Shielding Google’s language toxicity model against adversarial attacks
Figure 4: Effectiveness in disarming the obfuscation attack. These radial histograms show the proportion of obfuscated comments correctly scored with at least the same toxicity of the original comment, out of 1000 variants (red area), as obtained by GP model (green sector) and TP+GP method (amber sector). (a) On the obfuscation-50 dataset. (b) On the obfuscation-99 dataset.
['(a)', '(b)']
In order to further compare the effectiveness of the proposed method in disarming the obfuscation attack, we illustrate in Fig. It can be seen how on the obfuscation-50 dataset the TP+GP method (amber area) is able to correctly score a large proportion of comments in all topics. This pattern is replicated in the obfuscation-99 dataset, although proportions slightly decline due to the higher corruption level, which yields more acid attacks.