AdvCodec: Towards A Unified Framework for Adversarial Text Generation
Table 12: Whitebox attack results on BERT-QA in terms of exact match rates and F1 scores by the official evaluation script. The lower EM and F1 scores mean the better attack success rate.
['Model', '[EMPTY]', 'Origin', 'Position Targeted Attack Random', 'Position Targeted Attack Question-based', 'Position Targeted Attack Answer-based', 'Baseline AddSent']
Experimental Results. We tried the above initial sentence selection methods on AdvCodec(Word) and perform position targeted attack on BERT-QA given the same maximum optimization steps. From the table, we find using different initialization methods will greatly affect the attack success rates. Therefore, the initial sentence selection methods are indeed important to help reduce the number of iteration steps and fastly converge to the optimal z∗ that can attack the model.