改进的BeamAttack可精准破坏谣言分类模型，仅微调少量词就骗过多个主流模型。
Robustness of Misinformation Classification Systems to Adversarial Examples Through BeamAttack
- 用束搜索优化词替换，支持删词和跳过替换，找最小扰动。
- 在多个数据集上攻击成功率超99%，原文语义几乎不变。
- 适合评估谣言检测系统安全性，尤其对对抗训练模型也有效。
我们扩展了针对文本分类系统的对抗攻击算法BeamAttack，使其通过词级修改并借助束搜索进行优化。新方法支持词删除及跳过替换操作，能够发现最小化修改即可改变模型预测结果。同时引入LIME以更好优先选择词替换。在BODEGA框架下，针对多个数据集与目标模型（BiLSTM、BERT、对抗训练的RoBERTa）进行评估，该方法在保持原文语义和词汇相似性的前提下，攻击成功率超过99%。通过定量与定性分析，揭示了BeamAttack的有效性及其局限性。代码已开源：https://github.com/LucK1Y/BeamAttack。
原文摘要 · Abstract (English)
We extend BeamAttack, an adversarial attack algorithm designed to evaluate the robustness of text classification systems through word-level modifications guided by beam search. Our extensions include support for word deletions and the option to skip substitutions, enabling the discovery of minimal modifications that alter model predictions. We also integrate LIME to better prioritize word replacements. Evaluated across multiple datasets and victim models (BiLSTM, BERT, and adversarially trained RoBERTa) within the BODEGA framework, our approach achieves over a 99\% attack success rate while preserving the semantic and lexical similarity of the original texts. Through both quantitative and qualitative analysis, we highlight BeamAttack's effectiveness and its limitations. Our implementation is available at https://github.com/LucK1Y/BeamAttack
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。