Word-level Textual Adversarial Attacking as Combinatorial Optimization
Table 8: The classification accuracy of transferred adversarial examples on the three datasets. Lower accuracy reflects higher transferability.
['Transfer', 'Attack Model', 'IMDB', 'SST-2', 'SNLI']
The transferability of adversarial examples reflects whether an attack model can attack a DNN model without any access to it ( It has been widely used as an important evaluation metric in adversarial attacks. We evaluate the transferability of adversarial examples by using BiLSTM to classify the adversarial examples crafted for attacking BERT, and vice versa. Note that lower accuracy signifies higher transferability. The lower the accuracy is, the higher the transferability is. We find compared with the two baselines, our Sememe+PSO crafts adversarial examples with overall higher transferability.