LBA: Textual Hard-Label Adversarial Attack under Low Query Budgets

LBA：低查询预算下的文本硬标签对抗攻击

Abstract: Generating high-quality adversarial texts with low query budgets remains a challenging problem in the hard-label scenario. Most existing approaches rely on greedy algorithms, where one position in the text is selected for substitution, followed by the substitutions of other positions. This local search approach may fail to discover high-quality adversarial examples and often leads to excessive query costs.

摘要： 在硬标签场景下，利用低查询预算生成高质量的对抗文本仍然是一个极具挑战性的问题。现有的大多数方法依赖于贪婪算法，即先选择文本中的一个位置进行替换，然后再替换其他位置。这种局部搜索方法往往难以发现高质量的对抗样本，且通常会导致过高的查询成本。

Ideally, an optimal adversarial sample would consider all possible position combinations in the text, but exhaustive search is computationally impractical. To address this challenge, we propose a sampling-based method called LBA, which constructs an approximate distribution of high-quality adversarial examples by integrating both prior and posterior knowledge, and utilizes this distribution for sampling. As sampling progresses, posterior knowledge updates the approximate distribution, which in turn guides more effective sampling.

理想情况下，最优的对抗样本应考虑文本中所有可能的位置组合，但穷举搜索在计算上是不切实际的。为了解决这一挑战，我们提出了一种名为 LBA 的基于采样的方法。该方法通过整合先验和后验知识构建高质量对抗样本的近似分布，并利用该分布进行采样。随着采样过程的推进，后验知识会不断更新近似分布，进而引导更有效的采样。

Extensive experiments on six language models, ranging from small-scale to large-scale architectures across four datasets, demonstrate that LBA significantly outperforms state-of-the-art baselines on all evaluation metrics. Additionally, LLM-based assessment indicates that LBA generates more semantically preserved and comprehensible adversarial texts.

在四个数据集上针对从小型到大型架构的六种语言模型进行的广泛实验表明，LBA 在所有评估指标上均显著优于现有的最先进基准方法。此外，基于大语言模型（LLM）的评估显示，LBA 生成的对抗文本在语义保持和可理解性方面表现更佳。