Translate your gibberish: black-box adversarial attack on machine translation systems

A. Chertkov   ; O. Tsymboi   ; M. Pautov   ; I. Oseledets

Zapiski Nauchnykh Seminarov POMI, Investigations on applied mathematics and informatics. Part II–2, Tome 530 (2023), pp. 96-112

Résumé

Neural networks are deployed widely in natural language processing tasks on the industrial scale, and perhaps most often they are used as compounds of automatic machine translation systems. In this work, we present a simple approach to fool state of the art machine translation tools in the task of translation from Russian to English and vice versa. Using a novel black-box gradient-free tensor-based optimizer, we show that many online translation tools, such as Google, DeepL, and Yandex, may both produce wrong or offensive translations for nonsensical adversarial input queries and refuse to translate seemingly benign input phrases. This vulnerability may interfere with understanding a new language and simply worsen the user's experience while using machine translation systems, and, hence, additional improvements of these tools are required to establish better translation.

Bibliographie

[1] D. Bahdanau, K. Cho, and Y. Bengio, Neural machine translation by jointly learning to align and translate, 2014, arXiv: 1409.0473

[2] A. Batsheva, A. Chertkov, G. Ryzhakov, and I. Oseledets, PROTES: probabilistic optimization with tensor sampling, 2023, arXiv: 2301.12162

[3] Y. Berger, “Israel arrests Palestinian because Facebook translated “good morning” to “attack them””, Ha'aretz, 22 (2017)

[4] M. Blohm, G. Jagfeld, E. Sood, X. Yu, and N. T. Vu, “Comparing attention-based convolutional and recurrent neural networks: Success and limitations in machine reading comprehension”, Proceedings of the 22nd Conference on Computational Natural Language Learning, CoNLL 2018 (Brussels, Belgium, October 31 - November 1, 2018), 2018, 108–118 | DOI

[5] Y. Chen, H. Gao, G. Cui, F. Qi, L. Huang, Z. Liu, and M. Sun, Why should adversarial perturbations be imperceptible? rethink the research paradigm in adversarial nlp, 2022, arXiv: 2210.10683

[6] M. Cheng, J. Yi, P. Chen, H. Zhang, and C. Hsieh, “Seq2sick: Evaluating the robustness of sequence-to-sequence models with adversarial examples”, The Thirty-Fourth AAAI Conference on Artificial Intelligence, AAAI 2020, The Thirty-Second Innovative Applications of Artificial Intelligence Conference, IAAI 2020, The Tenth AAAI Symposium on Educational Advances in Artificial Intelligence, EAAI 2020 (New York, NY, USA, February 7-12, 2020), 2020, 3601–3608

[7] M. Cheng, J. Yi, H. Zhang, P.-Y. Chen, and C.-J. Hsieh, “Seq2sick: Evaluating the robustness of sequence-to-sequence models with adversarial examples”, Proceedings of the AAAI Conference on Artificial Intelligence, 34 (2018) | MR

[8] A. Chertkov, G. Ryzhakov, G. Novikov, and I. Oseledets, Optimization of functions given in the tensor train format, 2022, arXiv: (submitted to IEEE Computing in Science and Engineering) 2209.14808

[9] A. Cichocki, N. Lee, I. Oseledets, A.-H. Phan, Q. Zhao, and D. Mandic, “Tensor networks for dimensionality reduction and large-scale optimization: Part 1 low-rank tensor decompositions”, Foundations and Trends in Machine Learning, 9:4-5 (2016), 249–429 | DOI | Zbl

[10] A. Cichocki, A. Phan, Q. Zhao, N. Lee, I. Oseledets, M. Sugiyama, and D. Mandic, “Tensor networks for dimensionality reduction and large-scale optimization: Part 2 applications and future perspectives”, Foundations and Trends in Machine Learning, 9:6 (2017), 431–673 | DOI

[11] J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, Bert: Pre-training of deep bidirectional transformers for language understanding, 2018, arXiv: 1810.04805

[12] J. Ebrahimi, D. Lowd, and D. Dou, “On adversarial examples for character-level neural machine translation”, Proceedings of the 27th International Conference on Computational Linguistics, COLING 2018 (Santa Fe, New Mexico, USA, August 20-26, 2018), 2018, 653–663

[13] J. Ebrahimi, D. Lowd, and D. Dou, On adversarial examples for character-level neural machine translation, 2018, arXiv: 1806.09030

[14] J. Ebrahimi, A. Rao, D. Lowd, and D. Dou, “Hotflip: White-box adversarial examples for text classification”, Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics, ACL 2018 (Melbourne, Australia, July 15-20, 2018), v. 2, Short Papers, 2018, 31–36

[15] J. Ebrahimi, A. Rao, D. Lowd, and D. Dou, “HotFlip: White-box adversarial examples for text classification”, Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Melbourne, Australia, July 2018), v. 2, Short Papers, Association for Computational Linguistics, 2018, 31–36

[16] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples”, Conference Track Proceedings, 3rd International Conference on Learning Representations, ICLR 2015 (San Diego, CA, USA, May 7-9, 2015), 2015

[17] N. M. Guerreiro, E. Voita, and A. F. Martins, Looking for a needle in a haystack: a comprehensive study of hallucinations in neural machine translation, 2022, arXiv: 2208.05309

[18] C. Guo, A. Sablayrolles, H. Jégou, and D. Kiela, “Gradient-based adversarial attacks against text transformers”, Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing (Online and Punta Cana, Dominican Republic, November 2021), Association for Computational Linguistics, 2021, 5747–5757 | DOI

[19] J. Li, S. Ji, T. Du, B. Li, and T. Wang, Textbugger: Generating adversarial text against real-world applications, 2018, arXiv: 1812.05271

[20] L. Li, R. Ma, Q. Guo, X. Xue, and X. Qiu, “BERT-ATTACK: Adversarial attack against BERT using BERT”, Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing, EMNLP (Online, November 2020), Association for Computational Linguistics, 6193–6202 | MR

[21] I. Oseledets, “Tensor-train decomposition”, SIAM Journal on Scientific Computing, 33:5 (2011), 2295–2317 | DOI | MR | Zbl

[22] A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, I. Sutskever, et al., “Language models are unsupervised multitask learners”, OpenAI blog, 1:8 (2019), 9

[23] S. Sadrizadeh, A. D. Aghdam, L. Dolamic, and P. Frossard, Targeted adversarial attacks against neural machine translation, 2023, arXiv: 2303.01068

[24] S. Sadrizadeh, L. Dolamic, and P. Frossard, “Block-sparse adversarial attack to fool transformer-based text classifiers”, ICASSP 2022 - 2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2022, 7837–7841

[25] S. Sadrizadeh, L. Dolamic, and P. Frossard, TransFool: an adversarial attack against neural machine translation models, 2023, arXiv: 2302.00944

[26] K. Sozykin, A. Chertkov, R. Schutski, A.-H. Phan, A. Cichocki, and I. Oseledets, “TTOpt: a maximum volume quantized tensor train-based optimization and its application to reinforcement learning”, Advances in Neural Information Processing Systems, 2022

[27] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. J. Goodfellow, and R. Fergus, “Intriguing properties of neural networks”, Conference Track Proceedings, 2nd International Conference on Learning Representations, ICLR 2014 (Banff, AB, Canada, April 14-16, 2014), 2014

[28] A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need”, Advances in neural information processing systems, 30 (2017)

[29] E. Wallace, S. Feng, N. Kandpal, M. Gardner, and S. Singh, “Universal adversarial triggers for attacking and analyzing NLP”, Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP) (Hong Kong, China, November 2019), Association for Computational Linguistics, 2019, 2153–2162 | DOI | MR

[30] J. Wan, J. Yang, S. Ma, D. Zhang, W. Zhang, Y. Yu, and Z. Li, “Paeg: Phrase-level adversarial example generation for neural machine translation”, Proceedings of the 29th International Conference on Computational Linguistics, 2022, 5085–5097

[31] Y. Wang, S. Mishra, P. Alipoormolabashi, Y. Kordi, A. Mirzaei, A. Naik, A. Ashok, A. S. Dhanasekaran, A. Arunkumar, D. Stap, et al., “Super-natural instructions: Generalization via declarative instructions on 1600 + NLP tasks”, Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, 2022, 5085–5109 | DOI | MR

[32] Z. J. Wang, D. Choi, S. Xu, and D. Yang, Putting humans in the natural language processing loop: A survey, 2021, arXiv: 2103.04044

[33] X. Zhang, J. Zhang, Z. Chen, and K. He, “Crafting adversarial examples for neural machine translation”, Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing, v. 1, Long Papers, 2021, 1967–1977