--- title: "Vision-fused Attack: Advancing Aggressive and Stealthy Adversarial Text against Neural Machine Translation" authors: - "Yanni Xue" - "Haojie Hao" - "Jiakai Wang" - "Qiang Sheng" - "Renshuai Tao" - "Yu Liang" - "Pu Feng" - "Xianglong Liu" doi: "10.24963/ijcai.2024/730" url: "https://ijcai.org/proceedings/2024/730" pdf: "https://ijcai.org/proceedings/2024/0730.pdf" venue: "Proceedings of the Thirty-Third International Joint Conference on Artificial Intelligence" year: 2024 pages: "6606-6614" track: "Main Track" keywords: - "Natural Language Processing: NLP: Machine translation and multilinguality" - "AI Ethics, Trust, Fairness: ETF: Safety and robustness" - "Machine Learning: ML: Trustworthy machine learning" --- # Vision-fused Attack: Advancing Aggressive and Stealthy Adversarial Text against Neural Machine Translation Yanni Xue, Haojie Hao, Jiakai Wang, Qiang Sheng, Renshuai Tao, Yu Liang, Pu Feng, Xianglong Liu *Proceedings of the Thirty-Third International Joint Conference on Artificial Intelligence*, pages 6606-6614. DOI: [10.24963/ijcai.2024/730](https://doi.org/10.24963/ijcai.2024/730) ## Abstract While neural machine translation (NMT) models achieve success in our daily lives, they show vulnerability to adversarial attacks. Despite being harmful, these attacks also offer benefits for interpreting and enhancing NMT models, thus drawing increased research attention. However, existing studies on adversarial attacks are insufficient in both attacking ability and human imperceptibility due to their sole focus on the scope of language. This paper proposes a novel vision-fused attack (VFA) framework to acquire powerful adversarial text, i.e., more aggressive and stealthy. Regarding the attacking ability, we design the vision-merged solution space enhancement strategy to enlarge the limited semantic solution space, which enables us to search for adversarial candidates with higher attacking ability. For human imperceptibility, we propose the perception-retained adversarial text selection strategy to align the human text-reading mechanism. Thus, the finally selected adversarial text could be more deceptive. Extensive experiments on various models, including large language models (LLMs) like LLaMA and GPT-3.5, strongly support that VFA outperforms the comparisons by large margins (up to 81%/14% improvements on ASR/SSIM). ## Full text ## 1 Introduction Neural machine translation (NMT) has achieved remarkable progress and has been widely used in many scenarios with the advancement of deep neural networks. However, recent studies have revealed the vulnerability of NMT models. A well-designed adversarial text, which aims to deceive NMT models while remaining imperceptible to humans, could result in poor model performance [Zhang et al., 2021]. Nev- Trans �𝒚𝒚𝒐𝒐𝒐𝒐𝒐𝒐𝒐𝒐𝒐𝒐𝒐𝒐 [Codes can be found at https://github.com/Levelower/VFA.](https://github.com/Levelower/VFA) ![Image](https://ijcai.org/proceedings/2024/fulltext/730/image_000000_1bee15590043e34666b17fa7a1de446a4f0487145df9710c975524ff921ac6b6.png) Figure 1: Our proposed VFA reduces the translation quality of NMT models by generating visually similar characters that are aggressive, such as "未" and "末" in the figure, while maintaining consistency with human's recognition of text to achieve stealthiness. ertheless, as the old saying goes, every coin has two sides, though harming NMT models, the adversarial attacks could also help understand the behavior of the unexplainable deep models. Therefore, generating adversarial text has essential value in constructing trustworthy and robust NMT models. Existing studies on generating adversarial text for NMT models can be classified into targeted attacks and untargeted attacks based on the intended attack purpose. Although both of them aim to fool NMT models, their purposes have a few differences. To be specific, the former simply misleads the translation into arbitrary wrong output, while the latter is intended to let the NMT models make particular false responses, e.g., inserting keywords into the translated sentences [Cheng et al., 2018; Sadrizadeh et al., 2023]. Despite significant progress in generating adversarial text, current studies still show some weaknesses, which can be summarized into two aspects: (1) The unsatisfactory attacking ability. Most attacking methods first search candidate adversarial words in the embedding space, which is strictly constrained due to the extra semantic-preserving requirements. As a result, the searched adversarial results could not mislead the NMT models to the largest extent in such a narrow embedding space. (2) The insufficient imperceptibility goal. Current attacks mainly achieve the goal via restricting the adversarial results at the semantic level. However, the text's perception of mankind is more correlated to the visual system, i.e., humans always recognize text first and process them later. Thus, due to the sole semantic restriction, the generated adversarial text might not be stealthy enough for humans. To tackle these issues, we propose Vision-fused Attack framework (VFA) to generate more aggressive adversarial text against NMT models with higher attacking ability and better visual stealthiness. Figure 1 illustrates the difference between our adversarial text and others. To improve the attacking ability, considering that the limited semantic solution space might restrict the adversarial text candidates, we propose the vision-merged solution space enhancement (VSSE) strategy to abound the searchable adversarial candidates by the visual solution space mixture module. In detail, we first enhance the basic semantic space with the help of a reverse translation block. Further, we map the enhanced solution space into vision space via the text-image transformation block. Since the mapped visual solution space mixes both semantic and visual characteristics, it offers a broader searching range for candidate adversarial words, thus making it more possible to activate higher attacking ability in practice. Regarding the imperceptibility of adversarial text, given the neglected fact that human reading accepts visual signals first to recognize text, we develop the perception-retained adversarial text selection (PATS) strategy to evade human perception through the perception stealthiness enhancement module. Specifically, an improved word replacement operation is preliminarily introduced to disperse attack locations. Then, we integrate the visual characteristics of local characters and global sentences to align with the human text-reading mechanism. Since this selection strategy could filter the human perceptually suspected candidates, we could efficiently and accurately select more imperceptible adversarial text in principle to deceive the text perception of humans. To demonstrate the effectiveness of the proposed method, we conduct extensive experiments under white-box and black-box settings on various representative models and widely-used datasets, including open-source and closedsource large language models like GPT-3.5 and LLaMA. The experimental results strongly support that our VFA outperforms the comparisons by large margins. Our main contributions are as follows: - To the best of our knowledge, we are the first to introduce visual perception, which aligns with human reading, to generate adversarial text against NMT models. - We propose a Vision-fused Attack (VFA) against NMT models, acquiring aggressive and stealthy adversarial text through vision-merged solution space enhancement and perception-retained adversarial text selection. - Extensive experiments show that VFA outperforms the comparisons by large margins (up to 81%/28% improvements on common NMT models/LLMs), and achieves considerable imperceptibility (up to 14% improvements) in both machine evaluation and human study. ## 2 RelatedWork The neural machine translation (NMT), which translates texts from one language to another, has achieved impressive progress using DNN models such as transformers [Vaswani et al., 2017]. Due to their excellent performance, NMT models are widely used in different applications [Gao et al., 2023]. However, recent studies of adversarial text investigate the vulnerability of NMT models, whose ultimate goal is to mislead NMT models but imperceptible to humans. Though they are harmful to DNN models, they could also help us understand them [Wang et al., 2021a; Wang et al., 2021b]. Therefore, there has been an increasing number of recent studies on adversarial attacks against NMT models. Adversarial attacks on NMT models can be divided into untargeted attacks and targeted attacks. Untargeted attacks aim to degrade the translation quality of NMT models. Targeted attacks mislead the victim model to produce a particular translation, for example, one that does not overlap with the reference or inserts some keywords into the translation. Current untargeted attacks always use semantic perturbations to degrade the model performance. Specifically, attackers rank the words in a sentence by saliency and randomly substitute them based on the saliency order [Cheng et al., 2019; Cheng et al., 2020]. However, random substitution may reduce the imperceptibility of adversarial text. Therefore, some studies choose to replace these words with similar ones, requiring semantic similarity techniques to identify similar word lists [Feng et al., 2022]. Nevertheless, the inefficiency of embedding techniques may still result in false substitutions. To resolve this problem, Word Saliency speedup Local Search uses Round-Trip Translation (RTT) to handle it [Zhang et al., 2021]. Additionally, the Doubly RoundTrip Translation (DRTT) method further amplifies the RTT to achieve better quality of adversarial text [Lai et al., 2022]. In targeted attack research, attacks fool the target model into generating a particular translation. Such as the translation does not overlap with the reference or push some words into it [Cheng et al., 2018]. They use a hinge-like loss term and a group lasso regularization to make perturbations, thereby achieving specific attack targets. Since these perturbations in the embedding space are less constrained, they may not preserve semantic similarity. Therefore, some studies define the new optimization problem, including adversarial loss and similarity terms. Finally, they perform gradient projection in the embedding space to generate adversarial sentences [Sadrizadeh et al., 2023]. Both above approaches aim to perturb original sentences with similar words, which satisfies the requirement of semantics-preserving. However, there are differences in the cognitive process of text between humans and models. For humans, the cognitive process of text can be divided into visual perception and semantic understanding, while models only imitate the latter. Therefore, the generated adversarial text does not perform well in the visual perception part, resulting in poor human imperceptibility. ## 3 Approach In this section, we define the adversarial text for NMT models and then elaborate on our proposed Vision-fused Attack. ## 3.1 ProblemDefinition Given a source sentence x and a reference sentence y, the adversarial text xδ is generated to mislead targeted model M to generate low-quality results. Referring to previous work [Ebrahimi et al., 2018a], a successful attack satisfies: Figure 2: Overall framework of our Vision-fused Attack (VFA). We first use the Vision-merged Solution Space Enhancement strategy to search for more aggressive adversarial candidates. Then we find the final adversarial text that best matches human perception through the Perception-retained Adversarial Text Selection strategy. Finally we find more aggressive and stealthy adversarial text against NMT models. ![Image](https://ijcai.org/proceedings/2024/fulltext/730/image_000001_219a6097e5d59cc1fe408b65d05230bfaed95be9a93b9d2a85e546d9c326ea89.png) Here, simt(·) refers to the similarity function used for evaluating semantic similarity. The parameter α is established as the lower limit, representing the lowest degradation of translation quality. It is worth noting that we differ from previous work in assessing effectiveness, which uses sole semantic similarity [Zhang et al., 2021; Lai et al., 2022]. We define an authentic adversarial text from the perspective of visual perception, and the definition of adversarial text differs accordingly. Specifically, we generate a semantically extension ˆx for the original text x (this process will be detailed in the Reverse Translation Block), and use ˆx as the text to be replaced to generate the final adversarial text xδ. Our modified definition is given as: The function simv is a visual similarity function defined by the perception stealthiness enhancement module, which will be detailed in the following subsection. The parameter β and θ ensure the semantic and visual similarity. The authentic adversarial text satisfies the requirements of visual and semantic similarity while degrading the translation quality. ## 3.2 Overview of Vision-fused Attack Previous studies generated adversarial text within a limited semantic space and overlooked the significance of visual perception in text reading. Consequently, it is challenging to produce more aggressive and imperceptible results. In response, we introduce a Vision-fused Attack (VFA) to generate human imperceptible adversarial text against NMT models. The overall framework is illustrated in Figure 2. Addressing the limitation of the semantic solution space, we consider the amplified visual solution space and generate effective adversarial text through the Visual-merged Solution Space Enhancement (VSSE) strategy. Specifically, we expand the essential semantic solution space using a reverse translation block. Furthermore, our method generates candidate adversarial words through a text-image transformation block. With abundant adversarial candidates, we then filter unauthentic candidates using the Perception-retained Adversarial Text Selection (PATS) strategy to acquire more imperceptible adversarial text. Initially, we perform substitutions through an improved word replacement operation. Subsequently, we obtain the authentic adversarial text with a global perceptual constraint. This enables us to achieve superior perceptual retention results, aligning more closely with visioncorrelated human text perception. ## 3.3 Vision-merged Solution Space Enhancement Our vision-merged enhanced solution space consists of two parts: one is the essential semantic space expanded through reverse translation block, which is termed as T, and the other is the mapped visual solution space corresponding to the input text, which is termed as V. Considering the further enhancement of vision-merged solution space, we transform the original input to increase the variety of words. Therefore, we can map semantic space into a larger visual space and search for adversarial words within this expanded area. When generating the candidate adversarial words, we first tokenize the original input sentence and the texts which are transformed through the reverse translation block. Then, we use semantic importance ranking to obtain ordered attack locations. Finally, we acquire possible adversarial candidates through a text-image transformation block. Reverse Translation Block. We initially expand essential semantic space through reverse translation to amplify visionfused solution space. For the source sentence x and the reference sentence y, we generate similar sentences (referred to as ˆx) for x. For each reference translation y, we use an auxiliary translation model Maux to obtain transformed ˆx meanwhile the similarity between x and ˆx need to satisfy the constraint of the lowest thresh β. The sentence similarity is evaluated by a multilingual sentence model, which is termed as Msim: Semantic Importance Ranking. The source sentence can be represented as a list of words w = ⟨w1,w2, ...,wn⟩. For a sequence that is masked at position i, which is termed as wimask = ⟨w1,w2, ...,wi-1, [m],wi+1, ...,wn⟩. We calculate the importance scores of these words at different positions named wi imp . Masked language model Mmlm (e.g., BERT) is used to predict word probability of occurrence. This process can be written as: Text-imageTransformationBlock. For each character c in the Unicode character dictionary (referred to as C), we conduct a level-wise search to find the most similar candidate adversarial characters. Initially, we follow previous work to utilize the glyph dictionary, denoted as D, which stores mappings of specific characters c and their radicals z (Here we denote the set of all radicals as Z, where c ∈ C and z ∈ Z) [Su et al., 2022]. Each radical of character c can be found through function fc(·). We start by aggregating characters with the same radical (denoted as c′ ), narrowing down the candidate pool. We can obtain a portion of the candidate set Srad through a similar radical search, denoted as fa(·): Due to the limitations of the glyph dictionary, we further pixelated the characters set and conducted similar image searches to find similar characters, which is denoted as Spix. The function p(·) is defined to convert a sentence or character into the correlated image. We map the input character to its pixelated image through p(c). Then, we calculate cosine similarity to search top m visually similar results using Faiss (a tool that accelerates vector calculations through hierarchical search) [Johnson et al., 2019]. And the procedure could be formulated as fcos(·): where the top(·) represents the function that identifies the highest-ranked elements based on certain scores, such as cosine similarity. Finally, we apply Mean Squared Error (MSE) similarity to re-rank the possible adversarial character and select the top k candidate result: Combined with the results of Srad and Spix , we can obtain the final candidate adversarial characters set S. ## 3.4 Perception-retained Adversarial Text Selection For the generated candidate characters set S, we apply a perception stealthiness enhancement module, which consists of improved word replacement operation and global perceptual constraint, to filter out truly effective adversarial text. Therefore, the visually imperceptible candidates could stand out to better mislead human perception, i.e., stealthy. ImprovedWord Replacement Operation. Firstly, we implement a substitution constraint strategy grounded in human perception. We intuitively regulate the replacement rate, deliberately replacing only one character within each word. This strategy disrupts the semantic expression of the word and minimizes the impact of perturbation. For text ˆx to be replaced, wi denotes the i-th word in order of importance wi imp of the text, and cj signifies the j-th character of a word wi. The replacement operation rate, denoted as r, falls within the range 0 ≤ r ≤ 1, representing the replacement probability of the overall sentence. And function rep(cjδ , cj) indicates whether the character cj is substituted by cjδ in S. When the character changes, the function equals 1. Otherwise, it equals 0. We can detail this constraint as follows: Global Perceptual Constraint. Moreover, we take visual perception constraints into account. We introduce a visual perceptual similarity score for batch assessment of visual similarity. For a source sentence x paired with a reference image represented as p(x), and a perturbed sentence xδ with its associated image denoted as p(xδ), L(a, b) denotes the perceptual similarity score between images a and b. The parameter ϵ serves as a weight for local perception, where 0 ≤ ϵ ≤ 1. The sentence visual similarity score can be calculated using the visual perception constraint strategy. We introduce the LPIPS metric to construct a global perceptual constraint [Zhang et al., 2018]. This constraint measures the global perceptual similarity of a sentence and aggregates the local perceptual similarities of characters with the weighted summation. Finally, we use the perceptual constraint threshold θ to constrain visual similarity: ## 4 Experiment In this section, we first describe the experimental settings, and then we report the experimental results and some discussions on the common NMT models and LLMs. ## 4.1 Experiments Settings Datasets and Models. We choose the validation set of WMT19 [Ng et al., 2019], WMT18 [Bojar et al., 2018], and TED [Cettolo et al., 2016] for the Chinese-English (ZhEn) translation task and the test set of ASPEC [Nakazawa et al., 2016] for the Japanese-English (Ja-En) translation task. Regarding the models, the NMT models for both translation tasks are implemented using HuggingFace's Marian Model [Junczys-Dowmunt et al., 2018], with the Zh-En/JaEn translation models as the targeted models and the EnZh/En-Ja models as the auxiliary models. These datasets and models are widely used in previous studies. Besides, we consider pixel-based machine translation model as the targeted model to test the validity of our method [Salesky et al., 2023]. Table 1: Performance of VFA on Zh-En and Ja-En translation tasks using pure-text NMT models. The "Baseline" row records the metric scores on the clean dataset. The remaining rows record the different metric scores and the decrease relative to the "Baseline" of adversarial texts generated by various methods. ↓ indicates the lower, the better, and ↑ is the opposite. | Method | WMT19 (Zh-En) - BLEU↓ | WMT19 (Zh-En) - ASR↑ | WMT19 (Zh-En) - SSIM↑ | WMT18 (Zh-En) - BLEU↓ | WMT18 (Zh-En) - ASR↑ | WMT18 (Zh-En) - SSIM↑ | TED (Zh-En) - BLEU↓ | TED (Zh-En) - ASR↑ | TED (Zh-En) - SSIM↑ | ASPEC (Ja-En) - BLEU↓ | ASPEC (Ja-En) - ASR↑ | ASPEC (Ja-En) - SSIM↑ | |----------|-------------------------|------------------------|-------------------------|-------------------------|------------------------|-------------------------|-----------------------|----------------------|-----------------------|-------------------------|------------------------|-------------------------| | Baseline | 0.178 | | | 0.163 | | | 0.159 | | | 0.075 | | | | HotFlip | 0.141↓21% | 0.213 | 0.717 | 0.131↓19% | 0.212 | 0.722 | 0.121↓24% | 0.208 | 0.737 | 0.047↓38% | 0.334 | 0.717 | | Seq2Sick | 0.139↓22% | 0.198 | 0.773 | 0.134↓18% | 0.164 | 0.777 | 0.112↓30% | 0.228 | 0.762 | 0.072↓4% | 0.030 | 0.862 | | Targeted | 0.134↓25% | 0.234 | 0.799 | 0.126↓22% | 0.211 | 0.801 | 0.114↓28% | 0.266 | 0.793 | 0.047↓37% | 0.308 | 0.734 | | DRTT | 0.144↓19% | 0.173 | 0.768 | 0.131↓19% | 0.173 | 0.760 | 0.136↓14% | 0.130 | 0.780 | 0.069↓8% | 0.063 | 0.850 | | ADV | 0.146↓18% | 0.174 | 0.838 | 0.142↓12% | 0.141 | 0.843 | 0.125↓21% | 0.200 | 0.842 | - | - | - | | Ours | 0.107↓40% | 0.382 | 0.950 | 0.097↓40% | 0.384 | 0.949 | 0.109↓31% | 0.299 | 0.964 | 0.042↓44% | 0.387 | 0.859 | Evaluation Metrics. We use the relative decrease of the BLEU to measure the aggressiveness of adversarial text [Papineni et al., 2002]. A successful attack is defined when the BLEU score decreases by over 50%. The attack success rate (ASR) is defined as the ratio of successful adversarial texts to the total. Finally, we use the SSIM value to evaluate the imperceptibility of the adversarial text [Wang et al., 2004]. Compared Methods. We choose several state-of-the-art works about NLP attack and NMT attack, including HotFlip [Ebrahimi et al., 2018b], Seq2Sick [Cheng et al., 2018], Targeted Attack [Sadrizadeh et al., 2023], DRTT [Lai et al., 2022] and ADV [Su et al., 2022]. Implementation Details. As for the hyperparameter settings, we set the global perception constraint to 0.95 and the replacement rate to 0.2. To evaluate the semantic similarity between two sentences, we employ the HuggingFace sentence-transformer model [Wang et al., 2020], which supports multiple languages. Additionally, we utilize a Bert architecture model [Cui et al., 2019] to predict the importance of words. We conduct experiments in a cluster of NVIDIA GeForce RTX 3090 GPUs. ## 4.2 Effectiveness on Common NMTModels In this section, we evaluate the aggressiveness and imperceptibility of adversarial texts generated by our VFA and compared methods. The evaluation is conducted on the Zh-En and Ja-En translation tasks using pure-text and pixel-based NMT models. As seen in Tables 1 and 2, our VFA generates adversarial texts with the highest aggressiveness across both pixelbased and pure-text models in both tasks. (1) In terms of aggressiveness, our VFA achieves the maximum BLEU decrease and the highest ASR on different datasets and translation tasks. Taking the results on WMT18 as an example, our VFA achieves a BLEU decrease of 40%, better than the best of 22% achieved by the Targeted Attack. Our ASR (0.384) outperforms the best (0.212) by 81%. This indicates that our proposed Vision-merged Solution Space Enhancement strategy effectively improves aggressiveness. (2) Regarding imperceptibility, our VFA also achieves the best result. Our VFA maintains an SSIM value above 0.94 on Zh-En translation tasks, while the ADV has an SSIM value of no more than 0.85. Although our VFA is second only to Seq2Sick in the imperceptibility of the Ja-En translation task, Seq2Sick nearly keeps the original sentence when attacking Japanese texts, resulting in lower ASR and inability to guarantee aggressiveness. The results demonstrate that our proposed Perception-retained Adversarial Text Selection strategy effectively improves the imperceptibility of adversarial texts. Table 2: Performance of VFA on the pixel-based NMT model. | Method | WMT19 (Zh-En) - BLEU↓ | WMT19 (Zh-En) - ASR↑ | WMT18 (Zh-En) - BLEU↓ | WMT18 (Zh-En) - ASR↑ | TED (Zh-En) - BLEU↓ | TED (Zh-En) - ASR↑ | |----------|-------------------------|------------------------|-------------------------|------------------------|-----------------------|----------------------| | Baseline | 0.069 | | 0.070 | | 0.165 | | | HotFlip | 0.054↓22% | 0.216 | 0.057↓18% | 0.201 | 0.130↓21% | 0.202 | | Seq2Sick | 0.055↓21% | 0.209 | 0.058↓17% | 0.189 | 0.134↓18% | 0.183 | | Targeted | 0.056↓19% | 0.162 | 0.060↓15% | 0.154 | 0.143↓13% | 0.105 | | DRTT | 0.058↓16% | 0.139 | 0.060↓14% | 0.125 | 0.140↓15% | 0.116 | | ADV | 0.062↓10% | 0.133 | 0.063↓10% | 0.123 | 0.138↓16% | 0.149 | | Ours | 0.053↓23% | | 0.2320.056↓20% | | 0.2200.128↓23% | 0.215 | ## 4.3 Transferability on LLMs In this section, we evaluate the transferability of our VFA through LLM testing. We use adversarial texts generated by the common NMT model to evaluate the BLEU decrease and ASR on LLM. Our selection includes four models: LLaMA-13B [Touvron et al., 2023], BaiChuan13B [Baichuan, 2023], GPT-3.5-turbo [OpenAI, 2022], and Wenxin Yiyan (ERNIE) [Baidu, 2023], representing leading models in both open-source and closed-source fileds. ChatGPT and LLaMA represent the most advanced LLM for English, while ERNIE and BaiChuan represent the most advanced LLM for Chinese. These LLMs perform much better on clean datasets than common NMT models, indicating that LLMs also have strong capabilities in translation tasks. Table 3 displays the experiments on these models. These results indicate that even large language models exhibit decreased performance in the face of attack. We further give some insights and discussions as follows: (1) Our VFA demonstrates the best aggressiveness in the open-source and closed-source LLMs. For the widely used LLaMA and ChatGPT, our VFA achieves the strongest aggressiveness on all datasets. For BaiChuan and ERNIE, which perform better in Chinese, our VFA also performs best on WMT19 and WMT18. This proves that our VFA has good transferability for LLMs. Table 3: Performance of our VFA on open-source and closed-source LLMs, respectively. Our VFA achieves considerable attacking ability. | Method | Model | WMT19 - BLEU↓ | WMT19 - ASR↑ | WMT18 - BLEU↓ | WMT18 - ASR↑ | TED - BLEU↓ | TED - ASR↑ | Model | WMT19 - BLEU↓ | WMT19 - ASR↑ | |-----------------------------------------------|---------|-----------------|----------------|-----------------|----------------|---------------|--------------|----------|-----------------|----------------| | Baseline LLaMA HotFlip Seq2Sick Targeted DRTT | | 0.156 | | 0.146 | | 0.113 | | | 0.226 | | | | | 0.119↓23% | 0.289 | 0.113↓23% | 0.249 | 0.083↓27% | 0.273 | | 0.188↓17% | 0.205 | | | | 0.118↓24% | 0.273 | 0.113↓23% | 0.241 | 0.073↓35% | 0.307 | ChatGPT | 0.180↓20% | 0.235 | | | | 0.115↓26% | 0.306 | 0.109↓25% | 0.281 | 0.081↓29% | 0.298 | | 0.175↓23% | 0.237 | | (open) | | 0.126↓19% | 0.233 | 0.119↓18% | 0.224 | 0.098↓14% | 0.166 | (closed) | 0.181↓20% | 0.231 | | ADV | | 0.132↓15% | 0.214 | 0.128↓12% | 0.174 | 0.093↓18% | 0.213 | | 0.200↓12% | 0.156 | | Ours | | 0.099↓37% | 0.385 | 0.094↓35% | 0.359 | 0.071↓37% | 0.325 | | 0.168↓26% | 0.281 | | Baseline | | 0.227 | | 0.199 | | 0.145 | | | 0.275 | | | HotFlip | | 0.187↓17% | 0.182 | 0.167↓17% | 0.155 | 0.113↓22% | 0.201 | | 0.223↓19% | 0.157 | | BaiChuan Seq2Sick | | 0.185↓18% | 0.169 | 0.167↓17% | 0.171 | 0.105↓27% | 0.215 | ERNIE | 0.213↓22% | 0.198 | | Targeted | | 0.179↓21% | 0.199 | 0.159↓20% | 0.203 | 0.107↓26% | 0.228 | | 0.209↓24% | 0.213 | | (open) DRTT | | 0.182↓20% | 0.183 | 0.161↓19% | 0.199 | 0.126↓13% | 0.133 | (closed) | 0.220↓20% | 0.187 | | ADV | | 0.206↓9% | 0.110 | 0.183↓8% | 0.110 | 0.122↓16% | 0.143 | | 0.244↓11% | 0.113 | | Ours | | 0.176↓23% | 0.211 | 0.158↓21% | 0.209 | 0.110↓24% | 0.209 | | 0.205↓25% | 0.223 | (2) An interesting phenomenon is that our VFA is more aggressive against English LLMs than other methods. However, when applied to Chinese LLMs, our VFA only achieved a slight lead in aggressiveness and even performed weaker than Targeted Attack and Seq2Sick on the TED dataset. We attribute this phenomenon to the learning of human perception by LLM. After training with a large amount of Chinese corpus, the large model can generalize to a certain degree of human-like perception ability, which makes them robust to visual adversarial texts generated by our VFA. ## 4.4 Human Study To evaluate the impact of adversarial texts generated by our VFA and compared methods on reading comprehension, we conduct a human perception study on SurveyPlus, which is one of the most commonly used crowdsourcing platforms. We select 20 adversarial texts generated by six methods that meet the definition of a successful attack, then we select 105 subjects and conduct the following human perception experiments: (1) Semantic understanding. Subjects are informed of some changes in each text and asked if these changes affect their understanding of semantics. (2) Semantic comparison. For the texts selected by the subjects in the previous stage, they are required to compare them with original texts and choose the ones that maintain semantic consistency. Finally, we count the number of texts in each method that do not affect understanding (score1) and are semantically consistent with the original texts (score2), and divide them by the total number of people as the scores for each method. From Table 4, it can be seen that our VFA achieves the second-highest score in the semantic understanding stage and the highest score in the semantic comparison stage. This indicates that our method has the least impact on human understanding and the least impact on semantic changes. As for DRTT, which achieved the highest score in semantic understanding, due to its use of grammatically similar modification strategies, it will have a significant change in the semantics of the original sentence, resulting in a lower score in the semantic comparison stage. In the total score of the two stages, VFA achieves the highest, indicating that it has the least impact on human reading comprehension and has good imperceptibility. Table 4: Result of human study. We add up the scores of the two stages (score1+score2) as the total score (sum) for each method. | Method | Ours | ADV | DRTT | HotFlip | Targeted | Seq2Sick | |-----------------|--------|-------|--------|-----------|------------|------------| | score1↑ score2↑ | 9.35 | 6.13 | 9.76 | 5.07 | 6.66 | 5.90 | | | 8.63 | 5.77 | 5.49 | 4.31 | 4.29 | 3.88 | | sum↑ | 17.98 | 11.90 | 15.25 | 9.38 | 10.95 | 9.78 | ## 4.5 Ablation Study In this section, we conducted several ablation studies to further investigate the contributions of some crucial components and hyper-parameters in our method. Effectiveness of Enhanced Solution Space and Perception Constraint. We divide our VFA into Vision-merged Solution Space Enhancement (VSSE) and Perception-retained Adversarial Text Selection (PATS). For the vision-merged solution space, we compare the aggressiveness with the semantic solution space. Additionally, we explore the impact of PATS on the imperceptibility of adversarial texts. We conduct four sets of ablation experiments on these two components, namely, whether to use VSSE and PATS. As shown in Table 5, it is evident that searching in the enhanced solution space significantly improves aggressiveness compared to semantic solution space. Additionally, the PATS ensures a higher SSIM similarity score between the original texts and adversarial texts, which means ensuring the imperceptibility of adversarial texts. Meanwhile, adversarial texts generated using only semantic solution space violate the visual imperceptible rule. Therefore, after applying PATS, the ASR of semantic space search will significantly decrease. Table 5: Effectiveness of different components in our VFA. | Ablation | VSSE | PATS | TIT | BLEU↓ | ASR↑ | SSIM↑ | |-------------|---------|---------|---------------------------------|------------------------------------------|-------------------------|-------------------------| | VSSE + PATS | � � � � | � � � � | rad+pix rad+pix rad+pix rad+pix | 0.107↓40% 0.077↓57% 0.176↓0.8% 0.117↓34% | 0.382 0.542 0.013 0.316 | 0.950 0.922 0.993 0.662 | | TIT | � � � | � � � | rad+pix pix rad | 0.107↓40% 0.092↓49% 0.125↓30% | 0.382 0.476 0.283 | 0.950 0.944 0.955 | Figure 3: Effectiveness of hyper-parameters. ![Image](https://ijcai.org/proceedings/2024/fulltext/730/image_000002_cec428b7e867701d2ad0cfaf037a20bd7797a4b16fbeb7a8852b6040b6399a2d.png) Effectiveness of Different Parts in Text-Image Transformation. In the Text-image Transformation (TIT) block, we employed two strategies to form a complete visual solution space, one formed through similar radical components (rad) and the other through pixel characters (pix). Therefore, we explore the impact of these two complementary strategies on aggressiveness and imperceptibility. As shown in Table 5, the results indicate that the visual solution space formed by pixelbased strategies has stronger aggressiveness, while radicalbased strategies have stronger imperceptibility. Therefore, by using the former as a supplement to the latter, we ultimately form a solution space that is both aggressive and has extremely high imperceptibility. Impacts of Hyper-Parameters. We analyze the impact of various visual perception constraint thresholds θ (threshold) and different replacement rates r (rate) of aggressiveness and imperceptibility. As shown in Figure 3, we can draw the following conclusion: (1) It can be observed that the stronger the visual perception constraint, the higher the SSIM, indicating that visual perception constraint can significantly improve the imperceptibility of adversarial texts. (2) It can be observed that a higher replacement rate leads to an increase in ASR but a decrease in SSIM, which is consistent with our expectations. As more words are replaced, the difference between the adversarial texts and the original texts becomes greater, and the aggressiveness also increases. We balanced aggressiveness and imperceptibility by combining the replacement rate and visual perception constraints. Figure 4: Enhanced solution space and semantic solution space. ![Image](https://ijcai.org/proceedings/2024/fulltext/730/image_000003_1f72c37334368addb110a604445ab4eaf0242c935581cc26a6eca13c153376ee.png) Figure 5: Adversarial texts of all methods and their masks. ![Image](https://ijcai.org/proceedings/2024/fulltext/730/image_000004_f5edc711ad2ff4018fa5cf91376b3982e0c3b3c0a989d200f20796f9f83cc670.png) ## 4.6 Case Study Enhanced Solution Space Analysis. We analyze the enhanced solution space from a visualization perspective. For a single text, we calculated embeddings for all texts in the enhanced solution space and the semantic solution space, then reduced the dimensionality using t-SNE [van der Maaten and Hinton, 2008]. The result is shown in Figure 4. The left side of the figure shows the sample distribution in the two solution spaces, while the right side indicates the number of successfully attacked texts and the corresponding BLEU decrease in both spaces. Generally, we can draw such conclusions: (1) It can be witnessed that the scope of the enhanced solution space is broader than that of the semantic solution space. This indicates that the enhanced solution space can obtain more diverse adversarial texts, providing more possibilities to find more effective adversarial texts. (2) The pie charts of both solution spaces show that the enhanced solution space generates more aggressive texts than the semantic solution space. This is further proven by the BLEU decrease of the two approaches. Therefore, an enhanced solution space helps generate more texts with stronger aggressiveness. Imperceptibility Analysis. We visualized the adversarial texts generated by all methods and analyzed the imperceptibility of individual examples. Figure 5 shows the adversarial texts generated by our method and five compared methods. The differences between them and the original texts are presented in the form of masks. The right side of the figure indicates the proportion of the differences in pixel values between the adversarial texts and the original texts. From the figure, we can see that at the cognitive level, our method requires minimal changes to the original texts, thus achieving recognition consistency and maintaining semantic consistency with the original texts in human reading comprehension. ## 5 Conclusion This paper proposed a vision-fused attack (VFA) framework for generating powerful adversarial text. Our VFA uses the vision-merged solution space enhancement and perceptionretained adversarial text selection strategy, producing more aggressive and stealthy adversarial text against NMT models. Extensive experiments demonstrated that VFA outperforms comparisons by significant margins both in attacking ability and imperceptibility enhancements. This paper indicates the important effect of multimodal correlations in current deep learning, which encourages future investigations on the corresponding topics, e.g., adversarial defense. ## Acknowledgements This work was supported by Grant KZ46009501. ## Contribution Statement Yanni Xue and Haojie Hao contributed equally to this work. Jiakai Wang is the corresponding author. ## References 1. [Baichuan, 2023] Baichuan. Baichuan 2: Open large-scale language models. arXiv preprint arXiv:2309.10305, 2023. [Baidu, 2023] Baidu. Introducing ernie 3.5: Baidu's knowledge-enhanced foundation model takes a giant leap forward. http://research.baidu.com/Blog/index-view?id= 185, 2023. Accessed: 2024-05-28. 2. [Bojar et al., 2018] Ondřej Bojar, Christian Federmann, Mark Fishel, Yvette Graham, Barry Haddow, Matthias Huck, Philipp Koehn, and Christof Monz. Findings of the 2018 conference on machine translation (WMT18). 3. In Ondřej Bojar, Rajen Chatterjee, Christian Federmann, Mark Fishel, Yvette Graham, Barry Haddow, Matthias Huck, Antonio Jimeno Yepes, Philipp Koehn, Christof Monz, Matteo Negri, Aurélie Névéol, Mariana Neves, Matt Post, Lucia Specia, Marco Turchi, and Karin Ver- spoor, editors, Proceedings of the Third Conference on Machine Translation: Shared Task Papers, pages 272- 303, Belgium, Brussels, October 2018. Association for Computational Linguistics. 4. [Cettolo et al., 2016] Mauro Cettolo, Jan Niehues, Sebastian Stüker, Luisa Bentivogli, Rolando Cattoni, and Marcello Federico. The IWSLT 2016 evaluation campaign. In Mauro Cettolo, Jan Niehues, Sebastian Stüker, Luisa Ben- tivogli, Rolando Cattoni, and Marcello Federico, editors, Proceedings of the 13th International Conference on Spo- ken Language Translation, Seattle, Washington D.C, De- cember 8-9 2016. International Workshop on Spoken Lan- guage Translation. 5. [Cheng et al., 2018] Minhao Cheng, Jinfeng Yi, Pin Yu Chen, Huan Zhang, and Cho Jui Hsieh. Seq2sick: Evalu- ating the robustness of sequence-to-sequence models with adversarial examples. Proceedings of the AAAI Confer- ence on Artificial Intelligence, 34(4), 2018. 6. [Cheng et al., 2019] Yong Cheng, Lu Jiang, and Wolfgang Macherey. Robust neural machine translation with doubly adversarial inputs. In Anna Korhonen, David Traum, and Lluís Màrquez, editors, Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pages 4324-4333, Florence, Italy, July 2019. Association for Computational Linguistics. 7. [Cheng et al., 2020] Yong Cheng, Lu Jiang, Wolfgang Macherey, and Jacob Eisenstein. AdvAug: Robust adver- sarial augmentation for neural machine translation. In Dan Jurafsky, Joyce Chai, Natalie Schluter, and Joel Tetreault, editors, Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 5961- 5970, Online, July 2020. Association for Computational Linguistics. 8. [Cui et al., 2019] Yiming Cui, Wanxiang Che, Ting Liu, Bing Qin, Ziqing Yang, Shijin Wang, and Guoping Hu. Pre-training with whole word masking for chinese bert. arXiv preprint arXiv:1906.08101, 2019. 9. [Ebrahimi et al., 2018a] Javid Ebrahimi, Daniel Lowd, and Dejing Dou. On adversarial examples for character-level neural machine translation. In Emily M. Bender, Leon Derczynski, and Pierre Isabelle, editors, Proceedings of the 27th International Conference on Computational Lin- guistics, pages 653-663, Santa Fe, New Mexico, USA, August 2018. Association for Computational Linguistics. 10. [Ebrahimi et al., 2018b] Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. Hotflip: White-box adversarial examples for text classification. In Proceedings of the 56th Annual Meeting of the Association for Computational Lin- guistics (Volume 2: Short Papers), pages 31-36, 2018. 11. [Feng et al., 2022] Fangxiaoyu Feng, Yinfei Yang, Daniel Cer, Naveen Arivazhagan, and Wei Wang. Language- agnostic bert sentence embedding. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 878-891, 2022. 12. [Gao et al., 2023] Pengzhi Gao, Liwen Zhang, Zhongjun He, Hua Wu, and Haifeng Wang. Improving zero-shot mul- tilingual neural machine translation by leveraging cross- lingual consistency regularization. In Anna Rogers, Jordan Boyd-Graber, and Naoaki Okazaki, editors, Findings of the Association for Computational Linguistics: ACL 2023, pages 12103-12119, Toronto, Canada, July 2023. Associ- ation for Computational Linguistics. 13. [Johnson et al., 2019] Jeff Johnson, Matthijs Douze, and Hervé Jégou. Billion-scale similarity search with gpus. IEEE Transactions on Big Data, 7(3):535-547, 2019. 14. [Junczys-Dowmunt et al., 2018] Marcin Junczys-Dowmunt, Roman Grundkiewicz, Tomasz Dwojak, Hieu Hoang, Kenneth Heafield, Tom Neckermann, Frank Seide, Ulrich Germann, Alham Fikri Aji, Nikolay Bogoychev, André F. T. Martins, and Alexandra Birch. Marian: Fast neural machine translation in C++. In Proceedings of ACL 2018, System Demonstrations, pages 116-121, Melbourne, Aus- tralia, July 2018. Association for Computational Linguis- tics. 15. [Lai et al., 2022] Siyu Lai, Zhen Yang, Fandong Meng, Xue Zhang, Yufeng Chen, Jinan Xu, and Jie Zhou. Gen- erating authentic adversarial examples beyond meaning- preserving with doubly round-trip translation. In Proceed- ings of the 2022 Conference of the North American Chap- ter of the Association for Computational Linguistics: Hu- man Language Technologies, pages 4256-4266, 2022. 16. [Nakazawa et al., 2016] Toshiaki Nakazawa, Manabu Yaguchi, Kiyotaka Uchimoto, Masao Utiyama, Eiichiro Sumita, Sadao Kurohashi, and Hitoshi Isahara. Aspec: Asian scientific paper excerpt corpus. In Nicoletta Calzolari (Conference Chair), Khalid Choukri, Thierry Declerck, Marko Grobelnik, Bente Maegaard, Joseph Mariani, Asuncion Moreno, Jan Odijk, and Stelios Piperidis, editors, Proceedings of the Ninth International Conference on Language Resources and Evaluation (LREC 2016), pages 2204-2208, Portorož, Slovenia, may 2016. European Language Resources Association (ELRA). 17. [Ng et al., 2019] Nathan Ng, Kyra Yee, Alexei Baevski, Myle Ott, Michael Auli, and Sergey Edunov. Face- book FAIR's WMT19 news translation task submission. 18. In Ondřej Bojar, Rajen Chatterjee, Christian Federmann, Mark Fishel, Yvette Graham, Barry Haddow, Matthias Huck, Antonio Jimeno Yepes, Philipp Koehn, André Mar- tins, Christof Monz, Matteo Negri, Aurélie Névéol, Mari- ana Neves, Matt Post, Marco Turchi, and Karin Verspoor, editors, Proceedings of the Fourth Conference on Machine Translation (Volume 2: Shared Task Papers, Day 1), pages 314-319, Florence, Italy, August 2019. Association for Computational Linguistics. 19. [OpenAI, 2022] OpenAI. ChatGPT: Optimizing language models for dialogue. https://openai.com/blog/chatgpt/, 2022. Accessed: 2024-05-28. 20. [Papineni et al., 2002] Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. Bleu: a method for auto- matic evaluation of machine translation. In Pierre Isabelle, Eugene Charniak, and Dekang Lin, editors, Proceedings of the 40th Annual Meeting of the Association for Compu- tational Linguistics, pages 311-318, Philadelphia, Penn- sylvania, USA, July 2002. Association for Computational Linguistics. 21. [Sadrizadeh et al., 2023] Sahar Sadrizadeh, AmirHos- sein Dabiri Aghdam, Ljiljana Dolamic, and Pascal Frossard. Targeted adversarial attacks against neural machine translation. In ICASSP 2023-2023 IEEE Inter- national Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 1-5. IEEE, 2023. 22. [Salesky et al., 2023] Elizabeth Salesky, Neha Verma, Philipp Koehn, and Matt Post. Multilingual pixel rep- resentations for translation and effective cross-lingual transfer. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 13845-13861, 2023. 23. [Su et al., 2022] Hui Su, Weiwei Shi, Xiaoyu Shen, Zhou Xiao, Tuo Ji, Jiarui Fang, and Jie Zhou. Rocbert: Ro- bust chinese bert with multimodal contrastive pretraining. In Proceedings of the 60th Annual Meeting of the Associ- ation for Computational Linguistics (Volume 1: Long Pa- pers), pages 921-931, 2022. 24. [Touvron et al., 2023] Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, Dan Bikel, Lukas Blecher, Cristian Can- ton Ferrer, Moya Chen, Guillem Cucurull, David Es- iobu, Jude Fernandes, Jeremy Fu, Wenyin Fu, Brian Fuller, Cynthia Gao, Vedanuj Goswami, Naman Goyal, Anthony Hartshorn, Saghar Hosseini, Rui Hou, Hakan Inan, Marcin Kardas, Viktor Kerkez, Madian Khabsa, Isabel Kloumann, Artem Korenev, Punit Singh Koura, Marie-Anne Lachaux, Thibaut Lavril, Jenya Lee, Diana Liskovich, Yinghai Lu, Yuning Mao, Xavier Martinet, Todor Mihaylov, Pushkar Mishra, Igor Molybog, Yixin Nie, Andrew Poulton, Jeremy Reizenstein, Rashi Rungta, Kalyan Saladi, Alan Schelten, Ruan Silva, Eric Michael Smith, Ranjan Subramanian, Xiaoqing Ellen Tan, Binh Tang, Ross Taylor, Adina Williams, Jian Xiang Kuan, Puxin Xu, Zheng Yan, Iliyan Zarov, Yuchen Zhang, An- gela Fan, Melanie Kambadur, Sharan Narang, Aurelien Rodriguez, Robert Stojnic, Sergey Edunov, and Thomas Scialom. Llama 2: Open foundation and fine-tuned chat models, 2023. 25. [van der Maaten and Hinton, 2008] Laurens van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of Machine Learning Research, 9(86):2579-2605, 2008. 26. [Vaswani et al., 2017] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Ł ukasz Kaiser, and Illia Polosukhin. Attention is all you need. In I. Guyon, U. Von Luxburg, S. Bengio, H. Wal- lach, R. Fergus, S. Vishwanathan, and R. Garnett, editors, Advances in Neural Information Processing Systems, vol- ume 30. 27. Curran Associates, Inc., 2017. 28. [Wang et al., 2004] Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE Trans- actions on Image Processing, 13(4):600-612, 2004. 29. [Wang et al., 2020] Wenhui Wang, Furu Wei, Li Dong, Hangbo Bao, Nan Yang, and Ming Zhou. Minilm: Deep self-attention distillation for task-agnostic compression of pre-trained transformers, 2020. 30. [Wang et al., 2021a] Jiakai Wang, Aishan Liu, Xiao Bai, and Xianglong Liu. Universal adversarial patch attack for automatic checkout using perceptual and attentional bias. IEEE Transactions on Image Processing, 31:598- 611, 2021. 31. [Wang et al., 2021b] Jiakai Wang, Aishan Liu, Zixin Yin, Shunchang Liu, Shiyu Tang, and Xianglong Liu. Dual attention suppression attack: Generate adversarial camou- flage in physical world. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8565-8574, 2021. 32. [Zhang et al., 2018] Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 586-595, 2018. 33. [Zhang et al., 2021] Xinze Zhang, Junzhe Zhang, Zhenhua Chen, and Kun He. Crafting adversarial examples for neu- ral machine translation. In Proceedings of the 59th An- nual Meeting of the Association for Computational Lin- guistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), pages 1967-1977, 2021.