AdvCodec: Towards A Unified Framework for Adversarial Text Generation
Table 14: Blackbox Attack Success Rate after inserting the whitebox generated adversarial sentence to different positions for BERT-QA.
['Method', '[EMPTY]', 'Back', 'Mid', 'Front']
To further explore how the location of adversarial sentences affects the attack success rate, we conduct the ablation experiments by varying the position of appended adversarial sentence. We generate the adversarial sentences from the whitebox BERT classification and QA models. Then we inject those adversaries into different positions of the original paragraph and test in another blackbox BERT with the same architecture but different parameters. We see in most time appending the adversarial sentence at the beginning of the paragraph achieves the best attack performance. Also the performance of appending the adversarial sentence at the end of the paragraph is usually slightly weaker than front. This observation suggests that the BERT model might pay more attention to the both ends of the paragraphs and tend to overlook the content in the middle.