Evaluating on adversarial examples has become a standard procedure to measure
robustness of deep learning models. Due to the difficulty of creating white-box
adversarial examples for discrete text input, most analyses of the robustness
of NLP models have been done through black-box adversarial examples. We
investigate adversarial examples for character-level neural machine translation
(NMT), and contrast black-box adversaries with a novel white-box adversary,
which employs differentiable string-edit operations to rank adversarial
changes. We propose two novel types of attacks which aim to remove or change a
word in a translation, rather than simply break the NMT. We demonstrate that
white-box adversarial examples are significantly stronger than their black-box
counterparts in different attack scenarios, which show more serious
vulnerabilities than previously known. In addition, after performing
adversarial training, which takes only 3 times longer than regular training, we
can improve the model's robustness significantly.

本研究提出了一种基于字符串编辑的白盒敌手算法，并在字符级别神经机器翻译模型中使用两种新类型的攻击来比较黑盒和白盒对抗例子的强度。该研究发现，白盒对抗例子在不同的攻击场景中都会显著强于黑盒对抗例子，并证明在对抗训练中取得了显著的鲁棒性提高。