Abstract
Current multi-task adversarial text attacks rely on abundant access to shared internal features and numerous queries, often limited to a single task type. As a result, these attacks are less effective against practical scenarios involving black-box feedback APIs, limited queries, or multiple task types. To bridge this gap, we propose \textbf{C}luster and \textbf{E}nsemble \textbf{M}ulti-task Text Adversarial \textbf{A}ttack (\textbf{CEMA}), an effective black-box attack that exploits the transferability of adversarial texts across different tasks. CEMA simplifies complex multi-task scenarios by using a \textit{deep-level substitute model} trained in a \textit{plug-and-play} manner for text classification, enabling attacks without mimicking the victim model. This approach requires only a few queries for training, converting multi-task attacks into classification attacks and allowing attacks across various tasks. CEMA generates multiple adversarial candidates using different text classification methods and selects the one that most effectively attacks substitute models. In experiments involving multi-task models with two, three, or six tasks--spanning classification, translation, summarization, and text-to-image generation--CEMA demonstrates significant attack success with as few as 100 queries. Furthermore, CEMA can target commercial APIs (e.g., Baidu and Google Translate), large language models (e.g., ChatGPT 4o), and image-generation models (e.g., Stable Diffusion V2), showcasing its versatility and effectiveness in real-world applications.
Abstract (translated)
目前的多任务对抗性文本攻击依赖于对共享内部特征的广泛访问和大量的查询，这些条件通常仅限于单一的任务类型。因此，在涉及黑盒反馈API、限制查询次数或多种任务类型的实用场景中，这类攻击的效果往往不尽如人意。为了弥合这一差距，我们提出了一种新的方法——集群与集成多任务文本对抗攻击（Cluster and Ensemble Multi-task Text Adversarial Attack, CEMA）。CEMA是一种有效的黑盒攻击策略，它利用了对抗性文本在不同任务间的可迁移性。 CEMA通过使用一种以“即插即用”方式训练的深度替代模型来简化复杂的多任务场景。这种替代模型用于文本分类，并且无需模仿受害模型即可发起攻击。此方法仅需要少量查询来进行训练，在将多任务攻击转化为分类攻击的同时，允许在各种任务间进行有效攻击。 CEMA利用不同的文本分类方法生成多个对抗性候选方案，并选择最能有效攻击替代模型的那一个作为最终输出。实验表明，在涉及两个、三个或六个不同任务（包括分类、翻译、摘要和文本到图像生成）的多任务模型中，即使使用少量的100次查询，CEMA也能实现显著的攻击成功率。 此外，CEMA还能够针对商业API（例如百度和谷歌翻译）、大型语言模型（如ChatGPT 4o）以及图像生成模型（如Stable Diffusion V2）发起有效攻击，展示了其在现实世界应用中的多样性和有效性。
URL
https://arxiv.org/abs/2508.10039
