提出两种新策略，显著降低文本对抗攻击的查询次数。
Overcoming Black-box Attack Inefficiency with Hybrid and Dynamic Select Algorithms
- 混合选择法根据文本长度动态切换最优攻击策略
- 平均减少25.82%查询量，攻击效果不下降
- 适合资源有限的研究者快速评估模型鲁棒性
对抗性文本攻击研究对评估NLP模型的鲁棒性至关重要。然而，基于Transformer的架构日益复杂，导致攻击测试的计算成本大幅上升，尤其对资源有限（如GPU）的研究者而言。现有主流黑盒攻击方法通常需要大量查询，效率低下且难以实用。为此，我们提出两种新的攻击选择策略：混合选择（Hybrid Select）与动态选择（Dynamic Select），更好融合以往选择算法的优势。混合选择通过引入大小阈值，将广义二分选择（BinarySelect）与贪婪选择（GreedySelect）结合；动态选择则学习不同文本长度下各方法的适用性，实现自适应组合。在4个数据集和6个目标模型上验证，最佳方法（句级混合选择）平均可减少25.82%的攻击查询次数，同时保持攻击有效性，适用于编码器模型与大语言模型。
原文摘要 · Abstract (English)
Adversarial text attack research plays a crucial role in evaluating the robustness of NLP models. However, the increasing complexity of transformer-based architectures has dramatically raised the computational cost of attack testing, especially for researchers with limited resources (e.g., GPUs). Existing popular black-box attack methods often require a large number of queries, which can make them inefficient and impractical for researchers. To address these challenges, we propose two new attack selection strategies called Hybrid and Dynamic Select, which better combine the strengths of previous selection algorithms. Hybrid Select merges generalized BinarySelect techniques with GreedySelect by introducing a size threshold to decide which selection algorithm to use. Dynamic Select provides an alternative approach of combining the generalized Binary and GreedySelect by learning which lengths of texts each selection method should be applied to. This greatly reduces the number of queries needed while maintaining attack effectiveness (a limitation of BinarySelect). Across 4 datasets and 6 target models, our best method(sentence-level Hybrid Select) is able to reduce the number of required queries per attack up 25.82\% on average against both encoder models and LLMs, without losing the effectiveness of the attack.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。