Question: Represent the text to find a very short summary (1-2 sentences max)

Question: Which generative model is the most suitable for Continual Learning? This paper aims at evaluating and comparing generative models on disjoint sequential image generation tasks. We investigate how several models learn and forget, considering various strategies: rehearsal, regularization, generative replay and fine-tuning. We used two quantitative metrics to estimate the generation quality and memory ability. We experiment with sequential tasks on three commonly used benchmarks for Continual Learning (MNIST, Fashion MNIST and CIFAR10). We found that among all models, the original GAN performs best and among Continual Learning strategies, generative replay outperforms all other methods. Even if we found satisfactory combinations on MNIST and Fashion MNIST, training generative models sequentially on CIFAR10 is particularly instable, and remains a challenge. Learning in a continual fashion is a key aspect for cognitive development among biological species BID4. In Machine Learning, such learning scenario has been formalized as a Continual Learning (CL) setting BID30 BID21 BID27 BID29 BID26. The goal of CL is to learn from a data distribution that change over time without forgetting crucial information. Unfortunately, neural networks trained with backpropagation are unable to retain previously learned information when the data distribution change, an infamous problem called "catastrophic forgetting" BID6. Successful attempts at CL with neural networks have to overcome the inexorable forgetting happening when tasks change. In this paper, we focus on generative models in Continual Learning scenarios. Previous work on CL has mainly focused on classification tasks BID14 BID23 BID29 BID26. Traditional approaches are regularization, rehearsal and architectural strategies, as described in Section 2. However, discriminative and generative models strongly differ in their architecture and learning objective. Several methods developed for discriminative models are thus not directly extendable to the generative setting. Moreover, successful CL strategies for generative models can be used, via sample generation as detailed in the next section, to continually train discriminative models. Hence, studying the viability and success/failure modes of CL strategies for generative models is an important step towards a better understanding of generative models and Continual Learning in general. We conduct a comparative study of generative models with different CL strategies. In our experiments, we sequentially learn generation tasks. We perform ten disjoint tasks, using commonly used benchmarks for CL: MNIST , Fashion MNIST BID34 and CIFAR10 BID15. In each task, the model gets a training set from one new class, and should learn to generate data from this class without forgetting what it learned in previous tasks, see Fig. 1 for an example with tasks on MNIST.We evaluate several generative models: Variational Auto-Encoders (VAEs), Generative Adversarial Networks (GANs), their conditional variant (CVAE ans CGAN), Wasserstein GANs (WGANs) and Figure 1: The disjoint setting considered. At task i the training set includes images belonging to category i, and the task is to generate samples from all previously seen categories. Here MNIST is used as a visual example,but we experiment in the same way Fashion MNIST and CIFAR10.Wasserstein GANs Gradient Penalty (WGAN-GP). We compare on approaches taken from CL in a classification setting: finetuning, rehearsal, regularization and generative replay. Generative replay consists in using generated samples to maintain knowledge from previous tasks. All CL approaches are applicable to both variational and adversarial frameworks. We evaluate with two quantitative metrics, Fréchet Inception Distance BID10 and Fitting Capacity BID17, as well as visualization. Also, we discuss the data availability and scalability of CL strategies. • Evaluating a wide range of generative models in a Continual Learning setting.• Highlight success/failure modes of combinations of generative models and CL approaches.• Comparing, in a CL setting, two evaluation metrics of generative models. We describe related work in Section 2, and our approach in Section 3. We explain the experimental setup that implements our approach in Section 4. Finally, we present our and discussion in Section 5 and 6, before concluding in Section 7. Continual Learning has mainly been applied to discriminative tasks. On this scenario, classification tasks are learned sequentially. At the end of the sequence the discriminative model should be able to solve all tasks. The naive method of fine-tuning from one task to the next one leads to catastrophic forgetting BID6, i.e. the inability to keep initial performance on previous tasks. Previously proposed approaches can be classified into four main methods. The first method, referred to as rehearsal, is to keep samples from previous tasks. The samples may then be used in different ways to overcome forgetting. The method can not be used in a scenario where data from previous tasks is not available, but it remains a competitive baseline BID23 BID21. Furthermore, the scalability of this method can also be questioned because the memory needed to store samples grows linearly with the number of tasks. The second method employs regularization. Regularization constrains weight updates in order to maintain knowledge from previous tasks and thus avoid forgetting. Elastic Weight Consolidation (EWC) BID14 has become the standard method for this type of regularization. It estimates the weights' importance and adapt the regularization accordingly. Extensions of EWC have been proposed, such as online EWC BID26. Another well known regularization method is distillation, which transfers previously learned knowledge to a new model. Initially proposed by BID11, it has gained popularity in CL BID20 BID23 BID33 BID29 as it enables the model to learn about previous tasks and the current task at the same time. The third method is the use of a dynamic architecture to maintain past knowledge and learn new information. Remarkable approaches that implement this method are Progressive Networks BID24, Learning Without Forgetting (LWF) BID19 and PathNet BID5.The fourth and more recent method is generative replay BID29 BID31, where a generative model is used to produce samples from previous tasks. This approach has also been referred to as pseudo-rehearsal. Discriminative and generative models do not share the same learning objective and architecture. For this reason, CL strategies for discriminative models are usually not directly applicable to generative models. Continual Learning in the context of generative models remains largely unexplored compared to CL for discriminative models. Among notable previous work, BID27 successfully apply EWC on the generator of Conditional-GANs (CGANS), after observing that applying the same regularization scheme to a classic GAN leads to catastrophic forgetting. However, their work is based on a scenario where two classes are presented first, and then unique classes come sequentially, e.g the first task is composed of 0 and 1 digits of MNIST dataset, and then is presented with only one digit at a time on the following tasks. This is likely due to the failure of CGANs on single digits, which we observe in our experiments. Moreover, the method is shown to work on CGANs only. Another method for generative Continual Learning is Variational Continual Learning (VCL) BID21, which adapts variational inference to a continual setting. They exploit the online update from one task to another inspired from Bayes' rule. They successfully experiment with VAEs on a single-task scenario. While VCL has the advantage of being a parameter-free method. However, they experiment only on VAEs. Plus, since they use a multi-head architecture, they use specific weights for each task, which need task index for inference. A second method experimented on VAEs is to use a student-teacher method where the student learns the current task while the teacher retains knowledge BID22. Finally, VASE BID0 ) is a third method, also experimented only on VAEs, which allocates spare representational capacity to new knowledge, while protecting previously learned representations from catastrophic forgetting by using snapshots (i.e. weights) of previous model. A different approach, introduced by BID29 is an adaptation of the generative replay method mentioned in Section 2.1. It is applicable to both adversarial and variational frameworks. It uses two generative models: one which acts as a memory, capable of generating all past tasks, and one that learns to generate data from all past tasks and the current task. It has mainly been used as a method for Continual Learning of discriminative models BID29 BID31 BID28. Recently, BID32 have developed a similar approach called Memory Replay GANs, where they use Generative Replay combined to replay alignment, a distillation scheme that transfers previous knowledge from a conditional generator to the current one. However they note that this method leads to mode collapse because it could favor learning to generate few class instances rather than a wider range of class instances. Typical previous work on Continual Learning for generative models focus on presenting a novel CL technique and comparing it to previous approaches, on one type of generative model (e.g. GAN or VAE). On the contrary, we focus on searching for the best generative model and CL strategy association. For now, empirical evaluation remain the only way to find the best performing combinations. Hence, we compare several existing CL strategies on a wide variety of generative models with the objective of finding the most suited generative model for Continual Learning. In this process, evaluation metrics are crucial. CL approaches are usually evaluated by computing a metric at the end of each task. Whichever method that is able to maintain the highest performance is best. In the discriminative setting, classification accuracy is the most commonly used metric. Here, as we focus on generative models, there is no consensus on which metric should be used. Thus, we use and compare two quantitative metrics. The Fréchet Inception Distance (FID) BID10 ) is a commonly used metric for evaluating generative models. It is designed to improve on the Inception Score (IS) BID25 which has many intrinsic shortcomings, as well as additional problems when used on a dataset different than ImageNet BID2. FID circumvent these issues by comparing the statistics of generated samples to real samples, instead of evaluating generated samples directly. BID10 propose using the Fréchet distance between two multivariate Gaussians: DISPLAYFORM0 where the statistics (µ r, Σ r) and (µ g, Σ g) are the activations of a specific layer of a discriminative neural network trained on ImageNet, for real and generated samples respectively. A lower FID correspond to more similar real and generated samples as measured by the distance between their activation distributions. Originally the activation should be taken from a given layer of a given Inception-v3 instance, however this setting can be adapted with another classifier in order to compare a set of models with each other BID17.A different approach is to use labeled generated samples from a generator G (GAN or VAE) to train a classifier and evaluate it afterwards on real data BID17. This evaluation, called Fitting Capacity of G, is the test accuracy of a classifier trained with G's samples. It measures the generator's ability to train a classifier that generalize well on a testing set, i.e the generator's ability to fit the distribution of the testing set. This method aims at evaluating generative models on complex characteristics of data and not only on their features distribution. In the original paper, the authors annotated samples by generating them conditionally, either with a conditional model or by using one unconditional model for each class. In this paper, we also use an adaptation of the Fitting Capacity where data from unconditional models are labelled by an expert network trained on the dataset. We believe that using these two metrics is complementary. FID is a commonly used metric based solely on the distribution of images features. In order to have a complementary evaluation, we use the Fitting Capacity, which evaluate samples on a classification criterion rather than features distribution. For all the progress made in quantitative metrics for evaluating generative models BID3, qualitative evaluation remains a widely used and informative method. While visualizing samples provides a instantaneous detection of failure, it does not provide a way to compare two wellperforming models. It is not a rigorous evaluation and it may be misleading when evaluating sample variability. We now describe our experimental setup: data, tasks, and evaluated approaches. Our code is available online 2. Our main experiments use 10 sequential tasks created using the MNIST, Fashion MNIST and CI-FAR10 dataset. For each dataset, we define 10 sequential tasks, one task corresponds to learning to generate a new class and all the previous ones (See Fig. 1 for an example on MNIST). Both evaluations, FID and Fitting Capacity of generative models, are computed at the end of each task. We use 6 different generative models. We experiment with the original and conditional version of GANs BID7 and VAEs BID13. We also added WGAN ) and a variant of it WGAN-GP BID8, as they are commonly used baselines that supposedly improve upon the original GAN. We focus on strategies that are usable in both the variational and adversarial frameworks. We use 3 different strategies for Continual Learning of generative models, that we compare to 3 baselines. Our experiments are done on 8 seeds with 50 epochs per tasks for MNIST and Fashion MNIST using Adam BID12 for optimization (for hyper-parameter settings, see Appendix F). For CIFAR10, we experimented with the best performing CL strategy. The first baseline is Fine-tuning, which consists in ignoring catastrophic forgetting and is essentially a lower bound of the performance. Our other baselines are two upper bounds: Upperbound Data, for which one generative model is trained on joint data from all past tasks, and Upperbound Model, for which one separate generator is trained for each task. For Continual Learning strategies, we first use a vanilla Rehearsal method, where we keep a fixed number of samples of each observed task, and add those samples to the training set of the current generative model. We balance the ing dataset by copying the saved samples so that each class has the same number of samples. The number of samples selected, here 10, is motivated by the in Fig. 7a and 7b, where we show that 10 samples per class is enough to get a satisfactory but not maximal validation accuracy for a classification task on MNIST and Fashion MNIST. As the Fitting Capacity share the same test set, we can compare the original accuracy with 10 samples per task to the final fitting capacity. A higher Fitting capacity show that the memory prevents catastrophic forgetting. Equal Fitting Capacity means overfitting of the saved samples and lower Fitting Capacity means that the generator failed to even memorize these samples. We also experiment with EWC. We followed the method described by BID27 for GANs, i.e. the penalty is applied only on the generator's weights, and for VAEs we apply the penalty on both the encoder and decoder. As tasks are sequentially presented, we choose to update the diagonal of the Fisher information matrix by cumulatively adding the new one to the previous one. The last method is Generative Replay, described in Section 2.2. Generative replay is a dual-model approach where a "frozen" generative model G t−1 is used to sample from previously learned distributions and a "current" generative model G t is used to learn the current distribution and G t−1 distribution. When a task is over, the G t−1 is replaced by a copy of G t, and learning can continue. The figures we report show the evolution of the metrics through tasks. Both FID and Fitting Capacity are computed on the test set. A well performing model should increase its Fitting Capacity and decrease its FID. We observe a strong correlation between the Fitting Capacity and FID (see FIG0 for an example on GAN for MNIST and Appendix C for full ). Nevertheless, Fitting Capacity are more stable: over the 8 random seeds we used, the standard deviations are less important than in the FID . For that reason, we focus our interpretation on the Fitting Capacity . Our main with Fitting Capacity are displayed in FIG1 and by class in Fig. 4. We observe that, for the adversarial framework, Generative Replay outperforms other approaches by a significant margin. However, for the variational framework, the Rehearsal approach was the best performing. The Rehearsal approach worked quite well but is unsatisfactory for CGAN and WGAN-GP. Indeed, the Fitting Capacity is lower than the accuracy of a classifier trained on 10 samples per classes (see Fig. 7a and 7b in Appendix). In our setting, EWC is not able to overcome catastrophic forgetting and performs as well as the naive Fine-tuning baseline which is contradictory with the of BID27 who found EWC successful in a slightly different setting. We replicated their in a setting where there are two classes by tasks (see Appendix E for details), showing the strong effect of task definition. In BID27 authors already found that EWC did not work with non-conditional models but showed successful with conditional models (i.e. CGANs). The difference come from the experimental setting. In BID27, the training sequence start by a task with two classes. Hence, when CGAN is trained it is possible for the Fisher Matrix to understand the influence of the class-index input vector c. In our setting, since there is only one class at the first task, the Fisher matrix can not get the importance of the class-index input vector c. Hence, as for non conditional models, the Fisher Matrix is not able to protect weights appropriately and at the end of the second task the model has forgot the first task. Moreover, since the generator forgot what it learned at the first task, it is only capable of generating samples of only one class. Then, the Fisher Matrix will still not get the influence of c until the end of the sequence. Moreover, we show that even by starting with 2 classes, when there is only one class for the second task, the Fisher matrix is not able to protect the class from the second task in the third task. (see Figure 11).Our do not give a clear distinction between conditional and unconditional models. However, adversarial methods perform significantly better than variational methods. GANs variants are able to produce better, sharper quality and variety of samples, as observed in FIG7 in Appendix G. Hence, adversarial methods seem more viable for CL. We can link the accuracy from 7a and 7b to the Fitting Capacity . As an example, we can estimate that GAN with Generative Replay is equivalent for both datasets to a memory of approximately 100 samples per class. Catastrophic forgetting can be visualized in Fig.4. Each square's column represent the task index and each row the class, the color indicate the Fitting Capacity (FC). Yellow squares show a high FC, blue one show a low FC. We can visualize both the performance of VAE and GAN but also the performance evolution for each class. For Generative Replay, at the end of the task sequence, VAE decreases its performance in several classes when GAN does not. For Rehearsal it is the opposite. Concerning the high performance of original GAN and WGAN with Generative Replay, they benefit from their samples quality and their stability. In comparison, samples from CGAN and WGAN-GP are more noisy and samples from VAE and CVAE more blurry (see in appendix 14). However in the Rehearsal approach GANs based models seems much less stable (See TAB0 and FIG1). In this setting the discriminative task is almost trivial for the discriminator which make training harder for the generator. In opposition, VAE based models are particularly effective and stable in the Rehearsal setting (See Fig. 4b). Indeed, their learning objective (pixel-wise error) is not disturbed by a low samples variability and their probabilistic hidden variables make them less prone to overfit. However the Fitting Capacity of Fine-tuning and EWC in TAB0 is higher than expected for unconditional models. As the generator is only able to produce samples from the last task, the Fitting capacity should be near 10%. This is a downside of using an expert for annotation before computing the Fitting Capacity. Fuzzy samples can be wrongly annotated, which can artificially increase the labels variability and thus the Fitting Capacity of low performing models, e.g., VAE with Fine-tuning. However, this stay lower than the Fitting Capacity of well performing models. Incidentally, an important side is that the Fitting capacity of conditional generative models is comparable to of Continual Learning classification. Our best performance in this setting is with CGAN: 94.7% on MNIST and 75.44% on Fashion MNIST. In a similar setting with 2 sequential tasks, which is arguably easier than our setting (one with digits from 0,1,2,3,4 and another with 5,6,7,8,9), achieve a performance of 94.91%. This shows that using generative models for CL could be a competitive tool in a classification scenario. It is worth noting that we did not compare our of unconditional models Fitting Capacity with classification state of the art. Indeed, in this case, the Fitting capacity is based on an annotation from an expert not trained in a continual setting. The comparison would then not be fair. In this experiment, we selected the best performing CL methods on MNIST and Fashion MNIST, Generative Replay and Rehearsal, and tested it on the more challenging CIFAR10 dataset. We compared the two method to naive Fine-tuning, and to Upperbound Model (one generator for each class). The setting remains the same, one task for each category, for which the aim is to avoid forgetting of previously seen categories. We selected WGAN-GP because it produced the most satisfying samples on CIFAR10 (see Fig. 16 in Appendix G).Results are provided in Fig. 5, where we display images sampled after the 10 sequential tasks, and FID + Fitting Capacity curves throughout training. The Fitting Capacity show that all four methods fail to generate images that allow to learn a classifier that performs well on real CIFAR10 test data. As stated for MNIST and Fashion MNIST, with non-conditional models, when the Fitting Capacity is low, it can been artificially increased by automatic annotation which make the difference between curves not significant in this case. Naive Fine-tuning catastrophically forgets previous tasks, as expected. Rehearsal does not yield satisfactory . While the FID score shows improvement at each new task, visualization clearly shows that the generator copies samples in memory, and suffers from mode collapse. This confirms our intuition that Rehearsal overfits to the few samples kept in memory. Generative Replay fails; since the dataset is composed of real-life images, the generation task is much harder to complete. We illustrate its failure mode in Figure 17 in Appendix G. As seen in Task 0, the generator is able to produce images that roughly resemble samples of the category, here planes. As tasks are presented, minor generation errors accumulated and snowballed into the in task 9: samples are blurry and categories are indistinguishable. As a consequence, the FID improves at the beginning of the training sequence, and then deteriorates at each new task. We also trained the same model separately on each task, and while the is visually satisfactory, the quantitative metrics show that generation quality is not excellent. These negative shows that training a generative model on a sequential task scenario does not reduce to successfully training a generative model on all data or each category, and that state-of-theart generative models struggle on real-life image datasets like CIFAR10. Designing a CL strategy for these type of datasets remains a challenge. Besides the quantitative and visual evaluation of the generated samples, the evaluated strategies have, by design, specific characteristics relevant to CL that we discuss here. Rehearsal violates the data availability assumption, often required in CL scenarios, by recording part of the samples. Furthermore the risk of overfitting is high when only few samples represent a task, as shown in the CIFAR10 . EWC and Generative Replay respect this assumption. EWC has the advantage of not requiring any computational overload during training, but this comes at the cost of computing the Fisher information matrix, and storing its values as well as a copy of previous parameters. The memory needed for EWC to save information from the past is twice the size of the model which may be expensive in comparison to rehearsal methods. Nevertheless, with Rehearsal and Generative Replay, the model has more and more samples to learn from at each new task, which makes training more costly. Another point we discuss is about a recently proposed metric BID32 to evaluate CL for generative models. Their evaluation is defined for conditional generative models. For a given label l, they sample images from the generator conditioned on l and feed it to a pre-trained classifier. If the predicted label of the classifier matches l, then it is considered correct. In our experiment we find that it gives a clear advantage to rehearsal methods. As the generator may overfit the few samples kept in memory, it can maximizes the evaluation proposed by BID33, while not producing diverse samples. We present this phenomenon with our experiments in appendix D. Nevertheless, even if their metric is unable to detect mode collapse or overfitting, it can efficiently expose catastrophic forgetting in conditional models. In this paper, we experimented with the viability and effectiveness of generative models on Continual Learning (CL) settings. We evaluated the considered approaches on commonly used datasets for CL, with two quantitative metrics. Our experiments indicate that on MNIST and Fashion MNIST, the original GAN combined to the Generative Replay method is particularly effective. This method avoids catastrophic forgetting by using the generator as a memory to sample from the previous tasks and hence maintain past knowledge. Furthermore, we shed light on how generative models can learn continually with various methods and present successful combinations. We also reveal that generative models do not perform well enough on CIFAR10 to learn continually. Since generation errors accumulate, they are not usable in a continual setting. The considered approaches have limitations: we rely on a setting where task boundaries are discrete and given by the user. In future work, we plan to investigate automatic detection of tasks boundaries. Another improvement would be to experiment with smoother transitions between tasks, rather than the disjoint tasks setting. A SAMPLES AT EACH STEP Figure 11: Reproduction of EWC experiment BID27 with four tasks. First task with 0 and 1 digits, then digits of 2 for task 2, digits of 3 for task 3 etc. When task contains only one class, the Fisher information matrix cannot capture the importance of the class-index input vector because it is always fixed to one class. This problem makes the learning setting similar to a non-conditional models one which is known to not work BID27. As a consequence 0 and 1 are well protected when following classes are not. Figure 16: WGAN-GP samples on CIFAR10, with on training for each separate category. The implementation we used is available here: https://github.com/caogang/wgan-gp. Classes, from 0 to 9, are planes, cars, birds, cats, deers, dogs, frogs, horses, ships and trucks. Figure 17: WGAN-GP samples on 10 sequential tasks on CIFAR10, with Generative Replay. Classes, from 0 to 9, are planes, cars, birds, cats, deers, dogs, frogs, horses, ships and trucks. We observe that generation errors snowballs as tasks are encountered, so that the images sampled after the last task are completely blurry.

represent the short summary for finding the corresponding scientific article (long)

A comparative study of generative models on Continual Learning scenarios.

represent this text to find a much much longer article about it with say hundreds-thousands of words

To give you a sense - "Use Monte carlo Tree Search and Homoglyphs to generate indistinguishable adversarial samples on text data" should be close to "Crafting adversarial examples on discrete inputs like text sequences is fundamentally different from generating such examples for continuous inputs like images. This paper tries to answer the question: under a black-box setting, can we create adversarial examples automatically to effectively fool deep learning classifiers on texts by making imperceptible changes? Our answer is a firm yes. Previous efforts mostly replied on using gradient evidence, and they are less effective either due to finding the nearest neighbor word (wrt meaning) automatically is difficult or relying heavily on hand-crafted linguistic rules. We, instead, use Monte Carlo tree search (MCTS) for finding the most important few words to perturb and perform homoglyph attack by replacing one character in each selected word with a symbol of identical shape. Our novel algorithm, we call MCTSBug, is black-box and extremely effective at the same time. Our experimental indicate that MCTSBug can fool deep learning classifiers at the success rates of 95% on seven large-scale benchmark datasets, by perturbing only a few characters. Surprisingly, MCTSBug, without relying on gradient information at all, is more effective than the gradient-based white-box baseline. Thanks to the nature of homoglyph attack, the generated adversarial perturbations are almost imperceptible to human eyes. Recent studies have shown that adding small modifications to continuous inputs can fool state-ofthe-art deep classifiers, ing in incorrect classifications BID33 BID15. This phenomenon was first formulated as adding tiny and often imperceptible perturbations on image pixel values that could fool deep learning models to make wrong predictions. It raises concerns about the robustness of deep learning systems, considering that they have become core components of many safety-sensitive applications. For a given classifier F and a test sample x, recent literature defined such perturbations as vector ∆x and the ing sample x = x + ∆x as an adversarial example BID15.Deep learning has achieved remarkable in the field of natural language processing (NLP), including sentiment analysis, relation extraction, and machine translation BID35 BID26 BID34. In contrast to the large body of research on adversarial examples for image classification BID15 BID33 BID29 BID2, less attention has been paid on generating adversarial examples on texts. A few recent studies defined adversarial perturbations on deep RNN-based text classifiers BID30 BID32. BID30 first chose the word at a random position in a text input, then used a projected Fast Gradient Sign Method to perturb the word's embedding vector. The perturbed vector is then projected to the nearest word vector in the word embedding space, ing in an adversarial sequence (adversarial examples in the text case; we adopt the name in this paper). This procedure may, however, replace words in an input sequence with totally irrelevant words since there is no hard guarantee that words close in the embedding space are semantically similar. BID32 used the "saliency map" of input words and complicated linguistic strategies to generate adversarial sequences that are semantically meaningful to humans. However, this strategy is difficult to perform automatically. BID12 proposed greedy scoring strategies to rank words in a text sequence and then applied simple character-level Figure 1: An example of MCTSBug generated black-box adversarial sequence. x shows an original text sample and x shows an adversarial sequence generated from x. From x to x, only two characters are modified. This fools the deep classifier to return a wrong classification of sentiment (from positive to negative).transformations like swapping to fool deep classifiers. Its central idea, minimizing the edit distance of the perturbation makes sense. However, the perturbations are quite visible and the empirical effectiveness needs improvements. We provide more discussions in Section 5.1.Crafting adversarial examples on discrete text sequences is fundamentally different from creating them on continuous inputs like images or audio signals. Continuous input such as images can be naturally represented as points in a continuous R d space (d denotes the total number of pixels in an image). Using an L p -norm based distance metric to limit the modification ∆x on images appears natural and intuitive. However, for text inputs searching for small text modifications is difficult, because it is hard to define the distance between two discrete sequences. Three possible choices exist:• Because deep learning NLP models usually use an embedding layer to map discrete inputs to a continuous space (gradients on the embedding layer is calculable). Therefore we can measure the distance among text inputs in the continuous space defined by the word2vec embedding BID31. However, state-of-the-art embedding models are still unsatisfactory especially in terms of providing nearest neighbors among words. FIG3 shows a few examples we chose based on the GloVe BID31. Two words close to each other in the GloVe embedding cannot guarantee they are similar, for example, they can be antonyms. For instance, the word "loved" is the nearest neighbor of the word "hated".• We can use the huge body of linguistic knowledge to measure the distance between two text inputs. However, this strategy is hard to generalize and is difficult to extend to other discrete spaces.• Shown in Figure 1, we can also use the edit distance between text x and text x being defined as the minimal edit operations that are required to change x to x. We focus on this distance in the paper. Intuitively we want to find imperceptible perturbations on a text input (with respect to human eyes) to evade deep learning classifiers. The second major concern we consider in this paper is the black-box setup. An adversary may have various degrees of knowledge about a deep-learning classifier it tries to fool, ranging from no information to complete information. FIG4 depicts the Perspective API BID19 from Google, which is a deep learning based text classification system that predicts whether a message is toxic or not. This service can be accessed directly from the API website that makes querying the model uncomplicated and widely accessible. The setting is a black-box scenario as the model is run on cloud servers and its structure and parameters are not available. Many state-of-the-art deep learning applications have the similar system design: the learning model is deployed on the cloud servers, and users can access the model via an app through a terminal machine (frequently a mobile device). In such cases, a user could not examine or retrieve the inner structure of the models. We believe that the black-box attack is generally more realistic than the white-box. Previous efforts about adversarial text sequences mostly replied on using gradient evidence. We instead assume attackers cannot access the structure, parameters or gradient of the target model. Considering the vast search space of possible changes (among all words/characters changes) from x to x, we design a search strategy based on Monte Carlo tree search (MCTS) for finding the most important few words to perturb. The search is conducted as a sequential decision process and aims to make small edit operations such that a human would consider the generated x (almost) the same as the original sequence. Inspired by the homoglyph attack BID11 that attacks characters with symbols of identical shapes, we replace a character in those important words found by MCTS with its homoglyph character (of identical shape). This simple strategy can effectively forces a deep classifier to a wrong decision by perturbing only a few characters in a text input. Contributions: This paper presents an effective algorithm, MCTSBug, that can generate adversarial sequences of natural language inputs to evade deep-learning classifiers. The techniques we explore here may shed light on discovering the vulnerability of using deep learning on other discrete inputs. Our novel algorithm has the following properties:• Black-box: Previous methods require knowledge of the model structure and parameters of the word embedding layer, while our method can work in a black-box setting.• Effective: on seven real-world text classification tasks, our MCTSBug can fool two stateof-the-art deep RNN models with the success rate of 95% on average (see FIG2).• Simple: MCTSBug uses simple character-level transformations to generate adversarial sequences, in contrast to previous works that use projected gradient or multiple linguisticdriven steps.• Almost imperceptible perturbations to human observers: MCTSBug can generate adversarial sequences that visually identical to seed sequences. Att: For the rest of the paper, we denote samples in the form of pair (x, y), where x = x 1 x 2 x 3...x n is an input text sequence including n tokens (each token could be either a word or a character in different models) and y set including {1, ..., K} is a label of K classes. A deep learning classifier is represented as F: X → Y, a function mapping from the input space to the label space. Basics of Adversarial Examples: Formally, we can define adversarial sample BID15 via the following equation: DISPLAYFORM0 Here we denote a machine learning classifier as F: X → Y, where X is the sample space, x ∈ X denotes a single sample and Y describes the set of output classes. ∆x describes the perturbation vector and the ing sample x is an adversarial example BID15. The strength of the adversary,, measures the permissible transformations. The choice of condition in Eq. indicates two methods for finding adversarial examples: whether they are untargeted(F (x) = F (x)) or targeted (F (x) = t) BID1.The choice of ∆x is typically an L p -norm distance metric. Recent studies BID33 BID15 BID2 BID29 DISPLAYFORM1 measures the maximum change in any dimension. This means an L ∞ adversary is limited by the maximum change it can make to each feature but can alter all the features by up to that maximum BID15. The L 2 norm corresponds to the Euclidean distance between x and x BID2. This distance can still remain small when small changes are applied to many different features. An L 0 adversary is limited by the number of feature variables it can alter BID29 ).There exist a large body of recent studies focusing on adversarial examples for image classification that typically created imperceptible modifications to pixel values through an optimization procedure BID15 BID33 BID29 BID2. We put more details in Section 5.4. A third parameter for categorizing recent methods, in addition to targeted/untargeted and ∆ choices, is whether the assumption of an adversary is blackbox or white box. An adversary may have various degrees of knowledge about the model it tries to fool, ranging from no information to complete information. In the black box setting, an adversary is only allowed to query the target classifier and does not know the details of learned models or the feature representations of inputs. Since the adversary does not know the feature set, it can only manipulate input samples by testing and observing a classification model's outputs. In the white box setting, an adversary has access to the model, model parameters, and the feature set of inputs. Similar to the black-box setting, the adversary is still not allowed to modify the model itself or change the training data. Most studies of adversarial examples use the white-box assumption BID33 BID15 BID2 BID29.Multiple recent studies extended adversarial examples to the black-box. One study proposed by BID28 showed that it is possible to create adversarial samples that successfully reduce the classification accuracy without knowing the model structure or parameters on image classification tasks. The method is to estimate a local model and attack the local model instead. Another paper BID6 generates black-box adversarial sample by estimating the gradient directly via queries. BID16 follows this direction, proposes three different threat models of black-box attack, and uses statistical gradient estimation. BID17 uses prior information about images and bandit to optimize the gradient estimation and adversarial sample search process. We design a method we call MCTSBug to generate adversarial modifications on a text sequence directly, without the guidance of gradients. Considering that the natural form of English text has white-spaces separating words, we treat the search of perturbations as a two-stage task:• Step 1: Determine the important words to change.•Step 2: Modify the important words slightly by creating "imperceivable" modifications. To find the important words, we formalize the problem as a search problem and use Monte Carlo Tree Search to achieve a good approximate to the global maximum. We then use homoglyph characters BID11 to create stable and effective imperceivable modifications. On the other hand, these modifications create big difficulties (i.e. large changes) to a target deep learning model. We first assume that words in a text input contribute differently to the final prediction made by a deep classifier. In Section 2.2, we propose a search process to find those important words through MCTS.After we find an important word, we need to use an efficient strategy to modify it by making imperceptibly changes (to human) while at the same time such changes can force a deep model's output classification of the whole text sequence to change. We therefore define such a small change on a word as one character modification based on homoglyph attack BID11. Homoglyph attack is an attack based on symbols with identical shapes. Figure 2 shows a table including all the text characters together with its homoglyph pair we use. In complicated modern computer character systems such as Unicode, many symbols have the very similar form to human observers but coming from different origins. For example, Cyrillic letter'a' and the Latin letter'a' are visually identical in every ways. However, computer systems treat them as different characters. Homoglyph attacks, though simple, have created a severe problem in cyber security when attackers spoof the domain name with homoglyphs of influential websites. Words are symbolic, and learning-based classifiers handle words through a dictionary to represent a finite set of possible words. However, the size of the typical NLP dictionary is much smaller than the huge space built by the combinations of all possible characters. This means if we deliberately create (visually) similar but mis-spelled version of important words, we can easily convert those crucial words to "unknown" (i.e., words not in the dictionary). Unknown words are mapped to the "unknown" embedding vector, which is likely to be vastly different from the embedding of the original word. Our empirical (Section 3) strongly indicate that this simple strategy can effectively force deep learning models to make wrong classifications. Based on our empirical , changing one character to its homoglyph pair is enough to make a word to be unrecognizable ("unknown") by a deep learning system. We say a word is "neutralized" to mean a deep learning system loses the information of this word. In the following, when we say "to neutralize a certain word", we mean to modify a random character in that word to its homoglyphs pair in Figure 2. while not reach maximum iteration R do s = root; while n is in T do s = arg max s ∈s.child v s + U CB s; # jump to next node end sT = random rollout(s); vs T = fs(sT, c); DISPLAYFORM0 DISPLAYFORM1 Input: Sample X = x1x2..xn, maximum search depth d, classification of the sample c l, maximum iterations R Output: Adversarial sample xact Initial action list A = set(X); DISPLAYFORM2 Connecting to related studies: Any method to generate adversarial text sequence needs a token transformer; that is, a mechanic to perturb text. On the well studied adversarial image samples, a perturbation is often following the gradient direction. However, such idea is problematic when directly being applied to text samples. One important issue is that gradient on the original text sample is hard to defined. Deep learning classifiers often accept the text sample as a sequence of id numbers to a dictionary, and gradients on those id numbers are not entirely meaningful. BID30 suggested to create perturbation based on gradient of the word embedding layer. However, generating such perturbation requires the assumption of continuity, that is, words near each other shares some similarity. However, two words close to each other in the embedding layers are often neither similar on shape nor on meaning (FIG3). Besides, generating such perturbation requires a projection from a perturbed embedding vector to the discrete space. Hard to control the distance of such perturbations. BID32 used linguistic based rules to transform words. While linguistic rules might be able to successfully generate appropriate perturbations in some cases, their method is complicated and time consuming. More importantly, the generated samples cannot provide any guarantee on the size of the perturbation. Homoglyph attack can successfully neutralize a word for a deep-learning classifier. To perform the minimal edit operations for generating an adversarial sequence from a seed x, we still need a powerful way to find out those important words (with respect to their influence on a deep classifier's prediction). Monte Carlo Tree Search is a method that creates a search tree to find optimal in some decision space, which combines Monte Carlo Method and Bandit. The Upper Confidence Tree (UCT) framework BID20 includes Upper Confidence Bound algorithm (UCB) BID0 to balance the exploration and exploitation in the tree search process, and achieve significant improvement in Go AI BID14. Later, many different applications choose MCTS as the solving algorithm, including game AI BID5, single player game BID4, and even feature selection BID13.Monte Carlo Tree Search is known to be able to find near optimal solutions in the vast search space. It has shown great success recently in different scenarios. To make it work, it requires a value function which can be queried at any time, which in our case can be calculated in a black-box manner through querying the target deep learning neural network. In details, we formalize adversarial perturbation generation problem as a reinforcement learning problem as follow. Let X = {x 1, x 2 ..., x n} denote the set of all possible words to change. We define state s to be the current set of words will be sent to the homoglyph transformer, and action a to be the action of select a single word and add it to current set. The whole process terminates when the size of current state s reaches a pre-defined limitation of d (or there's no more items to add). Therefore, the state space S is the powerset of word set X. The action space A is then equivalent to the set X. In this setting, a determined transition function over state and actions is then defined: p: S × A → S, which is simply removing the word action a represents from current s. A policy π(s) is a probability distribution over all possible action a. In the MCTS algorithm creates a search tree, in which every node represents a state. Every node stores a value v and number of times visits n c. Each edge represents an action a, that connects parent s and child s if state s takes action a comes to state s. The goal of the MCTS is to find a node(state) that minimize some loss function, which in our setting should be maximize a score which correctly evaluates the quality of adversarial samples. Formally, the goal of MCTS is to find the optimal terminal state s T over a predefined score function f s, that s T = arg max s∈Ts f s (s), T s stands for the set of terminal states. In our setting, the score function f s have multiple choices, one example can be the cross-entropy loss to its label. However, this loss function doesn't typically reflect the terminal condition of non targeted scenario: A higher score doesn't necessarily indicate the sample is better. A successful adversarial sample may have a lower cross entropy than an unsuccessful adversarial sample, if it's score is more balanced on different terms. Suppose f s the We defined directly by the definition of untargeted attack: DISPLAYFORM0 Here c l is the original predicted class, which the class that adversary trying to deviate the sample from. The equation stands for the maximum predicted probability on any class except c l minus the predicted probability of target class c l.We defined f s for the targeted attack as: DISPLAYFORM1 c target is the class that adversary is trying to convert the sample into. Such score is not fully differentiable, so that it can't be used in other optimization process, SGD for example. However, in MCTS the gradient is not required. That means unlike traditional optimization, MCTS is free to choose any function. We use a modified version of the UCT-1 algorithm BID20. Generally the algorithm treats every node as a independent bandit problem. Every iteration of MCTS algorithm includes four steps: Selection, Expansion, Simulation and Backpropagation. In the selection phase, the algorithm start from the root node. And on each node (s, v s, n s) where s is a set of words, the algorithm selects the action following the Upper Confidence Bound (UCB) criterion: DISPLAYFORM2 2 ln ns 2n s, C > 0 is a hyperparameter constant. The search ends at a node s doesn't belong to the tree, and it is then added to the tree in the following expansion phase, with v s and n s initialized as 0. After that, the algorithm starts a simulation phase that that selects random actions from the node s, until a terminal state is reached. It will then calculate the score function to return a score for the terminal state. Finally, in the backpropagation update the value of all the tree nodes, from s go up to all its parent nodes. The visit count n is increase by 1 and the value is updated to the average of all the scores in the trails. The total algorithm is described in Algorithm 1. To summarize, MCTSBug use MCTS to search for the most appropriate set of d words to change. After it found that set of words, it then modifies the words by using homoglyphs. One character in one word can neutralize the set of words. The effect to the prediction is correctly simulated in the MCTS value function. If the adversarial sample generated is not enough, the algorithm increase the value d. The algorithm will stop either the adversarial samples is a success or the maximum search limit is reached. Connecting to related studies: One previously proposed way to select words used the saliency over those words on the word embedding BID32. However, that breaks the black-box assumption. Besides, saliency can't accurately reflect the effect of the perturbation. A more accurate way is to use simulated leave-one-out score to sort all the words, such as in BID12. While the method is shown to effective to text input, it can be sub-optimal as it is essentially a greedy selection based on single round . Instead, we model the important words' selection problem as a combinatorial optimization problem and use Monte Carlo Tree Search to solve it. Comparing to the leave-one-out based greedy strategy, the greedy approach only focuses on local optimum, and MCTS focus on the global optimum. MCTS instead search more space, and can provide a good estimation of the global maximum. We evaluated the effectiveness of our algorithm by conducting experiments on multiple deep learning models across multiple real-world text classification datasets. In particular, we wanted to answer the following questions empirically:• Do adversarial samples generated by MCTSBug look valid?• Does the accuracy of deep classifier decrease by the crafted adversarial samples?• Can the adversarial samples generated by MCTSBug transfer between models?• Are MCTSBug strategies robust to configuration parameters?To evaluate the quality of adversarial samples generated by MCTSBug, we implemented three other baselines and compared them to MCTSBug. For fair comparisons, all three baselines also use the homoglyph word transformer. In summary we compare the following four methods:1. Random (baseline): Random select words for the perturbation.2. Gradient (baseline): Contrary to random selection which uses no knowledge of the model, we also compare to full knowledge of the model, where gradients are used to find the most important tokens. Following equation 3, the gradient method uses the magnitude of gradient w.r.t the original classification to decide which tokens should be changed. This method of selecting tokens is proposed in BID32 Greedy viruses keep on growing most it managers won 39 s quertion the importance of securits but this priority has been sliding between the third and fourth most important focus for companies MCTSBug viruses keep on growing most it managers won 39 t question the importance of security but this priority has been sliding between the third and fourth most important focus for companies Original Message dave matthews band even in the slightest add this to your collection there is one song angle where his back up singers take over a bit and it is so incredible that one song is worth buying this dvd for but trust me you wont be disappointed in the rest Projected Gradient Descent dave matthews band even in the slightest add this to your collection there is one song angle where his back up singers take over a bit and it inventions mfc terrific that one song is worth buying this dvd sensitivity hathaway clicks me hone transaction be studio in the olsen 5 Stars Amazon Reviews Full Dataset Greedy dave matthews band even in the slightest add this to your collection there is one song angle where his back up singers take over a bit and it is so incredible that one song is worth buying this dvd for but trust me you eont be disappointed in the rest MCTSBug dave matthews band even in the slightest add this to your collection there is one song angle where his back up singers take over a bit and it is so incredible that one song is worth buying this dvd for but trust me you wont be disappointed in the rest 3 StarsOriginal Message... 20 and 100 m they can be found worldwide in tropical and subtropical waters they are predators that wait for prey fish to pass by they have which they move to attract the prey they have little economic value other than a minor role in the aquarium trade Animal Projected Gradient Descent...goran and stretched cbd nationale luc jesus oakland stacy in sunflower and spice waters they are predators that wait for prey fish to pass by they have which they move to attract the prey they have little economic value other than a minor role in the aquarium trade Building DBPedia Dataset Greedy... 20 and 100 m they can be fcund worldwide in tropical and subtropical waters they ane aredators that wait for prey fivh to pass by they have which they move to attract the prey they have little economic value other than a minor role in the aquarium trade Building MCTSBug... 20 and 100 m they can be found worldwide in tropical and subtropical waters they are predators that wait for prey fish to pass by they have which they move to attract the prey they have little economic value other than a minor role in the aquarium trade Building Table 1: Examples of generated adversarial samples: The red part indicates the difference to the original message.3. Greedy (baseline): Following DeepWordbug paper BID12, the greedy baseline first evaluate the importance of each word by calculating a leave-one-out score on every word, and perform a greedy selection on the words. 4. MCTSBug (our method): Use MCTS to find the most important tokens (Section 2).Due to space limit, we have put the details of datasets, experimental setups, and details of target deep models in the appendix. We also put two detailed figures FIG6 ) and FIG1 showing how various methods behave by varying the number of characters they can modify and two tables TAB8 ) showing the effective rates under targeted and untargeted attacks in the appendix. Besides, the empirical of transferbility are shown in Figure 10. FIG10 shows the effective curves for different output classes and FIG7 shows the sensitivity analysis of how MCTSBug behaves when varying the value of C. Lastly we tried to conduct adversarial training by retraining the deep model using adverarial sequences generated by MCTSBug on the AG's News datase. However FIG9 shows that this retraining strategy does not effectively defend against our attack. To evaluate the quality of adversarial samples, we first compare our generated samples to state-ofthe-art baselines. The is summarized in 1. From Table 1, we can see that our MCTSBug creates samples with minimal perturbation. Comparing to baselines that changes many words or characters, adversarial samples from MCTSBug are extremely hard to be found to human eyes. We first present the of untargeted attack. Here, we calculate attacking successful rates on all 7 datasets when gradually relaxing the limitation on maximum edit distance difference. shows a direct comparison of the effectiveness of our attack to the baseline methods: With the attack that flips at most 20 words, MCTSBug have 100% or nearly 100% attacking successful rate on all 7 datasets, which means MCTSBug can successfully flip the prediction of any samples, which clearly outperforms all the baselines in comparison. We also notice that for most datasets, manipulating no more than 5 words can successfully flip the prediction of 70% to 90% samples. Comparing to the baselines, the Random baseline not surprisingly doesn't perform very well, which indicates that even with a powerful transformation function like homoglyph attack, generating an adversarial text input is not a trivial task. The Gradient baseline (Green line) also doesn't perform very well. The basic reason for the bad performance of gradient based white-box method is it doesn't fit our task. Gradient, as a estimator of function value change by perturbation, is only accurate when the perturbation is small enough, and has the same perturbation over every input features. In our case, our modification on the target is not small and also not same perturbation over different input features (as every word vector are different). In this case, gradient is not a good estimation of the effect of our transformation. We then present the of targeted attack. One may assume as targeted attack are much harder than untargeted attack, the power of MCTSBug will be severely undermined when comes to the targeted scenario. To justify it, we similarly present the targeted attacking successful rates on all 7 datasets when relaxing the limitation on maximum edit distance difference. FIG6 shows a direct comparison of the effectiveness of our attack to the baseline methods: MCTSBug have the attacking successful rate 70%-90% on the Basic-LSTM model. Due to the combinatorial nature of a large and discrete input space, searching adversarial text sequences is not a straightforward extension from image-based techniques generating adversarial examples. In this paper, we present a novel framework, MCTSBug which can generate imperceptible adversarial text sequences in a black-box manner. By combining homoglyph attack and MCTS, the proposed method can successfully fool two deep RNN-based text classifiers across seven large-scale benchmarks. The key idea we utilized in MCTSBug is that words with one character changed to its homoglyph pair are usually viewed as "unknown" by the deep-learning models. The shape change is almost invisible to humans, however, it is a huge change to a deep-learning model. More fundamentally this is caused by the fact that NLP training datasets normally only cover a very small portion of the huge space built by the combination of possible NLP letters. Then the question is: should the deep-learning classifiers model those words having identical shapes to human eyes as similar representations? We think the answer should be Yes. Early research on attacking text classifiers starts from BID10 and BID23, when researchers show that malicious manipulation on input can cause machine learning based spam detectors to generate false positives. BID24 propose the Good Word attack, which is a practical attack that adds positive, non-spam words into a spam message to evade machine learning classifiers. These attacks are designed for simple classifiers such as Naive Bayes, which work directly on different features. However, modern deep learning models work differently from traditional machine learning models. Also, such methods give no guarantee of the quality of the generated sample. For example, a spam message could become non-spam if too many "good words" were added to it, but the output message is almost guaranteed to be meaningless. In 2013, BID33 proposes the concept of adversarial sample: imperceptible perturbation on images can fool deep learning classifiers. This discovery is interesting because small modifications guarantee the validity of generated samples. Compared to studies of adversarial examples on images, little attention has been paid on generating adversarial sequences on text. Papernot et al. applied gradient-based adversarial modifications directly to NLP inputs targeting RNN-based classifiers in BID30. The ing samples are called "adversarial sequence," and we also adopt the name in this paper. The study proposed a white-box adversarial attack called projected Fast Gradient Sign Method and applied it repetitively to modify an input text until the generated sequence is misclassified. It first randomly picks a word, and then uses the gradient to generate a perturbation on the corresponding word vector. Then it maps the perturbed word vector into the nearest word based on Euclidean distance in the word embedding space. If the sequence is not yet misclassified, the algorithm will then randomly pick another position in the input. Recently, BID32 used the embedding gradient to determine important words. The technique used heuristic driven rules together with hand-crafted synonyms and typos. The method is a white-box attack since it accesses the gradient of the model. Another paper measures the importance of each word to a certain class by using the word frequency from that class's training data. Then the method uses heuristic driven techniques to generate adversarial samples by adding, modifying, or removing important words. This method needs to access a large set of labeled data. All after-mentioned methods are under the typical white-box setting of adversarial generation scenarios, in which gradients are used to guide the modification of input tokens from an original sample to an adversarial sample. However, gradients are hard to define on discrete symbolic text inputs. Also in black-box settings, calculating gradients is not possible since the model parameters are not observable. Recently, BID12 proposed greedy scoring strategies to rank words in a text sequence and then applied simple character-level transformations like swapping to fool deep classifiers. Its central idea, minimizing the edit distance of the perturbation makes sense. However the perturbations are quite visible and the empirical effectiveness needs improvements. BID12 propose multiple scoring strategies. However, it lacks the comparison between those scoring strategies. Our method does not require knowing the structure, parameters or gradient of the target model, while previous methods do. Also, most previous approaches used heuristic-driven and complicated modification approaches. We summarize the differences between our method and previous methods on generating adversarial text samples in TAB2.Besides, a few recent studies tried to generate adversarial examples for other NLPS tasks, like seq2seq based machine translation or machine-learning based reading comprehension NLP tasks. For example, BID7 attacks seq2seq translation models. Use projected gradient based input, BID7 can make the output of the translation model be completely different. BID18 generate samples that attacks Question Answering models. The authors propose algorithms which imitate the pattern of the question and feed additional wrong information into the sample that mislead the model to give a wrong answer. Machine learning models, when processing text, must first discretize a text into tokens. These tokens can then be fed into the model. Words are often used as the smallest unit for input to a model. A word embedding is a mapping that projects every word in a dictionary to a unique vector in some vector space. Such mappings transform the discrete representations of words into features on a continuous space, which is more conducive to use with machine learning models. Word embeddings have shown success in many NLP tasks BID9 BID31 BID25. Such models hold a dictionary and build the word embedding based on the dictionary. To be able to work with words not in the dictionary, word embedding based models often add a special entry in the dictionary called "out of vocabulary," or "unknown". Those models work well if the word embedding is well constructed and covers most words that occur in the data. Homoglyph has been a notorious security problem to many computer systems for many years. Hackers and malicious attackers has been deliberately using homoglyphs as attacks for many years. According to BID11, back to 2000 some person create a website'bl00mberg.com'(with 0 instead of o) to release fake financial news and fool many investors. Such issue become more severe as later domain name can include Unicode characters(punycode). Early studies of homoglyph attack includes BID11 and BID21.One may suggest since this problem has been popular for many years, it will certainly be solved by modern designs of web systems. However, in 2017 this issue still happens in popular web browsers Chrome and Firefox. Similar name spoofing attack are also used in computer viruses, where they make the name of virus process looks to be very similar to one of the system process (for example, svchost.exe and svch0st.exe). There exist a large body of recent studies focusing on adversarial examples for image classification that typically created imperceptible modifications to pixel values through an optimization procedure BID15 BID33 BID29 BID2. BID33 first observed that DNN models are vulnerable to ad- versarial perturbation (by limiting the modification using L 2 norm) and used the Limited-memory Broyden-Fletcher-Goldfarb-Shanno (L-BFGS) algorithm to find adversarial examples. Their study also found that adversarial perturbations generated from one Convolutional Neural Network (CNN) model can also force other CNN models to produce incorrect outputs. Subsequent papers have explored other strategies to generate adversarial manipulations, including using the linear assumption behind a model BID15 (by limits on L ∞ norm), saliency maps BID29 (by limits on L 0 norm), and evolutionary algorithms BID27. Recently, Carlini et al. proposed a group of attacking methods with optimization techniques to generate adversarial images with even smaller perturbations BID2. BID28 shows that it's possible to generate adversarial samples that can successfully reduce the classification accuracy in the black-box manner without the knowledge of model structure or the model parameters in the neural network. Recently multiple studies have extended adversarial examples to domains similar as images such as like speech recognition BID8 or speech-to-text BID3. Our experimental set up is as follows:• Datasets: In our experiments, we use seven large-scale text datasets gathered from BID35, which includes a variety of NLP tasks, e.g., text classification, sentiment analysis and spam detection. Details of the datasets are listed in TAB4.• Target Models: We conduct our experiment on several state-of-the-art RNN models. Basic-LSTM: A uni-directional LSTM. Detailedly speaking, the network contains a random embedding layer with dimension 100 to accept the word inputs. The embedding vectors are then fed through two LSTM layers (one for each direction) with 100 hidden nodes each. The hidden states of each direction are concatenated at the output and fed to a fully connected layer for the classification. Basic-LSTM with GloVe Embedding: Similar to Basic-LSTM, but use pretrained GloVe embedding BID31 from Stanford as the embedding layer. Bi-LSTM: A bi-directional LSTM, which contains an LSTM in both directions (reading from first word to last and from last word to first). The network contains a random embedding layer to accept the word inputs. The embedding vectors are then fed through two LSTM layers (one for each direction) with 100 hidden nodes each. The hidden states of each direction are concatenated at the output and fed to a fully connected layer for the classification. Bi-LSTM with GloVe Embedding: Similar to Bi-LSTM, but use pretrained GloVe embedding BID31 We summarize the performance of the models without adversarial samples in Table 3. In the non-adversarial setting, these models has achieve state-of-the-art level performance on those datasets.• Platform: We train the target deep-learning models and implement attacking methods using software platform PyTorch 0.3.0. All the experiments run on a server machine, whose operating system is CentOS7 and have 4 Titan X GPU cards.• Evaluation: Performance of the attacking methods is measured by the successful rate of the attack, which is 1 -the model on generated adversarial sequences. The lower the accuracy, the more effective is the attacking method. shows the attack successful rate on generated adversarial samples, each figure represents the on a certain dataset (We only present those dataset with larger than 2 classes). The X axis represents the number of modified characters(d), and the Y axis corresponds to the attack successful rate of the adversarial samples generated using the respective attacking methods. We study the effect of different parameters in this section. Our goal is to show our method i s robust to the change of parameters. In the MCTSBug algorithm, c is a parameter of UCB that balances the exploration and exploitation. We test several different choices of c value on AG's News Dataset. The shows that MCTSBug algorithm is robust to the change of C. Adversarial samples are famous for their transferability, which means a lot of adversarial samples that are generated for a certain model can also successfully fool other DNN models. We tested the transferability of adversarial samples generated using MCTSBug.We evaluate the transferability using four LSTMs. In the following table, LSTM1/BiLSTM1 are trained with randomly-initialized embedding, and LSTM2/BiLSTM2 are trained with GLoVe word embeddings. Figure 10 shows the accuracy from feeding adversarial sequences generated by one model to another model on the same task. The show that the target model accuracy in these circumstances is reduced from around 90% to 30-60%. Most adversarial samples can be successfully transferred to other models, even to those models with different word embedding. This experiment demonstrates that our method can successfully find those words that are important for classification and that the transformation is effective across multiple models. In another experiment, we study the performance of DeepWordBug attack on different classes of samples. We present the in the FIG10. From the figure, we can see that our attack works differently on different classes of inputs. It reveals that there may exist some bias in the target deep learning model towards some certain class. We present a histogram to analyze the distribution of the output probability of the target machine learning model on the fooled class in FIG11. The shows that even though we increase the word modification one by one, most adversarial samples we generated are predicted wrongly by the model with a high certainty, which indicated that the generated adversarial samples are hard to be filtered directly using the probability distribution. Certainty of model on the adversarial sample The MCTS attack algorithm can be also applied to other discrete type inputs, with a properly defined value function and a properly defined transformation function. As an example, we show the to generate on the MNIST dataset in FIG2.The idea is to generate adversarial samples on L0 norm. Because the uniqueness of the task, we can define a discrete action set over the pixels. Currently, for every pixel we define two types of actions: Change the value to 255 or change the value to 0. Doing so, the question can be viewed as a combinitorial optimization problem once again. We solve this problem: By performing at most 20 actions, we successfully flip 37 samples out of 100 samples we tested. We show some samples in FIG2."

A method for learning better representations, that acts as a regularizer and despite its no significant additional computation cost , achieves improvements over strong baselines on Supervised and Semi-supervised Learning tasks.