Token-modification adversarial attacks for natural language processing: A survey

Article type: Research Article

Authors: Roth, Tom^{a; b; *} | Gao, Yansong^b | Abuadbba, Alsharif^b | Nepal, Surya^b | Liu, Wei^a

Affiliations: [a] University of Technology Sydney, NSW, Australia | [b] CSIRO’s Data61, Sydney, NSW, Australia

Correspondence: [*] Corresponding author. E-mail: thomas.p.roth@student.uts.edu.au.

Abstract: Many adversarial attacks target natural language processing systems, most of which succeed through modifying the individual tokens of a document. Despite the apparent uniqueness of each of these attacks, fundamentally they are simply a distinct configuration of four components: a goal function, allowable transformations, a search method, and constraints. In this survey, we systematically present the different components used throughout the literature, using an attack-independent framework which allows for easy comparison and categorisation of components. Our work aims to serve as a comprehensive guide for newcomers to the field and to spark targeted research into refining the individual attack components.

Keywords: Text adversarial attacks, security, robustness, natural language processing

DOI: 10.3233/AIC-230279

Journal: AI Communications, vol. 37, no. 4, pp. 655-676, 2024