arXiv:2504.01345cs.CLcs.LG2025-04

用梯度攻击让BERT误判推文情感,隐蔽性高且精准。

Breaking BERT: Gradient Attack on Twitter Sentiment Analysis for Targeted Misclassification

  • 基于梯度重要性排序词语,迭代替换关键词生成对抗文本。
  • 在微调的BERT模型上实现95%以上的目标误分类率。
  • 适合研究模型安全或防御对抗攻击的研究者参考。

Twitter等社交平台广泛采用自然语言处理技术分析用户内容情感,其中最先进的模型是双向编码器表示来自Transformer(BERT)。然而,BERT易受对抗攻击影响。本文旨在剖析此类模型在推文情感分析中的固有漏洞,提出一种构建目标性对抗文本的框架,可在保持隐蔽性的同时欺骗模型。与传统方法不同,该框架核心思想是利用梯度来优先排序文本中每个词的重要性,采用白盒方式实现细粒度敏感性分析,精确定位对分类结果影响最大的词汇。论文分为三个相互关联阶段:首先在推特数据上微调预训练的BERT模型;其次分析模型梯度以排序词的重要程度,并迭代替换为可行候选词直至找到满意解;最后评估对抗文本对自训练情感分类模型的有效性,判断其能否成功误导分类而不引发警觉。

原文摘要 · Abstract (English)

Social media platforms like Twitter have increasingly relied on Natural Language Processing NLP techniques to analyze and understand the sentiments expressed in the user generated content. One such state of the art NLP model is Bidirectional Encoder Representations from Transformers BERT which has been widely adapted in sentiment analysis. BERT is susceptible to adversarial attacks. This paper aims to scrutinize the inherent vulnerabilities of such models in Twitter sentiment analysis. It aims to formulate a framework for constructing targeted adversarial texts capable of deceiving these models, while maintaining stealth. In contrast to conventional methodologies, such as Importance Reweighting, this framework core idea resides in its reliance on gradients to prioritize the importance of individual words within the text. It uses a whitebox approach to attain fine grained sensitivity, pinpointing words that exert maximal influence on the classification outcome. This paper is organized into three interdependent phases. It starts with fine-tuning a pre-trained BERT model on Twitter data. It then analyzes gradients of the model to rank words on their importance, and iteratively replaces those with feasible candidates until an acceptable solution is found. Finally, it evaluates the effectiveness of the adversarial text against the custom trained sentiment classification model. This assessment would help in gauging the capacity of the adversarial text to successfully subvert classification without raising any alarm.

对抗攻击BERT情感分析梯度攻击

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。