AdvCodec: Towards A Unified Framework for Adversarial Text Generation
Table 4: Whitebox attack results on QA in terms of exact match rates and F1 scores by the official evaluation script. The lower EM and F1 scores mean the better attack success rate.
['Model', '[EMPTY]', 'Origin', 'Position Targeted Attack Adv(Sent)', 'Position Targeted Attack Adv(Word)', 'Answer Targeted Attack Adv(Sent)', 'Answer Targeted Attack Adv(Word)', 'Baseline (untargeted) AddSent']
Adversarial Evaluation. We perform the whitebox attack with different attack methods on our testing models. It is worth noting although BERT has better performances than BiDAF, the performance drop for BERT ΔF1BERT is 55.4 larger than the performance drop for BiDAF ΔF1BiDAF=53.0, which again proves the BERT is insecure under the adversarial evaluation. We also find the position targeted attack is slightly stronger than the answer targeted attack. We assume it is because the answer targeted attack has fixed targeted answer and limited freedom to alter the appended sentence, but the position targeted attack has more freedom to alter the fake answer from the targeted position spans. We also tried the scatter attack on QA though the performances are not good. It turns out QA systems highly rely on the relationship between questions and contextual clues, which is hard to break when setting an arbitrary token to a target answer. We discussed in Appendix A.3 the untargeted scatter attack can work well and outperform the baseline methods.