Vision-fused Attack: Advancing Aggressive and Stealthy Adversarial Text against Neural Machine Translation

1 Introduction

Neural machine translation (NMT) has achieved remarkable progress and has been widely used in many scenarios with the advancement of deep neural networks. However, recent studies have revealed the vulnerability of NMT models. A well-designed adversarial text, which aims to deceive NMT models while remaining imperceptible to humans, could result in poor model performance [Zhang et al., 2021]. Nev- Trans �𝒚𝒚𝒐𝒐𝒐𝒐𝒐𝒐𝒐𝒐𝒐𝒐𝒐𝒐

Codes can be found at https://github.com/Levelower/VFA.

Figure 1: Our proposed VFA reduces the translation quality of NMT models by generating visually similar characters that are aggressive, such as "未" and "末" in the figure, while maintaining consistency with human's recognition of text to achieve stealthiness.

ertheless, as the old saying goes, every coin has two sides, though harming NMT models, the adversarial attacks could also help understand the behavior of the unexplainable deep models. Therefore, generating adversarial text has essential value in constructing trustworthy and robust NMT models.

Existing studies on generating adversarial text for NMT models can be classified into targeted attacks and untargeted attacks based on the intended attack purpose. Although both of them aim to fool NMT models, their purposes have a few differences. To be specific, the former simply misleads the translation into arbitrary wrong output, while the latter is intended to let the NMT models make particular false responses, e.g., inserting keywords into the translated sentences [Cheng et al., 2018; Sadrizadeh et al., 2023].

Despite significant progress in generating adversarial text, current studies still show some weaknesses, which can be summarized into two aspects: (1) The unsatisfactory attacking ability. Most attacking methods first search candidate adversarial words in the embedding space, which is strictly constrained due to the extra semantic-preserving requirements. As a result, the searched adversarial results could not mislead the NMT models to the largest extent in such a narrow embedding space. (2) The insufficient imperceptibility goal. Current attacks mainly achieve the goal via restricting the adversarial results at the semantic level. However, the text's perception of mankind is more correlated to the visual system, i.e., humans always recognize text first and process them later. Thus, due to the sole semantic restriction, the generated adversarial text might not be stealthy enough for humans.

To tackle these issues, we propose Vision-fused Attack framework (VFA) to generate more aggressive adversarial text against NMT models with higher attacking ability and better visual stealthiness. Figure 1 illustrates the difference between our adversarial text and others. To improve the attacking ability, considering that the limited semantic solution space might restrict the adversarial text candidates, we propose the vision-merged solution space enhancement (VSSE) strategy to abound the searchable adversarial candidates by the visual solution space mixture module. In detail, we first enhance the basic semantic space with the help of a reverse translation block. Further, we map the enhanced solution space into vision space via the text-image transformation block. Since the mapped visual solution space mixes both semantic and visual characteristics, it offers a broader searching range for candidate adversarial words, thus making it more possible to activate higher attacking ability in practice. Regarding the imperceptibility of adversarial text, given the neglected fact that human reading accepts visual signals first to recognize text, we develop the perception-retained adversarial text selection (PATS) strategy to evade human perception through the perception stealthiness enhancement module. Specifically, an improved word replacement operation is preliminarily introduced to disperse attack locations. Then, we integrate the visual characteristics of local characters and global sentences to align with the human text-reading mechanism. Since this selection strategy could filter the human perceptually suspected candidates, we could efficiently and accurately select more imperceptible adversarial text in principle to deceive the text perception of humans.

To demonstrate the effectiveness of the proposed method, we conduct extensive experiments under white-box and black-box settings on various representative models and widely-used datasets, including open-source and closedsource large language models like GPT-3.5 and LLaMA. The experimental results strongly support that our VFA outperforms the comparisons by large margins.

Our main contributions are as follows:

• To the best of our knowledge, we are the first to introduce visual perception, which aligns with human reading, to generate adversarial text against NMT models.
• We propose a Vision-fused Attack (VFA) against NMT models, acquiring aggressive and stealthy adversarial text through vision-merged solution space enhancement and perception-retained adversarial text selection.
• Extensive experiments show that VFA outperforms the comparisons by large margins (up to 81%/28% improvements on common NMT models/LLMs), and achieves considerable imperceptibility (up to 14% improvements) in both machine evaluation and human study.

2 RelatedWork

The neural machine translation (NMT), which translates texts from one language to another, has achieved impressive progress using DNN models such as transformers [Vaswani et al., 2017]. Due to their excellent performance, NMT models are widely used in different applications [Gao et al., 2023]. However, recent studies of adversarial text investigate the vulnerability of NMT models, whose ultimate goal is to mislead NMT models but imperceptible to humans. Though they are harmful to DNN models, they could also help us understand them [Wang et al., 2021a; Wang et al., 2021b]. Therefore, there has been an increasing number of recent studies on adversarial attacks against NMT models.

Adversarial attacks on NMT models can be divided into untargeted attacks and targeted attacks. Untargeted attacks aim to degrade the translation quality of NMT models. Targeted attacks mislead the victim model to produce a particular translation, for example, one that does not overlap with the reference or inserts some keywords into the translation.

Current untargeted attacks always use semantic perturbations to degrade the model performance. Specifically, attackers rank the words in a sentence by saliency and randomly substitute them based on the saliency order [Cheng et al., 2019; Cheng et al., 2020]. However, random substitution may reduce the imperceptibility of adversarial text. Therefore, some studies choose to replace these words with similar ones, requiring semantic similarity techniques to identify similar word lists [Feng et al., 2022]. Nevertheless, the inefficiency of embedding techniques may still result in false substitutions. To resolve this problem, Word Saliency speedup Local Search uses Round-Trip Translation (RTT) to handle it [Zhang et al., 2021]. Additionally, the Doubly RoundTrip Translation (DRTT) method further amplifies the RTT to achieve better quality of adversarial text [Lai et al., 2022].

In targeted attack research, attacks fool the target model into generating a particular translation. Such as the translation does not overlap with the reference or push some words into it [Cheng et al., 2018]. They use a hinge-like loss term and a group lasso regularization to make perturbations, thereby achieving specific attack targets. Since these perturbations in the embedding space are less constrained, they may not preserve semantic similarity. Therefore, some studies define the new optimization problem, including adversarial loss and similarity terms. Finally, they perform gradient projection in the embedding space to generate adversarial sentences [Sadrizadeh et al., 2023].

Both above approaches aim to perturb original sentences with similar words, which satisfies the requirement of semantics-preserving. However, there are differences in the cognitive process of text between humans and models. For humans, the cognitive process of text can be divided into visual perception and semantic understanding, while models only imitate the latter. Therefore, the generated adversarial text does not perform well in the visual perception part, resulting in poor human imperceptibility.

3 Approach

In this section, we define the adversarial text for NMT models and then elaborate on our proposed Vision-fused Attack.

3.1 ProblemDefinition

Given a source sentence x and a reference sentence y, the adversarial text xδ is generated to mislead targeted model M to generate low-quality results. Referring to previous work [Ebrahimi et al., 2018a], a successful attack satisfies:

Here, simt(·) refers to the similarity function used for evaluating semantic similarity. The parameter α is established as the lower limit, representing the lowest degradation of translation quality. It is worth noting that we differ from previous work in assessing effectiveness, which uses sole semantic similarity [Zhang et al., 2021; Lai et al., 2022]. We define an authentic adversarial text from the perspective of visual perception, and the definition of adversarial text differs accordingly. Specifically, we generate a semantically extension ˆx for the original text x (this process will be detailed in the Reverse Translation Block), and use ˆx as the text to be replaced to generate the final adversarial text xδ. Our modified definition is given as:

The function simv is a visual similarity function defined by the perception stealthiness enhancement module, which will be detailed in the following subsection. The parameter β and θ ensure the semantic and visual similarity. The authentic adversarial text satisfies the requirements of visual and semantic similarity while degrading the translation quality.

3.2 Overview of Vision-fused Attack

Previous studies generated adversarial text within a limited semantic space and overlooked the significance of visual perception in text reading. Consequently, it is challenging to produce more aggressive and imperceptible results. In response, we introduce a Vision-fused Attack (VFA) to generate human imperceptible adversarial text against NMT models. The overall framework is illustrated in Figure 2.

Addressing the limitation of the semantic solution space, we consider the amplified visual solution space and generate effective adversarial text through the Visual-merged Solution Space Enhancement (VSSE) strategy. Specifically, we expand the essential semantic solution space using a reverse translation block. Furthermore, our method generates candidate adversarial words through a text-image transformation block. With abundant adversarial candidates, we then filter unauthentic candidates using the Perception-retained Adversarial Text Selection (PATS) strategy to acquire more imperceptible adversarial text. Initially, we perform substitutions through an improved word replacement operation. Subsequently, we obtain the authentic adversarial text with a global perceptual constraint. This enables us to achieve superior perceptual retention results, aligning more closely with visioncorrelated human text perception.

3.3 Vision-merged Solution Space Enhancement

Our vision-merged enhanced solution space consists of two parts: one is the essential semantic space expanded through reverse translation block, which is termed as T, and the other is the mapped visual solution space corresponding to the input text, which is termed as V. Considering the further enhancement of vision-merged solution space, we transform the original input to increase the variety of words. Therefore, we can map semantic space into a larger visual space and search for adversarial words within this expanded area. When generating the candidate adversarial words, we first tokenize the original input sentence and the texts which are transformed through the reverse translation block. Then, we use semantic importance ranking to obtain ordered attack locations. Finally, we acquire possible adversarial candidates through a text-image transformation block.

Reverse Translation Block. We initially expand essential semantic space through reverse translation to amplify visionfused solution space. For the source sentence x and the reference sentence y, we generate similar sentences (referred to as ˆx) for x. For each reference translation y, we use an auxiliary translation model Maux to obtain transformed ˆx meanwhile the similarity between x and ˆx need to satisfy the constraint of the lowest thresh β. The sentence similarity is evaluated by a multilingual sentence model, which is termed as Msim:

Semantic Importance Ranking. The source sentence can be represented as a list of words w = ⟨w1,w2, ...,wn⟩. For a sequence that is masked at position i, which is termed as wimask = ⟨w1,w2, ...,wi-1, [m],wi+1, ...,wn⟩. We calculate the importance scores of these words at different positions named wi imp . Masked language model Mmlm (e.g., BERT) is used to predict word probability of occurrence. This process can be written as:

Text-imageTransformationBlock. For each character c in the Unicode character dictionary (referred to as C), we conduct a level-wise search to find the most similar candidate adversarial characters. Initially, we follow previous work to utilize the glyph dictionary, denoted as D, which stores mappings of specific characters c and their radicals z (Here we denote the set of all radicals as Z, where c ∈ C and z ∈ Z) [Su et al., 2022]. Each radical of character c can be found through function fc(·). We start by aggregating characters with the same radical (denoted as c′ ), narrowing down the candidate pool. We can obtain a portion of the candidate set Srad through a similar radical search, denoted as fa(·):

Due to the limitations of the glyph dictionary, we further pixelated the characters set and conducted similar image searches to find similar characters, which is denoted as Spix. The function p(·) is defined to convert a sentence or character into the correlated image. We map the input character to its pixelated image through p(c). Then, we calculate cosine similarity to search top m visually similar results using Faiss (a tool that accelerates vector calculations through hierarchical search) [Johnson et al., 2019]. And the procedure could be formulated as fcos(·):

where the top(·) represents the function that identifies the highest-ranked elements based on certain scores, such as cosine similarity. Finally, we apply Mean Squared Error (MSE) similarity to re-rank the possible adversarial character and select the top k candidate result:

Combined with the results of Srad and Spix , we can obtain the final candidate adversarial characters set S.

3.4 Perception-retained Adversarial Text Selection

For the generated candidate characters set S, we apply a perception stealthiness enhancement module, which consists of improved word replacement operation and global perceptual constraint, to filter out truly effective adversarial text. Therefore, the visually imperceptible candidates could stand out to better mislead human perception, i.e., stealthy.

ImprovedWord Replacement Operation. Firstly, we implement a substitution constraint strategy grounded in human perception. We intuitively regulate the replacement rate, deliberately replacing only one character within each word. This strategy disrupts the semantic expression of the word and minimizes the impact of perturbation. For text ˆx to be replaced, wi denotes the i-th word in order of importance wi imp of the text, and cj signifies the j-th character of a word wi. The replacement operation rate, denoted as r, falls within the range 0 ≤ r ≤ 1, representing the replacement probability of the overall sentence. And function rep(cjδ , cj) indicates whether the character cj is substituted by cjδ in S. When the character changes, the function equals 1. Otherwise, it equals 0. We can detail this constraint as follows:

Global Perceptual Constraint. Moreover, we take visual perception constraints into account. We introduce a visual perceptual similarity score for batch assessment of visual similarity. For a source sentence x paired with a reference image represented as p(x), and a perturbed sentence xδ with its associated image denoted as p(xδ), L(a, b) denotes the perceptual similarity score between images a and b. The parameter ϵ serves as a weight for local perception, where 0 ≤ ϵ ≤ 1. The sentence visual similarity score can be calculated using the visual perception constraint strategy. We introduce the LPIPS metric to construct a global perceptual constraint [Zhang et al., 2018]. This constraint measures the global perceptual similarity of a sentence and aggregates the local perceptual similarities of characters with the weighted summation. Finally, we use the perceptual constraint threshold θ to constrain visual similarity:

4 Experiment

In this section, we first describe the experimental settings, and then we report the experimental results and some discussions on the common NMT models and LLMs.

4.1 Experiments Settings

Datasets and Models. We choose the validation set of WMT19 [Ng et al., 2019], WMT18 [Bojar et al., 2018], and TED [Cettolo et al., 2016] for the Chinese-English (ZhEn) translation task and the test set of ASPEC [Nakazawa et al., 2016] for the Japanese-English (Ja-En) translation task. Regarding the models, the NMT models for both translation tasks are implemented using HuggingFace's Marian Model [Junczys-Dowmunt et al., 2018], with the Zh-En/JaEn translation models as the targeted models and the EnZh/En-Ja models as the auxiliary models. These datasets and models are widely used in previous studies. Besides, we consider pixel-based machine translation model as the targeted model to test the validity of our method [Salesky et al., 2023].

Evaluation Metrics. We use the relative decrease of the BLEU to measure the aggressiveness of adversarial text [Papineni et al., 2002]. A successful attack is defined when the BLEU score decreases by over 50%. The attack success rate (ASR) is defined as the ratio of successful adversarial texts to the total. Finally, we use the SSIM value to evaluate the imperceptibility of the adversarial text [Wang et al., 2004].

Compared Methods. We choose several state-of-the-art works about NLP attack and NMT attack, including HotFlip [Ebrahimi et al., 2018b], Seq2Sick [Cheng et al., 2018], Targeted Attack [Sadrizadeh et al., 2023], DRTT [Lai et al., 2022] and ADV [Su et al., 2022].

Implementation Details. As for the hyperparameter settings, we set the global perception constraint to 0.95 and the replacement rate to 0.2. To evaluate the semantic similarity between two sentences, we employ the HuggingFace sentence-transformer model [Wang et al., 2020], which supports multiple languages. Additionally, we utilize a Bert architecture model [Cui et al., 2019] to predict the importance of words. We conduct experiments in a cluster of NVIDIA GeForce RTX 3090 GPUs.

4.2 Effectiveness on Common NMTModels

In this section, we evaluate the aggressiveness and imperceptibility of adversarial texts generated by our VFA and compared methods. The evaluation is conducted on the Zh-En and Ja-En translation tasks using pure-text and pixel-based NMT models.

As seen in Tables 1 and 2, our VFA generates adversarial texts with the highest aggressiveness across both pixelbased and pure-text models in both tasks.

(1) In terms of aggressiveness, our VFA achieves the maximum BLEU decrease and the highest ASR on different datasets and translation tasks. Taking the results on WMT18 as an example, our VFA achieves a BLEU decrease of 40%, better than the best of 22% achieved by the Targeted Attack. Our ASR (0.384) outperforms the best (0.212) by 81%. This indicates that our proposed Vision-merged Solution Space Enhancement strategy effectively improves aggressiveness.

(2) Regarding imperceptibility, our VFA also achieves the best result. Our VFA maintains an SSIM value above 0.94 on Zh-En translation tasks, while the ADV has an SSIM value of no more than 0.85. Although our VFA is second only to Seq2Sick in the imperceptibility of the Ja-En translation task, Seq2Sick nearly keeps the original sentence when attacking Japanese texts, resulting in lower ASR and inability to guarantee aggressiveness. The results demonstrate that our proposed Perception-retained Adversarial Text Selection strategy effectively improves the imperceptibility of adversarial texts.

4.3 Transferability on LLMs

In this section, we evaluate the transferability of our VFA through LLM testing. We use adversarial texts generated by the common NMT model to evaluate the BLEU decrease and ASR on LLM. Our selection includes four models: LLaMA-13B [Touvron et al., 2023], BaiChuan13B [Baichuan, 2023], GPT-3.5-turbo [OpenAI, 2022], and Wenxin Yiyan (ERNIE) [Baidu, 2023], representing leading models in both open-source and closed-source fileds. ChatGPT and LLaMA represent the most advanced LLM for English, while ERNIE and BaiChuan represent the most advanced LLM for Chinese. These LLMs perform much better on clean datasets than common NMT models, indicating that LLMs also have strong capabilities in translation tasks.

Table 3 displays the experiments on these models. These results indicate that even large language models exhibit decreased performance in the face of attack. We further give some insights and discussions as follows:

(1) Our VFA demonstrates the best aggressiveness in the open-source and closed-source LLMs. For the widely used LLaMA and ChatGPT, our VFA achieves the strongest aggressiveness on all datasets. For BaiChuan and ERNIE, which perform better in Chinese, our VFA also performs best on WMT19 and WMT18. This proves that our VFA has good transferability for LLMs.

(2) An interesting phenomenon is that our VFA is more aggressive against English LLMs than other methods. However, when applied to Chinese LLMs, our VFA only achieved a slight lead in aggressiveness and even performed weaker than Targeted Attack and Seq2Sick on the TED dataset. We attribute this phenomenon to the learning of human perception by LLM. After training with a large amount of Chinese corpus, the large model can generalize to a certain degree of human-like perception ability, which makes them robust to visual adversarial texts generated by our VFA.

4.4 Human Study

To evaluate the impact of adversarial texts generated by our VFA and compared methods on reading comprehension, we conduct a human perception study on SurveyPlus, which is one of the most commonly used crowdsourcing platforms.

We select 20 adversarial texts generated by six methods that meet the definition of a successful attack, then we select 105 subjects and conduct the following human perception experiments: (1) Semantic understanding. Subjects are informed of some changes in each text and asked if these changes affect their understanding of semantics. (2) Semantic comparison. For the texts selected by the subjects in the previous stage, they are required to compare them with original texts and choose the ones that maintain semantic consistency. Finally, we count the number of texts in each method that do not affect understanding (score1) and are semantically consistent with the original texts (score2), and divide them by the total number of people as the scores for each method.

From Table 4, it can be seen that our VFA achieves the second-highest score in the semantic understanding stage and the highest score in the semantic comparison stage. This indicates that our method has the least impact on human understanding and the least impact on semantic changes. As for DRTT, which achieved the highest score in semantic understanding, due to its use of grammatically similar modification strategies, it will have a significant change in the semantics of the original sentence, resulting in a lower score in the semantic comparison stage. In the total score of the two stages, VFA achieves the highest, indicating that it has the least impact on human reading comprehension and has good imperceptibility.

4.5 Ablation Study

In this section, we conducted several ablation studies to further investigate the contributions of some crucial components and hyper-parameters in our method.

Effectiveness of Enhanced Solution Space and Perception Constraint. We divide our VFA into Vision-merged Solution Space Enhancement (VSSE) and Perception-retained Adversarial Text Selection (PATS). For the vision-merged solution space, we compare the aggressiveness with the semantic solution space. Additionally, we explore the impact of PATS on the imperceptibility of adversarial texts. We conduct four sets of ablation experiments on these two components, namely, whether to use VSSE and PATS. As shown in Table 5, it is evident that searching in the enhanced solution space significantly improves aggressiveness compared to semantic solution space. Additionally, the PATS ensures a higher SSIM similarity score between the original texts and adversarial texts, which means ensuring the imperceptibility of adversarial texts. Meanwhile, adversarial texts generated using only semantic solution space violate the visual imperceptible rule. Therefore, after applying PATS, the ASR of semantic space search will significantly decrease.

Effectiveness of Different Parts in Text-Image Transformation. In the Text-image Transformation (TIT) block, we employed two strategies to form a complete visual solution space, one formed through similar radical components (rad) and the other through pixel characters (pix). Therefore, we explore the impact of these two complementary strategies on aggressiveness and imperceptibility. As shown in Table 5, the results indicate that the visual solution space formed by pixelbased strategies has stronger aggressiveness, while radicalbased strategies have stronger imperceptibility. Therefore, by using the former as a supplement to the latter, we ultimately form a solution space that is both aggressive and has extremely high imperceptibility.

Impacts of Hyper-Parameters. We analyze the impact of various visual perception constraint thresholds θ (threshold) and different replacement rates r (rate) of aggressiveness and imperceptibility. As shown in Figure 3, we can draw the following conclusion: (1) It can be observed that the stronger the visual perception constraint, the higher the SSIM, indicating that visual perception constraint can significantly improve the imperceptibility of adversarial texts. (2) It can be observed that a higher replacement rate leads to an increase in ASR but a decrease in SSIM, which is consistent with our expectations. As more words are replaced, the difference between the adversarial texts and the original texts becomes greater, and the aggressiveness also increases. We balanced aggressiveness and imperceptibility by combining the replacement rate and visual perception constraints.

4.6 Case Study

Enhanced Solution Space Analysis. We analyze the enhanced solution space from a visualization perspective. For a single text, we calculated embeddings for all texts in the enhanced solution space and the semantic solution space, then reduced the dimensionality using t-SNE [van der Maaten and Hinton, 2008]. The result is shown in Figure 4. The left side of the figure shows the sample distribution in the two solution spaces, while the right side indicates the number of successfully attacked texts and the corresponding BLEU decrease in both spaces. Generally, we can draw such conclusions: (1) It can be witnessed that the scope of the enhanced solution space is broader than that of the semantic solution space. This indicates that the enhanced solution space can obtain more diverse adversarial texts, providing more possibilities to find more effective adversarial texts. (2) The pie charts of both solution spaces show that the enhanced solution space generates more aggressive texts than the semantic solution space. This is further proven by the BLEU decrease of the two approaches. Therefore, an enhanced solution space helps generate more texts with stronger aggressiveness.

Imperceptibility Analysis. We visualized the adversarial texts generated by all methods and analyzed the imperceptibility of individual examples. Figure 5 shows the adversarial texts generated by our method and five compared methods. The differences between them and the original texts are presented in the form of masks. The right side of the figure indicates the proportion of the differences in pixel values between the adversarial texts and the original texts. From the figure, we can see that at the cognitive level, our method requires minimal changes to the original texts, thus achieving recognition consistency and maintaining semantic consistency with the original texts in human reading comprehension.

5 Conclusion

This paper proposed a vision-fused attack (VFA) framework for generating powerful adversarial text. Our VFA uses the vision-merged solution space enhancement and perceptionretained adversarial text selection strategy, producing more aggressive and stealthy adversarial text against NMT models. Extensive experiments demonstrated that VFA outperforms comparisons by significant margins both in attacking ability and imperceptibility enhancements. This paper indicates the important effect of multimodal correlations in current deep learning, which encourages future investigations on the corresponding topics, e.g., adversarial defense.

Acknowledgements

This work was supported by Grant KZ46009501.

Contribution Statement

Yanni Xue and Haojie Hao contributed equally to this work. Jiakai Wang is the corresponding author.