Single Word Change is All You Need: Using LLMs to Create Synthetic Training Examples for Text Classifiers
This addresses a critical security flaw in text classifiers that malicious users could exploit, though it is incremental as it builds on existing adversarial attack and defense research.
The paper tackles the vulnerability of text classifiers to single-word adversarial perturbations by introducing a new metric to measure robustness, an attack method (SP-Attack) that exploits this weakness, and a defense method (SP-Defense) that improves robustness by 14.6% and 13.9% and reduces attack success rates by up to 30.4%.
In text classification, creating an adversarial example means subtly perturbing a few words in a sentence without changing its meaning, causing it to be misclassified by a classifier. A concerning observation is that a significant portion of adversarial examples generated by existing methods change only one word. This single-word perturbation vulnerability represents a significant weakness in classifiers, which malicious users can exploit to efficiently create a multitude of adversarial examples. This paper studies this problem and makes the following key contributions: (1) We introduce a novel metric $ρ$ to quantitatively assess a classifier's robustness against single-word perturbation. (2) We present the SP-Attack, designed to exploit the single-word perturbation vulnerability, achieving a higher attack success rate, better preserving sentence meaning, while reducing computation costs compared to state-of-the-art adversarial methods. (3) We propose SP-Defense, which aims to improve \r{ho} by applying data augmentation in learning. Experimental results on 4 datasets and BERT and distilBERT classifiers show that SP-Defense improves $ρ$ by 14.6% and 13.9% and decreases the attack success rate of SP-Attack by 30.4% and 21.2% on two classifiers respectively, and decreases the attack success rate of existing attack methods that involve multiple-word perturbations.