Abstract
While neural machine translation (NMT) models achieve success in our daily lives, they show vulnerability to adversarial attacks. Despite being harmful, these attacks also offer benefits for interpreting and enhancing NMT models, thus drawing increased research attention. However, existing studies on adversarial attacks are insufficient in both attacking ability and human imperceptibility due to their sole focus on the scope of language. This paper proposes a novel vision-fused attack (VFA) framework to acquire powerful adversarial text, i.e., more aggressive and stealthy. Regarding the attacking ability, we design the vision-merged solution space enhancement strategy to enlarge the limited semantic solution space, which enables us to search for adversarial candidates with higher attacking ability. For human imperceptibility, we propose the perception-retained adversarial text selection strategy to align the human text-reading mechanism. Thus, the finally selected adversarial text could be more deceptive. Extensive experiments on various models, including large language models (LLMs) like LLaMA and GPT-3.5, strongly support that VFA outperforms the comparisons by large margins (up to 81%/14% improvements on ASR/SSIM).
Abstract (translated)
虽然神经机器翻译（NMT）模型在我们的日常生活中取得了成功，但它们对对抗性攻击非常脆弱。尽管这些攻击是有害的，但它们也为解释和增强 NMT 模型提供了好处，因此吸引了更多的研究关注。然而，现有的对抗性攻击研究由于仅关注语言范围而不足，因此本文提出了一种新颖的视频融合攻击（VFA）框架，以获取强大的对抗性文本，即更具有攻击性和隐秘性的文本。在攻击能力方面，我们设计了愿景融合解决方案空间增强策略，以扩大有限语义解决方案空间，这使我们能够搜索具有更高攻击能力的对抗性候选者。在人类感知方面，我们提出了保留感知的人类文本选择策略，使人类的文本阅读机制与攻击策略保持一致。因此，最终选择的攻击性文本可能更具有欺骗性。在各种模型（包括大型语言模型，如LLMs（如LLLM和GPT-3.5））的广泛实验中，VFA 的优越性明显超过基于ASR（自动文本评分）和SSIM（结构从文本到序列匹配）的比较（ASR/SSIM改进率高达81%/14%）。
URL
https://arxiv.org/abs/2409.05021
