Adversarial examples in NLP are receiving increasing research attention. One
line of investigation is the generation of word-level adversarial examples
against fine-tuned Transformer models that preserve naturalness and
grammaticality. Previous work found that human- and machine-generated
adversarial examples are comparable in their naturalness and grammatical
correctness. Most notably, humans were able to generate adversarial examples
much more effortlessly than automated attacks. In this paper, we provide a
detailed analysis of exactly how humans create these adversarial examples. By
exploring the behavioural patterns of human workers during the generation
process, we identify statistically significant tendencies based on which words
humans prefer to select for adversarial replacement (e.g., word frequencies,
word saliencies, sentiment) as well as where and when words are replaced in an
input sequence. With our findings, we seek to inspire efforts that harness
human strategies for more robust NLP models.

本研究分析了人类如何生成针对细调 Transformer 模型的自然性和语法正确性保持的词级对抗性示例，通过探索人类工作者在生成过程中的行为模式，我们识别出人类更喜欢选择哪些单词进行对抗替换以及何时何地进行替换。研究结果可用于启发利用人类策略制定更强大的自然语言处理模型。

识别生成单词级对抗样本的人类策略

Identifying Human Strategies for Generating Word-Level Adversarial Examples

In this work, we examine methods for data augmentation for text-based tasks
such as neural machine translation (NMT). We formulate the design of a data
augmentation policy with desirable properties as an optimization problem, and
derive a generic analytic solution. This solution not only subsumes some
existing augmentation schemes, but also leads to an extremely simple data
augmentation strategy for NMT: randomly replacing words in both the source
sentence and the target sentence with other random words from their
corresponding vocabularies. We name this method SwitchOut. Experiments on three
translation datasets of different scales show that SwitchOut yields consistent
improvements of about 0.5 BLEU, achieving better or comparable performances to
strong alternatives such as word dropout (Sennrich et al., 2016a). Code to
implement this method is included in the appendix.

本文针对神经机器翻译等文本任务的数据增强方法进行了研究。我们将数据增强策略的设计形式化为一个优化问题，并推导出一种通用的解析解。该方法不仅综合了一些现有的增强方案，而且还引导出一种极为简单的数据增强策略：随机地用其对应的词汇库中的其他单词替换源语句和目标语句中的单词。我们将这个方法命名为 SwitchOut。对三个不同规模的翻译数据集进行实验表明，SwitchOut 可以始终改进约 0.5 BLEU，达到比强大的替代方案如单词丢失（Sennrich et al.，2016a）更好或相当的性能。文中还包括了代码以实现该方法。