通过替换关键词生成欺骗性问题，让问答模型答错。
Deceiving Question-Answering Models: A Hybrid Word-Level Adversarial Approach
- 基于注意力机制定位关键词，用同义词替换制造误导。
- 在多个数据集上使基线模型错误率提升，超越现有攻击方法。
- 适合研究模型鲁棒性或安全性的研究人员参考。
深度学习支撑着当前大多数先进自然语言处理任务，如文本分类、神经机器翻译（NMT）、抽象摘要和问答（QA）。然而，模型尤其是问答模型对对抗攻击的鲁棒性仍是一个关键且未充分探索的问题。本文提出QA-Attack（问答攻击），一种新颖的词级对抗策略，可误导问答模型。该基于注意力的攻击利用定制化注意力机制与删除排序策略，识别并针对上下文段落中的特定词语。通过精心选择并替换同义词，在保持语法正确性的同时，使模型产生错误回答。该方法在多种问题类型中表现出色，尤其适用于长文本输入。在多个基准数据集上的大量实验表明，QA-Attack能有效欺骗基线问答模型，其成功率、语义变化、BLEU分数、流畅度及语法错误率均优于现有对抗技术。
原文摘要 · Abstract (English)
Deep learning underpins most of the currently advanced natural language processing (NLP) tasks such as textual classification, neural machine translation (NMT), abstractive summarization and question-answering (QA). However, the robustness of the models, particularly QA models, against adversarial attacks is a critical concern that remains insufficiently explored. This paper introduces QA-Attack (Question Answering Attack), a novel word-level adversarial strategy that fools QA models. Our attention-based attack exploits the customized attention mechanism and deletion ranking strategy to identify and target specific words within contextual passages. It creates deceptive inputs by carefully choosing and substituting synonyms, preserving grammatical integrity while misleading the model to produce incorrect responses. Our approach demonstrates versatility across various question types, particularly when dealing with extensive long textual inputs. Extensive experiments on multiple benchmark datasets demonstrate that QA-Attack successfully deceives baseline QA models and surpasses existing adversarial techniques regarding success rate, semantics changes, BLEU score, fluency and grammar error rate.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。