Generating Fluent Adversarial Examples for Natural Languages
Table 1: Adversarial attack results on IMDB and SNLI. The acceptance rates (α) of M-H sampling are in a reasonable range.
['Task', 'Approach', 'Succ(%)', 'Invok#', 'PPL', '[ITALIC] α(%)']
Success rates are obtained by invoking the victim model for at most 6,000 times. As shown, the gaps of success rates between the models are not very large, because all models can give pretty high success rate. As the corpus is large enough and the language model for evaluation is strong enough, it indicates the examples generated by MHA are more likely to appear in natural language space. It eventually leads to better fluency.