Research On Textual Adversarial Attack Against Deep Learning Model

As one of the important threats to the security of deep learning models,adversarial samples have always been the main research object of researchers.However,although the research on adversarial attacks has achieved remarkable results,there are still problems such as poor availability of adversarial samples and weak practicability of attack strategies.This thesis proposes a text attack strategy for Chinese text.The application scenario of this strategy is set as a black box scenario.At the same time,the strategy provides a reasonable solution,mainly for the actual difficulty of the attacker,such as the access restriction of the target model.The main perturbation methods in the text replacement strategy are six oper-ations,such as the conversion of simplified Chinese and traditional Chinese,the conversion of synonyms.In addition,this thesis proposes to record the effective data returned from the target model attack and further optimize a local substitution model,which helps to improve the similarity between the local substitution model and the targeted attack model,thereby improving the quality of generated adversarial samples.Experiments have proved that,compared with the comparison scheme,the adversarial sam-ples generated by the proposed scheme have a higher success rate for the LSTM model,and the adversarial samples also have good usability.By comparing the success rate of the Ran-dom attack scheme and DeepWordBug attack scheme,it can be seen that the attack scheme proposed in this thesis is effective,and the attack success has been reduced by about 30%,and it has also proved to have good readability in human evaluation.