Recently, generating adversarial examples has become an important means of
measuring robustness of a deep learning model. Adversarial examples help us
identify the susceptibilities of the model and further counter those
vulnerabilities by applying adversarial training techniques. In natural
language domain, small perturbations in the form of misspellings or paraphrases
can drastically change the semantics of the text. We propose a reinforcement
learning based approach towards generating adversarial examples in black-box
settings. We demonstrate that our method is able to fool well-trained models
for (a) IMDB sentiment classification task and (b) AG's news corpus news
categorization task with significantly high success rates. We find that the
adversarial examples generated are semantics-preserving perturbations to the
original text.

提出了一种基于强化学习的方法，在黑盒设置中生成对抗性示例，能够成功地欺骗针对 IMDB 情感分类任务和 AG 新闻语料库新闻分类任务的模型，并且生成的对抗示例保留了原始文本的语义。

使用深度强化模型为文本分类器生成黑盒对抗样本

Generating Black-Box Adversarial Examples for Text Classifiers Using a  Deep Reinforced Model

Deep neural networks (DNNs) are vulnerable to adversarial examples,
perturbations to correctly classified examples which can cause the model to
misclassify. In the image domain, these perturbations are often virtually
indistinguishable to human perception, causing humans and state-of-the-art
models to disagree. However, in the natural language domain, small
perturbations are clearly perceptible, and the replacement of a single word can
drastically alter the semantics of the document. Given these challenges, we use
a black-box population-based optimization algorithm to generate semantically
and syntactically similar adversarial examples that fool well-trained sentiment
analysis and textual entailment models with success rates of 97% and 70%,
respectively. We additionally demonstrate that 92.3% of the successful
sentiment analysis adversarial examples are classified to their original label
by 20 human annotators, and that the examples are perceptibly quite similar.
Finally, we discuss an attempt to use adversarial training as a defense, but
fail to yield improvement, demonstrating the strength and diversity of our
adversarial examples. We hope our findings encourage researchers to pursue
improving the robustness of DNNs in the natural language domain.

通过黑盒基于人口的优化算法生成有迷惑性的语义和语法类似的对抗样本，不仅能提高情感分析和文本蕴涵模型的错误率，还能在 20 名人类注释者中得到 92.3% 的标签正确分类。进一步讨论了对抗训练作为一种防御的尝试，但未能产生改进，说明了这种对抗样本的强大和多样性。我们希望此研究能够鼓励研究人员追求提高自然语言域下深度神经网络的鲁棒性。