Dual-granularity sparse perturbation Chinese countermeasure attack method based on gradient perception

Abstract

The invention discloses a double-granularity sparse perturbation Chinese adversarial attack method based on gradient perception. The method comprises the following steps: firstly, carrying out dual-granularity importance positioning on an input text, and respectively calculating gradient norms at a word level and a character level so as to identify key semantic units; secondly, a sparse mask is constructed based on the importance score, and disturbance is selectively applied to the key position; then, constrained continuous confrontation disturbance is generated in the embedding space through projection gradient descent; further constructing a multi-distribution candidate pool, and integrating mask language model prediction, semantic embedding similarity and Chinese specific vocabulary conversion, including homophonic character replacement, similar character replacement, character splitting and pinyin replacement; and finally, mapping continuous perturbation into discrete vocabulary replacement operation, supporting four operation types of insertion, replacement, deletion and exchange, and generating a semantically coherent adversarial sample. The method can be used for robustness evaluation and safety protection research of the Chinese NLP model.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence and natural language processing (NLP) technology, specifically relating to an attack method for generating adversarial examples of Chinese text, and more particularly to a gradient-aware dual-granularity sparse perturbation Chinese adversarial attack method. Background Technology

[0002] With the rapid development of deep learning technology, Chinese natural language processing systems based on pre-trained language models have achieved remarkable results in various applications, including text classification, sentiment analysis, named entity recognition, and machine translation. These models, pre-trained on large-scale corpora, learn rich linguistic knowledge and representation capabilities, demonstrating powerful performance in downstream tasks. However, numerous studies have shown that these models are extremely sensitive to subtle perturbations in the input data and are easily misled by maliciously designed adversarial examples.

[0003] Adversarial attacks refer to attacks that cause a model to make incorrect predictions by adding carefully designed small perturbations to the input. In the field of computer vision, research on adversarial examples is relatively mature; however, in the field of natural language processing, adversarial attacks face unique challenges due to the discrete nature of text and semantic constraints.

[0004] Existing text adversarial attack methods are primarily designed for English, including gradient-based methods and word substitution-based methods. Most existing text attack methods fall into three categories:

[0005] Word-level replacement methods generate semantically similar attack samples by replacing high-contribution words, but they are prone to disrupting semantic coherence in Chinese scenarios.

[0006] Character-level perturbation methods achieve fine-grained attacks by modifying characters or strokes, but often cause semantic distortion.

[0007] Embedding perturbation methods apply small vector perturbations to the embedding space, which have good semantic preservation but limited attack strength.

[0008] Existing text adversarial attack methods are primarily designed for English, facing numerous challenges when directly applied to Chinese. As an ideographic script, Chinese possesses unique linguistic characteristics: characters themselves carry semantic meaning, word boundaries are lacking, and there is a wealth of homophones and similar-looking characters. These characteristics necessitate fine-grained control over the generation of Chinese adversarial examples at multiple granularities. Currently, for Chinese scenarios, single-granularity perturbations struggle to balance attack strength, naturalness, and controllability. Traditional attack methods often employ dense or uniform perturbation strategies, failing to fully utilize the model's vulnerabilities, and the generated adversarial examples perform poorly in terms of semantic preservation and naturalness. Furthermore, existing methods rarely consider the multi-granular semantic structure of Chinese, making it difficult to achieve a balance between attack effectiveness and semantic quality. Since the Chinese language structure is based on characters and composed of words, perturbations based solely on words or characters suffer from information loss or over-modification. Moreover, excessive perturbation can lead to unreadable text or semantic drift, reducing the effectiveness and realism of the attack examples. Therefore, developing a specific adversarial attack method for Chinese that can accurately locate vulnerabilities at multiple granularities and generate high-quality and semantically coherent adversarial samples is of significant theoretical and practical value for comprehensively evaluating the robustness of Chinese NLP systems and discovering security vulnerabilities in models. Summary of the Invention

[0009] The purpose of this invention is to overcome the problems of perturbation redundancy, semantic destruction, and insufficient controllability in existing Chinese text adversarial attack methods. It can accurately locate vulnerable positions at the word and character levels and generate high-quality, semantically coherent adversarial examples, which is of great significance for evaluating and improving the robustness of Chinese NLP systems. This adds a new approach to research on Chinese adversarial attacks in the field of natural language processing, and draws more attention to the security issues behind current models.

[0010] To achieve the above objectives, this invention provides a gradient-aware, dual-granularity sparse perturbation Chinese adversarial attack method, comprising the following steps:

[0011] Obtain the Chinese dataset needed to train the language model;

[0012] Preprocess the collected Chinese dataset;

[0013] Clean performance is obtained by training with a pre-trained language model;

[0014] The input text is located using a dual-granularity approach, with gradient norms calculated at both the word and character levels to identify key semantic units.

[0015] A sparse mask is constructed based on importance scores, and perturbations are selectively applied to key locations.

[0016] Constrained continuous adversarial perturbations are generated in the embedding space by projective gradient descent;

[0017] Construct a multi-distributed candidate pool and integrate masked language model prediction, semantic embedding similarity, and Chinese specific word conversion;

[0018] Continuous perturbations are mapped to discrete word substitution operations to generate semantically coherent adversarial examples.

[0019] Evaluate the success rate of adversarial examples in attacking the target model and the quality of semantic preservation.

[0020] In the process of obtaining the datasets required for Chinese natural language processing tasks, we first obtain datasets for various tasks from major mainstream open source platforms, including GitHub and Kaggle, and check the format and labeling of the datasets to obtain the datasets required for Chinese natural language processing tasks.

[0021] The data preprocessing workflow includes the following steps:

[0022] The data is standardized to remove duplicate data and data with incomplete labels;

[0023] The preprocessed dataset is divided according to a certain ratio.

[0024] Use pre-trained language models from open-source modeling platforms such as Hugging Face to train, evaluate, and test on clean datasets to obtain the initial performance of the pre-trained language models on clean datasets.

[0025] This invention provides a gradient-aware, dual-granularity sparse perturbation Chinese adversarial attack method. This method automatically identifies the most sensitive word and character positions in the input through model gradient information and applies sparse perturbations to these key regions. Simultaneously, a semantic candidate pool mechanism is introduced to ensure that the generated adversarial samples achieve an optimal balance between semantic consistency and attack effectiveness. The dual-granularity importance localization process includes: at the word level, calculating the L2 norm of the gradient of each word embedding with respect to the adversarial loss to quantify the influence of words on model predictions; at the character level, further analyzing the gradient contribution of each character within a multi-character word. Combining the scores at both granularities allows for more accurate identification of key semantic positions. The sparse perturbation strategy uses a binary mask vector to apply perturbations only to positions where the importance score exceeds a threshold, avoiding unnecessary modifications to non-critical positions. Iterative projective gradient descent (PGD) optimizes the continuous perturbation vector under bounded L∞ constraints.

[0026] A multi-distributed candidate pool integrates three candidate sources: a masked language model (MLM) predicts context-dependent candidate words to ensure replacement words conform to the context; semantically similar words are retrieved based on semantic embedding similarity to maintain semantic coherence; and Chinese-specific features, including homophones, similar-looking characters, character splitting, and pinyin replacement, are utilized to increase candidate diversity. Finally, a nearest neighbor search maps continuous perturbation vectors to discrete word replacements, supporting four operations: insertion, replacement, deletion, and swapping. The generated adversarial examples are evaluated using three metrics: attack success rate, BLEU score, and perplexity. This method can efficiently generate natural, fluent, semantically preserving, and high-strength Chinese adversarial examples. Attached Figure Description

[0027] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 This is a flowchart illustrating a gradient-aware, dual-granularity sparse perturbation Chinese adversarial attack method according to the present invention.

[0029] Figure 2 This is a method architecture diagram of a gradient-aware, dual-granularity sparse perturbation Chinese adversarial attack method according to the present invention.

[0030] Figure 3 This is a diagram of the general adversarial attack architecture of the present invention. Detailed Implementation

[0031] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0032] Please see Figure 1 This invention proposes a gradient-aware, dual-granularity sparse perturbation Chinese adversarial attack method, comprising the following steps:

[0033] S1: Obtain datasets related to natural language processing tasks from major open-source platforms;

[0034] S2: Normalize the data, remove useless and meaningless words and phrases, remove non-standard symbols in the text, and train a clean pre-trained language model to obtain its clean performance.

[0035] S3: Calculate word-level and character-level importance scores using gradient backpropagation;

[0036] S4: Select perturbation locations based on scores and construct a sparse perturbation mask;

[0037] S5: Generate continuous perturbations to update gradients;

[0038] S6: Construct a multi-distribution candidate pool to map continuous disturbances to the nearest discrete value;

[0039] S7: Test the attack success rate and semantic quality of adversarial examples on the target model.

[0040] In the process of obtaining the datasets required for Chinese natural language processing tasks, we first obtain datasets for various tasks from major mainstream open source platforms, including GitHub and Kaggle, and check the format and labeling of the datasets to obtain the datasets required for Chinese natural language processing tasks.

[0041] Use pre-trained language models from open-source modeling platforms such as Hugging Face to train, evaluate, and test on clean datasets to obtain the initial performance of the pre-trained language models on clean datasets.

[0042] The input text is first segmented into words, and the gradient of the adversarial loss with respect to each word embedding is calculated. For multi-character words, the gradient norm of each character is further calculated at the character level. A threshold is set, and when the importance score is greater than the threshold, the corresponding position is marked as a key semantic unit. Based on the previously obtained importance score, a binary mask vector is generated. The sparse mask ensures that the perturbation is concentrated at the key semantic position.

[0043] Initialize the perturbation vector and update the perturbation through K iterations of projective gradient descent: In each iteration, first calculate the mask gradient, then perform gradient ascent update, and finally project the perturbation into the L∞ sphere. Repeat this process K times to obtain the final perturbation. For each position requiring perturbation, construct a set of candidate words. Integrate three types of sources: MLM candidates; semantic candidates; and Chinese-specific candidates: apply homophone replacement, similar-looking character replacement, character splitting, and pinyin replacement.

[0044] The continuous perturbations are then mapped to the most recent discrete replacements. Four discrete operations are supported: replacement, insertion, deletion, and swapping. The final adversarial examples are generated. The attack accuracy, semantic fluency, and perplexity of the generated adversarial examples are evaluated.

[0045] Furthermore, the present invention will be described in further detail with reference to specific embodiments and figures:

[0046] Please see Figure 2The specific steps of gradient-aware dual-granularity sparse perturbation Chinese adversarial attack are as follows:

[0047] Step 1: Obtain datasets related to natural language processing tasks from major open-source platforms.

[0048] Step 2: Normalize the data by removing useless or meaningless characters and words, as well as non-standard symbols. Train a clean pre-trained language model to obtain its clean performance.

[0049] Step 3: Calculate the word-level gradient norm and mark the position with the highest character-level score as the key position.

[0050] Step 4: Construct a sparse mask, applying perturbations only to key locations. Optimize the continuous perturbations through multiple PGD iterations.

[0051] Step 5: Generate a candidate pool for important characters: The candidate pool is obtained by combining semantically similar characters, specific homophones in Chinese, and characters with similar forms, using MLM prediction and pinyin merging.

[0052] Step 6: Select discrete words through nearest neighbor mapping to generate adversarial examples.

[0053] Step 7: Evaluate the stealth and effectiveness of the adversarial examples on the pre-trained model.

[0054] Furthermore,

[0055] Overall architecture diagram of the counterattack is as follows Figure 3 As shown in the diagram, the specific steps are explained below:

[0056] Step 1: Randomly select a certain proportion of data from the dataset.

[0057] Step 2: Attack the positive samples, with the goal of flipping them into negative predictions.

[0058] Step 3: Identify keywords, find the most sensitive positions to attack, and use small changes to change the label of the sample to achieve the attack.

[0059] The above description discloses only one preferred embodiment of the present invention, and should not be construed as limiting the scope of the present invention. Those skilled in the art will understand that all or part of the processes of the above embodiments can be implemented, and equivalent changes made in accordance with the claims of the present invention are still within the scope of the invention.

Claims

1. A gradient-aware dual-granularity sparse perturbation Chinese adversarial attack method, which mainly includes the following steps: acquiring and preprocessing Chinese datasets, localizing dual-granularity semantic importance, constructing sparse masks, constructing multi-distribution candidate pools, mapping continuous perturbations to discrete word substitution operations, generating semantically coherent adversarial examples; evaluating the attack success rate and semantic preservation quality of adversarial examples against the target model.

2. The gradient-aware dual-granularity sparse perturbation Chinese adversarial attack method as described in claim 1, characterized in that: In the process of obtaining the datasets required for Chinese natural language processing tasks, we first obtain datasets for various tasks from major mainstream open source platforms, including GitHub and Kaggle, and check the format and labeling of the datasets to obtain the datasets required for Chinese natural language processing tasks.

3. The gradient-aware dual-granularity sparse perturbation Chinese adversarial attack method as described in claim 1, characterized in that: The dual-granularity importance localization process includes the following steps: at the word level, the gradient of the adversarial loss with respect to each word embedding is calculated; at the character level, the gradient norm is calculated for each character within a multi-character word. A threshold is set, and when the importance of a word or character exceeds the threshold, it is marked as a key semantic unit; the adversarial loss considers both classification error and semantic deviation, and combines cross-entropy loss and cosine similarity penalty term.

4. The gradient-aware dual-granularity sparse perturbation Chinese adversarial attack method as described in claim 1, characterized in that: Use pre-trained language models from open-source modeling platforms such as Hugging Face to train, evaluate, and test on clean datasets to obtain the initial performance of the pre-trained language models on clean datasets.

5. The gradient-aware dual-granularity sparse perturbation Chinese adversarial attack method as described in claim 1, characterized in that: The adaptive sparse perturbation strategy uses a binary mask vector to control the perturbation location, applies perturbation only to words marked as important, updates the perturbation vector iteratively through gradient ascent, normalizes the gradient at each step and projects it into the L∞ sphere, ensuring the perturbation is bounded.

6. The gradient-aware dual-granularity sparse perturbation Chinese adversarial attack method as described in claim 1, characterized in that: Discrete perturbation operations include four types: insertion, replacement, deletion, and swapping. The replacement operation selects the optimal candidate word by minimizing the embedding space distance; the insertion operation inserts a candidate word at a specified position; the deletion operation removes the word at the target position; and the swapping operation swaps the positions of adjacent words.

7. The gradient-aware dual-granularity sparse perturbation Chinese adversarial attack method as described in claim 1, characterized in that: The construction of the multi-distributed candidate pool integrates three sources: using a pre-trained masked language model to predict context-related candidate words; calculating cosine similarity based on semantic embedding to retrieve semantically similar candidate words; and applying Chinese-specific transformations including homophone replacement, similar-looking character replacement, character splitting, and pinyin replacement.

8. The gradient-aware dual-granularity sparse perturbation Chinese adversarial attack method as described in claim 1, characterized in that: Chinese specific word conversion includes: homophone replacement: finding and replacing characters with the same pinyin; similar-looking character replacement: finding visually similar characters based on radical and stroke similarity; character splitting: splitting characters into components that can stand alone as characters; pinyin replacement: replacing the original character with the pinyin corresponding to the character.

Images