Trigger Optimization for Black-Box Universal Adversarial Attacks on Text Classifiers

Adversarial attacks significantly undermine the robustness of deep learning models, posing a major challenge to their deployment in critical applications. Universal adversarial perturbations pose a formidable threat due to their ability to mislead models for various inputs. This paper introduces a novel method to attack text classifiers in a black-box setting using universal adversarial attacks. It accomplishes this by enhancing trigger words, which are specific sequences of words that, when added to any input, cause consistent misclassification. The proposed method utilizes the Genetic Algorithm (GA) and differs from the conventional white-box attack as it does not need internal architectures or gradients within the model. Instead, it iteratively evolves a population of adversarial triggers, effectively navigating the search space to maintain fluency and semantic coherence in the generated sequences. We achieved a high rate of successful attacks across the Bi-LSTM and BERT models while preserving the naturalness of the input text. Our findings demonstrate the potential of GA-optimized universal triggers as a formidable and practical tool for adversarial attacks in real-world situations where only input-output access to the target model is available.