Recent work has demonstrated the vulnerability of modern text classifiers to
universal adversarial attacks, which are input-agnostic sequences of words
added to text processed by classifiers. Despite being successful, the word
sequences produced in such attacks are often ungrammatical and can be easily
distinguished from natural text. We develop adversarial attacks that appear
closer to natural English phrases and yet confuse classification systems when
added to benign inputs. We leverage an adversarially regularized autoencoder
(ARAE) to generate triggers and propose a gradient-based search that aims to
maximize the downstream classifier's prediction loss. Our attacks effectively
reduce model accuracy on classification tasks while being less identifiable
than prior models as per automatic detection metrics and human-subject studies.
Our aim is to demonstrate that adversarial attacks can be made harder to detect
than previously thought and to enable the development of appropriate defenses.

利用对抗正则化自编码器 (ARAE) 和梯度搜索等技术，对现代文本分类器进行了对抗攻击，生成的词组比先前模型更接近自然的英语短语，并能在被加入到输入文本后成功混淆分类器，并且难以被自动检测或人为辨识。该研究的目的是展示对抗攻击可以比先前认为的更难被检测到，并推动防御技术的发展。