Chinese adversarial text generation method based on punctuation insertion

ZHANG Qian; YAN Qiao

doi:10.11959/j.issn.2096-109x.2025026

您当前的位置：

首页 >

文章列表页 >

Chinese adversarial text generation method based on punctuation insertion

Papers | 更新时间：2025-05-14

- Chinese adversarial text generation method based on punctuation insertion
- Chinese Journal of Network and Information Security Vol. 11, Issue 2, Pages: 161-174(2025)
- 作者机构：
  
  深圳大学计算机与软件学院，广东深圳 518060
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China(61976142);Shenzhen Science and Technology Planning Project(JCYJ20210324093609025)
- DOI：10.11959/j.issn.2096-109x.2025026
  CLC： TP393
- Received：25 August 2024，
  
  Revised：2024-12-21，
  
  Published：25 April 2025
- 稿件说明：
移动端阅览
张谦, 闫巧. 基于标点符号插入的中文对抗文本生成方法[J]. 网络与信息安全学报, 2025, 11(2): 161-174.

ZHANG Q, YAN Q. Chinese adversarial text generation method based on punctuation insertion[J]. Chinese Journal of Network and Information Security, 2025, 11(2): 161-174.
张谦, 闫巧. 基于标点符号插入的中文对抗文本生成方法[J]. 网络与信息安全学报, 2025, 11(2): 161-174. DOI： 10.11959/j.issn.2096-109x.2025026.

ZHANG Q, YAN Q. Chinese adversarial text generation method based on punctuation insertion[J]. Chinese Journal of Network and Information Security, 2025, 11(2): 161-174. DOI： 10.11959/j.issn.2096-109x.2025026.

摘要

自然语言处理模型容易受到对抗文本的影响。现有的针对中文对抗文本的生成方法主要采用形近字替换或同音字替换等方式，在面对鲁棒性较强的预训练模型时，对抗文本中的扰动数增加导致文本的流畅性和可读性下降，从而生成的对抗文本质量差。而英文对抗文本中符号插入方法不能完全适用于中文。同时，在黑盒场景下，先验知识的缺乏导致难以生成高质量的对抗文本。面向中文文本分类任务，提出了一种基于标点符号插入的中文对抗文本生成方法。在黑盒设置中，该方法采用一种词性重要性计算方法，并结合标点符号插入设计了一种适用于中文的字符级扰动方法，以实现对抗文本的生成。实验证明，针对文本分类任务，所提方法在使用两个真实数据集训练的LSTM（long short-term memory）和BERT（bidirectional encoder representations from transformers）模型上攻击成功率显著提升，同时，成功避免了直接破坏原始句子，保持了原始句意。在测试中，该方法能够达到97%的语义相似度，明显优于基线方法。

Abstract

The susceptibility of natural language processing models to adversarial texts has been a significant concern. Current methods for generating adversarial texts in Chinese were mainly based on replacing characters with visually similar or homophonic ones. However

when faced with robust pre-trained models

these methods led to increased perturbations in adversarial texts

resulting in reduced fluency and readability

and thus generating low-quality adversarial texts. Moreover

symbol insertion methods used in English adversarial texts were not entirely applicable to Chinese. Additionally

in a black-box scenario

the lack of prior knowledge made it difficult to generate high-quality adversarial texts. A punctuation-based method for generating adversarial texts for Chinese text classification tasks was proposed. Under a black-box setting

a novel part-of-speech importance calculation was utilized and combined with punctuation insertion to design a character-level perturbation approach suitable for Chinese

achieving the generation of adversarial texts. Experiments were conducted

and the results demonstrated that for text classification tasks

the proposed method significantly improved the attack success rate on LSTM and BERT models trained with two real-world datasets. Furthermore

the method successfully avoided direct destruction of the original sentences and maintained the original meaning. In the tests

a semantic similarity of up to 97% was achieved

which was significantly better than the baseline methods.

关键词

Keywords

references

SZEGEDY C , ZAREMBA W , SUTSKEVER I , et al . Intriguing properties of neural networks [J ] . arXiv preprint arXiv: 1312.6199 , 2013 .

CARLINI N , WAGNER D . Audio adversarial examples: Targeted attacks on speech-to-text [C ] // Proceedings of the 2018 IEEE Security and Privacy Workshops (SPW) . IEEE , 2018 : 1 - 7 .

EBRAHIMI J , RAO A , LOWD D , et al . HotFlip: white-box adversarial examples for text classification [C ] // Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics . 2018 . 31 - 36 .

郑洪浩 , 郝一诺 , 于洪涛 , 等 . 基于改进Transformer的社交媒体谣言检测 [J ] . 网络与信息安全学报 , 2022 , 8 ( 4 ): 168 - 174 .

ZHENG H H , HAO Y , YU H T , et al . Rumor detection in social media based on enhanced Transformer [J ] . Chinese Journal of Network and Information Security , 2022 , 8 ( 4 ): 168 - 174 .

LIU H Y , CAI C Y , QI Y J . Expanding scope: adapting english adversarial attacks to chinese [C ] // Proceedings of the 3rd Workshop on Trustworthy Natural Language Processing(TrustNLP) . 2023 : 276 - 286 .

ZHANG Z H ， LIU M X , ZHANG C , et al . Argot: generating adversarial readable chinese texts [C ] // Proceedings of the 29th Int’l Joint Conference on Artificial Intelligence . 2021 : 2533 - 2539 .

FORMENTO B , FOO C.S , TUAN L .A , et al . Using punctuation as an adversarial attack on deep learning based NLP systems: an empirical study [C ] // Proceedings of the Findings of the Association for Computational Linguistics: EACL . 2023 : 1 - 34 .

BEMARD E M . JONES. Exploring the role of punctuation in parsing natural text [C ] // Proceedings of the 15th International Conference on Computational Linguistics . 1994 : 421 - 425 .

FORMENTO B , NG S. K , FOO C.S . Special symbol attacks on nlp systems [C ] // Proceedings of International Joint Conference on Neural Networks (IJCNN) . 2021 : 1 - 8 .

JIN D , JIN Z J , ZHOU J , et al . Is BERT really robust? A strong baseline for natural language attack on text classification and entailment [C ] // Proceedings of the 34th AAAI Conference on Artificial Intelligence . Menlo Park , 2020 : 8018 - 8025 .

ZANG Y , QI F C , YANG C H , et al . Word-level textual adversarial attacking as combinatorial optimization [C ] // Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics . Stroudsburg, Online , 2020 : 6066 - 6080 .

GAO J , LANCHANTIN J , SOFFA M L , et al . Black-box generation of adversarial text sequences to evade deep learning classifiers [C ] // Proceedings of the IEEE Security and Privacy Workshops . 2018 : 50 - 56 .

王文琦 , 汪润 , 王丽娜 , 等 . 面向中文文本倾向性分类的对抗样本生成方法 [J ] . 软件学报 , 2019 , 30 ( 8 ): 2415 – 2427 .

WANG W Q , WANG R , WANG L N , et al . Adversarial examples generation approach for tendency classification on Chinese texts [J ] . Journal of Software . 2019 , 30 ( 8 ): 2415 - 2427 .

LIU M X , ZHANG Z H , ZHANG Y M , et al . Automatic generation of adversarial readable chinese texts [J ] . IEEE Transactions on Dependable and Secure Computing . 2023 , 20 ( 2 ): 1756 - 1770

NOU C , CHANG G Q , GAO H C , et al . Wordchange: adversarial examples generation approach for chinese text classification [J ] . IEEE Access . 2020 , 20 ( 8 ): 79561 - 79572

仝鑫 , 王罗娜 , 王润正 , 等 . 面向中文文本分类的词级对抗样本生成方法 [J ] . 信息网络安全， 2020 ， 20 ( 9 )： 12 - 16 .

TONG X , WANG L N , WANG R Z , et al . A generation method of word-level adversarial samples for chinese text classification [J ] . Netinfo Security , 2020 , 20 ( 9 ): 12 - 16 (in Chinese) .

LI L Y , SHAO Y F , SONG D M , et al . Generating adversarial examples in Chinese texts using sentence-pieces [J ] . arXiv preprint arXiv: 2012.14769 , 2020 .

张云婷 , 叶麟 , 唐浩林 , 等 . 基于掩码语言模型的中文BERT攻击方法 [J ] . 软件学报 , 2023 , 10 ( 1 ): 1 - 18 .

ZHANG Y T , YE L , TANG H L , et al . Chinese BERT attack method based on masked language model [J ] . Journal of Software , 2023 , 10 ( 1 ): 1 - 18 .

袁里驰 . 基于BERT-BiLSTM-CRF的中文分词和词性标注联合方法 [J ] . 小型微型计算机系统 . 2023 , 44 ( 9 ): 1906 - 1911 .

YUAN L C . Joint method for chinese word segmentation and part-of-speech tagging based on BERT-BiLSTM-CRE [J ] . Journal of Chinese Computer Systems . 2023 , 44 ( 9 ): 1906 - 1911 .

孙茂松 , 李景阳 , 郭志芃 , 等 . THUCTC: 一个高效的中文文本分类工具包 [M ] . 北京 : 清华大学 . 2016 .

SUN M S , LI J Y , GUO Z P , et al . THULAC: An efficient lexical analyzer for chinese [M ] . Beijing : Tsinghua University . 2016 .

JIA R , LIANG P . Adversarial examples for evaluating reading comprehension systems [C ] // Proceedings of the Conference on Empirical Methods in Natural Language Processing , Copenhagen, Denmark , 2017 : 2021 - 2031 .

HPCHREITER S , SCHMIDHUBER J . Long short-term memory [J ] . Neural Computation , 1997 , 9 ( 8 ): 1735 - 1780 .

DEVLIN J , CHANG M W , LEE K , TOUTANOVA K . BERT: Pre-training of deep bidirectional transformers for language understanding [C ] // Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies , Minneapolis, Minnesota , 2019 . 4171 - 4186 .

LIU X , CHEN Q C , CHONG D , et al . LCQMC:a large-scale chinese question matching corpus [C ] // Proceedings of the 27th International Conference on Computational Linguistics , Santa Fe, New Mexico . 2018 : 1952 - 1962 .

LIU Y , MYLE O , NAMAN G , et al . Roberta: A robustly optimized bert pretraining approach [J ] . arXiv preprint arXiv: 1907.11692 , 2019 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

No data

Related Author

No data

Related Institution

No data

⁰