Written language contains stylistic cues that can be exploited to automatically infer a variety of potentially sensitive author information. Adversarial stylometry intends to attack such models by rewriting an author's text. Our research proposes several components to facilitate deployment of these adversarial attacks in the wild, where neither data nor target models are accessible. We introduce a transformer-based extension of a lexical replacement attack, and show it achieves high transferability when trained on a weakly labeled corpus -- decreasing target model performance below chance. While not completely inconspicuous, our more successful attacks also prove notably less detectable by humans. Our framework therefore provides a promising direction for future privacy-preserving adversarial attacks.

我们的研究提出了几个组件，以便于在野外部署对抗性攻击以攻击自动推断潜在敏感作者信息的模型，并且介绍了基于Transformer扩展的词汇替换攻击，证明了其在训练弱标记语料库数据时能够实现高传递性，使目标模型的性能降低到低于随机 chance 水平。我们成功的攻击虽然不完全不可察觉，但也比人类需要更少的检测。因此，我们的框架为未来进行隐私保护的对抗性攻击提供了一个具有实用前景的方向。

野外环境中的对抗文体学: 可转移的词汇替换攻击在作者画像中的应用