Recent studies on adversarial examples expose vulnerabilities of natural
language processing (NLP) models. Existing techniques for generating
adversarial examples are typically driven by deterministic heuristic rules that
are agnostic to the optimal adversarial examples, a strategy that often results
in attack failures. To this end, this research proposes Fraud's Bargain Attack
(FBA) which utilizes a novel randomization mechanism to enlarge the search
space and enables high-quality adversarial examples to be generated with high
probabilities. FBA applies the Metropolis-Hasting sampler, a member of Markov
Chain Monte Carlo samplers, to enhance the selection of adversarial examples
from all candidates proposed by a customized stochastic process that we call
the Word Manipulation Process (WMP). WMP perturbs one word at a time via
insertion, removal or substitution in a contextual-aware manner. Extensive
experiments demonstrate that FBA outperforms the state-of-the-art methods in
terms of both attack success rate and imperceptibility.

本研究提出了一种名为欺诈交易攻击（FBA）的新型随机化机制，利用 Metropolis-Hasting 采样器和自定义的随机过程，即单词操纵过程（WMP），对文本进行单词级别的扰动，生成高质量的对自然语言处理（NLP）模型的对抗样本，实验证明其攻击成功率和难以察觉性均优于现有技术。