use w * Replace x 2 w′ * Get the candidate text x′(w * ), calculate x′(w * )’s adversarial attack score Adv(F,x,x′(w * )); S23, judge Adv(F, x, x′(w * ))'s value; If Adv(F, x, x′(w * ))=1, then use w * Replace x 2 w′ * , and repeat steps S21 to S22 until Adv(F, x, x′(w * ))=0; If Adv(F, x, x′(w * ))=0, then x 2 As the third confrontation text x 3 .

5. The black-box adversarial text generation method based on attention mechanism and local sensitive hashing according to claim 1, characterized in that: In S31.2, calculate the cosine distance The method is; according to x 3 The word vector of the word at the corresponding position in is marked as Mark the word vector of the word at the corresponding position in x as Calculate cosine distance Among them, coS(·,·) is the cosine similarity function; S31.3, calculated according to the following formula The sampling probability 6. The black-box adversarial text generation method based on attention mechanism and local sensitive hashing according to claim 1, characterized in that: In S32.3, select Where argmax[·] is the argmax function, For use Replace x 3 In The candidate text obtained after that, S(·,·) is the semantic similarity score, for The adversarial attack score is hour, otherwise Will The cluster is recorded as cluster The final transition word is obtained according to the following formula In the formula, It is used Replace x 3 In The candidate text obtained later is yes The adversarial attack score is hour, otherwise,

Images