Discovering the existence of universal adversarial perturbations had large
theoretical and practical impacts on the field of adversarial learning. In the
text domain, most universal studies focused on adversarial prefixes which are
added to all texts. However, unlike the vision domain, adding the same
perturbation to different inputs results in noticeably unnatural inputs.
Therefore, we introduce a new universal adversarial setup - a universal
adversarial policy, which has many advantages of other universal attacks but
also results in valid texts - thus making it relevant in practice. We achieve
this by learning a single search policy over a predefined set of semantics
preserving text alterations, on many texts. This formulation is universal in
that the policy is successful in finding adversarial examples on new texts
efficiently. Our approach uses text perturbations which were extensively shown
to produce natural attacks in the non-universal setup (specific synonym
replacements). We suggest a strong baseline approach for this formulation which
uses reinforcement learning. It's ability to generalise (from as few as 500
training texts) shows that universal adversarial patterns exist in the text
domain as well.

我们引入了一种新的通用对抗策略，通过在多个文本上学习一个单一的搜索策略，可以成功地找到通用的对抗样本，该策略基于与文本领域相关的名称替换和语义保留文本修改，并使用强化学习来提取强基线方法。