Recent work in black-box adversarial attacks for NLP systems has attracted
much attention. Prior black-box attacks assume that attackers can observe
output labels from target models based on selected inputs. In this work,
inspired by adversarial transferability, we propose a new type of black-box NLP
adversarial attack that an attacker can choose a similar domain and transfer
the adversarial examples to the target domain and cause poor performance in
target model. Based on domain adaptation theory, we then propose a defensive
strategy, called Learn2Weight, which trains to predict the weight adjustments
for a target model in order to defend against an attack of similar-domain
adversarial examples. Using Amazon multi-domain sentiment classification
datasets, we empirically show that Learn2Weight is effective against the attack
compared to standard black-box defense methods such as adversarial training and
defensive distillation. This work contributes to the growing literature on
machine learning safety.

提出一种新的黑盒 NLP 对抗攻击，攻击者可以选择类似的领域并将对抗性样本转移到目标领域，本文提出学习调整目标模型权重的防御策略 ——Learn2Weight，证明其对 Amazon 多领域情感分类数据集等攻击效果优于传统防御方法。