AdvCodec: Towards A Unified Framework for Adversarial Text Generation
Table 5: Targeted Attack Results of whitebox attack on QA. Here, the targeted exact match rates and targeted F1 Score measures how many model outputs match the targeted fake answers. Higher targeted EM and F1 mean higher targeted attack success rate. UT is short for Universal Trigger baseline.
['Model BERT', 'Model target EM', 'Adv(Sent) 32.1', 'Adv(Word)  [BOLD] 43.4', 'UT 1.4']
Then we test the targeted results of whitebox attack methods on QA models. It shows that AdvCodec(Word) has the best targeted attack ability on QA. And all our attack methods outperform the baseline(Universal Triggers) when it comes to the targeted results.