Hard tag text adversarial sample generation method and system based on momentum and variance

Abstract

The invention discloses a hard tag text adversarial sample generation method and system based on momentum and variance. The method comprises the following steps: collecting a text data set of which categories are labeled; preprocessing the data set; randomly initializing an adversarial sample, providing a global fixed word replacement strategy to improve the attack success rate, and generating a plurality of initial adversarial samples; a plurality of adversarial samples are used for searching, momentum and variance are applied to guide the searching process, a'noise adding-noise reducing 'strategy is provided to enrich the randomness of the searching, a quality evaluation index is provided to balance the quality of the generated adversarial samples, and a dynamic searching threshold is provided to reduce redundant searching; and putting forward a greedy optimization strategy, optimizing the optimal adversarial sample generated in the previous step, and obtaining an adversarial sample with higher quality. On the five classification data sets and the three reasoning data sets, the similarity between the adversarial sample generated in the hard tag black box scene and the original text is improved, and the attack success rate is guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of text adversarial example generation, and in particular to a method and system for generating hard-label text adversarial examples based on momentum and variance. Background Art

[0002] Text adversarial examples are input samples generated by making small but targeted perturbations to the original text, which can mislead natural language processing models. These perturbations usually change the output results of the models under the condition that they are hardly perceptible to the human eye, thus revealing the vulnerabilities and potential security loopholes of the models.

[0003] When an attacker cannot access the internal structure and parameter information of the target model, it is called a black-box scenario. And when the attacker can only obtain the final output category of the target model but cannot obtain the confidence score, it is called a black-box hard-label scenario. Studying the generation of text adversarial examples in this scenario can truly evaluate the vulnerability of the model under adversarial attacks and reveal the security risks of the model under limited information conditions.

[0004] The existing research on generating hard-label text adversarial examples mainly optimizes by searching based on an initialized adversarial example. Since the attacker can only obtain the hard-label output of the model and cannot utilize gradient information, researchers usually adopt search-based optimization algorithms (such as genetic algorithms) or design a series of strategies to select the positions of words to be replaced and the synonyms for replacement, and generate adversarial examples by querying the target model multiple times. In addition, to improve the search efficiency of adversarial examples, some research also combines the word embedding space for search, and synchronously updates multiple positions to be replaced by calculating the distances of words and synonyms at different positions in the vector space, so as to improve the search efficiency. How to balance the attack success rate, the semantic similarity between the generated adversarial example and the original sample, the perturbation concealment, and the query efficiency is still the core challenge in the current research.

[0005] Although the current methods for generating hard-label text adversarial examples have made a lot of research progress, most of these achievements optimize a single initialized adversarial example, and there are new challenges in using the information of multiple generated adversarial examples to guide the search for higher-quality adversarial examples. Summary of the Invention

[0006] Object of the Invention: The object of the present invention is to provide a method and system for generating hard-label text adversarial examples based on momentum and variance, which use multiple adversarial examples for search. In the initialization stage, global fixed word replacement is added to improve the attack success rate; in the search stage, momentum and variance are proposed to guide the search process, adding noise and reducing noise enrich the search process, calculating quality evaluation indicators to balance the number of word replacements and similarity, and a dynamic search threshold is proposed to reduce redundant searches; in the optimization stage, a greedy optimization strategy is proposed to improve the quality of the generated adversarial examples.

[0007] Technical solution: To achieve the above-mentioned invention objective, a method for generating hard-label text adversarial examples based on momentum and variance according to the present invention includes the following steps:

[0008] Step 1: Collect a text classification or inference dataset with labeled categories.

[0009] Step 2: Preprocess the original text dataset, including word segmentation and stop word removal.

[0010] Step 3: For each preprocessed text, first randomly initialize an adversarial example that can mislead the target model, then adopt a global fixed word replacement strategy to find potential adversarial examples to improve the attack success rate, and at the same time generate multiple initial adversarial examples for search optimization.

[0011] Step 4: Calculate the momentum and variance of multiple samples to guide the search for more imperceptible adversarial examples.

[0012] Step 5: Propose a "noise addition - noise reduction" strategy to enrich the randomness of the search process.

[0013] Step 6: Propose a quality evaluation index to balance the number of word perturbations of the adversarial example and the similarity between the adversarial example and the original sample, sort in descending order and retain the first part of the adversarial examples for momentum calculation in Step 4.

[0014] Step 7: Propose a dynamic search threshold for ending the process of searching for new adversarial examples in advance.

[0015] Step 8: Further optimize the best adversarial example using a greedy strategy, and globally update the words to be replaced to find higher-quality adversarial examples.

[0016] Further, the global fixed word replacement strategy in Step 3 means that the part-of-speech of the word to be replaced in the text is restricted to adjectives, adverbs, verbs, and nouns. For all words at the positions to be replaced, 49 synonyms of the word in the synonym set are selected, and global fixed-position word replacement is performed using the same synonym index to generate 49 new samples, and then it is tested whether they are adversarial examples.

[0017] Further, Step 4 includes the following steps:

[0018] Step 41: For multiple high-quality adversarial examples, calculate the difference from the original sample in the word embedding space and take the average as the variance.

[0019] Step 42: Calculate the difference between the current best adversarial example and the original sample in the word embedding space as the momentum.

[0020] Step 43: Set an inner loop and an outer loop, update the variance in the inner loop, and update the current best sample only in the outer loop.

[0021] Further, the step 5 includes the following steps:

[0022] Step 51: Initialize an empty temporary noise in the outer loop;

[0023] Step 52: Calculate the new variance in the inner loop and accumulate the variance as the temporary noise;

[0024] Step 53: Weight the momentum and the accumulated variance, and the calculation method is as follows:

[0025] now_noise = μ × best_noise+(1 - μ)×tmp_noise

[0026] where tmp_noise is the temporary noise representing the accumulated variance, best_noise is the best noise representing the momentum, μ is a random number between 0.5 and 1, and now_noise is the weighted noise;

[0027] Step 54: Subtract a random number random from now_noise, and the calculation method is as follows:

[0028] new_noise = now_noise - random

[0029] where random is a random noise array with the same size as now_noise and elements following the standard normal distribution, and the process of obtaining the new noise new_noise is noise reduction.

[0030] Further, the quality evaluation index in the step 6 is the difference between the number of word perturbations of the generated adversarial sample and the similarity between the generated adversarial sample and the original text. The smaller the difference, the better. Sort the generated adversarial samples in descending order and retain the previous part of the adversarial samples for the momentum calculation in the inner loop.

[0031] Further, the dynamic search threshold in the search stage of the step 7 is set such that during the process of searching for new adversarial samples using multiple samples, if the outer loop reaches the upper limit, or a certain upper limit is reached when a part of the adversarial samples used for variance calculation remain unchanged continuously, that is, the threshold condition is reached, the search ends.

[0032] Further, the step 8 includes the following steps:

[0033] Step 81: Select the best one of the adversarial samples in the search stage and obtain its similarity with the original text;

[0034] Step 82: For each word in the original text, if it is different from the corresponding word in the current best sample, mark this position as to be optimized;

[0035] Step 83: Generate a series of new samples by replacing the words in the current best sample with synonyms of the original words; calculate the semantic similarity between the new samples and the original text. If the similarity is higher than that of the current best adversarial sample, add the new sample to the candidate sample set, and repeat the same operation for each position to be optimized;

[0036] Step 84: After generating a series of new candidate samples, sort all the samples in descending order of similarity;

[0037] Step 85: Test them one by one to see if they are new adversarial samples. If so, update the current best adversarial sample and the similarity of the current best adversarial sample, and go to Step 82;

[0038] Step 86: If all positions to be optimized have been checked and there are no new adversarial samples, end the optimization and output the final adversarial sample.

[0039] A hard-label text adversarial sample generation system based on momentum and variance, characterized by including:

[0040] A data collection module, used to collect text classification or inference data sets with labeled categories;

[0041] A data preprocessing module, used to preprocess the original data set, including word segmentation and stop word removal;

[0042] An initialization module, used for each preprocessed text, first randomly initialize an adversarial sample that can mislead the target model, and then adopt a global fixed word replacement strategy to find potential adversarial samples to improve the attack success rate, and at the same time generate multiple initial adversarial samples for search optimization;

[0043] A search module, used to search for new adversarial samples, calculate the momentum and the variance of multiple samples to guide the search for more imperceptible adversarial samples, propose a "noise addition - noise reduction" strategy to enrich the randomness of the search, propose a quality evaluation index to balance the number of word perturbations of the adversarial sample and the similarity between the adversarial sample and the original sample, and propose a dynamic search threshold to reduce redundant searches;

[0044] And an optimization module, used to further optimize the best adversarial sample using a greedy strategy, and globally update the words to be replaced to find higher-quality adversarial samples.

[0045] The present invention provides a computer system, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the computer program is loaded into the processor, the steps of the hard-label text adversarial sample generation method based on momentum and variance are implemented.

[0046] The present invention also provides a computer-readable storage medium storing a computer program, characterized in that when the computer program is executed by a processor, the steps of the method for generating hard-label text adversarial examples based on momentum and variance are implemented.

[0047] Beneficial effects: The present invention proposes a method for generating hard-label text adversarial examples based on momentum and variance. The globally fixed word replacement proposed in the initialization stage can improve the attack success rate on the basis of the original scheme; in the search stage, momentum and the variances of multiple samples are calculated to guide the search for more imperceptible adversarial examples. The "noise addition - noise reduction" strategy is proposed to enrich the randomness of the search. A quality evaluation index is proposed to balance the number of word perturbations of the adversarial example and the similarity between the adversarial example and the original example. A dynamic search threshold is proposed to reduce redundant searches. The strategies in the search stage are conducive to finding more potential adversarial examples; in the optimization stage, adversarial examples with higher similarity can be found. Because the present invention adopts the above technical solutions, compared with the prior art, the adversarial examples generated by the present invention have the best similarity with the original examples and have a good attack success rate on five classification data sets and three inference data sets. Description of the Drawings

[0048] Figure 1 is a schematic overall flow chart of an embodiment of the present invention.

[0049] Figure 2 is a schematic flow chart of the search module generating new adversarial examples in an embodiment of the present invention.

[0050] Figure 3 is a schematic flow chart of the optimization module generating final adversarial examples in an embodiment of the present invention. Detailed Embodiments

[0051] The present invention will be further described below with reference to the drawings and specific embodiments.

[0052] As Figure 1 shown, a method for generating hard-label text adversarial examples based on momentum and variance provided by an embodiment of the present invention mainly includes the following steps:

[0053] Step 1: Collect text classification or inference datasets with labeled categories. Specifically, five classification datasets and three inference datasets are collected. The five classification datasets are: the Movie Review dataset MR for sentiment analysis, which contains two categories, positive or negative; the AG News Topic Classification dataset, which includes four categories: world, sports, business, and science; the Yahoo Question Answering dataset for topic classification, which includes ten categories; the Yelp Document-Level Sentiment Classification dataset, which includes two categories; and the IMDB Document-Level Movie Review dataset, which includes two categories. The three inference datasets are: the SNLI dataset for natural language inference; the MNLI, one of the broader corpora for studying natural language inference; and the mMNLI, a variant dataset that contains mismatched premise-hypothesis pairs.

[0054] Step 2: Preprocess the eight collected datasets, including tokenization and stop-word removal. Tokenization is the process of splitting a continuous sequence of English text into independent lexical units (tokens). Since English text separates words with spaces, tokenization is relatively straightforward, but special cases still need to be handled, such as punctuation marks, abbreviations, hyphens, and mixed forms of numbers and special characters. Stop-word removal is based on tokenization and filters out high-frequency words that contribute little to the semantics (such as "the", "is", "and", etc.). Although these words play a connecting role grammatically, they usually have limited impact on the results in tasks such as text classification, sentiment analysis, or semantic understanding, and may even introduce noise. Removing stop words can effectively reduce the data dimension, reduce computational complexity, and highlight the key information in the text.

[0055] Step 3: For each preprocessed text, first randomly initialize an adversarial example that can mislead the target model, and then adopt a global fixed-word replacement strategy to find potential adversarial examples to improve the attack success rate. At the same time, generate multiple initial adversarial examples for search optimization.

[0056] Step 3 includes the following steps:

[0057] Step 31: Restrict the part-of-speech of the words to be replaced in the text to adjectives, adverbs, verbs, and nouns.

[0058] Step 32: Randomly initialize an adversarial example. Random initialization includes local word replacement and global word replacement. Local word replacement generates an adversarial example by replacing some words in the text. After each replacement, query the target model to determine whether it is an adversarial example. If so, calculate the semantic similarity and save the generated adversarial example. This process gradually increases the replacement range and the number of queries to ensure finding an effective adversarial example within a limited number of attempts.

[0059] Step 33: If no adversarial example is found in local word substitution, perform global word substitution; otherwise, skip global word substitution.

[0060] Step 34: Different from local substitution, global word substitution randomly selects words for substitution within the entire text range, with the limit of querying the target model no more than 2500 times.

[0061] Step 35: Global fixed-word substitution. For the words at all positions to be substituted, select 49 synonyms of the word in the synonym set and perform global fixed-position word substitution using the same synonym index to generate 49 new samples. Test whether they are adversarial examples. End the initialization until α adversarial examples are generated. In the worst case, none of the 49 generated samples are adversarial examples. The proposed global fixed-word substitution strategy can improve the attack success rate on the basis of the original random initialization strategy.

[0062] Step 4: Input multiple initial adversarial examples for search. The subsequent adversarial examples for search are the top α with the highest quality evaluation scores among all the obtained adversarial examples. Calculate the momentum and variance of the top α samples to guide the search for more imperceptible adversarial examples.

[0063] Step 4 includes the following steps:

[0064] Step 41: For the α adversarial examples with higher quality evaluation scores, calculate the difference from the original sample in the word embedding space and take the mean as the variance.

[0065] Step 42: Calculate the difference between the current best adversarial example and the original sample in the word embedding space as the momentum.

[0066] Step 43: Set the inner loop and the outer loop. The variance is updated in the inner loop, and the current best sample is updated only in the outer loop.

[0067] Step 5: In the process of searching for new adversarial examples, in order to enrich the randomness of the process of generating adversarial examples, the "adding noise - reducing noise" strategy is proposed to enrich the randomness of the search process.

[0068] Step 5 includes the following steps:

[0069] Step 51: Initialize an empty temporary noise in the outer loop.

[0070] Step 52: Calculate the new variance in the inner loop and accumulate the variance as the temporary noise.

[0071] Step 53: Weight the momentum and the accumulated variance. The calculation method is as follows:

[0072] now_noise = μ × best_noise + (1 - μ) × tmp_noise

[0073] Among them, tmp_noise is the temporary noise representing the cumulative variance, best_noise is the best noise representing the momentum, μ is a random number between 0.5 and 1, and now_noise is the weighted noise;

[0074] Step 54: Reduce the noise by subtracting a random number random from now_noise. The random number is a random noise array with the same size as now_noise and elements following the standard normal distribution.

[0075] Step 6: Select the synonym pair closest to the noise to replace the original word, and determine whether the attack is successful. If so, change back to the original word, calculate the quality assessment score, sort, and update the best sample.

[0076] Step 6 includes the following steps:

[0077] Step 61: Replace the synonyms. For each word at a position where the noise is not 0, calculate the perturbed target vector by adding the noise vector to the original word vector. Traverse all the synonyms of this word, calculate the Euclidean distance between the synonym vector and the perturbed target vector, and find the synonym with the smallest distance as the best replacement word. Replace the synonym and complete the update of the sample; this process combines word vector and noise information to ensure that the replacement word is semantically close to the original word while effectively perturbing the prediction result of the model;

[0078] Step 62: Determine whether the newly generated sample is an adversarial sample. If so, change back to the original word. If not, determine whether the threshold is reached; before checking whether the generated sample is an adversarial sample, it is necessary to first determine whether this sample appears in the successful attack queue or the failed attack queue. This step is to avoid redundant queries;

[0079] Step 63: Change back to the original word. If a new adversarial sample is generated, change back the word at the replaced position of this sample to the original word: Based on the current adversarial sample, gradually change back the words at the replaced positions to the original words, and sort all possible restoration options by semantic similarity. Preferentially restore the words with higher semantic similarity while ensuring that the restored sample can still attack successfully. On the premise of ensuring the success of the attack, gradually push the adversarial sample towards the decision boundary to find a lower perturbation adversarial sample;

[0080] Step 64: The number of words in the generated adversarial sample that are different from the original text is the word perturbation quantity. To balance the word perturbation quantity of the generated adversarial sample and the similarity between the generated adversarial sample and the original text, the quality assessment index is designed as the difference between the word perturbation quantity and the similarity. The word replacement quantity is a positive integer, and the similarity is a decimal less than or equal to 1. The smaller the difference between the two, the lower the word replacement number and the higher the semantic similarity of the generated adversarial sample;

[0081] Step 65: The top α adversarial samples sorted in descending order according to the quality assessment scores are used for variance calculation in the next search, and the first one is used as the current best sample for momentum calculation in the outer loop.

[0082] Step 7: A dynamic search threshold is proposed to end the process of searching for new adversarial samples using α samples in advance during the search stage.

[0083] Step 7 includes the following steps:

[0084] Step 71: The threshold in the search stage is set as follows. During the process of searching for new adversarial samples using α samples, an inner loop and an outer loop are set. If the outer loop reaches the upper limit (set to 20 times), or if multiple adversarial samples used for variance calculation remain unchanged continuously up to a certain upper limit (set to 40 times), that is, the threshold condition is reached, the search ends and the best adversarial sample is output; otherwise, the momentum and variance are continued to be calculated to search for new adversarial samples.

[0085] The selection of α directly affects the quality of the generated adversarial samples. To determine the value of α, the relationships between different values of α and the quality of the generated adversarial samples are observed on the classification dataset and the inference dataset respectively. The values of α are set to 1, 3, 5, 7, and 9 respectively. The evaluation metrics are the original classification or inference success rate Acc_ori, the classification success rate Acc after attack (the lower the better), the number of queries to the target model Qrs (the lower the better), the word perturbation rate Pert (the lower the better), and the semantic similarity Sim (the higher the better). The semantic similarity is calculated using the Universal Sentence Encoder USE.

[0086] The classification success rate Acc after attack represents the proportion of the number of samples for which the target model is correctly classified after the attack to the total number of samples. The calculation formula is:

[0087]

[0088] where N fail is the number of samples for which the attack fails, that is, the number of samples that can still be correctly classified after the attack, and N total is the total number of all samples;

[0089] The word perturbation rate Pert represents the average ratio of the number of replaced words in the generated adversarial samples to the total number of words in the original text compared with the original text. The calculation formula is:

[0090]

[0091] where represents the number of word modifications in text X i , and len(X i ) represents the total number of words in text X i , and n suc

[0092] The number of samples representing successful attacks;

[0093] Table 1 Influence of different values of α on the MR dataset

[0094]

[0095] Select a classification dataset MR, attack three target models, Long Short-Term Memory Network (LSTM), Convolutional Neural Network (CNN), and Bidirectional Encoder Representations from Transformers (BERT). The influence of different values of α on four metrics is shown in Table 1. The bold indicates the best. It can be seen that the number of queries is positively correlated with α, and using more adversarial samples in the search process will increase the cost of the experiment; when α = 1, it is similar to the previous optimization method using a single sample; as α increases, Pert begins to decrease and Sim begins to increase; on the MR dataset, when attacking different models, α = 7 achieves the best similarity, and both α = 5 and α = 7 achieve relatively low perturbation rates;

[0096] Select three inference datasets SNLI, MNLI, mMNLI, and one target model BERT. The influence of different values of α on four metrics is shown in Table 2. The bold indicates the best. It can be seen that the inference datasets have more obvious patterns. Acc is independent of α, and Qrs is positively correlated with α; different from the MR dataset, as α increases, the perturbation rate decreases and the similarity increases; this may be related to the size of the dataset. The average length of the three NLI datasets is less than that of MR;

[0097] Table 2 Influence of different values of α on the inference datasets

[0098]

[0099] Refer to Table 1 and Table 2 and the time overhead during the experiment, and take α = 5 as an example for subsequent experiments.

[0100] Step 8: Further optimize the best adversarial sample using the greedy strategy, and globally update the words to be replaced to find higher-quality adversarial samples.

[0101] Step 8 includes the following steps:

[0102] Step 81: Input the best adversarial sample generated after the search ends and obtain its similarity with the original text;

[0103] Step 82: Update all positions to be replaced in this sample. First, split the current best adversarial sample into a word list. For each word in the original text, if it is different from the corresponding word in the current best sample, mark this position as to be optimized;

[0104] Step 83: Generate a series of new samples by replacing the words in the current best sample with synonyms of the original words; calculate the semantic similarity between the new samples and the original text. If the similarity is higher than that of the current best adversarial sample, add the new samples to the candidate sample set and repeat the same operation for each position to be optimized.

[0105] Step 84: After generating a series of new candidate samples, sort all the samples in descending order of similarity.

[0106] Step 85: Test them one by one to see if they are new adversarial samples. If so, update the current best adversarial sample and the similarity of the current best adversarial sample, and go to Step 82.

[0107] Step 86: If all positions to be optimized have been checked and there are no new adversarial samples, end the optimization and output the final adversarial sample.

[0108] For ease of description, we use a hard-label text adversarial sample generation method based on momentum and variance to generate adversarial samples for eight classification or inference datasets to attack the target model. The process is as follows:

[0109] Step 1: Collect text classification or inference datasets with labeled categories.

[0110] Step 2: Preprocess the original text dataset, including word segmentation and stop word removal.

[0111] Step 3: For each preprocessed text, first randomly initialize an adversarial sample that can mislead the target model, and then adopt a global fixed word replacement strategy to find potential adversarial samples to improve the attack success rate. At the same time, generate multiple initial adversarial samples for search optimization.

[0112] Step 4: Calculate the momentum and variance of multiple samples to guide the search for more imperceptible adversarial samples.

[0113] Step 5: Propose a "noise addition - noise reduction" strategy to enrich the randomness of the search process.

[0114] Step 6: Propose a quality evaluation metric to balance the number of word perturbations of the adversarial sample and the similarity between the adversarial sample and the original sample, sort in descending order and retain the first part of the adversarial samples for momentum calculation in Step 4.

[0115] Step 7: Propose a dynamic search threshold to end the process of searching for new adversarial samples in advance.

[0116] Step 8: Further optimize the best adversarial sample using the greedy strategy, and globally update the words to be replaced to find higher-quality adversarial samples.

[0117] Construct the adversarial sample generation model through the above steps, generate adversarial samples on five classification datasets, attack three target models. Compared with the state-of-the-art comparison method HyGloadAttack, the experimental results are shown in Table 3. The bold indicates better Acc or Sim. The adversarial samples constructed by the proposed method have better Acc and the best Sim.

[0118] Table 3 Comparison of Acc and Sim with HyGloadAttack on Classification Datasets

[0119]

[0120] Construct the adversarial sample generation model through the above steps, attack a target model BERT on three inference datasets. Compared with the state-of-the-art comparison method HyGloadAttack, the experimental results are shown in Table 4. The adversarial samples constructed by the proposed method have the best Sim and Pert, and better Acc and Qrs.

[0121] The average success rate Acc of the proposed method after attack is 1.4% on eight datasets. Compared with the advanced HyGloadAttack, the average similarity of the proposed method is increased by 1.3% on five classification datasets and 4.1% on three inference datasets.

[0122] Table 4 Comparison with HyGloadAttack on Inference Datasets

[0123]

[0124] Based on the same inventive concept, an embodiment of the present invention provides a hard-label text adversarial sample generation system based on momentum and variance, including: a data collection module for collecting text classification or inference datasets with labeled categories; a data preprocessing module for preprocessing the original dataset, including word segmentation and stop word removal; an initialization module for, for each preprocessed text, first randomly initializing an adversarial sample that can mislead the target model, and then using a global fixed word replacement strategy to find potential adversarial samples to improve the attack success rate, and at the same time generating multiple initial adversarial samples for search optimization; a search module for searching for new adversarial samples, calculating the momentum and the variances of multiple samples to guide the search for more imperceptible adversarial samples, proposing a "noise addition - noise reduction" strategy to enrich the randomness of the search, proposing a quality evaluation index to balance the word perturbation quantity of the adversarial sample and the similarity between the adversarial sample and the original sample, and proposing a dynamic search threshold to reduce redundant searches; and an optimization module for further optimizing the best adversarial sample using a greedy strategy, and globally updating the words to be replaced to find higher-quality adversarial samples.

[0125] For the specific working processes of the modules described above, reference may be made to the corresponding processes in the foregoing method embodiments, which will not be elaborated herein. The division of the modules is only a logical function division, and there may be other division methods in actual implementation. For example, multiple modules may be combined or integrated into another system.

[0126] Based on the same inventive concept, an embodiment of the present invention provides a computer system, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the computer program is loaded into the processor, the steps of the method for generating hard-label text adversarial samples based on momentum and variance are implemented.

[0127] Based on the same inventive concept, an embodiment of the present invention provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for generating hard-label text adversarial samples based on momentum and variance are implemented.

[0128] Those skilled in the art can understand that the technical solution of the present invention, in essence, or the part that contributes to the prior art can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer system (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the embodiments of the present invention. The storage medium includes: various media that can store computer programs, such as USB flash drives, mobile hard disks, read-only memory ROM, random access memory RAM, magnetic disks, or optical discs.

[0129] Although the present invention has been illustrated and described with respect to the preferred embodiments, those skilled in the art should understand that various changes and modifications can be made to the present invention as long as they do not exceed the scope defined by the claims of the present invention.

Claims

1. A method for generating hard-label text adversarial examples based on momentum and variance, characterized in that It includes the following steps: Step 1: Collect a text classification or inference dataset with labeled categories; Step 2: Preprocess the original text dataset, including word segmentation and stop word removal; Step 3: For each preprocessed text, first randomly initialize an adversarial sample that can mislead the target model, then adopt a global fixed word replacement strategy to find potential adversarial samples to improve the attack success rate, and generate multiple initial adversarial samples for search optimization; Step 4: Calculate the momentum and variance of multiple samples to guide the search for more imperceptible adversarial samples; Step 5: Propose a "noise addition - noise reduction" strategy to enrich the randomness of the search process; Step 6: Propose a quality evaluation metric to balance the number of word perturbations of the adversarial sample and the similarity between the adversarial sample and the original sample, sort them in descending order and retain the first part of the adversarial samples for momentum calculation in Step 4; Step 7: Propose a dynamic search threshold to end the process of searching for new adversarial samples in advance; Step 8: Further optimize the best adversarial sample using a greedy strategy, and globally update the words to be replaced to find higher - quality adversarial samples.

2. The method for generating hard-label text adversarial samples based on momentum and variance according to claim 1, wherein The global fixed word replacement strategy in Step 3 means that the part - of - speech of the word to be replaced in the text is restricted to adjectives, adverbs, verbs, and nouns. For all words at the positions to be replaced, select 49 synonyms of the word in the synonym set, and use the same synonym index for global fixed - position word replacement to generate 49 new samples, and test whether they are adversarial samples.

3. A method for generating hard-label text adversarial examples based on momentum and variance according to claim 1, characterized in that The following steps are included in Step 4: Step 41: For multiple high - quality adversarial samples, calculate the difference in the word embedding space from the original sample and take the mean as the variance; Step 42: Calculate the difference between the current best adversarial sample and the original sample in the word embedding space as the momentum; Step 43: Set an inner loop and an outer loop. The variance is updated in the inner loop, and the current best sample is only updated in the outer loop.

4. A method for generating hard-label text adversarial examples based on momentum and variance according to claim 1, characterized in that, The following steps are included in Step 5: Step 51: Initialize an empty temporary noise in the outer loop; Step 52: Calculate the new variance in the inner loop and accumulate the variance as the temporary noise; Step 53: Weight the momentum and the accumulated variance, and the calculation method is as follows: now_noise = μ×best_noise+(1 - μ)×tmp_noise where tmp_noise is the temporary noise representing the accumulated variance, best_noise is the best noise representing the momentum, μ is a random number between 0.5 and 1, and now_noise is the weighted noise; Step 54: Make now_noise minus a random number random to achieve noise reduction. The random number is a random noise array with the same size as now_noise and elements following the standard normal distribution.

5. A method for generating hard-label text adversarial examples based on momentum and variance according to claim 1, characterized in that The quality evaluation metric in Step 6 is the difference between the number of word perturbations of the generated adversarial sample and the similarity between the generated adversarial sample and the original text. The smaller the difference, the better. Sort the generated adversarial samples in descending order and retain the first part of the adversarial samples for momentum calculation in the inner loop.

6. A method for generating hard-label text adversarial examples based on momentum and variance according to claim 1, characterized in that In step 7, the dynamic search threshold in the search stage is set such that during the process of searching for new adversarial examples using multiple samples, if the outer loop reaches the upper limit, or a certain number of partial adversarial examples used to calculate the variance remain unchanged continuously, that is, the threshold condition is reached, the search ends.

7. A method for generating hard-label text adversarial examples based on momentum and variance according to claim 1, characterized in that Step 8 includes the following steps: Step 81: Select the best one of the adversarial examples in the search stage and obtain its similarity to the original text. Step 82: For each word in the original text, if it is different from the corresponding word in the current best example, mark that position as to be optimized. Step 83: Generate a series of new examples by replacing the words in the current best example with synonyms of the original words. Calculate the semantic similarity between the new examples and the original text. If the similarity is higher than that of the current best adversarial example, add the new example to the candidate example set, and repeat the same operation for each position to be optimized. Step 84: After generating a series of new candidate examples, sort all the examples in descending order of similarity. Step 85: Test them in turn to see if they are new adversarial examples. If so, update the current best adversarial example and the similarity of the current best adversarial example, and go to step 82. Step 86: If all positions to be optimized have been checked and there are no new adversarial examples, end the optimization and output the final adversarial example.

8. A hard-label text adversarial sample generation system based on momentum and variance, characterized in that, It includes: A data collection module for collecting text classification or inference data sets with labeled categories. A data preprocessing module for preprocessing the original data set, including word segmentation and stop word removal. An initialization module for, for each preprocessed text, first randomly initializing an adversarial example that can mislead the target model, then using a global fixed word replacement strategy to find potential adversarial examples to improve the attack success rate, and at the same time generating multiple initial adversarial examples for search optimization. A search module for searching for new adversarial examples, calculating momentum and the variance of multiple samples to guide the search for less perceptible adversarial examples, proposing a "noise addition - noise reduction" strategy to enrich the randomness of the search, proposing a quality evaluation index to balance the number of word perturbations of the adversarial example and the similarity between the adversarial example and the original example, and proposing a dynamic search threshold to reduce redundant searches. And an optimization module for further optimizing the best one of the adversarial examples using a greedy strategy, and globally updating the words to be replaced to find higher - quality adversarial examples.

9. A computer system, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the computer program is loaded into the processor, it implements the steps of the method for generating hard - label text adversarial examples based on momentum and variance according to any one of claims 1 - 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the method for generating hard - label text adversarial examples based on momentum and variance according to any one of claims 1 - 7.

Images