Gradient-based adversarial attacks on categorical sequence models via
  traversing an embedded world
  Deep learning models suffer from a phenomenon called adversarial attacks: we
can apply minor changes to the model input to fool a classifier for a
particular example. The literature mostly considers adversarial attacks on
models with images and other structured inputs. However, the adversarial
attacks for categorical sequences can also be harmful. Successful attacks for
inputs in the form of categorical sequences should address the following
challenges: (1) non-differentiability of the target function, (2) constraints
on transformations of initial sequences, and (3) diversity of possible
problems. We handle these challenges using two black-box adversarial attacks.
The first approach adopts a Monte-Carlo method and allows usage in any
scenario, the second approach uses a continuous relaxation of models and target
metrics, and thus allows usage of state-of-the-art methods for adversarial
attacks with little additional effort. Results for money transactions, medical
fraud, and NLP datasets suggest that proposed methods generate reasonable
adversarial sequences that are close to original ones but fool machine learning
models.
