WO2021212675A1 - 对抗样本的生成方法、装置、电子设备及存储介质 - Google Patents

对抗样本的生成方法、装置、电子设备及存储介质 Download PDF

Info

Publication number
WO2021212675A1
WO2021212675A1 PCT/CN2020/103219 CN2020103219W WO2021212675A1 WO 2021212675 A1 WO2021212675 A1 WO 2021212675A1 CN 2020103219 W CN2020103219 W CN 2020103219W WO 2021212675 A1 WO2021212675 A1 WO 2021212675A1
Authority
WO
WIPO (PCT)
Prior art keywords
word
particle
original text
adversarial
sample
Prior art date
Application number
PCT/CN2020/103219
Other languages
English (en)
French (fr)
Inventor
刘知远
岂凡超
臧原
孙茂松
Original Assignee
清华大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 清华大学 filed Critical 清华大学
Publication of WO2021212675A1 publication Critical patent/WO2021212675A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
    • G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F40/00—Handling natural language data
    • G06F40/20—Natural language analysis
    • G06F40/237—Lexical tools
    • G06F40/247—Thesauruses; Synonyms
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F40/00—Handling natural language data
    • G06F40/20—Natural language analysis
    • G06F40/279—Recognition of textual entities
    • G06F40/289—Phrasal analysis, e.g. finite state techniques or chunking
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/004—Artificial life, i.e. computing arrangements simulating life
    • G06N3/006—Artificial life, i.e. computing arrangements simulating life based on simulated virtual individual or collective life forms, e.g. social simulations or particle swarm optimisation [PSO]

Definitions

  • This application relates to the field of natural speech processing technology, and in particular to a method, device, electronic device, and storage medium for generating countermeasure samples.
  • the adversarial attack refers to the process of making the target model judge wrong by generating adversarial samples.
  • Adversarial attacks can expose the vulnerability of machine learning models, thereby improving the robustness and interpretability of the model.
  • Text adversarial attack refers to the process of generating adversarial samples by modifying the original text to make the natural language processing model judge wrong.
  • the existing text confrontation attack methods are mainly word-level. By determining the candidate set of replacement words for each word in the original text, the discrete space formed by the combination of all candidate sets of replacement words is searched for confrontation samples that can successfully attack the target model.
  • Existing search algorithms are mainly based on greedy or genetic algorithms. Such algorithms have a large performance improvement space in terms of search speed and attack success rate.
  • the embodiments of the present application provide a method, a device, an electronic device, and a storage medium for generating a confrontation sample to solve the problems of low search algorithm speed and low attack success rate in the prior art.
  • the embodiment of the present application provides a method for generating adversarial samples, including:
  • the sample of the attack target model is searched from the discrete space formed by the combination of the candidate set of replacement words, and the adversarial sample is generated.
  • the determining a candidate set of replacement words for each word in the original text includes:
  • the set consisting of the candidate replacement words is determined as the replacement word candidate set.
  • the marking the part of speech of each word in the original text includes:
  • each word in the original text is restored to its original form, and the part of speech of each restored word is marked.
  • said particle swarm optimization algorithm is used to search for a sample of an attack target model from a discrete space formed by a combination of the candidate set of replacement words, and to generate an adversarial sample includes:
  • the global optimal solution is the position of the particle with the highest target label prediction score given by the target model, and the historical optimal solution is The position with the highest predicted score of the target tag in each particle's previous iterations;
  • the recorded optimal solution is the adversarial sample
  • stop searching and output the adversarial sample If it is determined that the recorded optimal solution is the adversarial sample, stop searching and output the adversarial sample. Otherwise, update the particle speed and position, and after performing mutation operation, return to execute the recorded particle swarm with the highest target label prediction score given by the target model The operation of the particles and the position with the highest prediction score of the target label in each iteration of each particle, until it is determined that the recorded optimal solution is the adversarial sample, the search is stopped and the corresponding adversarial sample is output.
  • the updating particle velocity and position includes:
  • Is the velocity of the nth particle in the d dimension, ⁇ is the inertia factor decreasing with the number of iterations
  • Is the position of the nth particle in the d dimension Is the position of the d-th dimension of the historical optimal solution of the n-th particle
  • I(a,b) is defined as:
  • the particle position update includes: moving to the historical optimal solution of each particle itself, with the probability of P i ; moving to the global optimal solution, with the probability of P g ; where P i and P g are updated with the number of iterations:
  • the performing mutation operation includes:
  • x o represents the original text
  • ⁇ (x n , x o ) represents the number of different words in x n and x o
  • D represents the total number of words in the original text
  • An embodiment of the present application also provides a device for generating a confrontation sample, including:
  • Obtaining module configured to obtain the original text
  • a determining module configured to determine a candidate set of replacement words for each word in the original text
  • the generating module is configured to search for samples of the attack target model from the discrete space formed by the combination of the candidate set of replacement words based on the particle swarm optimization algorithm, and generate adversarial samples.
  • the determining module includes:
  • a labeling unit configured to label the part of speech of each word in the original text
  • the first determining unit is configured to obtain the original tagging of each meaning item of each word under the same part of speech, and determine the word with the same original tag and the same part of speech as the candidate replacement word;
  • the second determining unit is configured to determine the set of candidate replacement words as the candidate replacement word set.
  • An embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor. Steps to generate method.
  • the embodiment of the present application also provides a non-transitory computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of any one of the aforementioned methods for generating a confrontation sample are realized.
  • the method, device, electronic device, and storage medium for generating confrontation samples obtained in the embodiments of the application obtain the original text; determine the candidate set of replacement words for each word in the original text; based on the particle swarm optimization algorithm, from the combination of the candidate set of replacement words Search for samples of the attack target model in the formed discrete space, and generate adversarial samples.
  • the embodiment of the application uses a particle swarm optimization algorithm to search for adversarial samples. As a meta-heuristic group evolution calculation method, particle swarm optimization is more efficient than genetic algorithms. Therefore, the algorithm can improve the search speed when searching for adversarial samples, and It can also increase the attack success rate. For different natural language processing models, the embodiments of the present application can quickly and efficiently generate a large number of high-quality adversarial samples, successfully deceive the target model, and then expose its vulnerability, which has good practicability.
  • FIG. 1 is a flowchart of a specific implementation manner of a method for generating adversarial examples provided by an embodiment of the application;
  • FIG. 2 is a flowchart of determining a candidate set of replacement words in the method for generating adversarial examples according to an embodiment of the application;
  • FIG. 3 is a flowchart of searching for adversarial examples in the method for generating adversarial examples according to an embodiment of the application;
  • FIG. 4 is a structural block diagram of the apparatus for generating adversarial samples provided by an embodiment of the application
  • FIG. 5 is a schematic diagram of the physical structure of an electronic device provided by an embodiment of the application.
  • FIG. 1 The flowchart of a specific implementation of the method for generating adversarial examples provided by the embodiments of the present application is shown in FIG. 1, and the method specifically includes:
  • Step S101 Obtain the original text
  • Step S102 Determine a candidate set of replacement words for each word in the original text
  • the type of the original text is Chinese text or English text. If it is an English text, there is no need to perform word segmentation; if it is a Chinese text, you should perform word segmentation to obtain each word in the original text.
  • a candidate replacement word corresponding to each word is generated.
  • the set of one or more candidate replacement words is determined as the replacement word candidate set.
  • the candidate replacement word determination operation can be performed. Lexical restoration is an important part of text preprocessing. Lexical restoration is to remove the affixes of words and extract the main part of the words. For example, the word “cars" after morphological restoration is "car”, and the word “ate” after morphological restoration is "eat”.
  • the embodiment of the present application can generate a candidate set containing replacement words with the same or similar semantics for each word in the original text with the help of HowNet's original knowledge base.
  • the original text can be tagged with part of speech, and after obtaining the part of speech of each word, the original tag of each meaning of the word with the same part of speech can be obtained from HowNet, and there will be words with the same part of speech as the original tag. Treat as candidate replacement words, and then group all candidate replacement words into a replacement word candidate set.
  • Step S103 Based on the particle swarm optimization algorithm, search for samples of the attack target model from the discrete space formed by the combination of the candidate set of replacement words, and generate adversarial samples.
  • the method for generating adversarial samples obtained by the embodiments of the present application obtains the original text; determines the candidate set of replacement words for each word in the original text; based on the particle swarm optimization algorithm, searches for the attack target from the discrete space formed by the combination of candidate sets of replacement words Model samples to generate adversarial samples.
  • the embodiment of the application uses a particle swarm optimization algorithm to search for adversarial samples. As a meta-heuristic group evolution calculation method, particle swarm optimization is more efficient than genetic algorithms. Therefore, the algorithm can improve the search speed when searching for adversarial samples, and It can also increase the attack success rate.
  • a common method is to use the synonyms of the words in the original text to form a candidate set of replacement words with the help of a thesaurus.
  • synonyms such as named entity words
  • the number of synonyms for words with synonyms is also very limited. This results in a small number of candidate adversarial samples that are finally generated, which in turn affects the success rate of the attack.
  • the method for generating adversarial samples provided by the embodiments of this application uses other knowledge bases.
  • HowNet is a linguistic knowledge base that uses pre-defined meanings—the smallest semantic unit in linguistics— To carry out semantic labeling for more than 100,000 Chinese and English words, it can be considered that words with the same meanings have the same meaning and can be used as candidate replacement words.
  • HowNet has marked the meanings of various words including entity words, ensuring that candidate replacement words can be found for most words in the actual text. Therefore, this embodiment can increase the number and diversity of candidate replacement words.
  • the specific process of determining the candidate set of replacement words in step S102 may include:
  • Step S201 mark the part of speech of each word in the original text
  • the original text is a Chinese text
  • word segmentation is performed on the original text, and the part of speech of each word after word segmentation is marked
  • the original text is determined to be an English text
  • each word in the original text is restored to The original form is to mark the part of speech of the restored words.
  • Step S202 Obtain the original tagging of each meaning item of each word under the same part of speech, and determine the word with the same original tag and the same part of speech as the candidate replacement word;
  • Step S203 Determine the set of candidate replacement words as the candidate set of replacement words.
  • the embodiment of the present application generates a candidate set containing replacement words with the same or similar semantics for each word in the original text with the help of HowNet's original knowledge base, which can greatly increase the number and diversity of candidate replacement words, and further improve The attack success rate of the generated adversarial samples.
  • the specific process of the search algorithm in the method for generating adversarial samples includes:
  • Step S301 Initialize the particle swarm
  • the size of the particle swarm is k, copy the original text k times to obtain an initial sample, and perform a mutation operation on each initial sample to generate a new particle swarm.
  • the mutation operation refers to randomly selecting a word in the text and replacing it with a random word in the candidate set of replacement words.
  • Each particle in the particle swarm is a mutated sample, which can also be regarded as an n-dimensional vector, where n is the number of words in the text.
  • the position of the particle in the discrete space represents the combination of replacement words selected for each word of the sample. For each dimension of each particle, we randomly initialize a velocity v.
  • Step S302 Record the optimal solution
  • the target label refers to the label that the model is expected to classify against the adversarial sample. For example, in the sentiment binary classification task, the original sample label is positive and the target label is negative, because it is hoped that the adversarial sample will make the model classify incorrectly.
  • Step S303 judge whether it can be stopped, if not, go to step S304; if yes, go to step S305;
  • the currently recorded optimal solution (the particle with the highest target label prediction score) can make the model classification error, indicating that a successful adversarial sample has been found, stop searching and output the sample. Otherwise, it is necessary to update the particle speed and position, and perform the mutation operation, and then return to execute the record of the particle with the highest target label prediction score given by the target model in the particle swarm and the position with the highest target label prediction score in the previous iterations of each particle Operate until it is determined that the recorded optimal solution is the adversarial sample and stop searching and output the corresponding adversarial sample.
  • Step S304 update the particle velocity and position, mutate, return to step S302, and perform a new round of iteration.
  • Is the velocity of the nth particle in the d dimension, ⁇ is the inertia factor decreasing with the number of iterations
  • Is the position of the nth particle in the d dimension Is the position of the d-th dimension of the historical optimal solution of the n-th particle
  • I(a,b) is defined as:
  • the particles need to perform a two-step position update.
  • the second step is to move to the global optimal solution, and the moving probability is P g .
  • P i and P g are updated with the number of iterations:
  • P g, and P i is updated as the number of iterations, and P g and P i are constants setting compared to P i is set such as to reduce the number of iterations increases, P g
  • the particles will explore in their respective nearby spaces at the beginning of the search to explore more unknown spaces.
  • they will explore near the optimal solution that has been found so that they can converge to the maximum as soon as possible.
  • Excellent solution Experimental results show that at the same maximum iteration limit number of times, such a setting are constants setting the attack success rate of 10% -15% ratio of P i and P g.
  • the position is updated at each step. Once the particle decides to move, the probability of its movement in each dimension is
  • each particle in the particle swarm undergoes mutation operation with probability P m.
  • the mutation probability of the nth particle x n is:
  • x o represents the original text
  • ⁇ (x n , x o ) represents the number of different words in x n and x o
  • D represents the total number of words in the original text
  • Step S305 Stop searching and output the sample as a confrontation sample.
  • a candidate set of replacement words is generated by using meanings as words in the original text, and at the same time, a particle swarm optimization algorithm is used to search for an adversarial sample capable of successfully attacking the target model in a discrete space formed by the combination of candidate sets of replacement words.
  • this application can efficiently generate a large number of high-quality adversarial samples, successfully deceive the target model, and then expose its vulnerability, which has good practicability.
  • the structural block diagram of the device for generating adversarial samples provided by this application is shown in Figure 4.
  • the device specifically includes:
  • the obtaining module 401 is configured to obtain the original text
  • the determining module 402 is configured to determine a candidate set of replacement words for each word in the original text
  • the generating module 403 is configured to search for samples of the attack target model from the discrete space formed by the combination of the candidate set of replacement words based on the particle swarm optimization algorithm, and generate adversarial samples.
  • the determining module 402 may further include:
  • a labeling unit configured to label the part of speech of each word in the original text
  • the first determining unit is configured to obtain the original tagging of each meaning item under the same part of speech for each word, and determine a word with the same original tagging and the same part of speech meaning as a candidate replacement word;
  • the second determining unit is configured to determine the set of candidate replacement words as the candidate replacement word set.
  • the tagging unit is specifically configured to: determine that the original text is a Chinese text, perform a word segmentation operation on the original text, and tag the part of speech of each word after word segmentation; determine that the original text is an English text, and Each word in the original text is restored to its original form, and the part of speech of each restored word is marked.
  • the generating module 403 is specifically configured to: copy the original text k times to obtain an initial sample, and perform a mutation operation on each of the initial samples to generate a new particle swarm.
  • Each particle in is a mutated sample; in each iteration, record the particle with the highest target label prediction score given by the target model in the particle swarm and the position with the highest target label prediction score in each particle's previous iterations; determine the record
  • the optimal solution is to stop searching and output the adversarial sample when adversarial samples, otherwise update the particle speed and position, and perform mutation operation, and return to execute the particle with the highest target label prediction score given by the target model in the recorded particle swarm And the operation of the position with the highest prediction score of the target tag in each particle's previous iterations, until it is determined that the recorded optimal solution is the adversarial sample and the search is stopped and the corresponding adversarial sample is output.
  • the device for generating adversarial samples in this embodiment is used to implement the aforementioned method for generating adversarial samples. Therefore, the specific implementation of the device for generating adversarial samples can be seen in the foregoing example of the method for generating adversarial samples, such as the acquisition module 401, The determining module 402 and the generating module 403 are respectively used to implement the steps S101, S102, and S103 in the method for generating the adversarial samples.
  • FIG. 5 illustrates a schematic diagram of the physical structure of an electronic device.
  • the electronic device may include: a processor 510, a communications interface 520, a memory 530, and a communication bus 540, Among them, the processor 510, the communication interface 520, and the memory 530 communicate with each other through the communication bus 540.
  • the processor 510 may call the logic instructions in the memory 530 to execute the following methods: obtain the original text; determine the candidate set of replacement words for each word in the original text; based on the particle swarm optimization algorithm, from the combination of the candidate set of replacement words Search for samples of the attack target model in the formed discrete space, and generate adversarial samples.
  • the above-mentioned logical instructions in the memory 530 can be implemented in the form of a software functional unit and when sold or used as an independent product, they can be stored in a computer readable storage medium.
  • the technical solution of this application essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a computer software product, and the computer software product is stored in a storage medium. It includes several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disks or optical disks and other media that can store program codes. .
  • the processor 510 may call the logical instructions in the memory 530 to perform the following method: mark the part of speech of each word in the original text; obtain the meaning of each meaning item of each word under the same part of speech Annotation: determining words that have the same meaning and the same part-of-speech meaning as candidate replacement words; determining the set of candidate replacement words as the replacement word candidate set.
  • the processor 510 may call the logical instructions in the memory 530 to perform the following method: determine that the original text is a Chinese text, perform a word segmentation operation on the original text, and determine the part of speech of each word after the word segmentation Tagging; determining that the original text is an English text, restoring each word in the original text to its original form, and tagging the part of speech of each restored word.
  • the processor 510 may call the logic instructions in the memory 530 to execute the following method: copy the original text k times to obtain initial samples, and perform a mutation operation on each of the initial samples to generate new particles Swarm, each particle in the particle swarm is a mutated sample; in each iteration, record the particle with the highest target label prediction score given by the target model in the particle swarm and the highest target label prediction score in each iteration of each particle
  • the recorded optimal solution is a confrontation sample
  • stop searching and output the confrontation sample otherwise update the particle speed and position, and perform mutation operation, return to execute the target label given by the target model in the recorded particle swarm
  • the embodiments of the present application also provide a non-transitory computer-readable storage medium on which a computer program is stored.
  • the computer program is executed by a processor, the computer program is implemented to perform the transmission methods provided in the foregoing embodiments, for example, including : Obtain the original text; determine the replacement word candidate set of each word in the original text; based on the particle swarm optimization algorithm, search for samples of the attack target model from the discrete space formed by the combination of the replacement word candidate sets, and generate adversarial samples.
  • the electronic devices and non-transitory computer-readable storage media provided in the embodiments of the present application all correspond to the above-mentioned method for generating countermeasure samples.
  • the method, device, electronic device, and storage medium for generating confrontation samples obtain the original text; determine the candidate set of replacement words for each word in the original text; based on the particle swarm optimization algorithm, from the replacement candidate
  • the sample of the attack target model is searched in the discrete space formed by the combination of the set, and the adversarial sample is generated.
  • the embodiment of the application uses a particle swarm optimization algorithm to search for adversarial samples.
  • particle swarm optimization is more efficient than genetic algorithms. Therefore, the algorithm can improve the search speed when searching for adversarial samples, and It can also increase the attack success rate.
  • the embodiments of the present application can quickly and efficiently generate a large number of high-quality adversarial samples, successfully deceive the target model, and then expose its vulnerability, which has good practicability.
  • the device embodiments described above are merely illustrative.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in One location, or it can be distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the objectives of the solutions of the embodiments. Those of ordinary skill in the art can understand and implement it without creative work.
  • each implementation manner can be implemented by software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Therefore, this application can be embodied in the form of a computer software product, which can be stored in a computer-readable storage medium, such as ROM/RAM, magnetic disk, optical disk, etc., including several instructions to make a computer device (It can be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiment.
  • a computer-readable storage medium such as ROM/RAM, magnetic disk, optical disk, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Artificial Intelligence (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computational Linguistics (AREA)
  • Health & Medical Sciences (AREA)
  • Data Mining & Analysis (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Audiology, Speech & Language Pathology (AREA)
  • Evolutionary Computation (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Evolutionary Biology (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Biomedical Technology (AREA)
  • Biophysics (AREA)
  • Molecular Biology (AREA)
  • Computing Systems (AREA)
  • Mathematical Physics (AREA)
  • Software Systems (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Machine Translation (AREA)

Abstract

一种对抗样本的生成方法、装置、电子设备及存储介质，该方法包括：获取原始文本(S101)；确定原始文本中各个词的替换词候选集(S102)；基于粒子群优化算法，从替换词候选集的组合构成的离散空间中搜索攻击目标模型的样本，生成对抗样本(S103)。该方法使用粒子群优化算法来搜索对抗样本，搜索对抗样本时能够提升搜索速度，并且还能够提高攻击成功率。

Description

对抗样本的生成方法、装置、电子设备及存储介质
相关申请的交叉引用
本申请要求于2020年4月21日提交的申请号为202010317965.9，发明名称为“对抗样本的生成方法、装置、电子设备及存储介质”的中国专利申请的优先权，其通过引用方式全部并入本文。
技术领域
本申请涉及自然语音处理技术领域，尤其涉及一种对抗样本的生成方法、装置、电子设备及存储介质。
背景技术
对抗攻击指通过产生对抗样本使目标模型判断出错的过程。对抗攻击可以暴露机器学习模型的脆弱性，进而提高模型的鲁棒性和可解释性。文本对抗攻击指通过修改原始文本生成对抗样本使自然语言处理模型判断出错的过程。
现有的研究表明，深度学习模型非常容易受到对抗攻击的影响，比如对辱骂文本进行简单修改就可以骗过最先进的辱骂检测系统。鉴于目前基于深度学习技术的自然语言处理模型已经广泛应用于垃圾邮件检测、恶意评论检测等多项应用系统中，研究文本对抗攻击以发现这些系统的弱点并进行改进也就愈发具有实际意义和价值。
现有的文本对抗攻击方法主要是词级别的，通过确定原始文本中各个词的替换词候选集，在所有替换词候选集的组合构成的离散空间中搜索能够成功攻击目标模型的对抗样本。现有的搜索算法主要是基于贪心或遗传算法，这类算法在搜索速度以及攻击成功率方面均有较大的性能提升空间。
发明内容
本申请实施例提供一种对抗样本的生成方法、装置、电子设备及存储介质，用以解决现有技术中搜索算法的速度较低以及攻击成功率较低的问题。
本申请实施例提供一种对抗样本的生成方法，包括：
获取原始文本；
确定所述原始文本中各个词的替换词候选集；
基于粒子群优化算法，从所述替换词候选集的组合构成的离散空间中搜索攻击目标模型的样本，生成对抗样本。
可选地，所述确定所述原始文本中各个词的替换词候选集包括：
对所述原始文本中各个词的词性进行标注；
获取各个词在同一词性下每个义项的义原标注，将存在义原标注相同且词性相同义项的词语确定为候选替换词；
将所述候选替换词组成的集合确定为所述替换词候选集。
可选地，所述对所述原始文本中各个词的词性进行标注包括：
确定所述原始文本为中文文本，对所述原始文本进行分词操作，对分词后的各个词的词性进行标注；
确定所述原始文本为英文文本，将所述原始文本中各个词还原为原形，对还原后的各个词的词性进行标注。
可选地，所述基于粒子群优化算法，从所述替换词候选集的组合构成的离散空间中搜索攻击目标模型的样本，生成对抗样本包括：
将所述原始文本复制k次得到初始样本，并对每个所述初始样本进行变异操作生成新粒子群，粒子群中的每个粒子为一个变异后的样本；
每一轮迭代时，记录粒子群中的全局最优解以及历史最优解，所述全局最优解为目标模型给出的目标标签预测分数最高的粒子的位置，所述历史最优解为每个粒子历次迭代中目标标签预测分数最高的位置；
确定记录的最优解为对抗样本时停止搜索并输出所述对抗样本，否则更新粒子速度和位置，并进行变异操作后，返回执行所述记录粒子群中目标模型给出的目标标签预测分数最高的粒子以及每个粒子历次迭代中目标标签预测分数最高的位置的操作，直到确定记录的最优解为对抗样本时停止搜索并输出对应的对抗样本为止。
可选地，所述更新粒子速度和位置包括：
每一轮迭代时，粒子的速度按如下公式更新：
Figure PCTCN2020103219-appb-000001
式中，
Figure PCTCN2020103219-appb-000002
为第n个粒子第d维的速度，ω为惯性因子随迭代次数递减，
Figure PCTCN2020103219-appb-000003
为第n个粒子第d维的位置，
Figure PCTCN2020103219-appb-000004
为第n个粒子的历史最优解第d维的位置，
Figure PCTCN2020103219-appb-000005
为全局最优解第d维的位置，I(a,b)被定义为：
Figure PCTCN2020103219-appb-000006
粒子位置更新包括：向每个粒子自身的历史最优解移动，移动概率为P i；向全局最优解移动，移动概率为P g；其中，P i和P g随着迭代次数进行更新：
Figure PCTCN2020103219-appb-000007
Figure PCTCN2020103219-appb-000008
其中，1>P max>P min>0为预定义的超参数，t为当前迭代次数,T为最大迭代次数。
可选地，所述进行变异操作包括：
粒子群中的每个粒子以概率P m进行变异操作，第n个粒子x n的变异概率为：
Figure PCTCN2020103219-appb-000009
式中，x o表示原始文本，ε(x n,x o)表示x n和x o中不同的词数，D表示原始文本的总词数。
本申请实施例还提供一种对抗样本的生成装置，包括：
获取模块，配置为获取原始文本；
确定模块，配置为确定所述原始文本中各个词的替换词候选集；
生成模块，配置为基于粒子群优化算法，从所述替换词候选集的组合构成的离散空间中搜索攻击目标模型的样本，生成对抗样本。
可选地，所述确定模块包括：
标注单元，配置为对所述原始文本中各个词的词性进行标注；
第一确定单元，配置为获取各个词在同一词性下每个义项的义原标注，将存在义原标注相同且词性相同义项的词语确定为候选替换词；
第二确定单元，配置为将所述候选替换词组成的集合确定为所述替换词候选集。
本申请实施例提供一种电子设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述程序时实现 上述任一种所述对抗样本的生成方法的步骤。
本申请实施例还提供一种非暂态计算机可读存储介质，其上存储有计算机程序，该计算机程序被处理器执行时实现上述任一种所述对抗样本的生成方法的步骤。
本申请实施例提供的对抗样本的生成方法、装置、电子设备及存储介质，通过获取原始文本；确定原始文本中各个词的替换词候选集；基于粒子群优化算法，从替换词候选集的组合构成的离散空间中搜索攻击目标模型的样本，生成对抗样本。本申请实施例使用粒子群优化算法来搜索对抗样本，由于粒子群优化作为一种元启发式的群体进化计算方法，比遗传算法更加高效，因此采用该算法搜索对抗样本时能够提升搜索速度，并且还能够提高攻击成功率。针对不同的自然语言处理模型，本申请实施例能够快速高效地生成大量高质量对抗样本，成功欺骗目标模型，进而暴露其脆弱性，具有良好的实用性。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作一简单地介绍，显而易见地，下面描述中的附图是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本申请实施例提供的对抗样本的生成方法的一种具体实施方式的流程图；
图2为本申请实施例提供的对抗样本的生成方法方式中确定替换词候选集的流程图；
图3为本申请实施例提供的对抗样本的生成方法方式中搜索对抗样本的流程图；
图4为本申请实施例提供的对抗样本的生成装置的结构框图；
图5为本申请实施例提供的电子设备的实体结构示意图。
具体实施方式
为使本申请实施例的目的、技术方案和优点更加清楚，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描 述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请实施例提供的对抗样本的生成方法的一种具体实施方式的流程图如图1所示，该方法具体包括：
步骤S101：获取原始文本；
步骤S102：确定所述原始文本中各个词的替换词候选集；
在获取原始文本之后，确定原始文本的类型为中文文本或者英文文本。如果为英文文本，则不需要进行分词操作；如果为中文文本，则应进行分词操作，得到原始文本中的各个词。针对原始文本中的各个词，生成各个词分别对应的候选替换词。将一个或多个候选替换词组成的集合确定为替换词候选集。为进一步保证替换文本的质量，在原始文本为英文时，可以对原始文本中的各个词进行词形还原操作之后，再进行候选替换词确定操作。词形还原为文本预处理中的重要部分，词形还原就是去掉单词的词缀，提取单词的主干部分。比如，单词“cars”词形还原后的单词为“car”，单词“ate”词形还原后的单词为“eat”。
进一步地，本申请实施例能够借助知网义原知识库为原始文本的每个词生成一个包含语义相同或相近的替换词的候选集。具体地，可以在对原始文本做词性标注，在得到每个词语的词性后从知网中获取该词语同词性的每个义项的义原标注，将存在与原标注相同且词性相同义项的词语视作候选替换词，然后将所有候选替换词组成替换词候选集。
步骤S103：基于粒子群优化算法，从所述替换词候选集的组合构成的离散空间中搜索攻击目标模型的样本，生成对抗样本。
基于粒子群优化算法，从所有替换词候选集的组合构成的离散空间中迅速搜索能够成功攻击目标模型的对抗样本。
本申请实施例提供的对抗样本的生成方法，通过获取原始文本；确定原始文本中各个词的替换词候选集；基于粒子群优化算法，从替换词候选集的组合构成的离散空间中搜索攻击目标模型的样本，生成对抗样本。本申请实施例使用粒子群优化算法来搜索对抗样本，由于粒子群优化作为一种元启发式的群体进化计算方法，比遗传算法更加高效，因此采用该算法 搜索对抗样本时能够提升搜索速度，并且还能够提高攻击成功率。
在产生替换词候选集时，常见的方法是借助同义词词典用原始文本中词语的同义词构成替换词候选集。然而，真实的文本中相当一部分词语没有同义词(比如命名实体词)，且有同义词的词语的同义词数量也非常有限。这导致了最终生成的候选对抗样本数量较少，进而影响攻击成功率。
本申请实施例提供的对抗样本的生成方法，通过借助其他的知识库，例如知网(HowNet)是一个语言知识库，其使用预定义好的义原——语言学中最小的语义单位——来为超过10万个中英文词语进行语义标注，可以认为义原标注相同的词语有相同的意思，进而可以作为候选替换词。而且，知网为包括实体词在内的各类词语都标注了义原，确保了实际文本中绝大多数词语都可以找到候选替换词。因此，本实施例能够提高候选替换词的数量和多样性。如图2本申请实施例提供的对抗样本的生成方法方式中确定替换词候选集的流程图所示，步骤S102确定替换词候选集的具体过程可以包括：
步骤S201：对所述原始文本中各个词的词性进行标注；
其中，确定所述原始文本为中文文本，对所述原始文本进行分词操作，对分词后的各个词的词性进行标注；确定所述原始文本为英文文本，将所述原始文本中各个词还原为原形，对还原后的各个词的词性进行标注。
步骤S202：获取各个词在同一词性下每个义项的义原标注，将存在义原标注相同且词性相同义项的词语确定为候选替换词；
步骤S203：将所述候选替换词组成的集合确定为所述替换词候选集。
本申请实施例通过借助知网义原知识库，为原始文本的每个词生成一个包含语义相同或相近的替换词的候选集，能够大幅度提高候选替换词的数量和多样性，进一步提升了所生成对抗样本的攻击成功率。
在上述任一实施例的基础上，参照图3，本申请实施例提供的对抗样本的生成方法中搜索算法的具体过程包括：
步骤S301：初始化粒子群；
设粒子群大小为k，将所述原始文本复制k次得到初始样本，并对每个所述初始样本进行一次变异操作生成新粒子群。变异操作指随机选取文本中的一个词语并将其替换成其替换词候选集中的随机一个词。粒子群中的 每个粒子为一个变异后的样本，也可以视作一个n维向量，n是文本的词语数量。粒子在离散空间中的位置代表样本每个词选取的替换词的组合。对于每个粒子的每一维我们都随机初始化一个速度v。
步骤S302：记录最优解；
每一轮迭代时，记录粒子群中目标模型给出的目标标签预测分数最高的粒子(全局最优解)以及每个粒子历次迭代中目标标签预测分数最高的位置(历史最优解)。目标标签指希望模型对对抗样本分类的标签，比如在情感二分类任务中原样本标签是正向则目标标签为负向，因为希望对抗样本使模型分类错误。
步骤S303：判断是否可以停止，如果否，则进入步骤S304；如果是，则进入步骤S305；
如果当前记录的最优解(目标标签预测分数最高的粒子)能够使模型分类错误，说明已经找到了一个成功的对抗样本，则停止搜索并输出该样本。否则需要在更新粒子速度和位置，并进行变异操作后，返回执行所述记录粒子群中目标模型给出的目标标签预测分数最高的粒子以及每个粒子历次迭代中目标标签预测分数最高的位置的操作，直到确定记录的最优解为对抗样本时停止搜索并输出对应的对抗样本为止。
步骤S304：更新粒子速度和位置，变异，返回步骤S302，进行新一轮的迭代。
每一轮迭代时，粒子的速度按如下公式更新：
Figure PCTCN2020103219-appb-000010
式中，
Figure PCTCN2020103219-appb-000011
为第n个粒子第d维的速度，ω为惯性因子随迭代次数递减，
Figure PCTCN2020103219-appb-000012
为第n个粒子第d维的位置，
Figure PCTCN2020103219-appb-000013
为第n个粒子的历史最优解第d维的位置，
Figure PCTCN2020103219-appb-000014
为全局最优解第d维的位置，I(a,b)被定义为：
Figure PCTCN2020103219-appb-000015
完成速度更新之后，粒子需要进行两步位置更新。第一步向每个粒子自身的历史最优解移动，移动概率为P i。第二步向全局最优解移动，移动概率为P g。其中P i和P g随着迭代次数进行更新：
Figure PCTCN2020103219-appb-000016
Figure PCTCN2020103219-appb-000017
其中1>P max>P min>0为预定义的超参数，t为当前迭代次数,T为最大迭代次数。
本申请实施例中，P i和P g随着迭代次数进行更新，与P i和P g均为常数的设定相比，这样的设定下P i随着迭代次数增加而减少，P g随着迭代次数增加而变大，使得粒子在搜索初期在各自附近空间进行探索，以探索更多的未知空间，在搜索后期则在当前已经找到的最优解附近进行探索，能够尽快收敛到最优解。经过实验验证，在相同的最高迭代次数限制下，这样的设定比P i和P g均为常数的设定攻击成功率高10％-15％。
在每一步位置更新，一旦粒子决定移动，其每一维的移动概率为
Figure PCTCN2020103219-appb-000018
更新速度和位置后，粒子群中的每个粒子以概率P m进行变异操作。第n个粒子x n的变异概率为：
Figure PCTCN2020103219-appb-000019
式中，x o表示原始文本，ε(x n,x o)表示x n和x o中不同的词数，D表示原始文本的总词数。
步骤S305：停止搜索并输出该样本，作为对抗样本。
本申请实施例通过义原为原始文本中的词产生替换词候选集，同时通过粒子群优化算法在替换词候选集组合而成的离散空间中搜索能够成功攻击目标模型的对抗样本。本申请针对不同的自然语言处理模型，能够高效地生成大量高质量对抗样本，成功欺骗目标模型，进而暴露其脆弱性，具有良好的实用性。
本申请所提供的对抗样本的生成装置的结构框图如图4所示，该装置具体包括：
获取模块401，配置为获取原始文本；
确定模块402，配置为确定所述原始文本中各个词的替换词候选集；
生成模块403，配置为基于粒子群优化算法，从所述替换词候选集的组合构成的离散空间中搜索攻击目标模型的样本，生成对抗样本。
进一步地，所述确定模块402还可以包括：
标注单元，配置为对所述原始文本中各个词的词性进行标注；
第一确定单元，配置为获取各个词在同一词性下每个义项的义原标注， 将存在义原标注相同且词性相同义项的词语确定为候选替换词；
第二确定单元，配置为将所述候选替换词组成的集合确定为所述替换词候选集。
进一步地，所述标注单元具体配置为：确定所述原始文本为中文文本，对所述原始文本进行分词操作，对分词后的各个词的词性进行标注；确定所述原始文本为英文文本，将所述原始文本中各个词还原为原形，对还原后的各个词的词性进行标注。
在上述任一实施例的基础上，所述生成模块403具体配置为：将所述原始文本复制k次得到初始样本，并对每个所述初始样本进行变异操作生成新粒子群，粒子群中的每个粒子为一个变异后的样本；每一轮迭代时，记录粒子群中目标模型给出的目标标签预测分数最高的粒子以及每个粒子历次迭代中目标标签预测分数最高的位置；确定记录的最优解为对抗样本时停止搜索并输出所述对抗样本，否则更新粒子速度和位置，并进行变异操作后，返回执行所述记录粒子群中目标模型给出的目标标签预测分数最高的粒子以及每个粒子历次迭代中目标标签预测分数最高的位置的操作，直到确定记录的最优解为对抗样本时停止搜索并输出对应的对抗样本为止。
本实施例的对抗样本的生成装置用于实现前述的对抗样本的生成方法，因此对抗样本的生成装置中的具体实施方式可见前文中的对抗样本的生成方法的实施例部分，例如获取模块401、确定模块402、生成模块403分别用于实现上述对抗样本的生成方法中步骤S101，S102，S103，所以，其具体实施方式可以参照对应的各个部分实施例的描述，在此不再赘述。
图5示例了一种电子设备的实体结构示意图，如图5所示，该电子设备可以包括：处理器(processor)510、通信接口(Communications Interface)520、存储器(memory)530和通信总线540，其中，处理器510，通信接口520，存储器530通过通信总线540完成相互间的通信。处理器510可以调用存储器530中的逻辑指令，以执行如下方法：获取原始文本；确定所述原始文本中各个词的替换词候选集；基于粒子群优化算法，从所述替换词候选集的组合构成的离散空间中搜索攻击目标模型的样本，生成对抗样本。
此外，上述的存储器530中的逻辑指令可以通过软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以计算机软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
在一种实施例中，处理器510可以调用存储器530中的逻辑指令，以执行如下方法：对所述原始文本中各个词的词性进行标注；获取各个词在同一词性下每个义项的义原标注，将存在义原标注相同且词性相同义项的词语确定为候选替换词；将所述候选替换词组成的集合确定为所述替换词候选集。
在一种实施例中，处理器510可以调用存储器530中的逻辑指令，以执行如下方法：确定所述原始文本为中文文本，对所述原始文本进行分词操作，对分词后的各个词的词性进行标注；确定所述原始文本为英文文本，将所述原始文本中各个词还原为原形，对还原后的各个词的词性进行标注。
在一种实施例中，处理器510可以调用存储器530中的逻辑指令，以执行如下方法：将所述原始文本复制k次得到初始样本，并对每个所述初始样本进行变异操作生成新粒子群，粒子群中的每个粒子为一个变异后的样本；每一轮迭代时，记录粒子群中目标模型给出的目标标签预测分数最高的粒子以及每个粒子历次迭代中目标标签预测分数最高的位置；确定记录的最优解为对抗样本时停止搜索并输出所述对抗样本，否则更新粒子速度和位置，并进行变异操作后，返回执行所述记录粒子群中目标模型给出的目标标签预测分数最高的粒子以及每个粒子历次迭代中目标标签预测分数最高的位置的操作，直到确定记录的最优解为对抗样本时停止搜索并输出对应的对抗样本为止。
另一方面，本申请实施例还提供一种非暂态计算机可读存储介质，其 上存储有计算机程序，该计算机程序被处理器执行时实现以执行上述各实施例提供的传输方法，例如包括：获取原始文本；确定所述原始文本中各个词的替换词候选集；基于粒子群优化算法，从所述替换词候选集的组合构成的离散空间中搜索攻击目标模型的样本，生成对抗样本。
本申请实施例所提供的电子设备以及非暂态计算机可读存储介质，均与上述对抗样本的生成方法相对应，其具体实施方式可以参照前述部分的对应内容，在此不再赘述。
综上，本申请实施例提供的对抗样本的生成方法、装置、电子设备及存储介质，通过获取原始文本；确定原始文本中各个词的替换词候选集；基于粒子群优化算法，从替换词候选集的组合构成的离散空间中搜索攻击目标模型的样本，生成对抗样本。本申请实施例使用粒子群优化算法来搜索对抗样本，由于粒子群优化作为一种元启发式的群体进化计算方法，比遗传算法更加高效，因此采用该算法搜索对抗样本时能够提升搜索速度，并且还能够提高攻击成功率。针对不同的自然语言处理模型，本申请实施例能够快速高效地生成大量高质量对抗样本，成功欺骗目标模型，进而暴露其脆弱性，具有良好的实用性。
以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个位置，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。本领域普通技术人员在不付出创造性的劳动的情况下，即可以理解并实施。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到各实施方式可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件。由此，本申请可以以计算机软件产品的形式体现出来，该计算机软件产品可以存储在计算机可读存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行各个实施例或者实施例的某些部分所述的方法。
最后应说明的是：以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通 技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (10)

  1. 一种对抗样本的生成方法，其特征在于，包括：
    获取原始文本；
    确定所述原始文本中各个词的替换词候选集；
    基于粒子群优化算法，从所述替换词候选集的组合构成的离散空间中搜索攻击目标模型的样本，生成对抗样本。
  2. 根据权利要求1所述的对抗样本的生成方法，其特征在于，所述确定所述原始文本中各个词的替换词候选集包括：
    对所述原始文本中各个词的词性进行标注；
    获取各个词在同一词性下每个义项的义原标注，将存在义原标注相同且词性相同义项的词语确定为候选替换词；
    将所述候选替换词组成的集合确定为所述替换词候选集。
  3. 根据权利要求2所述的对抗样本的生成方法，其特征在于，所述对所述原始文本中各个词的词性进行标注包括：
    确定所述原始文本为中文文本，对所述原始文本进行分词操作，对分词后的各个词的词性进行标注；
    确定所述原始文本为英文文本，将所述原始文本中各个词还原为原形，对还原后的各个词的词性进行标注。
  4. 根据权利要求1至3任一项所述的对抗样本的生成方法，其特征在于，所述基于粒子群优化算法，从所述替换词候选集的组合构成的离散空间中搜索攻击目标模型的样本，生成对抗样本包括：
    将所述原始文本复制k次得到初始样本，并对每个所述初始样本进行变异操作生成新粒子群，粒子群中的每个粒子为一个变异后的样本；
    每一轮迭代时，记录粒子群中的全局最优解以及历史最优解，所述全局最优解为目标模型给出的目标标签预测分数最高的粒子的位置，所述历史最优解为每个粒子历次迭代中目标标签预测分数最高的位置；
    确定记录的最优解为对抗样本时停止搜索并输出所述对抗样本，否则更新粒子速度和位置，并进行变异操作后，返回执行所述记录粒子群中目标模型给出的目标标签预测分数最高的粒子以及每个粒子历次迭代中目标标签预测分数最高的位置的操作，直到确定记录的最优解为对抗样本时 停止搜索并输出对应的对抗样本为止。
  5. 根据权利要求4所述的对抗样本的生成方法，其特征在于，所述更新粒子速度和位置包括：
    每一轮迭代时，粒子的速度按如下公式更新：
    Figure PCTCN2020103219-appb-100001
    式中，
    Figure PCTCN2020103219-appb-100002
    为第n个粒子第d维的速度，ω为惯性因子随迭代次数递减，
    Figure PCTCN2020103219-appb-100003
    为第n个粒子第d维的位置，
    Figure PCTCN2020103219-appb-100004
    为第n个粒子的历史最优解第d维的位置，
    Figure PCTCN2020103219-appb-100005
    为全局最优解第d维的位置，I(a,b)被定义为：
    Figure PCTCN2020103219-appb-100006
    粒子位置更新包括：向每个粒子自身的历史最优解移动，移动概率为P i；向全局最优解移动，移动概率为P g；其中，P i和P g随着迭代次数进行更新：
    Figure PCTCN2020103219-appb-100007
    Figure PCTCN2020103219-appb-100008
    其中，1>P max>P min>0为预定义的超参数，t为当前迭代次数,T为最大迭代次数。
  6. 根据权利要求4所述的对抗样本的生成方法，其特征在于，所述进行变异操作包括：
    粒子群中的每个粒子以概率P m进行变异操作，第n个粒子x n的变异概率为：
    Figure PCTCN2020103219-appb-100009
    式中，x o表示原始文本，ε(x n,x o)表示x n和x o中不同的词数，D表示原始文本的总词数。
  7. 一种对抗样本的生成装置，其特征在于，包括：
    获取模块，配置为获取原始文本；
    确定模块，配置为确定所述原始文本中各个词的替换词候选集；
    生成模块，配置为基于粒子群优化算法，从所述替换词候选集的组合构成的离散空间中搜索攻击目标模型的样本，生成对抗样本。
  8. 根据权利要求7所述的对抗样本的生成装置，其特征在于，所述 确定模块包括：
    标注单元，配置为对所述原始文本中各个词的词性进行标注；
    第一确定单元，配置为获取各个词在同一词性下每个义项的义原标注，将存在义原标注相同且词性相同义项的词语确定为候选替换词；
    第二确定单元，配置为将所述候选替换词组成的集合确定为所述替换词候选集。
  9. 一种电子设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其特征在于，所述处理器执行所述程序时实现如权利要求1至6任一项所述对抗样本的生成方法的步骤。
  10. 一种非暂态计算机可读存储介质，其上存储有计算机程序，其特征在于，该计算机程序被处理器执行时实现如权利要求1至6任一项所述对抗样本的生成方法的步骤。
PCT/CN2020/103219 2020-04-21 2020-07-21 对抗样本的生成方法、装置、电子设备及存储介质 WO2021212675A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010317965.9 2020-04-21
CN202010317965.9A CN111652267B (zh) 2020-04-21 2020-04-21 对抗样本的生成方法、装置、电子设备及存储介质

Publications (1)

Publication Number Publication Date
WO2021212675A1 true WO2021212675A1 (zh) 2021-10-28

Family

ID=72346469

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/103219 WO2021212675A1 (zh) 2020-04-21 2020-07-21 对抗样本的生成方法、装置、电子设备及存储介质

Country Status (2)

Country Link
CN (1) CN111652267B (zh)
WO (1) WO2021212675A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114169443A (zh) * 2021-12-08 2022-03-11 西安交通大学 词级文本对抗样本检测方法
CN114238661A (zh) * 2021-12-22 2022-03-25 西安交通大学 一种基于可解释模型的文本歧视性样本检测生成系统与方法
CN115034318A (zh) * 2022-06-17 2022-09-09 中国平安人寿保险股份有限公司 标题判别模型的生成方法和装置、设备、介质
CN115333869A (zh) * 2022-10-14 2022-11-11 四川大学 一种分布式网络对抗攻击自训练学习方法
CN117808095A (zh) * 2024-02-26 2024-04-02 哈尔滨工业大学(深圳)(哈尔滨工业大学深圳科技创新研究院) 一种对抗攻击样本生成方法和装置、电子设备

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112216273B (zh) * 2020-10-30 2024-04-16 东南数字经济发展研究院 一种针对语音关键词分类网络的对抗样本攻击方法
CN112380845B (zh) * 2021-01-15 2021-04-09 鹏城实验室 句子噪声设计方法、设备及计算机存储介质
CN113723506B (zh) * 2021-08-30 2022-08-05 南京星环智能科技有限公司 一种对抗样本的生成方法、设备及存储介质
CN113806490B (zh) * 2021-09-27 2023-06-13 中国人民解放军国防科技大学 一种基于bert采样的文本通用触发器生成系统和方法
CN113935481B (zh) * 2021-10-12 2023-04-18 中国人民解放军国防科技大学 针对自然语言处理模型在有限次数条件下的对抗测试方法
CN113642678B (zh) * 2021-10-12 2022-01-07 南京山猫齐动信息技术有限公司 一种对抗消息样本生成的方法、装置及存储介质
CN113946687B (zh) * 2021-10-20 2022-09-23 中国人民解放军国防科技大学 一种标签一致的文本后门攻击方法
CN114444476B (zh) * 2022-01-25 2024-03-01 腾讯科技（深圳）有限公司 信息处理方法、装置和计算机可读存储介质
CN116151392B (zh) * 2023-02-28 2024-01-09 北京百度网讯科技有限公司 训练样本生成方法、训练方法、推荐方法以及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109214327A (zh) * 2018-08-29 2019-01-15 浙江工业大学 一种基于pso的反人脸识别方法
CN109599109A (zh) * 2018-12-26 2019-04-09 浙江大学 针对白盒场景的对抗音频生成方法及系统
CN109887496A (zh) * 2019-01-22 2019-06-14 浙江大学 一种黑盒场景下的定向对抗音频生成方法及系统
CN110767216A (zh) * 2019-09-10 2020-02-07 浙江工业大学 一种基于pso算法的语音识别攻击防御方法

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11468234B2 (en) * 2017-06-26 2022-10-11 International Business Machines Corporation Identifying linguistic replacements to improve textual message effectiveness
CN110619292B (zh) * 2019-08-31 2021-05-11 浙江工业大学 基于二进制粒子群通道优化的对抗防御方法
CN110930182A (zh) * 2019-11-08 2020-03-27 中国农业大学 基于改进粒子群优化算法的客户分类方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109214327A (zh) * 2018-08-29 2019-01-15 浙江工业大学 一种基于pso的反人脸识别方法
CN109599109A (zh) * 2018-12-26 2019-04-09 浙江大学 针对白盒场景的对抗音频生成方法及系统
CN109887496A (zh) * 2019-01-22 2019-06-14 浙江大学 一种黑盒场景下的定向对抗音频生成方法及系统
CN110767216A (zh) * 2019-09-10 2020-02-07 浙江工业大学 一种基于pso算法的语音识别攻击防御方法

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
QIAN, YAGUAN ET AL.: "Adversarial Example Generation Based on Particle Swarm Optimization", JOURNAL OF ELECTRONICS & INFORMATION TECHNOLOGY, vol. 41, no. 7, 31 July 2019 (2019-07-31), pages 1658 - 1665, XP055860464 *
YUAN ZANG; CHENGHAO YANG; FANCHAO QI; ZHIYUAN LIU; MENG ZHANG; QUN LIU; MAOSONG SUN: "Open the Boxes of Words: Incorporating Sememes into Textual Adversarial Attack", ARXIV.ORG, 27 October 2019 (2019-10-27), 201 Olin Library Cornell University Ithaca, NY 14853 , XP081521492 *
YUAN ZANG; CHENGHAO YANG; FANCHAO QI; ZHIYUAN LIU; MENG ZHANG; QUN LIU; MAOSONG SUN: "Textual Adversarial Attack as Combinatorial Optimization", ARXIV.ORG, 27 October 2019 (2019-10-27), 201 Olin Library Cornell University Ithaca, NY 14853 , XP081529211 *

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114169443A (zh) * 2021-12-08 2022-03-11 西安交通大学 词级文本对抗样本检测方法
CN114169443B (zh) * 2021-12-08 2024-02-06 西安交通大学 词级文本对抗样本检测方法
CN114238661A (zh) * 2021-12-22 2022-03-25 西安交通大学 一种基于可解释模型的文本歧视性样本检测生成系统与方法
CN114238661B (zh) * 2021-12-22 2024-03-19 西安交通大学 一种基于可解释模型的文本歧视性样本检测生成系统与方法
CN115034318A (zh) * 2022-06-17 2022-09-09 中国平安人寿保险股份有限公司 标题判别模型的生成方法和装置、设备、介质
CN115034318B (zh) * 2022-06-17 2024-05-17 中国平安人寿保险股份有限公司 标题判别模型的生成方法和装置、设备、介质
CN115333869A (zh) * 2022-10-14 2022-11-11 四川大学 一种分布式网络对抗攻击自训练学习方法
CN115333869B (zh) * 2022-10-14 2022-12-13 四川大学 一种分布式网络对抗攻击自训练学习方法
CN117808095A (zh) * 2024-02-26 2024-04-02 哈尔滨工业大学(深圳)(哈尔滨工业大学深圳科技创新研究院) 一种对抗攻击样本生成方法和装置、电子设备
CN117808095B (zh) * 2024-02-26 2024-05-28 哈尔滨工业大学(深圳)(哈尔滨工业大学深圳科技创新研究院) 一种对抗攻击样本生成方法和装置、电子设备

Also Published As

Publication number Publication date
CN111652267B (zh) 2023-01-31
CN111652267A (zh) 2020-09-11

Similar Documents

Publication Publication Date Title
WO2021212675A1 (zh) 对抗样本的生成方法、装置、电子设备及存储介质
US11734329B2 (en) System and method for text categorization and sentiment analysis
CN108399228B (zh) 文章分类方法、装置、计算机设备及存储介质
US10262272B2 (en) Active machine learning
US9633002B1 (en) Systems and methods for coreference resolution using selective feature activation
US20200342172A1 (en) Method and apparatus for tagging text based on adversarial learning
EP3748548A1 (en) Adversarial learning-based text annotation method and device
US20200192979A1 (en) Efficient and accurate named entity recognition method and apparatus
US8635171B1 (en) Systems and methods for reducing false positives produced by heuristics
US11847423B2 (en) Dynamic intent classification based on environment variables
CN112256842B (zh) 用于文本聚类的方法、电子设备和存储介质
WO2022222300A1 (zh) 开放关系抽取方法、装置、电子设备及存储介质
WO2021179483A1 (zh) 基于损失函数的意图识别方法、装置、设备及存储介质
US8352409B1 (en) Systems and methods for improving the effectiveness of decision trees
US11126797B2 (en) Toxic vector mapping across languages
WO2020172649A1 (en) System and method for text categorization and sentiment analysis
Zhang et al. Argot: Generating adversarial readable chinese texts
WO2020006488A1 (en) Corpus generating method and apparatus, and human-machine interaction processing method and apparatus
WO2024051196A1 (zh) 恶意代码检测方法、装置、电子设备及存储介质
CN115035890B (zh) 语音识别模型的训练方法、装置、电子设备及存储介质
CN113378557B (zh) 一种基于容错粗糙集的自动关键字提取方法、介质及系统
CN115858776A (zh) 一种变体文本分类识别方法、系统、存储介质和电子设备
US11556574B2 (en) Preparing documents for coreference analysis
US20220092260A1 (en) Information output apparatus, question generation apparatus, and non-transitory computer readable medium
Guo et al. Searching for Textual Adversarial Examples with Learned Strategy

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20932401

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20932401

Country of ref document: EP

Kind code of ref document: A1