In this paper, we present an effective method to craft text adversarial
samples, revealing one important yet underestimated fact that DNN-based text
classifiers are also prone to adversarial sample attack. Specifically,
confronted with different adversarial scenarios, the text items that are
important for classification are identified by computing the cost gradients of
the input (white-box attack) or generating a series of occluded test samples
(black-box attack). Based on these items, we design three perturbation
strategies, namely insertion, modification, and removal, to generate
adversarial samples. The experiment results show that the adversarial samples
generated by our method can successfully fool both state-of-the-art
character-level and word-level DNN-based text classifiers. The adversarial
samples can be perturbed to any desirable classes without compromising their
utilities. At the same time, the introduced perturbation is difficult to be
perceived.

本文介绍了一种有效的方法来生成文本对抗样本，证明了基于深度神经网络的文本分类器同样容易受到对抗样本的攻击。通过计算代价梯度或者生成一系列遮盖测试样本，可以识别用于分类的文本信息，基于这些信息，设计了三种扰动策略（插入、修改、删除）来生成对抗样本。实验表明，基于我们方法生成的对抗样本可以成功欺骗基于字符和词语所的 DNN 文本分类器，并且可以扰动到任意的分类类别而不影响其实用性，同时所引入的扰动难以被发现。