TextAttack Documentation

TextAttack defines the adversarial attack process using four interchangeable components. This modular design allows for the reuse of components across different research papers and facilitates data augmentation:

1. Goal Function: Defines what the attack is trying to achieve (e.g., maximizing loss or minimizing prediction probability).
2. Constraints: Ensures the adversarial examples remain within certain bounds (e.g., semantic or visual similarity).
3. Transformation: The actual modification applied to the input (e.g., character swaps, synonym replacement).
4. Search Method: The algorithm used to find the best perturbation (e.g., greedy search, genetic algorithms).

TextAttack formulates adversarial attacks using four core components:

1. Goal Function: Takes an AttackedText object, scores it, and returns a GoalFunctionResult indicating if the attack succeeded.
2. Constraints: Takes the current AttackedText and a list of transformed AttackedTexts, returning a boolean for each to ensure perturbations remain valid (e.g., maintaining grammar or semantic similarity).
3. Transformations: Takes an AttackedText and returns a list of possible transformed AttackedTexts (e.g., synonym replacements).
4. Search Methods: Traverses the search space by calling get_transformations (which applies transformations filtered by constraints) until the goal is met or the search is exhausted.

TextAttack focuses on adversarial perturbations, which are specific changes to benign inputs designed to cause a model to misclassify them. This differs from general 'adversarial examples' which can be created from scratch.

Key metrics for measuring model robustness include:

• Attack Success Rate: The percentage of attack attempts that successfully produce an adversarial example.
• After-attack Accuracy: The percentage of inputs that are both correctly classified by the model and successfully resist the attack.

TextAttack attacks iterate through a dataset and only attempt to perturb samples that the model initially predicts correctly. If a sample is already incorrectly predicted, it is not attacked.

The textattack.goal_functions package provides various goal functions used to define the objective of an adversarial attack. Goal functions determine how the success of an attack is measured (e.g., maximizing error or minimizing a specific metric).

Available subpackages include:

• textattack.goal_functions.classification: Goal functions specifically designed for classification tasks.
• textattack.goal_functions.text: Goal functions focused on text-based objectives.
• textattack.goal_functions.custom: Interface for implementing and using custom goal functions.

The textattack.metrics.quality_metrics package provides various metrics to evaluate the quality of text transformations during adversarial attacks. These metrics are typically used to ensure that the perturbed text remains semantically similar to the original input.

Available submodules include:

• bert_score: BERTScore for semantic similarity.
• meteor_score: METEOR metric for linguistic quality.
• perplexity: Perplexity scores to measure how natural the text is.
• sentence_bert: Sentence-BERT based similarity.
• use: Universal Sentence Encoder based similarity.

An attack in TextAttack is composed of four modular components:

1. Goal Function: Determines if the attack succeeded by scoring an AttackedText object and returning a GoalFunctionResult.
2. Constraints: Validates whether a transformation is acceptable (e.g., maintaining grammar or semantic similarity). It returns a boolean for each transformed option.
3. Transformation: Generates a list of potential modifications (e.g., synonym replacements) for a given AttackedText.
4. Search Method: Traverses the search space of perturbations to find a sequence of transformations that satisfies the GoalFunction while adhering to Constraints.

The textattack.constraints package provides the framework for defining and applying constraints during adversarial attacks. Constraints are used to ensure that the perturbed text remains within certain bounds, such as maintaining grammatical correctness, semantic similarity, or avoiding excessive overlap with the original text.

Available constraint categories include:

• textattack.constraints.grammaticality: Constraints related to the grammatical integrity of the text.
• textattack.constraints.overlap: Constraints that limit how much the perturbed text overlaps with the original.
• textattack.constraints.semantics: Constraints that ensure the meaning (semantics) of the text is preserved.
• textattack.constraints.pre_transformation: Constraints applied before transformations occur.