Natural Language Adversarial Attack and Defense in Word Level
Table 2: The classification accuracy (%) of various models for adversarial examples generated on other models on Yahoo! Answers for evaluating the transferability. * indicates that the adversarial examples are generated based on this model.
['Attack', 'Word-CNN NT', 'Word-CNN AT', 'Word-CNN SEM', 'LSTM NT', 'LSTM AT', 'LSTM SEM', 'Bi-LSTM NT', 'Bi-LSTM AT', 'Bi-LSTM SEM']
To evaluate the ability of preventing the transferability of adversarial examples, we generate adversarial examples on each model under normal training, and test them on other models with or without defense on Yahoo! Answers. Almost on all models with adversarial examples generated by other models, SEM could yield the highest classification accuracy. Transferability. For instance, if we generate adversarial examples on Word-CNN (column 2, NT), GA can achieve better transferability on LSTM with NT (column 5) while IGA can achieve better transferability on LSTM with AT and SEM (column 6, 7).