Textual adversarial attacking has received wide and increasing attention in
recent years. Various attack models have been proposed, which are enormously
distinct and implemented with different programming frameworks and settings.
These facts hinder quick utilization and fair comparison of attack models. In
this paper, we present an open-source textual adversarial attack toolkit named
OpenAttack to solve these issues. Compared with existing other textual
adversarial attack toolkits, OpenAttack has its unique strengths in support for
all attack types, multilinguality, and parallel processing. Currently,
OpenAttack includes 15 typical attack models that cover all attack types. Its
highly inclusive modular design not only supports quick utilization of existing
attack models, but also enables great flexibility and extensibility. OpenAttack
has broad uses including comparing and evaluating attack models, measuring
robustness of a model, assisting in developing new attack models, and
adversarial training. Source code and documentation can be obtained at
this https URL

本篇论文提出了一个基于开源的文本对抗攻击工具包 OpenAttack，该工具包有其独特的优势，在支持所有攻击类型、多语言和并行处理方面表现突出。它包含 15 种典型的攻击模型，覆盖了所有攻击类型，高度包容性的模块化设计不仅支持现有攻击模型的快速利用，还能实现巨大的灵活性和可扩展性。OpenAttack 工具包广泛应用于攻击模型的比较和评估、模型的鲁棒性测试、辅助开发新的攻击模型和敌对训练等领域。

OpenAttack：一个开源的文本对抗攻击工具包

OpenAttack: An Open-source Textual Adversarial Attack Toolkit

Adversarial attacks are carried out to reveal the vulnerability of deep
neural networks. Textual adversarial attacking is challenging because text is
discrete and a small perturbation can bring significant change to the original
input. Word-level attacking, which can be regarded as a combinatorial
optimization problem, is a well-studied class of textual attack methods.
However, existing word-level attack models are far from perfect, largely
because unsuitable search space reduction methods and inefficient optimization
algorithms are employed. In this paper, we propose a novel attack model, which
incorporates the sememe-based word substitution method and particle swarm
optimization-based search algorithm to solve the two problems separately. We
conduct exhaustive experiments to evaluate our attack model by attacking BiLSTM
and BERT on three benchmark datasets. Experimental results demonstrate that our
model consistently achieves much higher attack success rates and crafts more
high-quality adversarial examples as compared to baseline methods. Also,
further experiments show our model has higher transferability and can bring
more robustness enhancement to victim models by adversarial training. All the
code and data of this paper can be obtained on
this https URL

本文提出了一种新颖的攻击模型，采用语义元替换和粒子群优化算法处理词级攻击中不适当的搜索空间缩减方法和低效的优化算法，实验结果表明该模型相对于基线方法在攻击成功率方面显著提高，可生成更高质量的对抗样本并通过对抗训练提高受害模型的鲁棒性。