In text classification, creating an adversarial example means subtly perturbing a few words in a sentence without changing its meaning, causing it to be misclassified by a classifier. A concerning observation is that a significant portion of adversarial examples generated by existing methods change only one word. This single-word perturbation vulnerability represents a significant weakness in classifiers, which malicious users can exploit to efficiently create a multitude of adversarial examples. This paper studies this problem and makes the following key contributions: (1) We introduce a novel metric \r{ho} to quantitatively assess a classifier's robustness against single-word perturbation. (2) We present the SP-Attack, designed to exploit the single-word perturbation vulnerability, achieving a higher attack success rate, better preserving sentence meaning, while reducing computation costs compared to state-of-the-art adversarial methods. (3) We propose SP-Defense, which aims to improve \r{ho} by applying data augmentation in learning. Experimental results on 4 datasets and BERT and distilBERT classifiers show that SP-Defense improves \r{ho} by 14.6% and 13.9% and decreases the attack success rate of SP-Attack by 30.4% and 21.2% on two classifiers respectively, and decreases the attack success rate of existing attack methods that involve multiple-word perturbations.

本文研究文本分类中单词扰动漏洞的问题，并提出了评估分类器鲁棒性、利用单词扰动漏洞的SP-Attack攻击方法以及通过数据增强提高分类器鲁棒性的SP-Defense方法。实验结果表明SP-Defense能将攻击成功率下降30.4%和21.2%，而提高鲁棒性达到14.6%和13.9%。同时，SP-Defense还能降低多词扰动攻击成功率。

单字更改足矣：为文本分类器设计攻击与防御