Abstract
We extend BeamAttack, an adversarial attack algorithm designed to evaluate the robustness of text classification systems through word-level modifications guided by beam search. Our extensions include support for word deletions and the option to skip substitutions, enabling the discovery of minimal modifications that alter model predictions. We also integrate LIME to better prioritize word replacements. Evaluated across multiple datasets and victim models (BiLSTM, BERT, and adversarially trained RoBERTa) within the BODEGA framework, our approach achieves over a 99\% attack success rate while preserving the semantic and lexical similarity of the original texts. Through both quantitative and qualitative analysis, we highlight BeamAttack's effectiveness and its limitations. Our implementation is available at this https URL
Abstract (translated)
我们扩展了BeamAttack，这是一种通过词级修改（由束搜索引导）来评估文本分类系统鲁棒性的对抗性攻击算法。我们的扩展包括支持词删除和跳过替换的选项，从而能够发现能改变模型预测结果的最小化修改。此外，我们将LIME集成进来，以便更好地优先考虑单词替换。在BODEGA框架下，针对多个数据集和受害模型（BiLSTM、BERT以及对抗性训练过的RoBERTa），我们的方法实现了超过99%的成功攻击率，并同时保持了原始文本的语义和词汇相似性。通过定量和定性的分析，我们强调了BeamAttack的有效性和其局限性。我们的实现代码可在[此处](https://this https URL)获得。
URL
https://arxiv.org/abs/2506.23661
