{"type":"ScholarlyArticle","title":"Annealing Genetic-based Preposition Substitution for Text Rubbish Example Generation","authors":[{"name":"Chen Li","slug":"chen-li","given":"Chen","family":"Li","affiliation":"China University of Petroleum (East China)"},{"name":"Xinghao Yang","slug":"xinghao-yang","given":"Xinghao","family":"Yang","affiliation":"China University of Petroleum (East China)"},{"name":"Baodi Liu","slug":"baodi-liu","given":"Baodi","family":"Liu","affiliation":"China University of Petroleum (East China)"},{"name":"Weifeng Liu","slug":"weifeng-liu","given":"Weifeng","family":"Liu","affiliation":"China University of Petroleum (East China)"},{"name":"Honglong Chen","slug":"honglong-chen","given":"Honglong","family":"Chen","affiliation":"China University of Petroleum (East China)"}],"abstract":"Modern Natural Language Processing (NLP) models expose under-sensitivity towards text rubbish examples. The text rubbish example is the heavily modified input text which is nonsensical to humans but does not change the model’s prediction. Prior work crafts rubbish examples by iteratively deleting words and determining the deletion order with beam search. However, the produced rubbish examples usually cause a reduction in model confidence and sometimes deliver human-readable text. To address these problems, we propose an Annealing Genetic based Preposition Substitution (AGPS) algorithm for text rubbish sample generation with two major merits. Firstly, the AGPS crafts rubbish text examples by substituting input words with meaningless prepositions instead of directly removing them, which brings less degradation to the model’s confidence. Secondly, we design an Annealing Genetic algorithm to optimize the word replacement priority, which allows the Genetic Algorithm (GA) to jump out the local optima with probabilities. This is significant in achieving better objectives, i.e., a high word modification rate and a high model confidence. Experimental results on five popular datasets manifest the superiority of AGPS compared with the baseline and expose the fact: the NLP models can not really understand the semantics of sentences, as they give the same prediction with even higher confidence for the nonsensical preposition sequences.","doi":"10.24963/ijcai.2023/569","url":"https://ijcai.org/proceedings/2023/569","pdf":"https://ijcai.org/proceedings/2023/0569.pdf","markdown":"https://ijcai.org/proceedings/2023/569.md","bibtex":"https://ijcai.org/proceedings/2023/bibtex/569","volume":{"slug":"2023","title":"Proceedings of the Thirty-Second International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2023","url":"https://ijcai.org/proceedings/2023/","year":2023,"location":"Macao, SAR","dates":"19-25 August 2023","editors":"Edith Elkind","isbn":"978-1-956792-03-4","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2023"},"section":"Natural Language Processing","track":"Main Track","number":569,"pages":{"first":5122,"last":5130},"keywords":["Natural Language Processing: NLP: Interpretability and analysis of models for NLP","Natural Language Processing: NLP: Text classification"],"videos":[],"references":[{"position":1,"raw":"[Alzantot et al., 2018] Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, and Kai- Wei Chang. Generating natural language adversarial ex- amples. arXiv preprint arXiv:1804.07998, 2018.","title":"Generating natural language adversarial examples","authors":"Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, Kai-Wei Chang","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Bakator and Radosav, 2018] Mihalj Bakator and Dragica Radosav. Deep learning and medical diagnosis: A review of literature. Multimodal Technologies and Interaction, 2(3):47, 2018.","title":"Mihalj Bakator and Dragica Radosav. Deep learning and medical diagnosis: A review of literature","authors":"Radosav Bakator","year":"2018","venue":"Multimodal Technologies and Interaction","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Bidi and Elberrichi, 2016] Noria Bidi and Zakaria Elber- richi. Feature selection for text classification using ge- netic algorithms. In 2016 8th International Conference on Modelling, Identification and Control (ICMIC), pages 806-810. IEEE, 2016.","title":"Noria Bidi and Zakaria Elberrichi. Feature selection for text classification using genetic algorithms","authors":"Elberrichi Bidi","year":"2016","venue":"2016 8th International Conference on Modelling, Identification and Control (ICMIC)","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Bowman et al., 2015] Samuel R Bowman, Gabor Angeli, Christopher Potts, and Christopher D Manning. A large annotated corpus for learning natural language inference. arXiv preprint arXiv:1508.05326, 2015.","title":"A large annotated corpus for learning natural language inference","authors":"Gabor Samuel R Bowman, Christopher Angeli, Christopher D Potts, Manning","year":"2015","venue":null,"doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Cer et al., 2018] Daniel Cer, Yinfei Yang, Sheng-yi Kong, Nan Hua, Nicole Limtiaco, Rhomni St John, Noah Con- stant, Mario Guajardo-Cespedes, Steve Yuan, Chris Tar, et al. Universal sentence encoder. arXiv preprint arXiv:1803.11175, 2018.","title":"Universal sentence encoder","authors":"Daniel Cer, Yinfei Yang, Sheng-Yi Kong, Nan Hua, Nicole Limtiaco, Rhomni St John, Noah Constant, Mario Guajardo-Cespedes, Steve Yuan, Chris Tar","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Devlin et al., 2018] Jacob Devlin, Ming-Wei Chang, Ken- ton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understand- ing. arXiv preprint arXiv:1810.04805, 2018.","title":"Bert: Pre-training of deep bidirectional transformers for language understanding","authors":"Jacob Devlin, Ming-Wei Chang, Kenton Lee, Kristina Toutanova","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Ebrahimi et al., 2017] Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. Hotflip: White-box adver- sarial examples for text classification. arXiv preprint arXiv:1712.06751, 2017.","title":"Hotflip: White-box adversarial examples for text classification","authors":"Javid Ebrahimi, Anyi Rao, Daniel Lowd, Dejing Dou","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Feng et al., 2018] Shi Feng, Eric Wallace, Alvin Grissom II, Mohit Iyyer, Pedro Rodriguez, and Jordan Boyd-Graber. Pathologies of neural models make interpretations diffi- cult. In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pages 3719- 3728, Brussels, Belgium, October-November 2018. Asso- ciation for Computational Linguistics.","title":"Pathologies of neural models make interpretations difficult","authors":"Eric Shi Feng, Alvin Wallace, I I Grissom, Mohit Iyyer, Pedro Rodriguez, Jordan Boyd-Graber","year":"2018","venue":"Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Ghorbani et al., 2019] Amirata Ghorbani, Abubakar Abid, and James Zou. Interpretation of neural networks is frag- ile. In Proceedings of the AAAI conference on artificial intelligence, volume 33, pages 3681-3688, 2019.","title":"Interpretation of neural networks is fragile","authors":"Ghorbani","year":"2019","venue":"Proceedings of the AAAI conference on artificial intelligence","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Goodfellow et al., 2014] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.","title":"Explaining and harnessing adversarial examples","authors":"Ian J Goodfellow, Jonathon Shlens, Christian Szegedy","year":"2014","venue":null,"doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Guzella and Caminhas, 2009] Thiago S Guzella and Walmir M Caminhas. A review of machine learning approaches to spam filtering. Expert Systems with Applications, 36(7):10206-10222, 2009.","title":"A review of machine learning approaches to spam filtering","authors":"S Thiago, Guzella, M Walmir, Caminhas","year":"2009","venue":"Expert Systems with Applications","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Jia and Liang, 2017] Robin Jia and Percy Liang. Adversar- ial examples for evaluating reading comprehension sys- tems. arXiv preprint arXiv:1707.07328, 2017.","title":"Adversarial examples for evaluating reading comprehension systems","authors":"Liang Jia, Robin Jia, Percy Liang","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Jin et al., 2019] Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. Is bert really robust? natural language attack on text classification and entailment. arXiv preprint arXiv:1907.11932, 2, 2019.","title":"Is bert really robust? natural language attack on text classification and entailment","authors":"Di Jin, Zhijing Jin, Joey Tianyi Zhou, Peter Szolovits","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Kwon and Lee, 2022] Hyun Kwon and Sanghyun Lee. En- semble transfer attack targeting text classification systems. Computers & Security, 117:102695, 2022.","title":"Ensemble transfer attack targeting text classification systems","authors":"Lee ; Kwon, Hyun Kwon, Sanghyun Lee","year":"2022","venue":"Computers & Security","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Lan et al., 2019] Zhenzhong Lan, Mingda Chen, Sebastian Goodman, Kevin Gimpel, Piyush Sharma, and Radu Sori- cut. Albert: A lite bert for self-supervised learning of lan- guage representations. arXiv preprint arXiv:1909.11942, 2019.","title":"Albert: A lite bert for self-supervised learning of language representations","authors":"Zhenzhong Lan, Mingda Chen, Sebastian Goodman, Kevin Gimpel, Piyush Sharma, Radu Soricut","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Li et al., 2020] Dianqi Li, Yizhe Zhang, Hao Peng, Liqun Chen, Chris Brockett, Ming-Ting Sun, and Bill Dolan. Contextualized perturbation for textual adversarial attack. arXiv preprint arXiv:2009.07502, 2020.","title":"Contextualized perturbation for textual adversarial attack","authors":"Dianqi Li, Yizhe Zhang, Hao Peng, Liqun Chen, Chris Brockett, Ming-Ting Sun, Bill Dolan","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Liu et al., 2019] Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:1907.11692, 2019.","title":"Roberta: A robustly optimized bert pretraining approach","authors":"Liu","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Morris et al., 2020a] John X Morris, Eli Lifland, Jack Lan- chantin, Yangfeng Ji, and Yanjun Qi. Reevaluating ad- versarial examples in natural language. arXiv preprint arXiv:2004.14174, 2020.","title":"Reevaluating adversarial examples in natural language","authors":"Morris","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Morris et al., 2020b] John X Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, Di Jin, and Yanjun Qi. Textat- tack: A framework for adversarial attacks, data augmen- tation, and adversarial training in nlp. arXiv preprint arXiv:2005.05909, 2020.","title":"Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp","authors":"Morris","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Mosa et al., 2019] Mohamed Atef Mosa, Arshad Syed An- war, and Alaa Hamouda. A survey of multiple types of text summarization with their satellite contents based on swarm intelligence optimization algorithms. Knowledge- Based Systems, 163:518-532, 2019.","title":"A survey of multiple types of text summarization with their satellite contents based on swarm intelligence optimization algorithms","authors":"Mohamed Atef Mosa, Arshad Syed Anwar, Alaa Hamouda","year":"2019","venue":"Knowledge-Based Systems","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Nguyen et al., 2015] Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High con- fidence predictions for unrecognizable images. In Pro- ceedings of the IEEE conference on computer vision and pattern recognition, pages 427-436, 2015.","title":"Deep neural networks are easily fooled: High confidence predictions for unrecognizable images","authors":"Anh Nguyen, Jason Yosinski, Jeff Clune","year":"2015","venue":"Proceedings of the IEEE conference on computer vision and pattern recognition","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Pang and Lee, 2005] Bo Pang and Lillian Lee. Seeing stars: Exploiting class relationships for sentiment categorization with respect to rating scales. arXiv preprint cs/0506075, 2005.","title":"Seeing stars: Exploiting class relationships for sentiment categorization with respect to rating scales","authors":"Lee ; Pang, Bo Pang, Lillian Lee","year":"2005","venue":null,"doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Papernot et al., 2016] Nicolas Papernot, Patrick McDaniel, Ananthram Swami, and Richard Harang. Crafting ad- versarial input sequences for recurrent neural networks. In MILCOM 2016-2016 IEEE Military Communications Conference, pages 49-54. IEEE, 2016.","title":"Crafting adversarial input sequences for recurrent neural networks","authors":"Nicolas Papernot, Patrick Mcdaniel, Ananthram Swami, Richard Harang","year":"2016","venue":"MILCOM 2016-2016 IEEE Military Communications Conference","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Risch and Krestel, 2020] Julian Risch and Ralf Krestel. Toxic comment detection in online discussions. In Deep learning-based approaches for sentiment analysis, pages 85-109. Springer, 2020.","title":"Toxic comment detection in online discussions","authors":"Julian Risch, Ralf Krestel","year":"2020","venue":"Deep learning-based approaches for sentiment analysis","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Roy et al., 2020] Pradeep Kumar Roy, Sarabjeet Singh Chowdhary, and Rocky Bhatia. A machine learning ap- proach for automation of resume recommendation system. Procedia Computer Science, 167:2318-2327, 2020.","title":"A machine learning approach for automation of resume recommendation system","authors":"Pradeep Kumar, Roy, Sarabjeet Singh Chowdhary, Rocky Bhatia","year":"2020","venue":"Procedia Computer Science","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Sanh et al., 2019] Victor Sanh, Lysandre Debut, Julien Chaumond, and Thomas Wolf. Distilbert, a distilled ver- sion of bert: smaller, faster, cheaper and lighter. arXiv preprint arXiv:1910.01108, 2019.","title":"Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter","authors":"Victor Sanh, Lysandre Debut, Julien Chaumond, Thomas Wolf","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Shankar et al., 2017] Iyer Shankar, Dandekar Nikhil, and Csernai Kornel. First quora dataset release: question pairs (2017). URL https://www. quora. com/q/quoradata/First- Quora-Dataset-Release-Question-Pairs, 2017.","title":"First quora dataset release: question pairs","authors":"Iyer Shankar, Dandekar Nikhil, Csernai Kornel","year":"2017","venue":null,"doi":null,"url":"https://www.quora.com/q/quoradata/First-Quora-Dataset-Release-Question-Pairs","internal_url":null},{"position":28,"raw":"[Socher et al., 2013] Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Y Ng, and Christopher Potts. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 conference on empirical methods in natural language processing, pages 1631-1642, 2013.","title":"Recursive deep models for semantic compositionality over a sentiment treebank","authors":"Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Y Ng, Christopher Potts","year":"2013","venue":"Proceedings of the 2013 conference on empirical methods in natural language processing","doi":null,"url":null,"internal_url":null},{"position":29,"raw":"[Song and Park, 2009] Wei Song and Soon Cheol Park. Ge- netic algorithm for text clustering based on latent semantic indexing. Computers & Mathematics with Applications, 57(11-12):1901-1907, 2009.","title":"Genetic algorithm for text clustering based on latent semantic indexing","authors":"Wei Song, Soon Cheol Park","year":"2009","venue":"Computers & Mathematics with Applications","doi":null,"url":null,"internal_url":null},{"position":30,"raw":"[Wang et al., 2018] Alex Wang, Amanpreet Singh, Julian Michael, Felix Hill, Omer Levy, and Samuel R Bow- man. Glue: A multi-task benchmark and analysis plat- form for natural language understanding. arXiv preprint arXiv:1804.07461, 2018.","title":"Glue: A multi-task benchmark and analysis platform for natural language understanding","authors":"Alex Wang, Amanpreet Singh, Julian Michael, Felix Hill, Omer Levy, Samuel R Bowman","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":31,"raw":"[Wang et al., 2022] Boxin Wang, Chejian Xu, Xiangyu Liu, Yu Cheng, and Bo Li. Semattack: natural textual attacks via different semantic spaces. arXiv preprint arXiv:2205.01287, 2022.","title":"Semattack: natural textual attacks via different semantic spaces","authors":"Boxin Wang, Chejian Xu, Xiangyu Liu, Yu Cheng, Bo Li","year":"2022","venue":null,"doi":null,"url":null,"internal_url":null},{"position":32,"raw":"[Welbl et al., 2020] Johannes Welbl, Po-Sen Huang, Robert Stanforth, Sven Gowal, Krishnamurthy Dj Dvijotham, Martin Szummer, and Pushmeet Kohli. Towards verified robustness under text deletion interventions. ICLR 2020, 2020.","title":"Towards verified robustness under text deletion interventions","authors":"Johannes Welbl, Po-Sen Huang, Robert Stanforth, Sven Gowal, Dj Krishnamurthy, Martin Dvijotham, Pushmeet Szummer, Kohli","year":"2020","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":33,"raw":"[Yang et al., 2019] Zhilin Yang, Zihang Dai, Yiming Yang, Jaime Carbonell, Russ R Salakhutdinov, and Quoc V Le. Xlnet: Generalized autoregressive pretraining for lan- guage understanding. Advances in neural information pro- cessing systems, 32, 2019.","title":"Xlnet: Generalized autoregressive pretraining for language understanding","authors":"Zhilin Yang, Zihang Dai, Yiming Yang, Jaime Carbonell, Russ R Salakhutdinov, Quoc V Le","year":"2019","venue":"Advances in neural information processing systems","doi":null,"url":null,"internal_url":null},{"position":34,"raw":"[Yang et al., 2021] Xinghao Yang, Weifeng Liu, Dacheng Tao, and Wei Liu. Besa: Bert-based simulated annealing for adversarial text attacks. In IJCAI, pages 3293-3299, 2021.","title":"Besa: Bert-based simulated annealing for adversarial text attacks","authors":"Yang","year":"2021","venue":"IJCAI","doi":null,"url":null,"internal_url":"/proceedings/2021/453"},{"position":35,"raw":"[Zang et al., 2019] Yuan Zang, Fanchao Qi, Chenghao Yang, Zhiyuan Liu, Meng Zhang, Qun Liu, and Maosong Sun. Word-level textual adversarial attacking as combinatorial optimization. arXiv preprint arXiv:1910.12196, 2019.","title":"Word-level textual adversarial attacking as combinatorial optimization","authors":"Yuan Zang, Fanchao Qi, Chenghao Yang, Zhiyuan Liu, Meng Zhang, Qun Liu, Maosong Sun","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}