Text adversarial attack method based on antonym replacement

Abstract

The invention discloses a text adversarial attack method based on antonym replacement, which comprises the following steps of: 1) performing word segmentation on an original text through LAC, HanLP and LTP word segmentation and part-of-speech tagging tools, and tagging adjectives in the original text; 2) further screening unlabeled texts by using OpenHowNet, generating a vocabulary library related to positive or negative adjectives, and labeling words of which the similarity is greater than a threshold value; 3) sorting the words according to the importance scores by adopting a search algorithm based on a greedy algorithm and word importance sorting, and determining a disturbance sequence of each word in the text; and 4) based on screening and manual labeling results, constructing a complete antonym library, and disturbing labeled adjectives to generate a high-similarity and readable adversarial text. According to the method, based on an antonym replacement strategy, text perturbation is performed through a special structure, so that the generated adversarial text keeps the semantic similarity of the original text, and judgment of the sentiment classification model can be effectively interfered.

Description

Technical Field

[0001] The present invention relates to the research field of text confrontation, and in particular to a text confrontation attack method based on antonym replacement. Background Art

[0002] The LAC (Lexical Analysis of Chinese) tool is a Chinese word segmentation and part-of-speech tagging tool based on deep learning, which can quickly perform part-of-speech analysis on text.

[0003] HanLP is a Java toolkit consisting of a series of models and algorithms. It is a Chinese word segmentation and part-of-speech tagging framework based on multiple models, including multiple combinations of dictionary, statistics and neural network models.

[0004] LTP (Language Technology Platform) is an open source natural language processing platform and a comprehensive Chinese natural language processing tool. In addition to basic word segmentation and part-of-speech tagging functions, it can also perform deeper dependency syntactic analysis.

[0005] OpenHowNet is a sememe-based knowledge base that provides semantic information and contextual associations of words.

[0006] Adversarial attacks refer to the process of generating adversarial samples to deceive the target model by making minor modifications or perturbations to the input text. These perturbations are usually not noticeable by humans, but can cause machine learning models to make incorrect predictions or classifications, thereby exposing the model's vulnerability. Common attack methods include replacing words, inserting or deleting words, and even making minor modifications to characters. The core of these methods is to exploit the model's sensitivity to input details, causing the model to output incorrect results when faced with seemingly insignificant changes. Text adversarial attacks not only challenge the robustness of the model, but also reveal the security risks of machine learning models in actual application scenarios. Summary of the invention

[0007] The purpose of the present invention is to overcome the defects of the prior art and provide a text adversarial attack method based on antonym replacement, which performs text perturbation through a special structure so that the generated adversarial text can not only maintain the semantic similarity of the original text, but also effectively interfere with the judgment of the sentiment classification model.

[0008] The object of the present invention is achieved in this way: a text counterattack method based on antonym replacement comprises the following steps:

[0009] 1) Segment the original text using LAC, HanLP, LTP segmentation and part-of-speech tagging tools, and mark the adjectives in it;

[0010] 2) Use OpenHowNet to further screen the unlabeled texts, generate a vocabulary related to positive or negative adjectives, retrieve words in the unlabeled texts by similarity calculation, and label the words with similarity greater than a threshold;

[0011] 3) Using a search algorithm based on a greedy algorithm and word importance ranking, the words are ranked according to their importance scores to determine the perturbation order of each word in the text;

[0012] 4) Based on the screening and manual annotation results, a complete antonym library is constructed, and the annotated adjectives are disturbed to achieve antonym replacement of the original text, and finally generate adversarial text.

[0013] As a further limitation of the present invention, the step 1) specifically comprises:

[0014] Step 1.1) Using three word segmentation and part-of-speech tagging tools, the words marked as adjectives are recorded as potential replacement objects, and the rest of the words remain as they are; given the original input text sequence X = x 1 ,x 2 ,...,x n , where x i Represents the word at the i-th position in the sequence;

[0015] First, use the LAC tool, which is a Chinese word segmentation and part-of-speech tagging tool based on deep learning. The word segmentation and tagging results are expressed by the following formula:

[0016]

[0017] Among them, w i1 ,w i2 ,…,w im Represents the vocabulary marked by the LAC tool, Indicates the part-of-speech tagging results of these words;

[0018] Step 1.2) If some words are not marked as adjectives by LAC, these words are put into the HanLP tool for further marking to obtain a new marking sequence. The specific word segmentation and marking results can be expressed by the following formula:

[0019]

[0020] Among them, w j1 ,w j2 ,…,w jk Indicates words that are not marked as adjectives by LAC. Indicates the part-of-speech result marked by the HanLP tool;

[0021] Step 1.3) Use the LTP tool to further process the text. The specific word segmentation and tagging results are expressed by the following formula:

[0022]

[0023] Among them, w q1 ,w q2 ,…,w qn denotes words that are not marked as adjectives by LAC and HanLP. Indicates the annotation results of the LTP tool;

[0024] After processing by the three tools, all words marked as adjectives are finally recorded:

[0025] S final =S LAC ∪S HanLP ∪S LTP (4)

[0026] That is S final is the set of all words marked as adjectives in the three steps.

[0027] As a further limitation of the present invention, the step 2) specifically comprises:

[0028] Step 2.1) Generate positive and negative adjective vocabulary:

[0029] First, use OpenHowNet to generate positive and negative adjective vocabulary libraries; classify the marked adjectives into positive adjectives and negative adjectives; and generate two vocabulary libraries using the following formula:

[0030]

[0031] Among them, L pos represents the positive adjective vocabulary, L neg It represents the negative adjective vocabulary, which contains the positive and negative words that have been annotated; represents the positive adjective vocabulary generated by OpenHowNet, represents the negative adjective vocabulary generated by OpenHowNet;

[0032] Step 2.2) Similarity calculation:

[0033] The similarity between all unrecognized words in the unlabeled text and the adjectives in the above vocabulary database is calculated; the similarity calculation is based on the semantic origin, semantic attributes and context information of the words, and the similarity score of each word is obtained through the similarity calculation tool of OpenHowNet; the similarity calculation formula is:

[0034]

[0035] Among them, w i Represents a word in an unlabeled text. and Represents a word in the positive vocabulary and negative vocabulary respectively, Sim(w i ,L pos ) represents the similarity between the word and the most similar word in the positive vocabulary, Sim(w i ,L neg ) represents the similarity with the most similar word in the negative vocabulary;

[0036] Step 2.3) Label words whose similarity is greater than the threshold:

[0037] After calculating the similarity, select the words with similarity greater than the threshold in the positive or negative adjective vocabulary and give them positive or negative labels accordingly; if the positive similarity Sim(w i ,L pos ) is greater than the threshold, it is marked as a positive adjective; the negative similarity Sim(w i ,L neg ) is greater than the threshold, it is marked as a negative adjective; if the similarity of a word does not reach the threshold, it is not marked.

[0038] As a further limitation of the present invention, the step 3) specifically comprises:

[0039] Step 3.1) Select a search algorithm based on a greedy algorithm and word importance ranking; gradually determine the local optimal solution through the greedy algorithm, and use word importance ranking to determine which words have the greatest impact on the final classification results;

[0040] Step 3.2 By estimating the input text X = x 1 ,x 2 ,...,x n Each word x in i importance, determine the order of these words; specifically, x i The importance of is calculated by the following process:

[0041] Replace words with UNK tokens: For each word x in the input text i , temporarily change x i Replace it with an UNK token, i.e. an unknown word, and use the modified text as input and re-send it to the model for prediction;

[0042] Calculate confidence change: The "importance" of each word is measured by calculating the change in confidence of the model's prediction of the original label between the replaced text and the original text; the importance score is calculated using the following formula:

[0043]

[0044] stx ′ =replace(x,x i ,UNK) (10)

[0045] Among them, score(x i ) represents word x i Importance score in text X; Indicates that model F replaces x i The text x after UNK ′ The original label y orig The predicted probability of x ′ =replace(x,x i ,UNK) means to convert word x in text x i The new text x after replacing with the unknown token UNK ′ ;

[0046] Step 3.3) Using the method in step 3.2), for each word x in X i Calculate an importance score; then, sort the words according to these importance scores to determine the priority of perturbation; words with higher scores mean greater impact on the classification results, and they are perturbed first.

[0047] As a further limitation of the present invention, the step 4) specifically comprises:

[0048] Step 4.1) First, a complete antonym database is constructed, wherein the antonym database includes adjectives selected by the tool and their corresponding antonyms;

[0049] Step 4.2) After constructing a complete antonym library, perturb the marked adjectives; the specific method includes selecting one or more antonyms for each marked adjective to replace; the following strategy is used to replace antonyms:

[0050] Step 4.2.1) Choose appropriate antonyms: give priority to antonyms that are similar in meaning to the original adjective and applicable in the context;

[0051] Step 4.2.2) Syntactic consistency: Make sure the replaced antonyms are grammatically consistent with the original sentence to avoid grammatical errors.

[0052] Step 4.2.3) Contextual adaptability: When making substitutions, consider the contextual adaptability of the antonym to ensure the fluency and naturalness of the text;

[0053] Step 4.3) After replacing the antonyms, adversarial texts are generated; these adversarial texts are semantically similar to the original texts, but are effectively perturbed in terms of sentiment.

[0054] The present invention adopts the above technical solution, and compared with the prior art, the beneficial effects are as follows: (1) The present invention proposes a text perturbation method based on antonyms, and replaces it in combination with context information, grammatical consistency and readability; by accurately selecting antonyms with strong context adaptability, it not only maintains the high similarity of the text, but also enhances the adversarial and naturalness of the text. This innovative strategy provides a new idea for adversarial text generation and breaks through the bottleneck of poor readability in the existing methods.

[0055] (2) The present invention adopts a multi-stage screening strategy and sequentially uses a variety of word segmentation and part-of-speech tagging tools. Each tool is good at processing different types of language structures. Through layer-by-layer screening and tagging, the present invention significantly improves the accuracy of adjective recognition, ensuring that adjectives can be accurately tagged in diverse contexts, thus making up for the limitations of a single tool.

[0056] (3) The present invention introduces the OpenHowNet knowledge base and filters and annotates unlabeled adjectives through semantic similarity calculation; OpenHowNet can perform semantic matching on unlabeled words based on semantic information and generate a vocabulary library related to positive or negative emotions. By filtering through similarity thresholds, the present invention can accurately capture emotional adjectives that are not annotated by traditional word segmentation tools, effectively expanding the recognition ability of emotional words and making the adversarial text generation process more complete and flexible. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 Overall framework diagram of the present invention DETAILED DESCRIPTION

[0058] like Figure 1 The text counterattack method based on antonym replacement shown is characterized by comprising the following steps:

[0059] 1) Segment the original text using LAC, HanLP, LTP segmentation and part-of-speech tagging tools, and mark the adjectives in it;

[0060] Step 1.1) Three word segmentation and part-of-speech tagging tools are used to record the words marked as adjectives as potential replacement objects, and the rest of the words remain as they are; due to the continuity characteristics of Chinese text, three efficient word segmentation and part-of-speech tagging tools are selected, each of which works differently to ensure that adjectives in the text can be accurately marked in a variety of scenarios; given the input original text sequence X = x 1 ,x 2 ,...,x n , where x i Represents the word at the i-th position in the sequence;

[0061] First, use the LAC tool, which is a Chinese word segmentation and part-of-speech tagging tool based on deep learning. The word segmentation and tagging results are expressed by the following formula:

[0062]

[0063] Among them, w i1 ,w i2 ,…,w im Represents the vocabulary marked by the LAC tool, Indicates the part-of-speech tagging results of these words;

[0064] Step 1.2) If some words are not marked as adjectives by LAC, these words are put into the HanLP tool for further marking to obtain a new marking sequence. The HanLP tool is a Chinese word segmentation and part-of-speech tagging framework based on multiple models, which includes multiple combinations of dictionaries, statistics and neural network models; HanLP can better handle polysemous words and ambiguity in complex texts, and further enhance the recognition ability of adjectives; the specific word segmentation and tagging results can be expressed by the following formula:

[0065]

[0066] Among them, w j1 ,w j2 ,…,w jk Indicates words that are not marked as adjectives by LAC. Indicates the part-of-speech result marked by the HanLP tool;

[0067] Step 1.3) Use the LTP tool to further process the text. LTP is a comprehensive Chinese natural language processing tool. In addition to the basic word segmentation and part-of-speech tagging functions, it can also perform deeper dependency syntactic analysis. The specific word segmentation and tagging results are expressed by the following formula:

[0068]

[0069] Among them, w q1,w q2 ,…,w qn denotes words that are not marked as adjectives by LAC and HanLP. Indicates the annotation results of the LTP tool;

[0070] After processing by the three tools, all words marked as adjectives are finally recorded:

[0071] S final =S LAC ∪S HanLP ∪S LTP (4)

[0072] That is S final is the set of all words marked as adjectives in the three steps.

[0073] For example, the input sentence is "To tell the truth, it's just so-so." After word segmentation and part-of-speech tagging, the sentence becomes "To tell the truth, it's just so-so / a.".

[0074] 2) Use OpenHowNet to further screen the unlabeled texts, generate a vocabulary related to positive or negative adjectives, retrieve words in the unlabeled texts by similarity calculation, and label the words with similarity greater than a threshold;

[0075] Step 2.1) Generate positive and negative adjective vocabulary:

[0076] First, use OpenHowNet to generate positive and negative adjective vocabulary libraries; classify the marked adjectives into positive adjectives and negative adjectives; and generate two vocabulary libraries using the following formula:

[0077]

[0078] Among them, L pos represents the positive adjective vocabulary, L neg It represents the negative adjective vocabulary, which contains the positive and negative words that have been annotated; represents the positive adjective vocabulary generated by OpenHowNet, represents the negative adjective vocabulary generated by OpenHowNet;

[0079] Step 2.2) Similarity calculation:

[0080] The similarity between all unrecognized words in the unlabeled text and the adjectives in the above vocabulary database is calculated; the similarity calculation is based on the semantic origin, semantic attributes and context information of the words, and the similarity score of each word is obtained through the similarity calculation tool of OpenHowNet; the similarity calculation formula is:

[0081]

[0082] Among them, w i Represents a word in an unlabeled text. and Represents a word in the positive vocabulary and negative vocabulary respectively, Sim(w i ,L pos ) represents the similarity between the word and the most similar word in the positive vocabulary, Sim(w i ,L neg ) represents the similarity with the most similar word in the negative vocabulary;

[0083] Step 2.3) Label words whose similarity is greater than the threshold:

[0084] After calculating the similarity, the words with similarity greater than the threshold in the positive or negative adjective vocabulary are selected and marked positively or negatively accordingly; in the present invention, the threshold is 0.7. If the positive similarity Sim(w i ,L pos ) is greater than 0.7, it is marked as a positive adjective; the negative similarity Sim(w i ,L neg ) is greater than 0.7, it is marked as a negative adjective; if the similarity of a word does not reach 0.7, it is not marked.

[0085] For example, the input sentence is "When it comes to cost-effectiveness, this one has nothing to say, give it a thumbs up and give it a good review", and the word segmentation tool in step 1) fails to successfully mark the words "like" and "good review". The sentence is re-marked through the similarity detection in step 2), and the sentence becomes "When it comes to cost-effectiveness, this one has nothing to say, give it a thumbs up / s and give it a good review / s".

[0086] 3) Using a search algorithm based on a greedy algorithm and word importance ranking, the words are ranked according to their importance scores to determine the perturbation order of each word in the text;

[0087] Step 3.1) Select a search algorithm based on a greedy algorithm and word importance ranking; gradually determine the local optimal solution through the greedy algorithm to reduce the computational complexity, and use word importance ranking to clarify which words have the greatest impact on the final classification results;

[0088] Step 3.2 By estimating the input text X = x 1 ,x 2 ,...,x n Each word x in i importance, determine the order of these words; specifically, x i The importance of is calculated by the following process:

[0089] Replace words with UNK tokens: For each word x in the input text i , temporarily change x i Replace it with an UNK token, i.e. an unknown word, and use the modified text as input and re-send it to the model for prediction;

[0090] Calculate the confidence change: The "importance" of each word is measured by calculating the confidence change of the model's prediction of the original label between the replaced text and the original text. If the confidence of the model drops significantly after replacing a word, it means that the word has a greater impact on the classification result, otherwise it has a smaller impact.

[0091] The importance score is calculated using the following formula:

[0092]

[0093] stx ′ =replace(x,x i ,UNK) (10)

[0094] Among them, score(x i ) represents word x i Importance score in text X; Indicates that model F replaces x i The text x after UNK ′ The original label y orig The predicted probability of x ′ =replace(x,x i ,UNK) means to convert word x in text x i The new text x after replacing with the unknown token UNK ′ ;

[0095] Step 3.3) Using the method in step 3.2), for each word x in X i Calculate an importance score; then, sort the words according to these importance scores to determine the priority of perturbation; words with higher scores mean greater impact on the classification results, and they are perturbed first.

[0096] 4) Based on the screening and manual annotation results, a complete antonym library is constructed, and the annotated adjectives are disturbed to achieve antonym replacement of the original text, and finally generate adversarial text;

[0097] Step 4.1) First, a complete antonym library is constructed, which includes adjectives selected by the tool and their corresponding antonyms; this process ensures the accuracy of antonyms and provides a basis for subsequent adversarial text generation;

[0098] Step 4.2) After building a complete antonym library, perturb the marked adjectives. The specific method includes selecting one or more antonyms to replace each marked adjective. In order to ensure the readability and high semantic similarity of the text, the following strategy is used for antonym replacement:

[0099] Step 4.2.1) Choose appropriate antonyms: give priority to antonyms that are similar in meaning to the original adjective and applicable in the context;

[0100] Step 4.2.2) Syntactic consistency: Make sure the replaced antonyms are grammatically consistent with the original sentence to avoid grammatical errors.

[0101] Step 4.2.3) Contextual adaptability: When making substitutions, consider the contextual adaptability of the antonym to ensure the fluency and naturalness of the text;

[0102] Step 4.3) After replacing the antonyms, adversarial texts are generated; these adversarial texts are semantically similar to the original texts, but the sentiment is effectively disturbed. Ultimately, the generated adversarial texts should have a high degree of similarity and maintain good readability to facilitate subsequent text analysis and sentiment classification tasks.

[0103] In order to test the effectiveness of the present invention, three widely used Chinese sentiment analysis datasets were selected, namely, the Dianping dataset, the Ctrip dataset, and the JD dataset. The Dianping dataset contains user comments on different restaurants and attractions, the Ctrip dataset contains user comments on different hotels, and the JD dataset includes user purchase comments on different items. The comments in these three datasets are divided into positive and negative, with positive comments marked as 1 and negative comments marked as 0. In order to evaluate the robustness of the model in the face of adversarial attacks, five text perturbation methods were applied to each dataset. These methods include generating adversarial samples by exchanging homophones (ChineseHomophoneCharacterSwap); generating perturbed text by synonym replacement (ChineseSimilarWordSwap); using synonyms generated by masked language model for text replacement (ChineseWordSwapMaskedLM); creating visual interference by replacing similar characters (MorphonymCharacterSwap); and the present invention uses an antonym library to replace adjectives in the text (AntonymSwap) to generate semantically opposed adversarial text. Subsequently, experiments were conducted on three mainstream pre-trained language models, Llama, GLM4, and Qwen2.5, which were applied to the above three datasets to evaluate their performance in dealing with different types of adversarial samples. The dataset test results are shown in Table 1. It can be seen from Table 1 that the accuracy indicators of the results of the present invention in the six tasks in the three datasets are basically better than those of other methods.

[0104] Main experiment result table:

[0105] Table 1 Accuracy of experimental results

[0106]

[0107] Table 1 (Continued) Accuracy of experimental results

[0108]

[0109]

[0110] Table 1 (Continued) Accuracy of experimental results

[0111]

[0112] This paper proposes a text adversarial attack method based on antonym replacement. Based on the antonym replacement strategy, it is first proposed to perform text perturbation through a special structure, so that the generated adversarial text can not only maintain the semantic similarity of the original text, but also effectively interfere with the judgment of the sentiment classification model. This method is suitable for binary classification problems. By replacing the antonyms of adjectives, the judgment of the model is interfered, causing the sentiment classification model to misjudge, so as to achieve text attack.

[0113] The present invention is not limited to the above-mentioned embodiments. On the basis of the technical solution disclosed in the present invention, technicians in this field can make some substitutions and deformations to some technical features therein according to the disclosed technical content without creative labor, and these substitutions and deformations are all within the protection scope of the present invention.

Claims

1. A text counterattack method based on antonym replacement, characterized in that: The following steps are involved: 1) Segment the original text using LAC, HanLP, LTP segmentation and part-of-speech tagging tools, and mark the adjectives in it; 2) Use OpenHowNet to further screen the unlabeled texts, generate a vocabulary related to positive or negative adjectives, retrieve words in the unlabeled texts by similarity calculation, and label the words with similarity greater than a threshold; 3) Using a search algorithm based on a greedy algorithm and word importance ranking, the words are ranked according to their importance scores to determine the perturbation order of each word in the text; 4) Based on the screening and manual annotation results, a complete antonym library is constructed, and the annotated adjectives are disturbed to achieve antonym replacement of the original text, and finally generate adversarial text.

2. A text counterattack method based on antonym replacement according to claim 1, characterized in that: The step 1) specifically includes: Step 1.1) Three word segmentation and part-of-speech tagging tools are used to record the words marked as adjectives as potential replacement objects, and the rest of the words remain as they are; given the input original text sequence X = x1, x2, ..., x n , where x i Represents the word at the i-th position in the sequence; First, use the LAC tool, which is a Chinese word segmentation and part-of-speech tagging tool based on deep learning. The word segmentation and tagging results are expressed by the following formula: Among them, w i1 ,w i2 ,…,w im Represents the vocabulary marked by the LAC tool, Indicates the part-of-speech tagging results of these words; Step 1.2) If some words are not marked as adjectives by LAC, these words are put into the HanLP tool for further marking to obtain a new marking sequence. The specific word segmentation and marking results can be expressed by the following formula: Among them, w j1 ,w j2 ,…,w jk Indicates words that are not marked as adjectives by LAC. Indicates the part-of-speech result marked by the HanLP tool; Step 1.3) Use the LTP tool to further process the text. The specific word segmentation and tagging results are expressed by the following formula: Among them, w q1 ,w q2 ,…,w qn denotes words that are not marked as adjectives by LAC and HanLP. Indicates the annotation results of the LTP tool; After processing by the three tools, all words marked as adjectives are finally recorded: S final =S LAC ∪S HanLP ∪S LTP (4) That is S final is the set of all words marked as adjectives in the three steps.

3. The text counterattack method based on antonym replacement according to claim 1 is characterized in that: The step 2) specifically includes: Step 2.1) Generate positive and negative adjective vocabulary: First, use OpenHowNet to generate positive and negative adjective vocabulary libraries; classify the marked adjectives into positive adjectives and negative adjectives; and generate two vocabulary libraries using the following formula: Among them, L pos represents the positive adjective vocabulary, L neg It represents the negative adjective vocabulary, which contains the positive and negative words that have been annotated; represents the positive adjective vocabulary generated by OpenHowNet, represents the negative adjective vocabulary generated by OpenHowNet; Step 2.2) Similarity calculation: The similarity between all unrecognized words in the unlabeled text and the adjectives in the above vocabulary database is calculated; the similarity calculation is based on the semantic origin, semantic attributes and context information of the words, and the similarity score of each word is obtained through the similarity calculation tool of OpenHowNet; the similarity calculation formula is: Among them, w i Represents a word in an unlabeled text. and Represents a word in the positive vocabulary and negative vocabulary respectively, Sim(w i ,L pos ) represents the similarity between the word and the most similar word in the positive vocabulary, Sim(w i ,L neg ) represents the similarity with the most similar word in the negative vocabulary; Step 2.3) Label words whose similarity is greater than the threshold: After calculating the similarity, select the words with similarity greater than the threshold in the positive or negative adjective vocabulary and give them positive or negative labels accordingly; if the positive similarity Sim(w i ,L pos ) is greater than the threshold, it is marked as a positive adjective; the negative similarity Sim(w i ,L neg ) is greater than the threshold, it is marked as a negative adjective; if the similarity of a word does not reach the threshold, it is not marked.

4. The text counterattack method based on antonym replacement according to claim 1 is characterized in that: The step 3) specifically includes: Step 3.1) Select a search algorithm based on a greedy algorithm and word importance ranking; gradually determine the local optimal solution through the greedy algorithm, and use word importance ranking to determine which words have the greatest impact on the final classification results; Step 3.2: By estimating the input text X = x1, x2, ..., x n Each word x in i importance, determine the order of these words; specifically, x i The importance of is calculated by the following process: Replace words with UNK tokens: For each word x in the input text i , temporarily change x i Replace it with an UNK token, i.e. an unknown word, and use the modified text as input and re-send it to the model for prediction; Calculate confidence change: The "importance" of each word is measured by calculating the change in confidence of the model's prediction of the original label between the replaced text and the original text; the importance score is calculated using the following formula: s.t.x ′ =replace(x,x i ,UNK)(10) Among them, score(x i ) represents word x i Importance score in text X; Indicates that model F replaces x i The text x after UNK ′ The original label y orig The predicted probability of x ′ =replace(x,x i ,UNK) means to convert word x in text x i The new text x after replacing with the unknown token UNK ′ ; Step 3.3) Using the method in step 3.2), for each word x in X i Calculate an importance score; then, sort the words according to these importance scores to determine the priority of perturbation; words with higher scores mean greater impact on the classification results, and they are perturbed first.

5. The text counterattack method based on antonym replacement according to claim 1 is characterized in that: The step 4) specifically includes: Step 4.1) First, a complete antonym database is constructed, wherein the antonym database includes adjectives selected by the tool and their corresponding antonyms; Step 4.2) After constructing a complete antonym library, perturb the marked adjectives; the specific method includes selecting one or more antonyms for each marked adjective to replace; the following strategy is used to replace antonyms: Step 4.2.1) Choose appropriate antonyms: give priority to antonyms that are similar in meaning to the original adjective and applicable in the context; Step 4.2.2) Syntactic consistency: Make sure the replaced antonyms are grammatically consistent with the original sentence to avoid grammatical errors. Step 4.2.3) Contextual adaptability: When making substitutions, consider the contextual adaptability of the antonym to ensure the fluency and naturalness of the text; Step 4.3) After replacing the antonyms, adversarial texts are generated; these adversarial texts are semantically similar to the original texts, but are effectively perturbed in terms of sentiment.

Images