{"type":"ScholarlyArticle","title":"Argot: Generating Adversarial Readable Chinese Texts","authors":[{"name":"Zihan Zhang","slug":"zihan-zhang","given":"Zihan","family":"Zhang","affiliation":"Tsinghua University"},{"name":"Mingxuan Liu","slug":"mingxuan-liu","given":"Mingxuan","family":"Liu","affiliation":"Tsinghua University"},{"name":"Chao Zhang","slug":"chao-zhang","given":"Chao","family":"Zhang","affiliation":"Tsinghua University; Beijing National Research Center for Information Science and Technology"},{"name":"Yiming Zhang","slug":"yiming-zhang","given":"Yiming","family":"Zhang","affiliation":"Tsinghua University"},{"name":"Zhou Li","slug":"zhou-li","given":"Zhou","family":"Li","affiliation":"University of California Irvine"},{"name":"Qi Li","slug":"qi-li","given":"Qi","family":"Li","affiliation":"Tsinghua University; Beijing National Research Center for Information Science and Technology"},{"name":"Haixin Duan","slug":"haixin-duan","given":"Haixin","family":"Duan","affiliation":"Tsinghua University; Beijing National Research Center for Information Science and Technology; Qi An Xin Group"},{"name":"Donghong Sun","slug":"donghong-sun","given":"Donghong","family":"Sun","affiliation":"Tsinghua University; Beijing National Research Center for Information Science and Technology"}],"abstract":"Natural language processing (NLP) models are known vulnerable to adversarial examples, similar to image processing models. Studying adversarial texts is an essential step to improve the robustness of NLP models. However, existing studies mainly focus on analyzing English texts and generating adversarial examples for English texts. There is no work studying the possibility and effect of the transformation to another language, e.g, Chinese. In this paper, we analyze the differences between Chinese and English, and explore the methodology to transform the existing English adversarial generation method to Chinese. We propose a novel black-box adversarial Chinese texts generation solution Argot, by utilizing the method for adversarial English samples and several novel methods developed on Chinese characteristics. Argot could effectively and efficiently generate adversarial Chinese texts with good readability. Furthermore, Argot could also automatically generate targeted Chinese adversarial text, achieving a high success rate and ensuring readability of the Chinese.","doi":"10.24963/ijcai.2020/351","url":"https://ijcai.org/proceedings/2020/351","pdf":"https://ijcai.org/proceedings/2020/0351.pdf","markdown":"https://ijcai.org/proceedings/2020/351.md","bibtex":"https://ijcai.org/proceedings/2020/bibtex/351","volume":{"slug":"2020","title":"Proceedings of the Twenty-Ninth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2020","url":"https://ijcai.org/proceedings/2020/","year":2020,"location":"Yokohama","dates":"January 2021 (postponed from 11-17 July 2020)","editors":"Christian Bessiere","isbn":"978-0-9992411-6-5","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2020"},"section":"Machine Learning","track":"Main track","number":351,"pages":{"first":2533,"last":2539},"keywords":["Machine Learning: Adversarial Machine Learning","Natural Language Processing: Natural Language Processing"],"videos":[{"label":"Video","url":"https://videos.ijcai20.org/24712/file_24712.m3u8","length_sec":293,"provider":"hls"}],"references":[{"position":1,"raw":"[Alzantot et al., 2018] Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, and Kai- Wei Chang. Generating natural language adversarial ex- amples. arXiv preprint arXiv:1804.07998, 2018.","title":"Generating natural language adversarial examples","authors":"Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, Kai-Wei Chang","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Chen and Lee, 2000] Zheng Chen and Kai-Fu Lee. A new statistical approach to chinese pinyin input. In Proceedings of the 38th Annual Meeting of the Association for Compu- tational Linguistics, pages 241-247, 2000.","title":"A new statistical approach to chinese pinyin input","authors":"Zheng Chen, Kai-Fu Lee","year":"2000","venue":"Proceedings of the 38th Annual Meeting of the Association for Computational Linguistics","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Chopra et al., 2005] Sumit Chopra, Raia Hadsell, Yann Le- Cun, et al. Learning a similarity metric discriminatively, with application to face verification. In CVPR (1), pages 539-546, 2005.","title":"Learning a similarity metric discriminatively, with application to face verification","authors":"Sumit Chopra, Raia Hadsell, Yann Le-Cun","year":"2005","venue":"CVPR (1)","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Ebrahimi et al., 2017] Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. Hotflip: White-box adver- sarial examples for text classification. arXiv preprint arXiv:1712.06751, 2017.","title":"Hotflip: White-box adversarial examples for text classification","authors":"Javid Ebrahimi, Anyi Rao, Daniel Lowd, Dejing Dou","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Gao et al., 2018] Ji Gao, Jack Lanchantin, Mary Lou Soffa, and Yanjun Qi. Black-box generation of adversarial text sequences to evade deep learning classifiers. In 2018 IEEE Security and Privacy Workshops (SPW), pages 50- 56. IEEE, 2018.","title":"Black-box generation of adversarial text sequences to evade deep learning classifiers","authors":"Ji Gao, Jack Lanchantin, Mary Lou Soffa, Yanjun Qi","year":"2018","venue":"2018 IEEE Security and Privacy Workshops (SPW)","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Gong et al., 2018] Zhitao Gong, Wenlu Wang, Bo Li, Dawn Song, and Wei-Shinn Ku. Adversarial texts with gradient methods. arXiv preprint arXiv:1801.07175, 2018.","title":"Adversarial texts with gradient methods","authors":"Gong","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Hai Liang Wang, 2017] Hu Ying Xi Hai Liang Wang. Syn- onyms, 2017.","title":"Synonyms","authors":"Hu Ying, Xi Hai, Liang Wang","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Hai Liang Wang, 2018] Hu Ying Xi Hai Liang Wang. python-pinyin, 2018.","title":"python-pinyin","authors":"Hu Ying, Xi Hai, Liang Wang","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Hiruncharoenvate et al., 2015] Chaya Hiruncharoenvate, Zhiyuan Lin, and Eric Gilbert. Algorithmically by- passing censorship on sina weibo with nondeterministic homophone substitutions. In Ninth International AAAI Conference on Web and Social Media, 2015.","title":"Algorithmically bypassing censorship on sina weibo with nondeterministic homophone substitutions","authors":"Chaya Hiruncharoenvate, Zhiyuan Lin, Eric Gilbert","year":"2015","venue":"Ninth International AAAI Conference on Web and Social Media","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Kim, 2014] Yoon Kim. Convolutional neural networks for sentence classification. arXiv preprint arXiv:1408.5882, 2014.","title":"Convolutional neural networks for sentence classification","authors":"Yoon Kim","year":"2014","venue":null,"doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Kuleshov et al., 2018] Volodymyr Kuleshov, Shantanu Thakoor, Tingfung Lau, and Stefano Ermon. Adversarial examples for natural language classification problems. 2018.","title":"Adversarial examples for natural language classification problems","authors":"Volodymyr Kuleshov, Shantanu Thakoor, Tingfung Lau, Stefano Ermon","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Li et al., 2018a] Jinfeng Li, Shouling Ji, Tianyu Du, Bo Li, and Ting Wang. Textbugger: Generating adversar- ial text against real-world applications. arXiv preprint arXiv:1812.05271, 2018.","title":"Textbugger: Generating adversarial text against real-world applications","authors":"Li","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Li et al., 2018b] Shen Li, Zhe Zhao, Renfen Hu, Wensi Li, Tao Liu, and Xiaoyong Du. Analogical reasoning on chinese morphological and semantic relations. In Pro- ceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pages 138-143. Association for Computational Linguis- tics, 2018.","title":"Analogical reasoning on chinese morphological and semantic relations","authors":"Li","year":"2018","venue":"Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Liang et al., 2017] Bin Liang, Hongcheng Li, Miaoqiang Su, Pan Bian, Xirong Li, and Wenchang Shi. Deep text classification can be fooled. arXiv preprint arXiv:1704.08006, 2017.","title":"Deep text classification can be fooled","authors":"Bin Liang, Hongcheng Li, Miaoqiang Su, Pan Bian, Xirong Li, Wenchang Shi","year":"2017","venue":null,"doi":null,"url":null,"internal_url":"/proceedings/2018/585"},{"position":15,"raw":"[Mikolov et al., 2013] Tomas Mikolov, Kai Chen, Greg Corrado, and Jeffrey Dean. Efficient estimation of word representations in vector space. arXiv preprint arXiv:1301.3781, 2013.","title":"Efficient estimation of word representations in vector space","authors":"Tomas Mikolov, Kai Chen, Greg Corrado, Jeffrey Dean","year":"2013","venue":null,"doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Miyato et al., 2017] Takeru Miyato, Andrew M. Dai, and Ian J. Goodfellow. Adversarial training methods for semi- supervised text classification. In 5th International Con- ference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings, 2017.","title":"Adversarial training methods for semisupervised text classification","authors":"Takeru Miyato, Andrew M Dai, Ian J Goodfellow","year":"2017","venue":"5th International Conference on Learning Representations, ICLR 2017","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Nobata et al., 2016] Chikashi Nobata, Joel Tetreault, Achint Thomas, Yashar Mehdad, and Yi Chang. Abusive language detection in online user content. In Proceedings of the 25th international conference on world wide web, pages 145-153. International World Wide Web Conferences Steering Committee, 2016.","title":"Abusive language detection in online user content","authors":"Nobata","year":"2016","venue":"Proceedings of the 25th international conference on world wide web","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Papernot et al., 2016] Nicolas Papernot, Patrick McDaniel, Ananthram Swami, and Richard Harang. Crafting ad- versarial input sequences for recurrent neural networks. In MILCOM 2016-2016 IEEE Military Communications Conference, pages 49-54. IEEE, 2016.","title":"Crafting adversarial input sequences for recurrent neural networks","authors":"Nicolas Papernot, Patrick Mcdaniel, Ananthram Swami, Richard Harang","year":"2016","venue":"MILCOM 2016-2016 IEEE Military Communications Conference","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Ravi and Ravi, 2015] Kumar Ravi and Vadlamani Ravi. A survey on opinion mining and sentiment analysis: tasks, approaches and applications. Knowledge-Based Systems, 89:14-46, 2015.","title":"A survey on opinion mining and sentiment analysis: tasks, approaches and applications","authors":"Kumar Ravi, Vadlamani Ravi","year":"2015","venue":"Knowledge-Based Systems","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Samanta and Mehta, 2017] Suranjana Samanta and Sameep Mehta. Towards crafting text adversarial samples. arXiv preprint arXiv:1707.02812, 2017.","title":"Towards crafting text adversarial samples","authors":"Mehta Samanta","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Sato et al., 2018] Motoki Sato, Jun Suzuki, Hiroyuki Shindo, and Yuji Matsumoto. Interpretable adversarial perturbation in input embedding space for text. In Pro- ceedings of the Twenty-Seventh International Joint Con- ference on Artificial Intelligence, IJCAI 2018, July 13-19, 2018, Stockholm, Sweden, pages 4323-4330, 2018.","title":"Interpretable adversarial perturbation in input embedding space for text","authors":"Motoki Sato, Jun Suzuki, Hiroyuki Shindo, Yuji Matsumoto","year":"2018","venue":"Proceedings of the Twenty-Seventh International Joint Conference on Artificial Intelligence, IJCAI 2018","doi":null,"url":null,"internal_url":"/proceedings/2018/601"},{"position":22,"raw":"[Sun et al., 2016] Maosong Sun, Xinxiong Chen, Kaixu Zhang, Zhipeng Guo, and Zhiyuan Liu. Thulac: An effi- cient lexical analyzer for chinese. Technical report, Tech- nical Report. Technical Report, 2016.","title":"Thulac: An efficient lexical analyzer for chinese","authors":"Sun","year":"2016","venue":null,"doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Tiantian, 2015] Le Tiantian. Pinyin2hanzi, 2015.","title":"Pinyin2hanzi","authors":"Le Tiantian","year":"2015","venue":null,"doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Wu et al., 2019] Wei Wu, Yuxian Meng, Qinghong Han, Muyu Li, Xiaoya Li, Jie Mei, Ping Nie, Xiaofei Sun, and Jiwei Li. Glyce: Glyph-vectors for chinese character rep- resentations. arXiv preprint arXiv:1901.10125, 2019.","title":"Glyce: Glyph-vectors for chinese character representations","authors":"Wei Wu, Yuxian Meng, Qinghong Han, Muyu Li, Xiaoya Li, Jie Mei, Ping Nie, Xiaofei Sun, Jiwei Li","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Zhang et al., 2015] Xiang Zhang, Junbo Zhao, and Yann LeCun. Character-level convolutional networks for text classification. In Advances in neural information process- ing systems, pages 649-657, 2015.","title":"Character-level convolutional networks for text classification","authors":"Xiang Zhang, Junbo Zhao, Yann Lecun","year":"2015","venue":"Advances in neural information processing systems","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Zhu et al., 2018] Wenhao Zhu, Xin Jin, Jianyue Ni, Bao- gang Wei, and Zhiguo Lu. Improve word embed- ding using both writing and pronunciation. PloS one, 13(12):e0208785, 2018.","title":"Improve word embedding using both writing and pronunciation","authors":"Wenhao Zhu, Xin Jin, Jianyue Ni, Baogang Wei, Zhiguo Lu","year":"2018","venue":"PloS one","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}