Adversarial examples are helpful for analyzing and improving the robustness
of text classifiers. Generating high-quality adversarial examples is a
challenging task as it requires generating fluent adversarial sentences that
are semantically similar to the original sentences and preserve the original
labels, while causing the classifier to misclassify them. Existing methods
prioritize misclassification by maximizing each perturbation's effectiveness at
misleading a text classifier; thus, the generated adversarial examples fall
short in terms of fluency and similarity. In this paper, we propose a rewrite
and rollback (R&R) framework for adversarial attack. It improves the quality of
adversarial examples by optimizing a critique score which combines the fluency,
similarity, and misclassification metrics. R&R generates high-quality
adversarial examples by allowing exploration of perturbations that do not have
immediate impact on the misclassification metric but can improve fluency and
similarity metrics. We evaluate our method on 5 representative datasets and 3
classifier architectures. Our method outperforms current state-of-the-art in
attack success rate by +16.2%, +12.8%, and +14.0% on the classifiers
respectively. Code is available at this https URL

本文提出了一个 rewrite and rollback（R&R）框架，该框架通过优化批判分数来改进对抗样例的质量，结合流畅度、相似性和错分类度量，提高了对抗样例的质量，并在 5 个代表性数据集和 3 种分类器架构上进行了评估，攻击成功率分别增加了 + 16.2％，+12.8％和 + 14.0％。