Deep neural networks (DNNs) are known to be vulnerable to adversarial images, while their robustness in text classification is rarely studied. Several lines of text attack methods have been proposed in the literature, including character-level, word-level, and sentence-level attacks. However, it is still a challenge to minimize the number of word changes necessary to induce misclassification, while simultaneously ensuring lexical correctness, syntactic soundness, and semantic similarity. In this paper, we propose a Bigram and Unigram based adaptive Semantic Preservation Optimization (BU-SPO) method to examine the vulnerability of deep models. Our method has four major merits. Firstly, we propose to attack text documents not only at the unigram word level but also at the bigram level which better keeps semantics and avoids producing meaningless outputs. Secondly, we propose a hybrid method to replace the input words with options among both their synonyms candidates and sememe candidates, which greatly enriches the potential substitutions compared to only using synonyms. Thirdly, we design an optimization algorithm, i.e., Semantic Preservation Optimization (SPO), to determine the priority of word replacements, aiming to reduce the modification cost. Finally, we further improve the SPO with a semantic Filter (named SPOF) to find the adversarial example with the highest semantic similarity. We evaluate the effectiveness of our BU-SPO and BU-SPOF on IMDB, AG's News, and Yahoo! Answers text datasets by attacking four popular DNNs models. Results show that our methods achieve the highest attack success rates and semantics rates by changing the smallest number of words compared with existing methods.

翻译：深度神经网络（DNN）已知易受对抗图像攻击，但其在文本分类中的鲁棒性却鲜有研究。尽管文献中已提出多种文本攻击方法，包括字符级、词级和句子级攻击，但如何在最小化诱导分类错误所需的词改动数量的同时，确保词汇正确性、句法合理性和语义相似性仍是一大挑战。本文提出一种基于双词和单词的自适应语义保持优化（BU-SPO）方法，以探究深度模型的脆弱性。我们的方法具备四大优势：第一，我们不仅攻击单词级文本，还提出对双词组级别进行攻击，从而更好保持语义并避免生成无意义输出；第二，提出一种混合方法，将输入词替换为同义词候选和义原候选，与仅使用同义词相比极大丰富了潜在替换项；第三，设计一种优化算法（称为语义保持优化SPO），确定词替换的优先级以降低修改成本；第四，通过引入语义过滤器（SPOF）进一步改进SPO，以寻找语义相似度最高的对抗样本。我们在IMDB、AG's News和Yahoo! Answers文本数据集上攻击四种主流DNN模型，评估BU-SPO和BU-SPOF的有效性。结果表明，与现有方法相比，我们的方法在改动最少单词量的条件下实现了最高的攻击成功率和语义保持率。