用二分法选词，大幅减少黑盒攻击查询次数。
BinarySelect to Improve Accessibility of Black-Box Attack Research
- 结合二分搜索与选词策略，降低查询开销。
- 查询次数从n降至log₂(n)×2，yelp数据集省72次。
- 适合资源有限的研究者开展高效对抗攻击研究。
对抗文本攻击研究有助于检验NLP模型的鲁棒性，但随着Transformer模型的兴起，攻击测试所需时间显著增加，尤其对缺乏充足计算资源（如GPU）的研究者而言。单次攻击修改一个样本可能需数百次查询，尤其在黑盒攻击中，通常逐个移除词以寻找最优替换项，需n次查询（文本长度）。本文提出更高效的选词方法BinarySelect，结合二分搜索与攻击选择机制，将首个目标词的查找查询数从n降至log₂(n)×2。我们在5个分类器、3个数据集上验证该方法，在Yelp数据集上查询数减少32%（72次），攻击效果仅下降5个百分点，实现查询量与攻击效能的可行平衡。我们相信BinarySelect可帮助资源受限的研究者更高效地开展对抗攻击与黑盒问题研究。
原文摘要 · Abstract (English)
Adversarial text attack research is useful for testing the robustness of NLP models, however, the rise of transformers has greatly increased the time required to test attacks. Especially when researchers do not have access to adequate resources (e.g. GPUs). This can hinder attack research, as modifying one example for an attack can require hundreds of queries to a model, especially for black-box attacks. Often these attacks remove one token at a time to find the ideal one to change, requiring $n$ queries (the length of the text) right away. We propose a more efficient selection method called BinarySelect which combines binary search and attack selection methods to greatly reduce the number of queries needed to find a token. We find that BinarySelect only needs $\text{log}_2(n) * 2$ queries to find the first token compared to $n$ queries. We also test BinarySelect in an attack setting against 5 classifiers across 3 datasets and find a viable tradeoff between number of queries saved and attack effectiveness. For example, on the Yelp dataset, the number of queries is reduced by 32% (72 less) with a drop in attack effectiveness of only 5 points. We believe that BinarySelect can help future researchers study adversarial attacks and black-box problems more efficiently and opens the door for researchers with access to less resources.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。