Bridge the Gap Between CV and NLP! A Gradient-based Textual Adversarial
  Attack Framework
  Despite great success on many machine learning tasks, deep neural networks
are still vulnerable to adversarial samples. While gradient-based adversarial
attack methods are well-explored in the field of computer vision, it is
impractical to directly apply them in natural language processing due to the
discrete nature of text. To bridge this gap, we propose a general framework to
adapt existing gradient-based methods to craft textual adversarial samples. In
this framework, gradient-based continuous perturbations are added to the
embedding layer and are amplified in the forward propagation process. Then the
final perturbed latent representations are decoded with a mask language model
head to obtain potential adversarial samples. In this paper, we instantiate our
framework with \textbf{T}extual \textbf{P}rojected \textbf{G}radient
\textbf{D}escent (\textbf{TPGD}). We conduct comprehensive experiments to
evaluate our framework by performing transfer black-box attacks on BERT,
RoBERTa and ALBERT on three benchmark datasets. Experimental results
demonstrate our method achieves an overall better performance and produces more
fluent and grammatical adversarial samples compared to strong baseline methods.
All the code and data will be made public.
