Black box adversarial text generation method based on semantic clustering and gradient fusion

Abstract

The invention discloses a black box adversarial text generation method based on semantic clustering and gradient fusion, which belongs to the field of computer security, and comprises the following steps: generating an initial adversarial text of an original text based on synonym replacement; constructing a candidate text list P based on locality sensitive hashing and semantic clustering; selecting a current optimal text xbest from the P; sampling a plurality of candidate text pairs from the P; processing each candidate text pair based on gradient fusion to generate candidate confrontation texts, and constructing a first candidate list P1 together with xbest; and generating an optimal adversarial text x * based on semantic clustering. According to the method, in a black box scene with hard tag setting, the query efficiency is greatly improved under the condition of keeping the confrontation text quality and semantic consistency, so that the requirement of verifying the robustness of an existing natural language processing model in confrontation of confrontation attacks in a real scene with limited query times is met.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer security, and particularly relates to a black-box adversarial text generation method based on semantic clustering and gradient fusion. BACKGROUND

[0002] In recent years, the field of natural language processing has developed rapidly, especially the emergence of large language models such as GPT-4 has pushed the development of this field to a new height, and natural language processing technology has been widely applied to a series of real scenarios such as sentiment analysis, text generation, multi-round dialogue system, etc. However, existing research shows that existing natural language processing models are facing serious adversarial attack threats.

[0003] Adversarial attack is a security threat in the model inference stage. Attackers construct adversarial samples by adding small noise that does not affect human judgment to the input samples, so as to make artificial intelligence models produce false output. Specifically, taking the text classification task as an example, given an original text composed of words , the text classification model correctly classifies it, that is , in adversarial attack, the attacker adds special small noise to to generate adversarial text , to humans, and are similar in semantics, but are misclassified by , that is .

[0004] In recent years, in order to verify the robustness of existing natural language processing models in the face of adversarial samples and discover potential security vulnerabilities, researchers have proposed different adversarial text generation methods, but due to the particularity of text samples (discrete, existence of semantic information, easy to be detected by human eyes), it still faces great challenges to generate adversarial text with high semantic similarity and low disturbance rate in a black-box scenario where only the output label of the target model can be obtained.

[0005] Currently, adversarial attack methods against natural language processing models can be categorized as white-box and black-box, depending on the attacker's access to the target model. White-box attacks involve attackers with complete access to the target model, obtaining all information about the model, including its architecture, parameters, and gradients. These attackers then use this information to generate adversarial text. Therefore, these attacks typically generate adversarial examples with strong attack capabilities. In black-box attacks, attackers only obtain the target model's probability distribution for the input text (known as soft labeling) or the final label (known as hard labeling). Therefore, the adversarial text generated by these attacks is generally less powerful than that generated by white-box attacks. However, since black-box attacks do not require access to information about the target model, they are more suitable for real-world applications to verify the robustness of existing AI systems.

[0006] Compared with the soft label setting, generating adversarial text in the hard label setting where only the final label output by the target model is available is more challenging. Currently, researchers have proposed some black-box adversarial text generation methods in the hard label setting.

[0007] Maheshwary et al. first proposed a three-stage strategy of “initialization-search space reduction-population-based optimization”. Specifically, for a given original text x=[w1,w2,⋯,w i ,⋯w N ], the “initialization” stage randomly selects some words in the given text and respectively selects the words w i Randomly select candidate words from the synonyms of A to replace the selected original words, so that the initial adversarial text A crosses the decision boundary of the target model, which causes the target model to make an incorrect judgment on A. The "search space reduction" stage first replaces the words in A. Replace the original word w i The semantic similarity score between the replaced text and the original text is calculated. Then, based on the scores, the synonyms replaced in A are replaced one by one back to the original words, ensuring that the model's judgment is correct. This allows the adversarial text to gradually approach the decision boundary of the target model, resulting in adversarial text B. The "population-based optimization" stage uses a genetic algorithm. Through the iteration of the three processes of "selection-crossover-mutation," the adversarial text is brought as close as possible to the decision boundary of the target model while maintaining its ability to resist attacks, thereby optimizing the semantic similarity between the adversarial text and the original text. However, in this method, the genetic algorithm-based optimization process requires maintaining a large number of candidate samples, resulting in a large number of queries to the target model. This method cannot meet the requirements for verifying the robustness of natural language processing models in real-world scenarios where the number of queries is limited.

[0008] To this end, the TextHoaxer method treats hard-label adversarial attacks as an optimization problem in word embedding space. During the optimization process, it maintains only a single candidate text and uses the gradient information provided by the perturbation matrix objective function to optimize the semantics of the adversarial text. The LeapAttack method uses the difference between word vectors to represent the semantic deviation between two words and uses the gradient estimation of the continuous word vector space to optimize the semantics of the generated adversarial text. The SSPAttack method first constructs the adversarial text through initialization, then determines the replacement order and searches for an anchor synonym. Finally, it optimizes the replacement word to bring it closer to the original word, thereby continuously optimizing the semantics of the adversarial text. However, while these methods reduce the query overhead of the adversarial text generation process to some extent, the optimization process of maintaining a single candidate text significantly increases the likelihood of obtaining a suboptimal solution.

[0009] Therefore, existing black-box adversarial text generation methods in hard-label settings generally require a large number of queries to the target model, making it difficult to meet the requirements for robustness verification of natural language processing models in real-world scenarios with limited query times. Methods such as TextHoaxer and LeapAttack only maintain a single candidate sample during adversarial text generation. While this reduces the number of queries to the target model to a certain extent, it increases the likelihood of obtaining suboptimal solutions, resulting in a certain loss of semantic similarity and perturbation rate. Therefore, how to improve query efficiency while maintaining adversarial text quality and semantic consistency has become a key issue that needs to be addressed in the field of text adversarial sample generation in hard-label settings. Summary of the Invention

[0010] The purpose of the present invention is to provide a solution to the above-mentioned problem, which is to achieve a significant improvement in query efficiency while maintaining the quality and semantic consistency of adversarial text in a black-box scenario with hard label settings, thereby meeting the need to verify the robustness of existing natural language processing models in the face of adversarial attacks in real scenarios with a limited number of queries. A black-box adversarial text generation method based on semantic clustering and gradient fusion is proposed.

[0011] To achieve the above objectives, the technical solution adopted by the present invention is as follows: a black-box adversarial text generation method based on semantic clustering and gradient fusion, wherein the target model F of the attack outputs the category label F(∙) of the text when the text is input, including the following steps; S1, generates the initial adversarial text x' of the original text x based on synonym replacement, , , where w i 、 are the words at position i in x and x' respectively, N is the total number of words in x, the true label of x is y, F(x)=y, F(x')≠y; S2, constructing a candidate text list P based on local sensitive hashing and semantic clustering, including steps S21 to S23; S21, compare x word by word, generate the perturbed word position list I of x' 2 , specifically to create a new empty I 2 , for each word in x', if , add i to I 2 In, get , For I 2 The qth element in, Q is I 2 The total number of perturbable words in S22, generate I 2 middle The corresponding first optimal text x 1* , including steps S22.1 to S22.2; S22.1, using x position There are J synonyms in the synonym set of the word, which replace the position in x' The words are used to generate J candidate texts to form a list Xs; S22.2, based on the semantic vectors of the candidate texts, use the local sensitive hashing algorithm to divide Xs into multiple groups. In each group, select a candidate text and calculate its semantic similarity with x, and obtain the group containing the candidate text with the highest semantic similarity. , according to the following formula Find x in 1* and marked as ; , In the formula, argmax[∙] is the argmax function, S(∙,∙) is the calculation of semantic similarity, Adv(∙) is the calculation of anti-attack score, ,like ,but ,otherwise ; S23, process I in sequence according to S22 2 For each element in, we get Q x 1* Marked as ~ ,constitute ; S3, take the text with the highest semantic similarity to x in P as the current optimal text x best ; S4, based on ~ Generate probability distribution P' and generate R candidate text pairs from P by R sampling, where the rth candidate text pair , 、 They are text 1 and text 2 respectively; S5, construct the first candidate list P based on gradient fusion 1 ; S51, generate an empty P 1 , process each candidate text pair in turn, where The processing method is: In the word vector space, 、 Add Gaussian random noise to obtain the gradient matrix g of the semantics of text 1 and text 2 with respect to the noise 1 、g 2 , fusion g 1 、g 2 Generate adversarial noise matrix , and add it to the original text x to generate candidate adversarial text ,like and , then Deposit P 1 ; S52, x best Also deposited in P 1 , and P 1 Mark as , A is Total number of Chinese characters, for The ath text in; S6, generates optimal adversarial text x* based on semantic clustering; S61, generate an empty second candidate list P 2 ; S62, process P in sequence 1 For each text in The processing method is: S62.1, compare x word by word, generate List of perturbable word positions I 3 , , Ψ is I 3 The total number of perturbable words in For I 3 The position of the θth perturbable word in ; S62.2, for I 3 Each , using the position in x word replacement Middle position word, get the candidate text ,like ,Will Deposit P 2 Otherwise, proceed as per S22 method middle , and the corresponding first optimal text tag is , and Deposit P 2 ; S63, after processing P 1 After each text in the 2 Assign to candidate text list P; S64, repeat S3~S63τ times, select the text with the highest semantic similarity to the original text from the last P, and mark it as the optimal adversarial text x*.

[0012] Preferably, S1 includes the following S11 to S15; S11, get the original text x, , generate adversarial text x based on synonym replacement 0 , , where w i 、 x and x respectively 0 The word at position i in the 0 )≠y; S12, use w i Replace x 0 middle Get candidate text x 0 (w i ), N w i The corresponding N candidate texts constitute a set , calculate x 0 (w i )’s adversarial attack score Adv(x 0 (w i )); , S13, according to the following formula Find the best text in ; , S14, if Adv(x 0 (w i ))=0, use Replace x 0 Repeat steps S12~S13, otherwise the current x 0 As the initial adversarial text x', , is the word at position i in x'.

[0013] Preferably, S11 specifically includes steps S11.1 to S11.4; S11.1, process in sequence For each word in wi If the part of speech is a noun, verb, adjective or adverb, then i As a perturbed word, add i to the perturbed word position list I, and get I=[λ1,⋯,λ m ,⋯,λ M ], 1≤m≤M, M is the total number of perturbed words in x, λ m is the position of the mth perturbable word in x; S11.2, randomly sort the elements in I to obtain the first list I 1 , ; S11.3, let x 0 =x; S11.4, press I 1 In order, one by one x 0 The middle position is The word is marked as and from Synonyms for Randomly select a synonym from Replace x 0 in , and Marked as Repeat this operation until F(x 0 )≠y, get the adversarial text .

[0014] Preferably, in step S22, The list Xs in S22.1 is specifically: Get the x position Synonyms for the word , contains J synonyms in total, replace with the jth synonym Middle position word, get the jth candidate text , 1≤j≤J, all candidate texts form Xs, ; S22.2 specifically includes Sa1~Sa4: Sa1, process Xs with a universal sentence encoder , get the corresponding semantic vector ,Will ~ Semantic vector of ~ constitute ; Sa2, use the local sensitive hashing algorithm to group Xs, and map the candidate texts corresponding to the semantic vectors with the same hash value into the same group, a total of α groups, marked as b1~b α ; Sa3, from b1 to b α Randomly select a candidate text from each and mark it as ~ , respectively calculated ~ The semantic similarity with x, find the group of candidate texts with the highest semantic similarity ; Sa4, get All candidate texts in Find x in 1* and marked as ; .

[0015] As a preferred embodiment, in S4, based on ~ The generated probability distribution P' is specifically: generate ~ The sampling probability of ~ , forming a probability distribution P', where The sampling probability of According to the following formula: , Where exp(∙) is the exp function.

[0016] As a preference, in S51, processing Generated as g 1 、g 2 The method is: S51.1, will 、 Recorded as , Number the text and or , encode x into a matrix representation ,Will Encoded as a matrix representation ,in, and They are and Middle word Dimension word vector, calculate the perturbation matrix ; S51.2, randomly sample a dimensional noise matrix ,in, yes The noise vectors, and dimensional vector, calculation The proximity matrix ,in, yes The vectors, , is the scaling factor; S51.3, use Initialize a candidate text ,but ,right The position in is saved in Each of ,from Synonyms for Select The closest synonym in the word vector space is denoted by and use replace in ; S51.4, for and , calculate the gradient of the i-th noise vector according to the following formula , generate the gradient matrix ; , When ρ=1 and 2, the gradient matrix g 1 、g 2 .

[0017] As a preference, in S51, fusion g 1 、g 2 And generate candidate adversarial text The method is: According to the following formula, g is fused 1 、g 2 Generate adversarial noise matrix ; , Where, is the perturbation matrix when ρ=1, 、 are the gradient matrices when ρ = 1 and 2 respectively, and ϵ is a very small number; Will Recorded as ,in for For the i-th element in ,right The position in is saved in Each of ,from Select The closest synonym in the word vector space is denoted by and use replace in .

[0018] The idea of ​​the present invention is as follows: after the initial adversarial text is generated in step S1, the subsequent steps S2 to S6 are all for optimizing the semantics of the adversarial text, wherein S2 introduces local sensitive hashing, semantic similarity, and semantic clustering to construct a candidate text list P, and S3 selects the current optimal text x from P. best , S4 samples multiple candidate text pairs based on P, S5, introduces gradient fusion to construct the first candidate list P 1 S6 introduces local sensitive hashing, semantic similarity, and semantic clustering to generate optimal adversarial text .

[0019] Compared with the prior art, the advantages of the present invention are: (1) When constructing the candidate text list P in the process of optimizing the semantics of adversarial text, the present invention introduces a semantic clustering strategy based on the local sensitive hashing method to 2 middle For example, we first use synonyms to replace multiple candidate texts to form a list Xs; then we use the local sensitive hashing algorithm to group Xs based on the semantic similarity of the candidate text semantic vectors, and then randomly select candidate texts from each group to calculate the semantic similarity with the original text x, and select the group with the candidate text with the highest semantic similarity. , and finally from Middle press x 1* The calculation formula is used to select the candidate text that meets the requirements of the anti-attack and has the highest semantic similarity score with the original text as the candidate text Compared with the greedy query strategy in the existing methods, the present invention can significantly reduce the query consumption of the target model.

[0020] (2) The present invention constructs the first candidate list P 1 The gradient fusion strategy is introduced when first adding Gaussian random noise to the candidate text in the word vector space to obtain the gradient matrix g of the candidate text semantics with respect to the noise. 1 、g 2 , then through g 1 、g 2 Get the adversarial noise matrix , and Add to the original text x to get the candidate adversarial text and will satisfy and of Deposit P 1 , by fusing g 1 、g 2 The present invention can quickly search for adversarial texts with high semantic similarity. Compared with the random search strategy in the existing method, the present invention can quickly generate adversarial texts with high semantic consistency with the original text and effectively improve the query efficiency.

[0021] (3) The present invention constructs the second candidate list P 2 When the generated ,like Deposit directly into P 2 Otherwise, a semantic clustering strategy based on the locality sensitive hashing method is generated Deposit P 2 ,This step can also quickly select candidate texts that meet the requirements of the adversarial attack and have the highest semantic similarity score with the original text, thereby significantly reducing the query consumption of the target model.

[0022] In summary, in a black-box scenario with hard label settings, the optimal adversarial text x* generated based on the method of the present invention not only maintains the adversarial text quality and semantic consistency with the original text x, but also greatly improves the query efficiency and reduces the number of queries to the target model, thereby meeting the need to verify the robustness of existing natural language processing models in the face of adversarial attacks in real scenarios with a limited number of queries. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a flow chart of the present invention.

[0024] Figure 2 Generate an initial adversarial text flow chart for step S1; Figure 3 Flowchart of constructing candidate text list P for step S2. DETAILED DESCRIPTION

[0025] The present invention will be further described below with reference to the embodiments and accompanying drawings.

[0026] Example 1: See Figures 1 to 3 ,A black-box adversarial text generation method based on semantic clustering and gradient fusion, ,the target model F of the attack outputs the category label F(∙) of the text when inputting the text, including the following steps; S1, generates the initial adversarial text x' of the original text x based on synonym replacement, , , where w i 、 are the words at position i in x and x' respectively, N is the total number of words in x, the true label of x is y, F(x)=y, F(x')≠y; S2, constructing a candidate text list P based on local sensitive hashing and semantic clustering, including steps S21 to S23; S21, compare x word by word, generate the perturbed word position list I of x' 2 , specifically to create a new empty I 2 , for each word in x', if , add i to I 2 In, get , For I 2 The qth element in, Q is I 2 The total number of perturbable words in S22, generate I 2 middle The corresponding first optimal text x 1* , including steps S22.1 to S22.2; S22.1, using x position There are J synonyms in the synonym set of the word, which replace the position in x' The words are used to generate J candidate texts to form a list Xs; S22.2, based on the semantic vectors of the candidate texts, use the local sensitive hashing algorithm to divide Xs into multiple groups. In each group, select a candidate text and calculate its semantic similarity with x, and obtain the group containing the candidate text with the highest semantic similarity. , according to the following formula Find x in 1* and marked as ; , In the formula, argmax[∙] is the argmax function, S(∙,∙) is the calculation of semantic similarity, Adv(∙) is the calculation of anti-attack score, ,like ,but ,otherwise ; S23, process I in sequence according to S22 2 For each element in, we get Q x 1* Marked as ~ ,constitute ; S3, take the text with the highest semantic similarity to x in P as the current optimal text x best ; S4, based on ~ Generate probability distribution P' and generate R candidate text pairs from P by R sampling, where the rth candidate text pair , 、 They are text 1 and text 2 respectively; S5, construct the first candidate list P based on gradient fusion 1 ; S51, generate an empty P 1 , process each candidate text pair in turn, where The processing method is: In the word vector space, 、 Add Gaussian random noise to obtain the gradient matrix g of the semantics of text 1 and text 2 with respect to the noise 1 、g 2 , fusion g 1 、g 2 Generate adversarial noise matrix , and add it to the original text x to generate candidate adversarial text ,like and , then Deposit P 1 ; S52, x best Also deposited in P 1 , and P 1 Mark as , A is Total number of Chinese characters, for The ath text in; S6, generates optimal adversarial text x* based on semantic clustering; S61, generate an empty second candidate list P 2 ; S62, process P in sequence 1 For each text in The processing method is: S62.1, compare x word by word, generate List of perturbable word positions I 3 , , Ψ is I 3 The total number of perturbable words in For I 3 The position of the θth perturbable word in ; S62.2, for I 3 Each , using the position in x word replacement Middle position word, get the candidate text ,like ,Will Deposit P 2 Otherwise, proceed as per S22 method middle , and the corresponding first optimal text tag is , and Deposit P 2 ; S63, after processing P 1 After each text in the 2 Assign to candidate text list P; S64, repeat S3~S63τ times, select the text with the highest semantic similarity to the original text from the last P, and mark it as the optimal adversarial text x*.

[0027] In this embodiment, S1 includes the following S11 to S15; S11, get the original text x, , generate adversarial text x based on synonym replacement 0 , , where w i 、 x and x respectively 0 The word at position i in the 0 )≠y; S12, use w i Replace x 0 middle Get candidate text x 0 (w i ), N w i The corresponding N candidate texts constitute a set , calculate x 0 (w i )’s adversarial attack score Adv(x 0 (w i )); , S13, according to the following formula Find the best text in ; , S14, if Adv(x 0 (w i ))=0, use Replace x 0 Repeat steps S12~S13, otherwise the current x 0 As the initial adversarial text x', , is the word at position i in x'.

[0028] S11 specifically includes steps S11.1 to S11.4; S11.1, process in sequence For each word in w i If the part of speech is a noun, verb, adjective or adverb, then i As a perturbed word, add i to the perturbed word position list I, and get I=[λ1,⋯,λ m ,⋯,λ M ], 1≤m≤M, M is the total number of perturbed words in x, λ m is the position of the mth perturbable word in x; S11.2, randomly sort the elements in I to obtain the first list I 1 , ; S11.3, let x 0 =x; S11.4, press I 1 In order, one by one x 0 The middle position is The word is marked as and from Synonyms for Randomly select a synonym from Replace x 0 in , and Marked as Repeat this operation until F(x 0 )≠y, get the adversarial text .

[0029] In step S22, the list Xs constructed in S22.1 is specifically: Get the x position Synonyms for the word , contains J synonyms in total, replace with the jth synonym Middle position word, get the jth candidate text , 1≤j≤J, all candidate texts form Xs, ; In step S22, S22.2 specifically includes Sa1 to Sa4: Sa1, process Xs with a universal sentence encoder , get the corresponding semantic vector ,Will ~ Semantic vector of ~ constitute ; Sa2, use the local sensitive hashing algorithm to group Xs, and map the candidate texts corresponding to the semantic vectors with the same hash value into the same group, a total of α groups, marked as b1~b α ; Sa3, from b1 to b α Randomly select a candidate text from each and mark it as ~ , respectively calculated ~ The semantic similarity with x, find the group of candidate texts with the highest semantic similarity ; Sa4, get All candidate texts in Find x in 1* and marked as ; .

[0030] In S4, based on ~ The generated probability distribution P' is specifically: generate ~ The sampling probability of ~ , forming a probability distribution P', where The sampling probability of According to the following formula: , Where exp(∙) is the exp function.

[0031] In S51, processing Generated as g 1 、g 2 The method is: S51.1, will 、 Recorded as , Number the text and or , encode x into a matrix representation ,Will Encoded as a matrix representation ,in, and They are and Middle word Dimension word vector, calculate the perturbation matrix ; S51.2, randomly sample a dimensional noise matrix ,in, yes The noise vectors, and dimensional vector, calculation The proximity matrix ,in, yes The vectors, , is the scaling factor; S51.3, use Initialize a candidate text ,but ,right The position in is saved in Each of ,from Synonyms for Select The closest synonym in the word vector space is denoted by and use replace in ; S51.4, for and , calculate the gradient of the i-th noise vector according to the following formula , generate the gradient matrix ; , When ρ = 1 and 2, the gradient matrix g 1 、g 2 .

[0032] In S51, fusion g 1 、g 2 And generate candidate adversarial text The method is: According to the following formula, g is fused 1 、g 2 Generate adversarial noise matrix ; , Where, is the perturbation matrix when ρ=1, 、 are the gradient matrices when ρ = 1 and 2 respectively, and ϵ is a very small number; Will Recorded as ,in for For the i-th element in ,right The position in is saved in Each of ,from Select The closest synonym in the word vector space is denoted by and use replace in .

[0033] Example 2: See Figures 1 to 3 Based on Example 1, we provide a more specific step-by-step operation process: Step 1: Initialize the adversarial text; Step 1.1 Get the original text x, , w i is the word at position i in x, and F(x)=y, Each word w in i , if w i If the part of speech is a noun, verb, adjective or adverb, Add to the perturbed word position list I, and get I=[λ1,⋯,λ m ,⋯,λ M ], 1≤m≤M, M is the total number of perturbed words in x, λ m is the position of the mth perturbable word in x; Step 1.2 Randomly sort the elements in I to get the first list I 1 , ; Step 1.3 Use Initialize x 0 ; Step 1.4 Follow I 1 In order, one by one x 0 The middle position is The word is marked as ; and from Synonyms for Randomly select a synonym from Replace x 0 in , and Marked as Repeat this operation until F(x 0 )≠y, get the adversarial text , where F(x 0 ) is x 0 The output obtained by the target model F, is the first word; Step 1.5 Use w i Replace x 0 middle Get candidate text x 0 (w i ), N w i The corresponding N candidate texts constitute a set , calculate x 0 (w i )’s adversarial attack score Adv(x 0 (w i )); , Step 1.6 According to the following formula Select a candidate text that meets the requirements of the adversarial attack and has the highest semantic similarity with the original text , , Step 1.7 If ,use replace Repeat steps 1.5 to 1.6, otherwise the current As the initial adversarial text x', , is the word at position i in x'.

[0034] Step 2: Optimize the semantics of adversarial text; Step 2.1: Construct a candidate text list P based on locality-sensitive hashing and semantic clustering, including steps 2.1.1 to 2.1.9; Step 2.1.1 Compare x word by word to generate a list of perturbed word positions for x' , and initialize the candidate text list P=[∙] with an empty list, for I 2 Each of , perform steps 2.1.2-2.1.8; Step 2.1.2 Use Initialize a candidate text , and The middle position is The word is recorded as ,Will The middle position is The word is recorded as ; Step 2.1.3 Use Synonyms for Replace each synonym in in , J synonyms, where the jth synonym is replaced to generate a candidate text , then in turn get ~ , constitute a list ; Step 2.1.4 input each candidate text in Xs into the general sentence encoder to get a list of semantic vectors , where, is the semantic vector of output by the general sentence encoder USE; Step 2.1.5 input Xs and Es into the local sensitive hashing algorithm, which maps the candidate texts in Xs corresponding to the semantic vectors in Es with the same hash value into the same group to get a list , where, is the total number of groups, b k is the kth group in Bs, the candidate texts in each group have the same hash value of the semantic vectors thereof; Step 2.1.6 randomly select one candidate text from each b k in Bs, denoted as , to get a list , where, is the candidate text randomly selected from b k ; select one candidate text with the highest semantic similarity score with the original text from all in , denoted as the semantic similarity highest candidate text : , Step 2.1.7 denote the group where is located as , and denote the candidate text in as , where D is the total number of candidate texts in , is the dth candidate text in , select one candidate text x 1* that meets the requirements of the adversarial attack and has the highest semantic similarity score with the original text from all in , since this x 1* corresponds to 2 in I , in order to facilitate the distinction, the x 1* corresponding to is marked again as ; ; ​Step 2.1.8 Deposit to middle; Step 2.1.9 After steps 2.1.2-2.1.8, obtain each of , that is ~ ,Will Recorded as .

[0035] Step 2.2 Select the current optimal sample; Select a candidate text from P that has the highest semantic similarity with the original text x, denoted as x best , .

[0036] Step 2.3 Select candidate text pairs; generate ~ The sampling probability of ~ , forming a probability distribution P', using P' from Sample R candidate text pairs to form a list ,in, is the rth candidate text pair, 、 are text 1 and text 2 of the rth candidate text pair, The sampling probability of According to the following formula: , Where exp(∙) is the exp function.

[0037] Step 2.4 Construct the first candidate list P based on gradient fusion 1 ; Step 2.4.1 Initialize the first candidate list P with an empty list 1 =[∙], for each candidate text pair in Ps , perform steps 2.4.2-2.4.9; Step 2.4.2 Initialize the gradient list Gs=[∙] with an empty list, and 、 Recorded as , Number the text and or , for each , perform steps 2.4.3-2.4.6; Step 2.4.3 Encode x into a matrix representation ,Will Encoded as a matrix representation ,in, and They are and Middle word Dimension word vector, calculate the perturbation matrix ; Step 2.4.4 Randomly sample a dimensional noise matrix ,in, yes The noise vectors, and is a dimensional vector. Calculation The proximity matrix ,in, yes The vectors, , is the scaling factor; Step 2.4.5 Initialize a candidate text ,but ,right The position in is saved in Each of ,from Synonyms for Select The closest synonym in the word vector space is denoted by and use replace in ; Step 2.4.6 for and , calculate the gradient of the i-th noise vector according to the following formula , generate the gradient matrix , and Deposit into Gs; , When ρ=1 and 2, the gradient matrix g 1 、g 2 ; Step 2.4.7 Gs=[g 1 ,g 2 ], and T in step 2.4.3 when ρ=1 ρ T 1 , calculate the anti-noise matrix according to the following formula , where η is the step size parameter, ϵ is a very small number to prevent the denominator from being zero, ϵ=1×10 -5 ; , Step 2.4.8 Recorded as ,in for The i-th element in Initialize a candidate text ,right The position in is saved in Each of ,from Select The closest synonym in the word vector space is denoted by and use replace in ; Step 2.4.9 If Meet the conditions and , then Deposit P 1 ; Step 2.4.10 Set x best Also deposited in P 1 , and P 1 Mark as , A is P 1 Total number of Chinese characters, for The ath text in .

[0038] Step 2.5: semantic clustering; Step 2.5.1 Initialize the second candidate list P with an empty list 2 , P 2 =[∙], for P 1 Each of , perform steps 2.5.2-2.5.11; Step 2.5.2 Recorded as ,in, yes The word, yes Each of ,if , then Add to the list of disturber positions In, get , , yes and The total number of different words in . Each of , perform steps 2.5.3-2.5.11; Step 2.5.3: initialization , and The middle position is The word is recorded as ,Will The middle position is The word is recorded as ; Step 2.5.4: replace in , get the candidate text .like , then Deposit to P 2 In the process, do not execute steps 2.5.5-2.5.11; if , then execute steps 2.5.5-2.5.11; Step 2.5.5: Synonyms for Replace each synonym in in , get the candidate text list ,in, yes The total number of synonyms in yes The synonyms, It is used replace in The candidate text obtained after Step 2.5.6 Each of Input them into the Universal Sentence Encoding Model (USE) to get a list of semantic vectors ,in, Output by USE vector of Step 2.5.8 From Each Randomly select a candidate text from , get the list ,in, It is from The candidate text is randomly selected from ; Step 2.5.9: According to the following formula All Select a candidate text with the highest semantic similarity score with the original text, denoted as : , Step 2.5.10 The group is recorded as ,Will The candidate text in ,in, yes The total number of candidate texts in , yes The candidate texts. According to the following formula All Select a candidate text that meets the requirements of the adversarial attack and has the highest semantic similarity score with the original text, denoted as : , Step 2.5.11 Deposit to P 2 middle; Step 2.5.12 P 2 Assign it to P and record P as .

[0039] Step 2.5.13 Repeat steps 2.2-2.5.12 for τ times, and calculate the following equation from all the P Select a candidate text with the highest semantic similarity to the original text and record it as x*: , At this time, x* is the optimal adversarial text.

[0040] Example 3: In order to illustrate the effect of the present invention, the following experimental design was carried out: Dataset: The 1000 test texts in the MR dataset are used as the test set.

[0041] Target model: The BERT model fine-tuned using the training set of the MR dataset is used as the target model.

[0042] Experimental environment: The hardware environment is NVIDIA A100 GPU, and the software environment is PyTorch 1.13.

[0043] Experimental grouping: The experimental group is the adversarial text generation method of the present invention, and the control group is the existing adversarial text generation method HLBB. By comparing some performance indicators of the two methods, the following Table 1 is obtained: Table 1: Comparison of performance indicators of different methods for generating adversarial text Model Name Average number of queries Average attack success rate (%) Average semantic similarity (%) Average disturbance rate (%) Method of the present invention 219.17 98.82 87.94 13.45 Control group method (HLBB) 1813.31 98.59 86.12 14.86 Data analysis: Analysis of Table 1 shows that while maintaining the same attack success rate as the HLBB method, our method achieves better results than existing methods in terms of semantic similarity and perturbation rate, and the number of queries generated is much lower than that of existing methods. This shows the advantage of our method in generating high-quality adversarial text with fewer queries.

[0044] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A black-box adversarial text generation method based on semantic clustering and gradient fusion. The target model F of the attack outputs the category label F(∙) of the text when the text is input. The characteristics are: The following steps are included: S1, generates the initial adversarial text x' of the original text x based on synonym replacement, , , where w i 、 are the words at position i in x and x' respectively, N is the total number of words in x, the true label of x is y, F(x)=y, F(x')≠y; S2, constructing a candidate text list P based on local sensitive hashing and semantic clustering, including steps S21 to S23; S21, compare x word by word, generate the perturbed word position list I of x' 2 , specifically to create a new empty I 2 , for each word in x', if , add i to I 2 In, get , For I 2 The qth element in, Q is I 2 The total number of perturbable words in S22, generate I 2 middle The corresponding first optimal text x 1* , including steps S22.1 to S22.2; S22.1, using x position There are J synonyms in the synonym set of the word, which replace the position in x' The words are used to generate J candidate texts to form a list Xs; S22.2, based on the semantic vectors of the candidate texts, use the local sensitive hashing algorithm to divide Xs into multiple groups. In each group, select a candidate text and calculate its semantic similarity with x, and obtain the group containing the candidate text with the highest semantic similarity. , according to the following formula Find x in 1* and marked as ; ， In the formula, argmax[∙] is the argmax function, S(∙,∙) is the calculation of semantic similarity, Adv(∙) is the calculation of anti-attack score, ,like ,but ,otherwise ; S23, process I in sequence according to S22 2 For each element in, we get Q x 1* Marked as ~ ,constitute ; S3, take the text with the highest semantic similarity to x in P as the current optimal text x best ; S4, based on ~ Generate probability distribution P' and generate R candidate text pairs from P by R sampling, where the rth candidate text pair , 、 They are text 1 and text 2 respectively; S5, construct the first candidate list P based on gradient fusion 1 ; S51, generate an empty P 1 , process each candidate text pair in turn, where The processing method is: In the word vector space, 、 Add Gaussian random noise to obtain the gradient matrix g of the semantics of text 1 and text 2 with respect to the noise 1 、g 2 , fusion g 1 、g 2 Generate adversarial noise matrix , and add it to the original text x to generate candidate adversarial text ,like and , then Deposit P 1 ; S52, x best Also deposited in P 1 , and P 1 Mark as , A is Total number of Chinese characters, for The ath text in; S6, generates optimal adversarial text x* based on semantic clustering; S61, generate an empty second candidate list P 2 ; S62, process P in sequence 1 For each text in The processing method is: S62.1, compare x word by word, generate List of perturbable word positions I 3 , , Ψ is I 3 The total number of perturbable words in For I 3 The position of the θth perturbable word in ; S62.2, for I 3 Each , using the position in x word replacement Middle position word, get the candidate text ,like ,Will Deposit P 2 Otherwise, proceed as per S22 method middle , and the corresponding first optimal text tag is , and Deposit P 2 ; S63, after processing P 1 After each text in the 2 Assign to candidate text list P; S64, repeat S3~S63τ times, select the text with the highest semantic similarity to the original text from the last P, and mark it as the optimal adversarial text x*.

2. The black-box adversarial text generation method based on semantic clustering and gradient fusion according to claim 1, characterized in that: S1 includes the following S11~S15; S11, get the original text x, , generate adversarial text x based on synonym replacement 0 , , where w i 、 x and x respectively 0 The word at position i in the 0 )≠y; S12, use w i Replace x 0 middle Get candidate text x 0 (w i ), N w i The corresponding N candidate texts constitute a set , calculate x 0 (w i )’s adversarial attack score Adv(x 0 (w i )); ， S13, according to the following formula Find the best text in ; ， S14, if Adv(x 0 (w i ))=0, use Replace x 0 Repeat steps S12~S13, otherwise the current x 0 As the initial adversarial text x', , is the word at position i in x'.

3. The black-box adversarial text generation method based on semantic clustering and gradient fusion according to claim 2, characterized in that: S11 specifically includes steps S11.1 to S11.4; S11.1, process in sequence For each word in w i If the part of speech is a noun, verb, adjective or adverb, then i As a perturbed word, add i to the perturbed word position list I, and get I=[λ1,⋯,λ m ,⋯,λ M ], 1≤m≤M, M is the total number of perturbed words in x, λ m is the position of the mth perturbable word in x; S11.2, randomly sort the elements in I to obtain the first list I 1 , ; S11.3, let x 0 =x; S11.4, press I 1 In order, one by one x 0 The middle position is The word is marked as and from Synonyms for Randomly select a synonym from Replace x 0 in , and Marked as Repeat this operation until F(x 0 )≠y, get the adversarial text .

4. The black-box adversarial text generation method based on semantic clustering and gradient fusion according to claim 1, characterized in that: In step S22, The list Xs in S22.1 is specifically: Get the x position Synonyms for the word , contains J synonyms in total, replace with the jth synonym Middle position word, get the jth candidate text , 1≤j≤J, all candidate texts form Xs, ; S22.2 specifically includes Sa1~Sa4: Sa1, process Xs with a universal sentence encoder , get the corresponding semantic vector ,Will ~ Semantic vector of ~ constitute ; Sa2, use the local sensitive hashing algorithm to group Xs, and map the candidate texts corresponding to the semantic vectors with the same hash value into the same group, a total of α groups, marked as b1~b α ; Sa3, from b1 to b α Randomly select a candidate text from each and mark it as ~ , respectively calculated ~ The semantic similarity with x, find the group of candidate texts with the highest semantic similarity ; Sa4, get All candidate texts in Find x in 1* and marked as ; 。 5. The black-box adversarial text generation method based on semantic clustering and gradient fusion according to claim 1, characterized in that: In S4, based on ~ The generated probability distribution P' is specifically: generate ~ The sampling probability of ~ , forming a probability distribution P', where The sampling probability of According to the following formula: ， Where exp(∙) is the exp function.

6. The black-box adversarial text generation method based on semantic clustering and gradient fusion according to claim 1, characterized in that: In S51, processing Generated as g 1 、g 2 The method is: S51.1, will 、 Recorded as , Number the text and or , encode x into a matrix representation ,Will Encoded as a matrix representation ,in, and They are and Middle word Dimension word vector, calculate the perturbation matrix ; S51.2, randomly sample a dimensional noise matrix ,in, yes The noise vectors, and dimensional vector, calculation The proximity matrix ,in, yes The vectors, , is the scaling factor; S51.3, use Initialize a candidate text ,but ,right The position in is saved in Each of ,from Synonyms for Select The closest synonym in the word vector space is denoted by and use replace in ; S51.4, for and , calculate the gradient of the i-th noise vector according to the following formula , generate the gradient matrix ; ， When ρ=1 and 2, the gradient matrix g 1 、g 2 .

7. The black-box adversarial text generation method based on semantic clustering and gradient fusion according to claim 6, characterized in that: In S51, fusion g 1 、g 2 And generate candidate adversarial text The method is: According to the following formula, g is fused 1 、g 2 Generate adversarial noise matrix ; ， Where, is the perturbation matrix when ρ=1, 、 are the gradient matrices when ρ = 1 and 2 respectively, and ϵ is a very small number; Will Recorded as ,in for For the i-th element in ,right The position in is saved in Each of ,from Select The closest synonym in the word vector space is denoted by and use replace in .

Images