# On the regularity of weak solution for the Oberbeck-Boussinesq equations

Blanca Climent-Ezquerra  Departamento de Ecuaciones Diferenciales y Análisis
NuméricoUniversidad de SevillaSevilla, España<EMAIL_ADDRESS>Elva Ortega-
Torres  Departamento de MatemáticasUniversidad Católica del NorteAntofagasta,
Chile<EMAIL_ADDRESS>Marko Rojas-Medar  Departamento de MatemáticaUniversidad
de TarapacáArica, Chile<EMAIL_ADDRESS>
###### Abstract.

We prove new regularity criteria of the Prodi-Serrin type with weak Lebesgue
integrability in both space and time for a viscous active chemical fluid in a
bounded domain.

###### Key words and phrases:

Oberbeck-Boussinesq equations, Prodi-Serrin type conditions

###### 1991 Mathematics Subject Classification:

Primary 35Q35; Secondary 76D03

##  1\. Introduction

In this paper, we show some regularity results for the equations describing
the motion of a viscous chemical fluid in a bounded domain,
$\Omega\subset\mathbb{R}^{3}$, with smooth boundary, $\partial\Omega$, over a
time interval, $[0,T)$, $0<T\leq\infty$. Specifically, we consider the
following approximations of Oberbeck-Boussinesq type (see [1]):

$\left\\{\begin{array}[]{l}{\boldsymbol{u}}_{t}+({\boldsymbol{u}}\cdot\nabla){\boldsymbol{u}}-\mu\Delta{\boldsymbol{u}}+\nabla
p=\alpha(\theta+\varphi){\boldsymbol{g}}+{\boldsymbol{f}},\\\
\theta_{t}+({\boldsymbol{u}}\cdot\nabla)\theta-\kappa_{1}\Delta\theta=\ell,\\\
\varphi_{t}+({\boldsymbol{u}}\cdot\nabla)\varphi-\kappa_{2}\Delta\varphi=h,\\\
\mbox{div}\,{\boldsymbol{u}}=0,\end{array}\right.$ (1.1)

together with the following boundary and initial conditions:

${\boldsymbol{u}}(x,t)=0,\ \theta(x,t)=0,\ \varphi(x,t)=0\mbox{ on
}\partial\Omega\times(0,T).$ (1.2)
${\boldsymbol{u}}(x,0)={\boldsymbol{u}}_{0}(x),\ \theta(x,0)=\theta_{0}(x),\
\varphi(x,0)=\varphi_{0}\mbox{ in }\Omega.$ (1.3)

The unknowns are the functions ${\boldsymbol{u}}(x,t)\in\mathbb{R}^{3}$,
$\theta(x,t)\in\mathbb{R}$, $\varphi(x,t)\in\mathbb{R}$ and
$p(x,t)\in\mathbb{R}$ denoting the velocity vector, temperature, concentration
of material in the liquid and pressure at time $t\in[0,T)$, at point
$x\in\Omega$. Moreover,
${\boldsymbol{f}}(x,t),{\boldsymbol{g}}(x,t)\in\mathbb{R}^{3}$,
$\ell(x,t),h(x,t)\in\mathbb{R}$ are known external sources, $\mu>0$ is the
viscosity of fluid, $\kappa_{1}$ and $\kappa_{2}$ are the thermal and solute
diffusion, respectively. ${\boldsymbol{u}}_{0},\theta_{0}$ and $\varphi_{0}$
are functions given on the variable $x\in\Omega$. The non-homogeneous case for
$\theta$ and $\varphi$ in the initial conditions can be treated using an
appropriate lifting and only the obvious changes in the statement of the
results are required.

The expressions $\Delta$, $\nabla$ and div denote the gradient, Laplacian and
divergence operators, respectively; the $i^{th}$ component of
$({\boldsymbol{u}}\cdot\nabla){\boldsymbol{u}}$ is given by
$[({\boldsymbol{u}}\cdot\nabla){\boldsymbol{u}}]_{i}=\sum_{j=1}^{3}u_{j}\frac{\partial
u_{i}}{\partial x_{j}}$ and
$({\boldsymbol{u}}\cdot\nabla)\phi=\sum_{j=1}^{3}u_{j}\frac{\partial\phi}{\partial
x_{j}}$ for $\phi=\theta$ or $\varphi$. For the derivation and physical
discussion of equation (1.1)-(1.3) see, e.g., Joseph [1].

We note that this model of fluid includes as a particular case the classical
Navier-Stokes, which has been extensively studied (see, for instance, the
classic books by Ladyzhenskaya [9], Lions [17] and Temam [27]). It also
includes the classical Boussinesq problem (or Bernard’s problem) in the case
where chemical reactions are absent: $\varphi\equiv 0$. The existence of
various solution notions for this system has been studied, see [25], [15],
[6], [18], [8], [19] and [14] and the references therein.

The study of the uniqueness of weak solution for three-dimensional Navier-
Stokes equations is more difficult, see for example [10]. Uniqueness is proved
fairly easily for sufficiently regular solutions while in the class of weak
solutions, the problem of uniqueness (or non-uniqueness) remains open. A
pioneering work in this direction was given by Serrin [24], who proved that a
weak solution $({\boldsymbol{u}},p)$ is regular if the velocity
${\boldsymbol{u}}$ satisfies some suitable additional conditions (see next
section). Afterwards, many authors have extended Serrin’s result, see e.g.
[13], [28], [3], [4], [5], [20], [26], etc.

The model considered in this work was studied by Belov and Kapitonov, who
proved the stability of the solutions in [2]. Rojas-Medar and Lorca
established the existence, regularity and uniqueness of the solutions by means
of the Galerkin spectral method in [22], [23]. In [19], Morimoto obtained
results analogous to those in Serrin [24] involving conditions on
${\boldsymbol{u}}$ and $\theta$ for the Boussinesq approximation. This results
can be extended to the model considered in this paper, using the results of
weak solutions obtained in [12]. Note that this extension involves conditions
of the Prodi-Serrin type for ${\boldsymbol{u}}$, $\theta$ and $\varphi$. Here,
we obtain regularity results assuming only suitable conditions on
${\boldsymbol{u}}$. This work is inspired by the article [5] (see also [11]) .

The paper is organized as follows: In section 2, we show the notation and some
preliminary results. The two theorems presented in this paper are stated in
section 3 and in the following sections their proofs are given.

##  2\. Preliminaries

###  2.1. Notation

Let $\Omega$ be an open subset of $\mathbb{R}^{n}$. Boldface letters will be
used for vectorial spaces, for instance
${\textbf{L}^{2}(\Omega)}=L^{2}(\Omega)^{n}$. Sometimes, the notation will be
abridged, if $X=X(\Omega)$ is a space of functions defined in the open set
$\Omega$, we denote by $L^{p}(X)$ the Banach space $L^{p}(0,T;X)$. The
$L^{p}$-norm is denoted as $\|\cdot\|_{p}$ (in particular
$\|\cdot\|_{2}=\|\cdot\|$). The inner product of $L^{2}(\Omega)$ is denoted by
$(\cdot,\cdot)$.

As usual, we define $\mathcal{V}=\\{{\boldsymbol{v}}\in{\bf
C}_{0}^{\infty}(\Omega)\,:\,\mbox{div}\,{\boldsymbol{v}}=0\\}$ and the spaces

$\displaystyle{\bf H}$ $\displaystyle=\mbox{ the closure of }\mathcal{V}\mbox{
in }{\bf L}^{2}(\Omega),$ $\displaystyle{\bf V}$ $\displaystyle=\mbox{ the
closure of }\mathcal{V}\mbox{ in }{\bf H}^{1}(\Omega).$

We denote by $P$ the orthogonal projection onto ${\bf H}$ and $A=-P\Delta$ the
usual Stokes operator with domain $D(A)={\bf H}^{2}(\Omega)\cap{\bf V}$.

From now on, $C>0$ will denote different constants, depending only on the data
of the problem. When necessary, we emphasize that the constants may have
different values using the notation $C_{1}$, $C_{2}$, and so on.

###  2.2. Weak Lebesgue or Marcinkiewicz spaces

Given a measurable function $f$ on $\Omega$, the distribution function of $f$
is the function $d_{f}$, defined on $[0,\infty)$ by
$d_{f}(\alpha)=m(\\{x\in\Omega;|f(x)|>\alpha\\})$. For $1\leq p<\infty$, the
weak-$L^{p}(\Omega)$ space is denoted by $L^{p,\infty}(\Omega)$ and is defined
as the set of measurable functions $f$ such that

$\displaystyle\|f\|_{p,\infty}$
$\displaystyle=\sup_{\alpha}\left\\{\alpha\cdot
d_{f}(\alpha)^{1/p};\alpha>0\right\\}$

is finite. It is possible to check that $\|\lambda
f\|_{p,\infty}=|\lambda|\|f\|_{p,\infty}$, $\|f\|_{p,\infty}=0$ if and only if
$f=0$, and $\|f+g\|_{p,\infty}\leq 2(\|f\|_{p,\infty}+\|g\|_{p,\infty})$.
Hence, $L^{p,\infty}(\Omega)$ is a quasinormed linear space (for more details
see Grafakos [7], Kufner et al. [16]).

The weak-$L^{\infty}(\Omega)$ space is by definition the space
$L^{\infty}(\Omega)=L^{\infty,\infty}(\Omega).$ The space
$L^{p,\infty}(\Omega)$ is larger than the usual $L^{p}(\Omega)$ space. This
follows directly from Chebyshev’s inequality

$\displaystyle\alpha^{p}d_{f}(\alpha)$
$\displaystyle\leq\int_{\\{x;|f(x)|>\alpha\\}}|f(x)|^{p}dx.$

More precisely, the inclusion $L^{p}(\Omega)\subset L^{p,\infty}(\Omega)$ is
strict. For example, if $x_{0}\in\Omega$, we have $|x-x_{0}|^{-n/p}\in
L^{p,\infty}(\Omega)$, but $|x-x_{0}|\notin L^{p}(\Omega).$

We will also use the following lemma (Lemma 2.18.2 in [16]):

######  Lemma 2.1.

If $f\in L^{p}(\Omega)$, then

$\displaystyle\int_{\Omega}\|f(x)\|^{p}\,dx$
$\displaystyle=p\int_{0}^{\infty}\sigma^{p-1}d_{f}(\sigma)\,d\sigma.$

###  2.3. Previous results

For the Navier-Stokes equations it is well known that if
${\boldsymbol{u}}(0)\in{\bf H}$ and ${\boldsymbol{f}}\in L^{2}(0,T;{\bf
L}^{2}(\Omega))$, there exists at least one weak solution

${\boldsymbol{u}}\in L^{\infty}(0,T;{\bf H})\cap L^{2}(0,T;{\bf V}),$

which is called the Leray-Hopf solution. If, in addition
${\boldsymbol{u}}(0)\in{\bf V}$, there exists $T_{*}\in(0,\infty]$ such that
the Navier-Stokes equations admit a unique strong solution

${\boldsymbol{u}}\in L^{\infty}(0,T;{\bf V})\cap L^{2}(0,T;{\bf
H}^{2}(\Omega)),$

provided that $T<T^{*}$. Therefore, it is natural to ask under what conditions
do you have a global in time strong solution for initial data
${\boldsymbol{u}}(0)\in{\bf V}$, without any restriction on the size of its
norm. According to a result of Prodi [21] and Serrin [24], such a global
strong solution for the Navier-Stokes equations exists if

$\displaystyle{\boldsymbol{u}}\in L^{s}(0,T;{\bf L}^{r}(\Omega)),$

where $(r,s)$ is a Prodi-Serrin pair, that is, $r\in(3,\infty],s\in[2,\infty)$
and $\frac{3}{r}+\frac{2}{s}=1$. Moreover, using weak Lebesgue spaces, it has
been showed that the weak solution of the Navier-Stokes equations is strong on
$[0,T]$ if either

$\displaystyle{\boldsymbol{u}}\in L^{s}(0,T;{\bf L}^{r,\infty}(\Omega))\
\mbox{ or }\ {\boldsymbol{u}}\in L^{s,\infty}(0,T;{\bf L}^{r,\infty}(\Omega))$

and it exists a constant $\Gamma=\Gamma(r,s,\Omega)>0$ such that
$\|{\boldsymbol{u}}\|_{L^{s,\infty}({\bf
L}^{r,\infty})}\leq\Gamma\,\mu^{1-1/s}$ where $\Gamma>0$ is a small constant
(see [4], [5], [26]).

The following lemma of Bosia et al [5] will be necessary in our
demonstrations:

######  Lemma 2.2.

Let ${\boldsymbol{u}}\in{\bf V}\cap{\bf H}^{2}(\Omega)$ and $(r,s)$ be a
Prodi-Serrin pair, that is, $r\in(3,\infty],s\in[2,\infty)$ and
$\frac{3}{r}+\frac{2}{s}=1$. Then

$\displaystyle\|({\boldsymbol{u}}\cdot\nabla){\boldsymbol{u}}$
$\displaystyle\|\leq
C_{r}\|{\boldsymbol{u}}\|_{r,\infty}\|\nabla{\boldsymbol{u}}\|^{\frac{2}{s}}\|A{\boldsymbol{u}}\|^{\frac{s-2}{s}}.$

##  3\. The main results

Our purpose here is to extend the above regularity criteria of the Navier-
Stokes equations to problem (1.1) and provide short proofs of the results.

We assume that a weak solution $({\boldsymbol{u}},\theta,\varphi)$ of (1.1)
satisfies

$\displaystyle{\boldsymbol{u}}\in L^{\infty}(0,T;{\bf H})\cap L^{2}(0,T;{\bf
V}),$ $\displaystyle\theta,\varphi\in L^{\infty}(0,T;L^{2}(\Omega))\cap
L^{2}(0,T;H^{1}_{0}(\Omega)).$

######  Theorem 3.1.

Let ${\boldsymbol{f}}\in L^{2}(0,T;\L^{2}(\Omega))$, ${\boldsymbol{g}}\in
L^{\infty}(0,T;{\bf L}^{3}(\Omega))$ and $\ell,h\in L^{2}(0,T;L^{2}(\Omega))$.
Let $({\boldsymbol{u}},\theta,\varphi)$ be a weak solution of (1.1) with
initial data ${\boldsymbol{u}}(0)\in{\bf V}$ and $\theta(0),$ $\varphi(0)\in
H_{0}^{1}(\Omega)$. If

$\displaystyle{\boldsymbol{u}}\in L^{s}(0,T;{\bf L}^{r,\infty}(\Omega))$

for some Prodi-Serrin pair $(r,s)$, then $({\boldsymbol{u}},\theta,\varphi)$
remains strong on $[0,T]$.

######  Theorem 3.2.

Let ${\boldsymbol{f}}\in L^{2}(0,T;{\bf L}^{2}(\Omega))$, ${\boldsymbol{g}}\in
L^{\infty}(0,T;{\bf L}^{3}(\Omega))$ and $\ell,h\in L^{2}(0,T;L^{2}(\Omega))$.
Let $({\boldsymbol{u}},\theta,\varphi)$ be a weak solution of (1.1) with
initial data ${\boldsymbol{u}}(0)\in{\bf V},$ $\theta(0),$ $\varphi(0)\in
H_{0}^{1}(\Omega)$. If there exists a constant $\Gamma>0$, depending only on
$r$ and $\Omega$, such that

$\displaystyle{\boldsymbol{u}}\in L^{s,\infty}(0,T;{\bf
L}^{r,\infty}(\Omega))\mbox{ with }\|{\boldsymbol{u}}\|_{L^{s,\infty}({\bf
L}^{r,\infty})}$ $\displaystyle\leq\Gamma\,\mu^{(s-1)/s}$

for some Prodi-Serrin pair $(r,s)$, then $({\boldsymbol{u}},\theta,\varphi)$
remains strong on $[0,T]$.

######  Remark 3.3.

The constant $\Gamma$ is $\Gamma=(2C^{\epsilon}_{2}C_{1})^{-1/s}$, where
$C_{1}$ and $C_{2}$ are given in the proof of Theorem 3.2 and $\epsilon>0$ is
appropriately chosen.

##  4\. Proof of Theorem 3.1

By applying the operator $P$ in (1.1) and taking $A{\boldsymbol{u}}$ as test
function in the weak formulation of (1.1) we get

$\displaystyle\frac{1}{2}\frac{d}{dt}\|\nabla{\boldsymbol{u}}\|^{2}+\mu\|A{\boldsymbol{u}}\|^{2}$
$\displaystyle=-(P[({\boldsymbol{u}}\cdot\nabla){\boldsymbol{u}}],A{\boldsymbol{u}})+\alpha(P(\theta+\varphi){\boldsymbol{g}},A{\boldsymbol{u}})$
$\displaystyle\ \ \ +({\boldsymbol{f}},A{\boldsymbol{u}}).$ (4.1)

Lemma 2.2 provides the following estimate

$\displaystyle|(P[({\boldsymbol{u}}\cdot\nabla){\boldsymbol{u}}],A{\boldsymbol{u}})|$
$\displaystyle\leq\|({\boldsymbol{u}}\cdot\nabla){\boldsymbol{u}}\|\|A{\boldsymbol{u}}\|$
$\displaystyle\leq
C_{s}\|{\boldsymbol{u}}\|_{r,\infty}\|\nabla{\boldsymbol{u}}\|^{\frac{2}{s}}\|A{\boldsymbol{u}}\|^{\frac{2(s-1)}{s}}$
$\displaystyle\leq\frac{C_{1}}{2}\mu^{1-s}\|{\boldsymbol{u}}\|_{r,\infty}^{s}\|\nabla{\boldsymbol{u}}\|^{2}+\frac{\mu}{6}\|A{\boldsymbol{u}}\|^{2},$

where
$\frac{C_{1}}{2}=\frac{C_{s}^{s}}{s}\left[\frac{6(s-1)}{s}\right]^{s-1}$. By
using the Holder’s and Young’s inequalities we obtain

$\displaystyle|\alpha(P\theta{\boldsymbol{g}},A{\boldsymbol{u}}))|$
$\displaystyle\leq\alpha\|(\theta+\varphi){\boldsymbol{g}}\|\|A{\boldsymbol{u}}\|$
$\displaystyle\leq\frac{6}{\mu}\alpha^{2}\|(\theta+\varphi){\boldsymbol{g}}\|^{2}+\frac{\mu}{6}\|A{\boldsymbol{u}}\|^{2}$
$\displaystyle\leq
C_{2}\frac{6}{\mu}\alpha^{2}\|{\boldsymbol{g}}\|_{L^{\infty}({\bf
L}^{3})}(\|\nabla\theta\|^{2}+\|\nabla\varphi\|^{2})+\frac{\mu}{6}\|A{\boldsymbol{u}}\|^{2}.$

where $C_{2}$ is the embedding constant $H^{1}\hookrightarrow L^{6}$ and,

$|({\boldsymbol{f}},A{\boldsymbol{u}})|\leq\frac{6}{\mu}\|{\boldsymbol{f}}\|^{2}+\frac{\mu}{6}\|A{\boldsymbol{u}}\|^{2}.$

From the above estimates and from (4), we get the following differential
inequality:

$\displaystyle\frac{d}{dt}\|\nabla{\boldsymbol{u}}\|^{2}+\mu\|A{\boldsymbol{u}}\|^{2}$
$\displaystyle\leq
C_{1}\mu^{1-s}\|{\boldsymbol{u}}\|_{r,\infty}^{s}\|\nabla{\boldsymbol{u}}\|^{2}$
$\displaystyle\ \ \
+\tilde{C}(\|\nabla\theta\|^{2}+\|\nabla\varphi\|^{2})+\frac{\mu}{3}\|{\boldsymbol{f}}\|^{2},$
(4.2)

where
$\tilde{C}=2C_{2}\frac{6}{\mu}\alpha^{2}\|{\boldsymbol{g}}\|_{L^{\infty}({\bf
L}^{3})}$.

Setting $\phi(t)=\|\nabla{\boldsymbol{u}}(t)\|^{2}$ and
$k(t)=\|{\boldsymbol{u}}(t)\|_{r,\infty}^{s}$, inequality (4) implies

$\displaystyle\phi(t)$
$\displaystyle\leq\phi(0)+C_{1}\int_{0}^{t}k(\sigma)\phi(\sigma)d\sigma+\tilde{C}\int_{0}^{t}(\|\nabla\theta(\sigma)\|^{2}+\|\nabla\varphi(\sigma)\|^{2})d\sigma$
$\displaystyle\ \ \
+\frac{\mu}{3}\int_{0}^{t}\|{\boldsymbol{f}}(\sigma)\|^{2}d\sigma$
$\displaystyle\leq M+C_{1}\int_{0}^{t}k(\sigma)\phi(\sigma)d\sigma,$ (4.3)

where
$M=\varphi(0)+\tilde{C}(\|\theta\|_{L^{2}(H_{0}^{1})}+\|\varphi\|_{L^{2}(H_{0}^{1})})+\frac{\mu}{3}\|{\boldsymbol{f}}\|_{L^{2}({\bf
L}^{2})}<\infty$.

By Gronwall’s inequality we conclude that

$\|\nabla{\boldsymbol{u}}(t)\|^{2}=\varphi(t)\leq
M\exp\bigg{(}C_{1}\int_{0}^{t}k(\sigma)d\sigma\bigg{)}.$

Hence,

${\boldsymbol{u}}\in L^{\infty}(0,T;{\bf V}).$ (4.4)

Similarly, by taking the inner product of the second equation of (1.1) with
$-\Delta\theta$ we have that

$\frac{1}{2}\frac{d}{dt}\|\nabla\theta\|^{2}+\kappa_{1}\|\Delta\theta\|^{2}=-(\ell,\Delta\theta)+(({\boldsymbol{u}}\cdot\nabla)\theta,\Delta\theta).$
(4.5)

By using the Holder’s and Young’s inequalities, we have

$|-(\ell,\Delta\theta)|\leq\|\ell\|\|\Delta\theta\|\leq
C\|\ell\|^{2}+\frac{\kappa_{1}}{4}\|\Delta\theta\|^{2}.$

Owing to the Gagliardo-Niremberg, Poincaré, Young inequalities and (4.4), we
obtain

$\displaystyle|(({\boldsymbol{u}}\cdot\nabla)\theta,\Delta\theta)|$
$\displaystyle\leq\|{\boldsymbol{u}}\|_{6}\|\nabla\theta\|_{3}\|\Delta\theta\|$
$\displaystyle\leq
C\|\nabla{\boldsymbol{u}}\|(\|\nabla\theta\|^{\frac{1}{2}}\|\Delta\theta\|^{\frac{1}{2}})\|\Delta\theta\|$
$\displaystyle\leq
C\|\nabla\theta\|^{2}+\frac{\kappa_{1}}{4}\|\Delta\theta\|^{2}.$ (4.6)

Using the estimates above in (4.5) we get

$\displaystyle|\nabla\theta(t)\|^{2}$
$\displaystyle\leq\|\nabla\theta(0)\|^{2}+C\int_{0}^{t}\|\nabla\theta(\sigma)\|^{2}d\sigma+C\int_{0}^{t}\|\ell(\sigma)\|^{2}d\sigma$
$\displaystyle\leq N+C\int_{0}^{t}\|\nabla\theta(\sigma)\|^{2}d\sigma,$ (4.7)

where $N=\|\nabla\theta(0)\|^{2}+\|\ell\|_{L^{2}(0,T;L^{2}(\Omega)}<\infty$.
By the Gronwall’s inequality, we conclude that

$\theta\in L^{\infty}(0,T;H^{1}_{0}(\Omega)).$ (4.8)

Analogously,

$\varphi\in L^{\infty}(0,T;H^{1}_{0}(\Omega)).$ (4.9)

can be shown.

We then assume that the solution remains strong only on $[0,T^{\prime})$, with
$T^{\prime}<T$. It follows from (4.4), (4.8) and (4.9) that
$\|\nabla{\boldsymbol{u}}\|^{2}+\|\nabla\theta\|^{2}+\|\nabla\varphi\|^{2}$
remains bounded on $[0,T]$. But if $[0,T^{\prime})$ is the maximal interval
for the existence of the strong solution, then
$\|\nabla{\boldsymbol{u}}\|+\|\nabla\theta\|+\|\nabla\varphi\|\to\infty$ as
$t\to T^{\prime-}$ and we reach a contradiction. Hence, the solution must be
strong on $[0,T]$.

##  5\. Proof of Theorem 3.2

We use an argument similar to the one used in Bosia et al [5] and Pata [20]:
Given $0<\epsilon<1$, let $s_{\epsilon}=s+\epsilon(4-s)$ and $r_{\epsilon}$
such that $(r_{\epsilon},s_{\epsilon})$ is a Prodi-Serrin pair. By using the
following interpolation inequality

$\|{\boldsymbol{u}}\|_{r_{\epsilon},\infty}^{s_{\epsilon}}\leq\|{\boldsymbol{u}}\|_{r,\infty}^{s(1-\epsilon)}\|{\boldsymbol{u}}\|_{6,\infty}^{4\epsilon}\leq
C_{2}^{\varepsilon}\|{\boldsymbol{u}}\|_{r,\infty}^{s(1-\epsilon)}\|\nabla{\boldsymbol{u}}\|^{4\epsilon},$

in (4) for $s_{\epsilon}$ instead of $s$, it follows that

$\frac{d}{dt}\|\nabla{\boldsymbol{u}}\|^{2}\leq
C_{3}\mu^{1-s}\|{\boldsymbol{u}}\|_{r,\infty}^{s(1-\epsilon)}\|\nabla{\boldsymbol{u}}\|^{2+4\epsilon}+C(\|\nabla\theta\|^{2}+\|\nabla\varphi\|^{2}+\|{\boldsymbol{f}}\|^{2}).$

In this inequalities, $C_{2}^{\epsilon}$ depends only on $\Omega$ and
$\epsilon$, $C_{3}=C_{2}^{\epsilon}C_{1}$ and $C_{1}$ depends on
$(r_{\epsilon},s_{\epsilon})$. Hence, setting
$\phi(t)=\|\nabla{\boldsymbol{u}}(t)\|^{2}$ and integrating in $[0,t]$ we
obtain

$\phi(t)\leq
R+C_{3}\mu^{1-s}\int_{0}^{t}\|{\boldsymbol{u}}(\sigma)\|_{r,\infty}^{s(1-\epsilon)}\phi(\sigma)^{1+2\epsilon}d\sigma,$
(5.1)

where
$R=\phi(0)+C(\|\theta\|_{L^{2}(H_{0}^{1})}+\|\varphi\|_{L^{2}(H_{0}^{1})}+\|{\boldsymbol{f}}\|_{L^{2}({\bf
L}^{2})})<\infty.$

We denote $k(t)=\|{\boldsymbol{u}}\|_{r,\infty}^{s}$ and

$\psi(t)=R+C_{3}\mu^{1-s}\int_{0}^{t}k^{1-\epsilon}(\sigma)\phi^{1+2\epsilon}(\sigma)d\sigma\
\mbox{ for }\ t\in[0,T].$

Observe that $k\in L^{1,\infty}(0,T)$ and $\phi\leq\psi$. From (5.1), we have
that

$\displaystyle\psi^{\prime}(t)$
$\displaystyle=C_{3}\mu^{1-s}k^{1-\epsilon}(t)\phi^{1+2\epsilon}(t)$
$\displaystyle\leq C_{3}\mu^{1-s}k^{1-\epsilon}(t)\psi^{1+2\epsilon}(t).$

Integrating the last inequality in $[0,t]$, we obtain

$\psi(0)^{-2\epsilon}-\psi(t)^{-2\epsilon}\leq
2\,C_{3}\,\mu^{1-s}\epsilon\int_{0}^{t}k^{1-\epsilon}(\sigma)d\sigma.$ (5.2)

On the other hand, owing to Lemma 2.1,

$\displaystyle\epsilon\int_{0}^{T}k^{1-\epsilon}(\sigma)d\sigma$
$\displaystyle=\epsilon(1-\epsilon)\int_{0}^{\infty}\sigma^{-\epsilon}m\\{\tau\in[0,T];k(\tau)>\sigma\\}d\sigma$
$\displaystyle\leq\epsilon
T+\epsilon(1-\epsilon)\|k\|_{1,\infty}\int_{1}^{\infty}\sigma^{-(1+\epsilon)}d\sigma$
$\displaystyle=\epsilon T+(1-\epsilon)\|k\|_{1,\infty}.$ (5.3)

By using (5) in (5.2),

$\psi(0)^{-2\epsilon}-\psi(t)^{-2\epsilon}\leq 2C_{3}\mu^{1-s}\epsilon
T+2C_{3}\mu^{1-s}(1-\epsilon)\|k\|_{1,\infty}.$ (5.4)

Let $\delta\in(0,1/3)$ such that
$2\,C_{3}\,\mu^{1-s}\|k\|_{1,\infty}<1-3\delta$. Choosing $\epsilon>0$
sufficiently small so that $1-\delta<\psi^{-2\epsilon}(0)$ and
$2C_{3}\mu^{1-s}\epsilon T<\delta$, we have
$\psi(t)\leq\delta^{-1/(2\epsilon)}$ for all $t\in[0,T].$ Therefore, if
$\|k\|_{1,\infty}<1/(2C_{3}\mu^{1-s})$, then
$\phi=\|\nabla{\boldsymbol{u}}\|^{2}$ is bounded on $[0,T]$. Arguing as in the
proof of Theorem 3.1, we can conclude that $\|\nabla\theta\|$ and
$\|\nabla\varphi\|$ are bounded on $[0,T]$ (see (4.8)).

### Acknowledgment

M. Rojas-Medar is partially supported by MATH-AMSUD project 21-MATH-03
(CTMicrAAPDEs), CAPES-PRINT 88887.311962/2018-00 Brazil, Project UTA-Mayor,
753-20, Universidad de Tarapacá-Chile.

## References

  * [1] D.D. Joseph, Stability of fluid motion. Springer-Verlag, Berlin, 1976.
  * [2] V. Y. Belov and Kapitonov, B.V., A certain hidrodynamic model of chemically active fluid. Sibirskii Matematicheskii Zhurnal 24, No. 6 (1983), 3-13.
  * [3] H. Beirão da Veiga, Concerning the regularity of the solutions to the Navier-Stokes equations via the truncation method, Part I. Differential and integral Equations 10 (1997), 1149-1156.
  * [4] C. Bejorland and A. Vasseur, Weak in space, log in time improvement of the Ladyzenskaja-Prodi-Serrin criteria. J. Math. Fluid Mech. 13 (2011), 259-269.
  * [5] S. Bosia, V. Pata and J. Robinson, A weal-$L^{p}$ Prodi-Serrin type regularity criterion for the Navier-Stokes Equations, J. Math. Fluid Mech. 16 (2014), 721-725.
  * [6] J.R. Cannon, E. DiBenedetto, The initial value problem for the Boussinesq equations with data in Lp. In: Approximation Methods for Navier-Stokes Equations. Lecture Notes in Mathematics 771, Rautmann R. (eds), Springer-Verlag (1980), 129-144.
  * [7] L. Grafakos, Classical Fourier Analysis. Springer, New York, 2008.
  * [8] T. Hishida, Existence and regularizing properties of solutions for the nonstationary convection problem, Funkcialy Ekvaciy 34 (1991), 449-474.
  * [9] O. A. Ladyzhenskaya, The mathematical theory of viscous incompressible flow. Gordon and Breach, New York, London, Paris, 1969.
  * [10] O. A. Ladyzhenskaya, The sixth millennium problem: Navier-Stokes equations, existence and smoothness. Uspekhi Mat. Nauk 58, No. 2(350) (2003), 45-78; Russian Math. Surveys 58, No. 2 (2003), 251-286.
  * [11] M. Loayza, M.A. Rojas-Medar, A weak-$L_{p}$ Prodi-Serrin type regularity criterion for the micropolar fluid equations. J. Math. Phys. 57, 021512 (2016), 6 pp.
  * [12] S. Lorca, M.A. Rojas-Medar, Weak solutions for the viscous incompressible chemically active fluids. Rev. Mat. Estatíst. 14 (1996), 183-99.
  * [13] S. Kaniel, M. Shinbroth, Smoothness of weak solutions of the Navier-Stokes equations. Arch. Rational Mech. Anal. 24 (1967), 302-324.
  * [14] C. Komo, Optimal initial value conditions for the existence of strong solutions of the Boussinesq equations. Ann Univ Ferrara 60 (2014), 377-396.
  * [15] N.K. Korenev, On some problems of convection in a viscous incompressible fluid. Vestnik Leningrand Univ. Math. 4 (1977), 125-137.
  * [16] A. Kufner, O. John, S. Fucik, Function Spaces. Noordhoff International Publishing, Leyden, 1977.
  * [17] J. L. Lions, Quelques Méthodes de Résolution de Problèmes aux Limite non Linéares. Dunod, Paris, 1969.
  * [18] H. Morimoto, On the existence of weak solutions of the equation of natural convection. J. Fac. Sci. Univ. Tokio, Sect. IA 36 (1989), 87-102.
  * [19] H. Morimoto, Nonstationary Boussinesq equations. J. Fac. Sci., Univ Tokyo, Sect. IA Math. 39 (1992), 61-75.
  * [20] V. Pata, On the regularity of solutions to the Navier-Stokes equations. Commun. Pure Appl. Anal. 11 (2012), 747-761.
  * [21] G. Prodi, Un teorema di unicità per le equazioni di Navier-Stokes. Ann. Mat. Pura Appl. 48 (1959), 173-182.
  * [22] M.A. Rojas-Medar, S.A. Lorca, The equations of a viscous incompressible chemical active fluid I: uniqueness and existence of the local solutions. Rev. Mat. Apl. 16 (1995), 57-80.
  * [23] M.A. Rojas-Medar, S.A. Lorca, The equations of a viscous incompressible chemical active fluid I: regularity of solutions. Rev. Mat. Apl. 16 (1995), 81-95.
  * [24] J. Serrin, On the interior regularity of weak solutions of the Navier-Stokes equations. Arch. Ration. Mech. Anal. 9 (1962), 187-195.
  * [25] M. Shinbrot, W.P. Kotorynski, The initial value problem for a viscous heat-conduting fluid. J. Math. Anal. Appl. 45 (1974), 1-22.
  * [26] H. Sohr, A regularity class for the Navier Stokes equations in Lorentz spaces. J. Evol. Eq. 1 (2001), 441-467.
  * [27] R. Temam, Navier Stokes Equations, Theory and Numerical Analysis. Rev. Ed. North-Holland, Amsterdam, 1979.
  * [28] W. Von Walh, Regularity questions for the Navier-Stokes equations. In: Approximation Methods for Navier-Stokes Equations. Lecture Notes in Mathematics 771, Rautmann R. (eds), Springer-Verlag (1980), 538-542.


# A Context-Aware Approach for Textual Adversarial Attack through Probability
Difference Guided Beam Search

Huijun Liu, Jie Yu, Shasha Li, Jun Ma, Bin Ji
College of Computer, National University of Defense Technology

###### Abstract

Textual adversarial attacks expose the vulnerabilities of text classifiers and
can be used to improve their robustness. Existing context-aware methods solely
consider the gold label probability and use the greedy search when searching
an attack path, often limiting the attack efficiency. To tackle these issues,
we propose PDBS, a context-aware textual adversarial attack model using
Probability Difference guided Beam Search. The probability difference is an
overall consideration of all class label probabilities, and PDBS uses it to
guide the selection of attack paths. In addition, PDBS uses the beam search to
find a successful attack path, thus avoiding suffering from limited search
space. Extensive experiments and human evaluation demonstrate that PDBS
outperforms previous best models in a series of evaluation metrics, especially
bringing up to a +19.5% attack success rate. Ablation studies and qualitative
analyses further confirm the efficiency of PDBS.

A Context-Aware Approach for Textual Adversarial Attack through Probability
Difference Guided Beam Search

Huijun Liu, Jie Yu, Shasha Li, Jun Ma, Bin Ji College of Computer, National
University of Defense Technology

##  1 Introduction

In this paper, we explore Pre-trained Language Model (PLM) based textual
adversarial attack, and focus on the score-based and non-targeted black-box
setting. Previous work Papernot et al. (2016); Jin et al. (2020) demonstrate
that applying tiny perturbations to texts may fool a text classifier (a.k.a.
target model) while these perturbations are usually human imperceptible,
raising concerns on safety in reality. However, comprehensive research on
textual adversarial attack helps to improve the robustness of target models
Wallace et al. (2019), thus attracting much research attention.

The most recent work introduces various PLMs, e.g., BERT Devlin et al. (2019)
and RoBERTa Liu et al. (2019), into the textual adversarial attack, since PLMs
enable us to generate more contextual and fluent adversarial examples.
Specifically, to generate adversarial examples, BERT-Attack Li et al. (2020)
first finds the vulnerable tokens of the input text sequence through a Replace
action and then uses BERT to generate substitutes for these tokens. BAE Garg
and Ramakrishnan (2020) uses Replace and Insert operations to iteratively mask
vulnerable tokens of the input and then uses BERT to generate substitutes for
the masked tokens. CLARE Li et al. (2021) uses Replace, Insert and Merge
actions to mask tokens of the input text sequence and infills the masked
tokens using substitutes generated by RoBERTa. The score-based black-box
setting assumes class label probabilities of a classifier are accessible. For
example, the three label probabilities for input sequence $\textrm{x}^{(0)}$
are 0.16, 0.64, and 0.20 (see Figure 1). Based on these scores, the above
models formulate the task as a path search problem, and they propose to use
the greedy search by selecting the minimum gold label probability in each
attack iteration, such as the
$\textrm{x}^{(0)}\rightarrow\textrm{x}^{(1,1)}\rightarrow\textrm{x}^{(2,1)}$.
However, we find that in multi-class ($\geq$ 3) classifications, solely
considering the gold probability may be insufficient. For example, the
$\textrm{x}^{(1,2)}$ is intuitively easier to attack successfully than the
$\textrm{x}^{(1,1)}$, since the probability difference of the former (0.09) is
less than the latter (0.22). But the greedy search selects
$\textrm{x}^{(1,1)}$ when only considering the gold label probability.

In addition, we demonstrate that the greedy search limits the search space,
leading to attack failure in some cases. For example, in Figure 1 the greedy
search fails anyway, whether using the gold class probability or the
probability difference. However, there is a successful attack path, namely
$\textrm{x}^{(0)}\rightarrow\textrm{x}^{(1,3)}\rightarrow\textrm{x}^{(2,7)}$.

Figure 1: A textual attack example regarding the triple-class text
classification, where $\\{\textrm{y}_{1},\textrm{y}_{2}$, $\textrm{y}_{3}\\}$
are class labels. For clarity, we assume there are only three perturbations
applied to one text sequence. $\textrm{x}^{(0)}$ is the input text sequence
with gold label $\textrm{y}_{2}$ and Iter. 1 & 2 are two attack iterations.
The values in rectangles are probabilities of related class labels, which are
predicted by the target model. $\textrm{x}^{(i,j)}$ is a candidate example,
where $i$ is the iteration number and $j$ denotes the $j$-$th$ candidate. The
red value around $\textrm{x}^{(i,j)}$ is the probability difference, which is
defined as the gold label ($\textrm{y}_{2}$) probability minus the maximum
probability of the other labels ({$\textrm{y}_{1},\textrm{y}_{3}$}). The blue
path
$\textrm{x}^{(0)}\rightarrow\textrm{x}^{(1,1)}\rightarrow\textrm{x}^{(2,1)}$
is the greedy search path when selecting the minimum gold label probability in
each iteration. The green path
$\textrm{x}^{(0)}\rightarrow\textrm{x}^{(1,2)}\rightarrow\textrm{x}^{(2,4)}$
is the greedy search path when selecting the minimum probability difference in
each iteration. When using the probability difference guided beam search (set
beam size to 2), we obtain a successful attack path – the red path
$\textrm{x}^{(0)}\rightarrow\textrm{x}^{(1,3)}\rightarrow\textrm{x}^{(2,7)}$,
where $\textrm{x}^{(2,7)}$ fools the target model. However, using the gold
label probability to guide the beam search (set size to 2) still leads to
failure.

To tackle the above issues, we propose PDBS, a context-aware approach for
textual adversarial attack through Probability Difference guided Beam Search.
Following CLARE Li et al. (2021), PDBS uses three RoBERTa-based actions to
obtain candidate adversarial examples, but it is different from CLARE in path
search. Specifically, we use the probability difference to guide the path
search, where the probability difference is a trade-off between the
probabilities of the gold label and the other labels. In addition, we propose
to use the beam search for the path search. Compared to the greedy search, the
beam search provides multiple search channels, thus improving the attack
success rate. For example, in Figure 1 using the probability difference guided
beam search enables us to obtain the successful path
$\textrm{x}^{(0)}\rightarrow\textrm{x}^{(1,3)}\rightarrow\textrm{x}^{(2,7)}$.

We conduct experiments on Yelp, AG, MNLI, and QNLI to evaluate PDBS.
Experimental results show that PDBS consistently outperforms previous state-
of-the-art models in terms of A-rate, Mod, Sim, PPL, and overall GErr.
Specifically, PDBS brings up to +19.5% A-rate gains. In addition, the ablation
studies ($\S$5.1) validate the effectiveness of the probability difference and
the beam search.

In sum, we summarize the contributions as follows: (1) we propose the first
textual attack model using probability difference to guide the attack path
search; (2) we are the first to use the beam search in non-targeted textual
adversarial attack; (3) our model achieves new state-of-the-art results across
a set of benchmark datasets.

##  2 Related Work

Textual Adversarial attack has been widely studied. Previous work can be
divided into two types: white-box Papernot et al. (2016); Ebrahimi et al.
(2018); Wallace et al. (2019); Meng and Roger (2020) and black-box. The white-
box work needs structures and parameters of target models, which are
inaccessible in reality. By contrast, the black-box work only requires the
easily accessible class probabilities, thus attracting much research
attention.

###  2.1 Heuristic Rule-based Textual Adversarial Attack under Black-box
Setting

Early text adversarial attack models mainly use heuristic rule-based methods
to generate candidate adversarial examples. Liang et al. Liang et al. (2018)
use three actions to generate examples, but these examples are out of fluency
and lose semantic information. To tackle this, recent work proposes more
effective methods. Alzantot et al. Alzantot et al. (2018) use the genetic
algorithm to find synonyms for word replacement. Ren et al. Ren et al. (2019)
first obtain the word saliency and then greedily replace words with synonyms
derived from WordNet Miller (1995). Zang et al. Zang et al. (2020) use the
particle swarm optimization algorithm to find synonyms having the same sememe
of original words. Jin et al. Jin et al. (2020) first rank words and then
greedily replace them with synonyms obtained by semantically enhanced
embeddings Mrkšić et al. (2016). Although these models achieve good results,
they are context-unware, disabling them from generating contextual and fluent
adversarial examples. By contrast, our model is based on the PLM, enabling us
to avoid the above problems.

###  2.2 PLM-based Textual Adversarial Attack under Black-box Setting

To generate candidate adversarial examples in a context-aware manner, recent
work proposes to use PLMs. Li et al. Li et al. (2020) first use a Replace
operation to find the vulnerable words based on the gold label probability,
then it iteratively replaces the vulnerable words with synonyms generated by
BERT Devlin et al. (2019). Garg and Ramakrishnan Garg and Ramakrishnan (2020)
propose a model similar to Li et al. Li et al. (2020), but they add an Insert
operation when finding vulnerable words. More recently, Li et al. Li et al.
(2021) propose CLARE, which uses a mask-then-infill strategy to obtain
candidate adversarial examples with RoBERTa Liu et al. (2019). The above three
PLM-based models generate much more contextual and fluent adversarial examples
than rule-based models. However, we demonstrate there are two common flaws in
them: (1) they only use the gold label probability to guide the attack path
search, and (2) they use the greedy search, which limits the search space.
Compared to them, our model considers all label probabilities (probability
difference) and uses the beam search while also based on the PLM.

##  3 Approach

###  3.1 Problem Definition

In this paper, we focus on generating context-aware textual adversarial
examples under the black-box and non-targeted settings. Textual adversarial
example generation centers around a text classification model $f(\cdot)$,
referred to as the target model. The black-box setting enables us to access
probability outputs of $f(\cdot)$. We first define a text classification
dataset
$\mathcal{D}=\\{(\textrm{x}^{(1)},\textrm{y}^{(1)}),(\textrm{x}^{(2)},\textrm{y}^{(2)}),…,(\textrm{x}^{(d)},\textrm{y}^{(d)})\\}$
and the class label set $\mathcal{Y}=\\{y_{1},y_{2},…,y_{\ell}\\}$, where
$\textrm{x}^{(i)}$ is a text sequence, $\textrm{y}^{(i)}$ is the gold class
label of $\textrm{x}^{(i)}$ and $\textrm{y}^{(i)}\in\mathcal{Y}$. Given a
text-label pair $(\textrm{x},\textrm{y})\in\mathcal{D}$ (assume
$f(\textrm{x})=\textrm{y}$), an adversarial example $\textrm{x}^{\prime}$ is
supposed to modify x to fool the target model:
$f(\textrm{x}^{\prime})\neq\textrm{y}$ (non-targeted). In addition,
modifications made to $\textrm{x}^{\prime}$ should be minimal, such that
$\textrm{x}^{\prime}$ should be close to x and a human cannot percesive the
modifications Li et al. (2021). We achieve above constraints by restricting
the similarity between $\textrm{x}^{\prime}$ and x, namely
$\textrm{sim}(\textrm{x}^{\prime},\textrm{x})\geq\epsilon$, where
$\textrm{sim}(\cdot,\cdot)$ calculates the similarity and $\epsilon$ is a pre-
set threshold. Following previous work Li et al. (2021); Jin et al. (2020), we
use neural networks as the $\textrm{sim}(\cdot,\cdot)$ to calculate the cosine
similarity of text pairs in the embedding space.

###  3.2 Mask-then-Infill Strategy

Li et al. Li et al. (2021) demonstrate that Pre-trained Language Model (PLM)
helps to produce adversarial examples that are more fluent and closer to the
original text, and they propose CLARE, which contains a Mask-then-Infill
strategy. The strategy consists of three perturbation operations, i.e.,
Replace (R), Insert (I) and Merge (M). For a fair comparison, we also use the
strategy in our model. But we propose a more effective way to select
substitute tokens (see Eq.8) and a more effective scoring function to
calculate action scores (see Eq.9).

Given the text-label pair (x,y) and a position $i$, where
$\textrm{x}=x_{1}x_{2}…x_{n}$ and $1\leq i\leq n$, the above three operations
apply masks at the given position of x using operation-specific methods.

The Replace obtains a masked sequence by replacing the token $x_{i}$ with the
[mask] token.

$\textrm{R}(i,\textrm{[mask]})=x_{1}...x_{i-1}\textrm{[mask]}x_{i+1}...x_{n}$
(1)

The Insert obtains a masked sequence by inserting the [MASK] token between the
token ${x}_{i}$ and ${x}_{i+1}$, increasing the sequence length by 1.

$\textrm{I}(i,\textrm{[mask]})=x_{1}...x_{i}\textrm{[mask]}x_{i+1}...x_{n}$
(2)

The Merge obtains a masked sequence by replacing the bigram ${x}_{i}{x}_{i+1}$
with the [MASK] token, decreasing the sequence length by 1.111For the last
position (i.e., $n$), the operation just replaces the token ${x}_{n}$ with the
[MASK] token.

$\textrm{M}(i,\textrm{[mask]})=x_{1}...x_{i-1}\textrm{[mask]}x_{i+2}...x_{n}$
(3)

A total of $3n$ masked sequences can be obtained for x: 3 sequences for each
position. For clarity, we use $\hat{\textrm{x}}$ to denote any one of the $3n$
sequences.

${\hat{\textrm{x}}\in\\{\textrm{R}(i,\textrm{[mask]}),\textrm{I}(i,\textrm{[mask]}),\textrm{M}(i,\textrm{[mask]})\\}_{i=1}^{n}}$
(4)

The infilling action first use a MLM to generate a substitute token set
$\mathcal{Z}$ for the mask positon in $\hat{\textrm{x}}$, where $\mathcal{Z}$
is the vocabulary list $\mathcal{V}$ of the MLM initially. Then it selects a
$z\in\mathcal{Z}$ to infill the [mask] position in $\hat{\textrm{x}}$.

$\textrm{infill}(\hat{\textrm{x}},\textrm{[mask]},z)=x_{1}…x_{j-1}zx_{j+1}…x_{m}$
(5)

where we assume the [mask] token is at the position $j$ and the length of
$\hat{\textrm{x}}$ is $m$.222The Insert and Merge change sequence lengths, so
we use a variable $m$ to denote the length of the masked sequence
$\hat{\textrm{x}}$. We refer to the $x_{1}…x_{j-1}zx_{j+1}…x_{m}$ as a
candidate adversarial example, which is denoted as $\hat{\textrm{x}}_{z}$ for
clarity.

To obtain high-quality adversarial examples, the infilling action only selects
$z$ when satisfying the following constraints.

  * •

The probability of $z$ predicted by the MLM is larger than a threshold:
$p_{{\textrm{MLM}}}(z|\hat{\textrm{x}})>\alpha$

  * •

The similarity between $\hat{\textrm{x}}_{z}$ and x is larger than a
threshold: $\textrm{sim}(\hat{\textrm{x}}_{z},$x$)>\beta$

We use the $\alpha$ and $\beta$ values reported in CLARE: $\alpha=5e^{-3}$,
$\beta=0.7$. We then obtain the substitute token set $\mathcal{Z}$ as follows.

${\mathcal{Z}=\\{z\in\mathcal{V}\\}\ s.t.\
p_{{\textrm{MLM}}}(z|\hat{\textrm{x}})>\alpha,\textrm{sim}(\hat{\textrm{x}}_{z},\textrm{x})>\beta}$
(6)

Previous work Li et al. (2020); Garg and Ramakrishnan (2020); Li et al. (2021)
selects the $z\in\mathcal{Z}$ that most confuses the $f(\cdot)$ as the final
substitute token for the infilling action, where

$z=\underset{z\in\mathcal{Z}}{\arg\min}\
p_{{f}(\cdot)}(\textrm{y}|\hat{\textrm{x}}_{z})$ (7)

We observe that the above $z$ solely considers the probability of the gold
class label y. However, we demonstrate that for multi-class classification
tasks (# class $\geq$ 3), taking the probabilities of all class labels into
consideration is more effective for generating adversarial examples. Thus we
select the $z\in\mathcal{Z}$ according to the probability difference, which is
calculated by gold label probability minus the maximum probability of the
other class labels.

$z=\underset{z\in\mathcal{Z},\
\textrm{y}^{\prime}\in\mathcal{Y}\setminus\\{\textrm{y}\\}}{\arg\min}\
[p_{{f}(\cdot)}(\textrm{y}|\hat{\textrm{x}}_{z})-p_{{f}(\cdot)}(\textrm{y}^{\prime}|\hat{\textrm{x}}_{z})]$
(8)

where $\mathcal{Y}\setminus\\{\textrm{y}\\}$ denotes removing y from
$\mathcal{Y}$. For binary classifications, Eq.7 and Eq.8 make no difference.

In addition, the Eq.7 uses the greedy search since it solely selects the token
that minimizes the gold label probability, which limits the search space. To
tackle this, we propose to use the beam search. Specifically, we select the
$z$ for $\mathcal{K}$ times and search an attack path through $\mathcal{K}$
channels (see $\S\ref{beam}$), where $\mathcal{K}$ is the beam size. For the
$k\mbox{-}th$ of the $\mathcal{K}$ selections, we set the constraint of Eq.8
to
($z\in\mathcal{Z}\setminus\\{z^{(1)},z^{(2)},...,z^{(k-1)}\\},\textrm{y}^{\prime}\in\mathcal{Y}\setminus\\{\textrm{y}\\}$),
where $\\{z^{(1)},z^{(2)},...,z^{(k-1)}\\}$ is the set of selected tokens.
Finally, we obtain $\mathcal{K}$ infilling actions for the masked sequence
$\hat{\textrm{x}}$, where each action infills the [mask] position with a token
from $\\{z^{(1)},z^{(2)},...,z^{(\mathcal{K})}\\}$. Thus for the text sequence
x which has $3n$ masked sequences, we obtain a total of $(3*n*\mathcal{K})$
actions. For each action, we use the probability difference as its score.

$s_{(\textrm{x,
y})}(a)=\underset{\textrm{y}^{\prime}\in\mathcal{Y}\setminus\\{\textrm{y}\\}}{\min}[p_{f(\cdot)}(\textrm{y}|a(\textrm{x}))-p_{f(\cdot)}(\textrm{y}^{\prime}|a(\textrm{x}))]$
(9)

where $a$ denotes the action. $a(\textrm{x})$ denotes applying $a$ to x,
generating a candidate adversarial example. And the lower the score, the
better the action.

###  3.3  Probability Difference Guided Beam Search

We formulate the textual attacking as a path search problem and use
probability difference to guide the beam search to find an attack path, where
the destination example in the path can fool the target model, as the red path
$\textrm{x}^{(0)}\rightarrow\textrm{x}^{(1,3)}\rightarrow\textrm{x}^{(2,7)}$
in Figure 1 shows.

Algorithm 1 shows the path search procedure using PDBS. We divide the total
$T$ search iterations (Line 6-16) into two cases: the first iteration and the
subsequent iterations. In the first iteration (i.e., $t=1$, Line 8-10), we
start the beam search from the sequence $\textrm{x}^{(0)}$, and first obtain
its top $\mathcal{K}$ best actions according to action scores (Line 9). Then
we sort these actions (Line 17) and sequentially apply them to
$\textrm{x}^{(0)}$ (Line 18-19). Each action generates a candidate adversarial
example (Line 20), and if the example can fool $f(\cdot)$, it attacks
successfully and we return it (Line 21-22). Else we regard the $\mathcal{K}$
examples generated by the $\mathcal{K}$ actions as perturbed text sequences
and pass them to the next iteration.

If we fail to attack in the first iteration, we continue the beam search in
subsequent iterations (i.e., $t\geq 2$, Line 11-16). In the $t$-$th$
iteration, we conduct path search on the $\mathcal{K}$ perturbed text
sequences generated in the $(t-1)$ iteration. For each of the $\mathcal{K}$
sequences, we first obtain its top $\mathcal{K}$ best actions (Line 13). Thus
we can obtain a total of $\mathcal{K}^{2}$ actions. Next, we first sort the
$\mathcal{K}^{2}$ actions (Line 17), and then we select the top $\mathcal{K}$
best actions and sequentially apply them to their texts (Line 18-20). Each
action generates a candidate adversarial example (Line 20), and if the example
can fool $f(\cdot)$, it attacks successfully, and we return it (Line 21-22).
Else we regard the $\mathcal{K}$ examples generated by the $\mathcal{K}$
actions as perturbed text sequences and pass them to the $(t+1)$ iteration.

Algorithm 1 Adversarial Attack by PDBS
---
| 1: Input: text sequence x, gold class label y,
---
target model $f(\cdot)$
2: Output: An adversarial example
3: Initialization: $\textrm{x}^{(0)}\leftarrow\textrm{x}$
4: $\mathcal{K}\leftarrow\ $beam size
5: $T\leftarrow\ $iteration times
6: for $1\leq t\leq T$ do
7: $\mathcal{P}_{2}\leftarrow\varnothing$
8: if $t==1$ do
// start beam search only from $\textrm{x}^{(0)}$
9: $\mathcal{P}_{2}\leftarrow$ GetBestActions($\textrm{x}^{(0)}$)
10: end if
11: if $t\geq 2$ do
// continue beam search with $\mathcal{K}$ sequences
12: for $1\leq k\leq\mathcal{K}$ do
13: $\mathcal{P}^{(k)}\leftarrow$ GetBestActions($\textrm{x}^{(t-1,k)}$)
14: $\mathcal{P}_{2}\leftarrow\mathcal{P}_{2}\cup\mathcal{P}^{(k)}$
15: end for
// $\mathcal{P}_{2}$ contains $\mathcal{K}^{2}$ action-text pairs
16: end if
17: Sort $\mathcal{P}_{2}$ based on action scores ascendingly
18: for $1\leq k\leq\mathcal{K}$ do
// solely select the top $\mathcal{K}$ best pairs from $\mathcal{P}_{2}$
19: ($a$, $\bar{\textrm{x}}$) $\leftarrow$ the $k\mbox{-}th$ best action-text
pair in $\mathcal{P}_{2}$
20: $\textrm{x}^{(t,k)}\leftarrow$ Apply $a$ to $\bar{\textrm{x}}$
21: if $f(\textrm{x}^{(t,k)})\neq\textrm{y}$ then return $\textrm{x}^{(t,k)}$
// attack successfully
22: end if
23: end for
24: end for
25: return None
26: def GetBestActions($\bar{\textrm{x}}$) do
// return the top $\mathcal{K}$ best action-text pairs for $\bar{\textrm{x}}$
27: $\mathcal{P}_{1}\leftarrow\varnothing$
28: $\mathcal{A}\leftarrow$ all infilling actions of $\bar{\textrm{x}}$
// a total of (3*$|\bar{\textrm{x}}|$*$\mathcal{K}$) actions
29: Sort $\mathcal{A}$ based on action scores ascendingly
// the lower the score, the better the action
30: for $1\leq k\leq\mathcal{K}$ do
31: $a\leftarrow$ the $k\mbox{-}th$ action in $\mathcal{A}$
// select the ${k}\mbox{-}th$ best action from $\mathcal{A}$
32: $\mathcal{P}_{1}\leftarrow\mathcal{P}_{1}\cup\\{(a,\bar{\textrm{x}})\\}$
33: end for
34: return $\mathcal{P}_{1}$
35: end def

##  4 Experiment

###  4.1 Datasets and Baselines

Datasets. To evaluate the proposed PDBS, we conduct experiments on the
following benchmark datasets regarding text classification and Natural
Language Inference (NLI).

  * •

Yelp Zhang et al. (2015): a sentiment classification dataset from restaurant
reviews, containing two classes: positive and negative.

  * •

AG Zhang et al. (2015): a dataset classifying news articles to four classes:
world, sports, business, and science/technology.

  * •

MNLI Williams et al. (2018): a triple-class classification dataset regarding
NLI. It is composed of premise-hypothesis pairs. Each pair is labeled with the
relation between the premise and hypothesis. The relation set contains
entailment, contradiction and neutral.

  * •

QNLI Wang et al. (2018): a binary classification dataset regarding NLI. Each
instance is a question-answer pair, and is labeled whether the answer
corresponds to the question.

We summarize more dataset details in Table 1 Li et al. (2021). Following
previous work Jin et al. (2020); Li et al. (2020, 2021), we evaluate our model
on a set of 1,000 examples.333For a fair comaprison, we actually use the exact
1,000 examples used in CLARE for each dataset.
https://github.com/cookielee77/CLARE In addition, to comprehensively evaluate
the PDBS, we conduct experiments on four additional datasets: DBpedia ontology
dataset Zhang et al. (2015), Stanford sentiment treebank Socher et al. (2013),
Microsoft Research Paraphrase Corpus Dolan and Brockett (2005), and Quora
Question Pairs Wang et al. (2018). Limited by space, we report the results of
these additional datasets in Appendix A.

Dataset | # Class | Train | Test | Avg Len | Acc(%)
---|---|---|---|---|---
Yelp | 2 | 560K | 38.0K | 130 | 95.9
AG | 4 | 120K | 7.6K |  46 | 95.0
MNLI | 3 | 392K | 9.8K | 23/11 | 84.3
QNLI | 2 | 105K | 5.4K | 11/31 | 91.4
Table 1: Dataset details. The “Acc(%)” denotes the target model’s accuracy on the original test set without adversarial attack. | Yelp |  | AG
---|---|---|---
Model | A-rate($\%$)$\uparrow$ | Mod($\%$)$\downarrow$ | Sim$\uparrow$ | PPL$\downarrow$ | GErr$\downarrow$ |  | A-rate($\%$)$\uparrow$ | Mod($\%$)$\downarrow$ | Sim$\uparrow$ | PPL$\downarrow$ | GErr$\downarrow$
TextFooler | 77.0 | 16.6 | 0.70 | 163.3 | 1.23 |  | 56.1 | 23.3 | 0.69 | 331.3 | 1.43
+LM | 34.0 | 17.4 | 0.73 | 90.0 | 1.21 |  | 23.1 | 21.9 | 0.74 | 144.6 | 1.07
BERT-Attack | 71.8 | 10.7 | 0.72 | 90.8 | 0.27 |  | 63.4 |  7.9 | 0.71 | 90.6 | 0.25
CLARE | 79.7 | 10.3 | 0.78 | 83.5 | 0.25 |  | 79.1 |  6.1 | 0.76 | 86.0 | 0.17
PDBS | 99.2 |  4.9 | 0.80 | 64.2 | 0.13 |  | 87.7 |  6.0 | 0.78 | 84.7 | 0.07
| MNLI |  | QNLI
Model | A-rate($\%$)$\uparrow$ | Mod($\%$)$\downarrow$ | Sim$\uparrow$ | PPL$\downarrow$ | GErr$\downarrow$ |  | A-rate($\%$)$\uparrow$ | Mod($\%$)$\downarrow$ | Sim$\uparrow$ | PPL$\downarrow$ | GErr$\downarrow$
TextFooler | 59.8 | 13.8 | 0.73 | 161.5 | 0.63 |  | 57.8 | 16.9 | 0.72 | 164.4 | 0.62
+LM | 32.3 | 12.4 | 0.77 | 91.9 | 0.50 |  | 29.2 | 17.3 | 0.75 | 85.0 | 0.42
BERT-Attack | 82.7 |  8.4 | 0.77 | 86.7 | 0.04 |  | 76.7 | 13.3 | 0.73 | 86.5 | 0.03
CLARE | 88.1 |  7.5 | 0.82 | 82.7 | 0.02 |  | 83.8 | 11.8 | 0.78 | 76.7 | 0.01
PDBS | 98.3 |  4.5 | 0.83 | 73.9 | 0.07 |  | 92.6 |  8.3 | 0.79 | 67.1 | 0.07
Table 2: Performance comparisons across the four datasets. We use fine-tuned
BERT models as target models. Bold font values denote the best results for
each metric. $\uparrow$($\downarrow$) indicates the higher (lower) the better.

Baselines. We compare our model with previous state-of-the-art models
regarding black-box textual adversarial attack, including TextFooler Jin et
al. (2020), TextFooler+LM Li et al. (2021), BERT-Attack Li et al. (2020) and
CLARE Li et al. (2021), where the first two are heuristic rule-based and the
last two are PLM-based methods.444Following CLARE, we do not list BAE Garg and
Ramakrishnan (2020) since it has a similar performance as BERTAttack. We
report more details of these baselines in Appendix B.

###  4.2 Implementation Details

Following CLARE, we use a distilled version of RoBERT to infill the masked
tokens. Across all the datasets, we set the iteration times $T$ to 10, the
beam size $\mathcal{K}$ to 10. Moreover, we investigate model performance
against various $T$ values in Appendix C. As for other hyper-parameters, we
use just the same settings to CLARE. Following previous work Li et al. (2020,
2021), we use fine-tuned BERT models as the target models.555For a fair
comparison, we actually use the fine-tuned BERT models used in CLARE.

In addition, we also conduct experiments on two additional target models,
namely Word-LSTM Hochreiter and Schmidhuber (1997) and ESIM Chen et al.
(2017), where the former is specific for text classification, and the latter
is specific for NLI. We report experimental results on the two additional
models in Appendix D.

###  4.3 Automatic Evaluation Metrics

Following CLARE, we use the Attack success rate (A-rate), Modification Rate
(Mod), Textual similarity (Sim), Perplexity (PPL) and Grammar error (GErr) to
comprehensively evaluate the model performance, where the last four are used
to evaluate the quality of adversarial examples. We report more metric details
in Appendix E.

###  4.4 Main Results

We summarize the performance results in Table 2. Obviously, PDBS successfully
triggers classification errors in the target models across the four datasets.

Specifically, PDBS achieves the current state-of-the-art performance in terms
of A-rate, Mod, Sim, and PPL across the four datasets. To be more precise, (1)
PDBS delivers +8.6% to +19.5% A-rate gains compared to the previous best
model, i.e., CLARE. These gains explicitly validate the excellent attack
ability of PDBS. (2) PDBS consistently decreases the Mod scores, especially up
to -5.4% on Yelp, implying that the adversarial examples are more humanly
imperceptible. (3) The consistent optimal Sim scores indicate that our
adversarial examples are closer to the original texts than those generated by
previous models. (4) PDBS decreases the PPL by -9.75 on average, especially
-19.3 on Yelp. These lower PPL scores confirm that our adversarial examples
are more fluent than others.

In addition, PDBS is also superior to the listed baselines in terms of overall
GErr scores (0.085 v.s. 0.113, averaged scores), demonstrating that our
adversarial examples are grammatically correct.

We attribute these exciting performance gains to the fact that (1) the
probability difference takes all class probabilities into consideration and is
more effective than solely using the gold label probability; (2) the beam
search provides more search channels, enabling our model to avoid suffering
from limited search space caused by the greedy search.

We present case studies of adversarial examples in Appendix G.

###  4.5 Human Evaluation

To further evaluate the quality of adversarial examples, we set up human
evaluations on three criteria: similarity (Sim.), fluency & grammaticality
(Flu. & Gra.), and label consistency (Con.). We choose three independent
volunteers who are native English speakers. We randomly select 200 instances
(original text, adversarial example, gold label) from AG and MNLI
respectively, where the adversarial examples can fool our PDBS.

We first ask the volunteers to score (from 0-1) the similarity of original-
adversarial text pairs. And the higher the score, the better the similarity.
Then we evaluate the fluency and grammaticality by asking volunteers to score
(from 1-5) the mixed adversarial examples and original texts. And the higher
the score, the better the fluency and grammaticality. As for label
consistency, we ask volunteers to annotate adversarial examples and compare
their annotations with the gold labels. We finally average the scores marked
by the three volunteers.

Table 3 shows the evaluation results. We can observe that: (1) the Sim. scores
are 0.86 and 0.89, indicating that the adversarial examples maintain the most
semantics of the original texts, which preliminarily proves the validity of
our model. (2) the Flu. & Gra. scores of the adversarial examples are close to
the original ones (3.6 v.s. 4.1 and 3.7 v.s. 3.7), implying that the
adversarial examples have good fluency and satisfy the grammatical rules on
the whole. (3) the Con. scores are 0.77 and 0.84, revealing that the majority
of the adversarial examples are humanly imperceptible.

Dataset | Sim.$\uparrow$ | Flu. & Gra.$\uparrow$ | Con.$\uparrow$
---|---|---|---
AG | Original | 0.86 | 4.1 | 0.77
Adversarial | 3.6
MNLI | Original | 0.89 | 4.0 | 0.84
Adversarial | 3.7
Table 3: Human evaluation results.

In addition, the results on AG are worse than the ones on MNLI. We attribute
it to the fact that the adversarial examples of AG have an overall higher
modification rate than MNLI (6.2% v.s. 4.4%).666Since we solely select a part
of the two datasets, thus the two Mod scores are not the same to the ones in
Table 2.

##  5 Analysis

We first conduct ablation studies on the probability difference and the beam
search ($\S 5.1$). Then we examine the transferability of adversarial examples
($\S 5.2$). At last, we explore using PDBS to improve the robustness of the
target models ($\S 5.3$).

###  5.1 Ablation Study

Ablation on the Probability Difference. We report the ablation results on the
probability difference (P&D) in Table 4. We use the -P&D to denotes ablating
the P&D from PDBS, instead we use the gold label probability to select
substitutes (see Eq. 7, also select $\mathcal{K}$ times) and calculate the
action score.

$s_{(\textrm{x, y})}(a)=p_{f(\cdot)}(\textrm{y}|a(\textrm{x}))$ (10)

The ablation results show that the P&D significantly promotes the A-rate,
delivering +16.3% and +15.6% gains on MNLI and AG respectively, but the four
quality evaluation metrics become worse in current scenario.777Since the
probability difference and the gold label probability make no difference in
binary classifications (see $\S$3.2), we do not conduct ablations on Yelp and
QNLI. 888In both datasets, the A-rate of -P&D is inferior to CLARE, which we
attribute to the fact that -P&D and CLARE use different $T$ values. For a fair
comparison, we conduct more experiments in Appendix F. We attribute the worse
results to the fact that the -P&D generates much fewer adversarial examples,
thus making it unfair for comparison. For a fair comparison, we select a part
of the 1000 test instances of the two datasets, where if the -P&D can attack
an instance successfully, then the instance is selected. Finally, 785 and 672
instances are selected for MNLI and AG, which are referred to as Reduced MNLI
and Reduced AG, respectively. We report extended ablation results on the two
reduced datasets in Table 5. We observe that (1) the two A-rates of PDBS are
also 100%; (2) the P&D consistently benefits PDBS in terms of the four quality
evaluation metrics.

We conclude that using the probability difference is more effective than using
the gold label probability, especially in terms of the A-rate.

MNLI
---
Model | A-rate($\%$)$\uparrow$ | Mod($\%$)$\downarrow$ | Sim$\uparrow$ | PPL$\downarrow$ | GErr$\downarrow$
PDBS | 98.3 | 4.5 | 0.83 | 73.9 | 0.07
-P&D | 82.0 | 3.4 | 0.84 | 71.7 | 0.06
AG
Model | A-rate($\%$)$\uparrow$ | Mod($\%$)$\downarrow$ | Sim$\uparrow$ | PPL$\downarrow$ | GErr$\downarrow$
PDBS | 87.7 | 6.0 | 0.78 | 84.7 | 0.07
-P&D | 72.1 | 4.2 | 0.79 | 79.2 | 0.05
Table 4: Ablation results on probability difference. Reduced MNLI
---
Model | A-rate($\%$)$\uparrow$ | Mod($\%$)$\downarrow$ | Sim$\uparrow$ | PPL$\downarrow$ | GErr$\downarrow$
PDBS | 100.0 | 3.2 | 0.85 | 69.9 | 0.04
-P&D | 100.0 | 3.4 | 0.84 | 71.7 | 0.06
Reduced AG
Model | A-rate($\%$)$\uparrow$ | Mod($\%$)$\downarrow$ | Sim$\uparrow$ | PPL$\downarrow$ | GErr$\downarrow$
PDBS | 100.0 | 4.1 | 0.81 | 73.6 | 0.04
-P&D | 100.0 | 4.2 | 0.79 | 79.2 | 0.05
Table 5: Extended ablation results on probability difference. Figure 2:
Ablation results on the beam search.

Ablation on the Beam Search. We report the ablation results on the beam search
in Figure 4. To be specific, we set the beam size $\mathcal{K}$ from 1 to 10.
When $\mathcal{K}$=1, the beam search is the greedy search. We observe that
(1) when the $\mathcal{K}$ increases, the A-rate generally increases across
the four datasets; (2) compared to the greedy search ($\mathcal{K}$=1), the
beam search ($\mathcal{K}$>1) consistently brings A-rate gains. For example,
the beam search with $\mathcal{K}$=10 brings up to +17.62% A-rate scores on
AG. We attribute these to the fact that the beam search provides more search
channels, thus improving the performance.

Additionally, we report the performance of the four quality evaluation metrics
in Table 6. We observe that the $\mathcal{K}$ value poses tiny effects on the
four metrics, revealing that a bigger $\mathcal{K}$ value can bring a better
A-rate score while ensuring the high-quality of the adversarial examples.

Limited by hardware capacity, we cannot run experiments with a bigger
$\mathcal{K}$ due to GPU out of memory with 24GB of GPU memory. We believe
that it is possible to obtain a better A-rate with a bigger $\mathcal{K}$,
especially on MNLI and AG.

| Mod($\%$) | Sim | PPL | GErr
---|---|---|---|---
Yelp | 5.22$\pm$0.17 | 0.80$\pm$0.001 | 64.5$\pm$0.3 | 0.133$\pm$0.002
AG | 5.94$\pm$0.08 | 0.79$\pm$0.004 | 84.7$\pm$0.2 | 0.078$\pm$0.006
MNLI | 4.50$\pm$0.11 | 0.83$\pm$0.004 | 74.1$\pm$0.2 | 0.070$\pm$0.003
QNLI | 8.28$\pm$0.03 | 0.79$\pm$0.001 | 66.8$\pm$0.3 | 0.078$\pm$0.007
Table 6: Ablation results on the beam search when the $\mathcal{K}$ varing
from 1 to 10. We report the averaged value of each metric, as well as its
change intervals.

###  5.2 Transferability and Adversarial Training

Transferability. The transferability is measured by if the adversarial
examples generated with one target model can fool other target models directly
Kurakin et al. (2016). For this purpose, we first collect the adversarial
examples generated for Yelp and MNLI and then use other target models to
predict their classes. Following previous work Li et al. (2020), we select the
Word-LSTM and ESIM as new target models for Yelp and MNLI, respectively. We
report the results in Table 7, from with we can see that there is a noticeable
degree of transferability between models, and the transferability is higher in
Yelp than in MNLI, which is consistent with the conclusion in Jin et al.
(2020).

Dataset | Model | BERT | Word-LSTM
---|---|---|---
Yelp | BERT |  0.0 | 52.5
Word-LSTM | 56.7 |  0.0
Dataset | Model | BERT | ESIM
MNLI | BERT |  0.0 | 65.1
ESIM | 72.6 |  0.0
Table 7: Transferability results. Row $i$ and column $j$ is the accuracy of
adversarial examples generated for model $i$ evaluated on model $j$. The lower
the score, the better the transferability.

Adversarial Training. We investigate if the adversarial examples can be used
to improve the robustness of target models. For this purpose, we conduct a
preliminary experiment on adversarial training by feeding the models both the
original texts and the adversarial examples, where adversarial examples share
the same labels as their original texts.

We collect the adversarial examples curated from the training sets of AG and
MNLI and add them to the original training sets. We then use the mixed sets to
fine-tune BERT from scratch and attack this adversarially fine-tuned model.
The results in Table 8 show that the A-rate and Mod after adversarial re-
training become worse, indicating the greater difficulty of attacking. This
reveals one of the potencies of our attack system: we can enhance the
robustness of a model to future attacks by training it with the generated
adversarial examples.

|  | Acc($\%$)$\uparrow$ | A-rate($\%$)$\downarrow$ | Mod($\%$)$\uparrow$
---|---|---|---|---
AG | Original | 95.0 | 85.7 | 6.0
+Adv.Training | 94.8(-0.2) | 66.1(-19.6) | 12.4(+6.4)
MNLI | Original | 84.3 | 98.3 | 4.5
+Adv.Training | 84.0(-0.3) | 80.8(-17.5) | 10.2(+5.7)
Table 8: Comparisons of original fine-tuning (“Original”) and adversarial
fine-tuning (“+ Adv. Training”) BERT models on AG and MNLI.

##  6 Conclusion

In this work, we present PDBS, a PLM-based text adversarial attack model. PDBS
uses probability difference to guide the beam search when seeking a successful
attack path. Experimental results demonstrate that PDBS delivers +8.6% to
+19.5% attack access rate, and is consistently superior to previous models in
four quality evaluation metrics, indicating that the PDBS owns both efficient
attack ability and the ability to generate high-quality adversarial examples.
Qualitative analyses further show significant advantages of PDBS.

## References

  * Alzantot et al. (2018) Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, and Kai-Wei Chang. 2018.  Generating natural language adversarial examples.  In _Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing_.
  * Cer et al. (2018) Daniel Cer, Yinfei Yang, Sheng-yi Kong, Nan Hua, Nicole Limtiaco, Rhomni St John, Noah Constant, Mario Guajardo-Cespedes, Steve Yuan, Chris Tar, et al. 2018\.  Universal sentence encoder.  _arXiv preprint arXiv:1803.11175_.
  * Chen et al. (2017) Qian Chen, Xiaodan Zhu, Zhen-Hua Ling, Si Wei, Hui Jiang, and Diana Inkpen. 2017\.  Enhanced lstm for natural language inference.  In _Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics_.
  * Devlin et al. (2019) Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019.  Bert: Pre-training of deep bidirectional transformers for language understanding.  In _Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies_.
  * Dolan and Brockett (2005) Bill Dolan and Chris Brockett. 2005.  Automatically constructing a corpus of sentential paraphrases.  In _Third International Workshop on Paraphrasing (IWP2005)_.
  * Ebrahimi et al. (2018) Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018.  Hotflip: White-box adversarial examples for text classification.  In _Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics_.
  * Garg and Ramakrishnan (2020) Siddhant Garg and Goutham Ramakrishnan. 2020.  Bae: Bert-based adversarial examples for text classification.  In _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)_.
  * Hochreiter and Schmidhuber (1997) Sepp Hochreiter and Jürgen Schmidhuber. 1997.  Long short-term memory.  _Neural computation_.
  * Jin et al. (2020) Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2020.  Is bert really robust? a strong baseline for natural language attack on text classification and entailment.  In _Proceedings of the AAAI conference on artificial intelligence_.
  * Kurakin et al. (2016) Alexey Kurakin, Ian Goodfellow, Samy Bengio, et al. 2016.  Adversarial examples in the physical world.
  * Li et al. (2021) Dianqi Li, Yizhe Zhang, Hao Peng, Liqun Chen, Chris Brockett, Ming-Ting Sun, and William B Dolan. 2021.  Contextualized perturbation for textual adversarial attack.  In _Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies_.
  * Li et al. (2020) Linyang Li, Ruotian Ma, Qipeng Guo, Xiangyang Xue, and Xipeng Qiu. 2020.  Bert-attack: Adversarial attack against bert using bert.  In _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)_.
  * Liang et al. (2018) Bin Liang, Hongcheng Li, Miaoqiang Su, Pan Bian, Xirong Li, and Wenchang Shi. 2018\.  Deep text classification can be fooled.  In _Proceedings of the 27th International Joint Conference on Artificial Intelligence_.
  * Liu et al. (2019) Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. 2019.  Roberta: A robustly optimized bert pretraining approach.  _arXiv preprint arXiv:1907.11692_.
  * Meng and Roger (2020) Zhao Meng and Wattenhofer Roger. 2020.  A geometry-inspired attack for generating natural language adversarial examples.  In _Proceedings of the 28th International Conference on Computational Linguistics_.
  * Miller (1995) George A Miller. 1995.  Wordnet: a lexical database for english.  _Communications of the ACM_.
  * Mrkšić et al. (2016) Nikola Mrkšić, Diarmuid O Séaghdha, Blaise Thomson, Milica Gašić, Lina Rojas-Barahona, Pei-Hao Su, David Vandyke, Tsung-Hsien Wen, and Steve Young. 2016.  Counter-fitting word vectors to linguistic constraints.  _arXiv preprint arXiv:1603.00892_.
  * Naber et al. (2018) Daniel Naber et al. 2018.  A rule-based style and grammar checker.  _Citeseer_.
  * Papernot et al. (2016) Nicolas Papernot, Patrick McDaniel, Ananthram Swami, and Richard Harang. 2016.  Crafting adversarial input sequences for recurrent neural networks.  In _MILCOM 2016-2016 IEEE Military Communications Conference_. IEEE.
  * Radford et al. (2019) Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. 2019.  Language models are unsupervised multitask learners.  _OpenAI blog_.
  * Ren et al. (2019) Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. 2019.  Generating natural language adversarial examples through probability weighted word saliency.  In _Proceedings of the 57th annual meeting of the association for computational linguistics_.
  * Socher et al. (2013) Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Y Ng, and Christopher Potts. 2013.  Recursive deep models for semantic compositionality over a sentiment treebank.  In _Proceedings of the 2013 conference on empirical methods in natural language processing_.
  * Wallace et al. (2019) Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. 2019.  Universal adversarial triggers for attacking and analyzing nlp.  In _Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP)_.
  * Wang et al. (2018) Alex Wang, Amanpreet Singh, Julian Michael, Felix Hill, Omer Levy, and Samuel R Bowman. 2018.  Glue: A multi-task benchmark and analysis platform for natural language understanding.  In _Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing (EMNLP)_.
  * Williams et al. (2018) Adina Williams, Nikita Nangia, and Samuel Bowman. 2018.  A broad-coverage challenge corpus for sentence understanding through inference.  In _Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies_.
  * Zang et al. (2020) Yuan Zang, Fanchao Qi, Chenghao Yang, Zhiyuan Liu, Meng Zhang, Qun Liu, and Maosong Sun. 2020.  Word-level textual adversarial attacking as combinatorial optimization.  In _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_.
  * Zhang et al. (2015) Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015.  Character-level convolutional networks for text classification.  _Advances in neural information processing systems_.

##  Appendix A Appendix Results on Different Datasets

We include the results of DBpedia ontology dataset (DBpedia), Stanford
sentiment treebank (SST-2), Microsoft Research Paraphrase Corpus (MRPC), and
Quora Question Pairs (QQP) in this section. And the fine-tuned BERTs are the
target models. Table 9 summarizes some dataset details. And Table 10 shows the
results of these datasets. Compared with all baselines, PDBS achieves overall
best performance, and it is consistent with our observation in $\S$4.4.

Dataset | #Classes | Train | Test | Avg Len | Acc(%)
---|---|---|---|---|---
DBpedia | 14 | 560K | 70K | 55 | 99.3
SST-2 | 2 | 67K | 0.9K | 10 | 92.3
MRPC | 2 | 3.6K | 1.7K | 23/23 | 81.4
QQP | 2 | 363K | 40K | 13/13 | 91.4
Table 9: Dataset details. The “Acc(%)”denotes the target model’s accuracy on the original test set without adversarial attack. | DBpedia |  | SST-2
---|---|---|---
Model | A-rate($\%$)$\uparrow$ | Mod($\%$)$\downarrow$ | Sim$\uparrow$ | PPL$\downarrow$ | GErr$\downarrow$ |  | A-rate($\%$)$\uparrow$ | Mod($\%$)$\downarrow$ | Sim$\uparrow$ | PPL$\downarrow$ | GErr$\downarrow$
TextFooler | 56.2 | 24.9 | 0.68 | 182.5 | 1.88 |  | 89.8 | 14.9 | 0.69 | 227.7 | 0.53
+LM | 20.1 | 22.4 | 0.70 | 84.0 | 1.22 |  | 51.7 | 18.3 | 0.69 | 137.5 | 0.50
BERT-Attack | 60.7 | 9.1 | 0.69 | 57.8 | 0.20 |  | 87.8 | 8.1 | 0.67 | 142.9 | 0.03
CLARE | 65.8 | 7.0 | 0.73 | 53.3 | -0.03 |  | 97.8 | 7.5 | 0.75 | 137.4 | 0.01
PDBS | 89.4 | 5.8 | 0.80 | 50.2 | 0.01 |  | 98.6 | 5.4 | 0.78 | 125.6 | 0.04
| MRPC |  | QQP
Model | A-rate($\%$)$\uparrow$ | Mod($\%$)$\downarrow$ | Sim$\uparrow$ | PPL$\downarrow$ | GErr$\downarrow$ |  | A-rate($\%$)$\uparrow$ | Mod($\%$)$\downarrow$ | Sim$\uparrow$ | PPL$\downarrow$ | GErr$\downarrow$
TextFooler | 24.5 | 10.6 | 0.75 | 118.8 | 0.35 |  | 16.2 | 12.7 | 0.74 | 145.2 | 0.61
+LM | 12.9 | 9.5 | 0.79 | 71.0 | 0.29 |  | 7.8 | 12.9 | 0.77 | 78.8 | 0.21
BERT-Attack | 29.7 | 13.5 | 0.79 | 74.6 | 0.05 |  | 24.2 | 11.3 | 0.71 | 78.0 | 0.25
CLARE | 34.8 | 9.1 | 0.83 | 69.5 | 0.02 |  | 27.7 | 10.2 | 0.76 | 74.8 | 0.14
PDBS | 42.7 | 7.6 | 0.85 | 66.7 | 0.01 |  | 39.2 | 8.9 | 0.79 | 70.2 | 0.06
Table 10: Performance comparisons across other four datasets. We use fine-
tuned BERT models as target models. Bold font values denote the best results
for each metric. $\uparrow$($\downarrow$) indicates the higher (lower) the
better. Word-LSTM
---
| Yelp |  | AG
Model | A-rate($\%$)$\uparrow$ | Mod($\%$)$\downarrow$ | Sim$\uparrow$ | PPL$\downarrow$ | GErr$\downarrow$ |  | A-rate($\%$)$\uparrow$ | Mod($\%$)$\downarrow$ | Sim$\uparrow$ | PPL$\downarrow$ | GErr$\downarrow$
TextFooler | 97.8 | 10.6 | 0.79 | 143.4 | 1.17 |  | 95.8 | 18.6 | 0.63 | 196.8 | 1.35
BERT-Attack | 98.8 | 4.7 | 0.81 | 87.3 | 0.25 |  | 97.2 | 11.7 | 0.67 | 97.5 | 0.38
CLARE | 99.1 | 4.5 | 0.83 | 82.7 | 0.21 |  | 97.7 | 10.5 | 0.72 | 89.1 | 0.23
PDBS | 99.7 | 3.6 | 0.84 | 65.3 | 0.15 |  | 98.7 | 9.1 | 0.76 | 80.2 | 0.09
ESIM
| MNLI |  | QNLI
Model | A-rate($\%$)$\uparrow$ | Mod($\%$)$\downarrow$ | Sim$\uparrow$ | PPL$\downarrow$ | GErr$\downarrow$ |  | A-rate($\%$)$\uparrow$ | Mod($\%$)$\downarrow$ | Sim$\uparrow$ | PPL$\downarrow$ | GErr$\downarrow$
TextFooler | 90.1 | 14.5 | 0.59 | 182.4 | 0.79 |  | 88.0 | 18.4 | 0.67 | 182.6 | 0.74
BERT-Attack | 87.6 | 19.9 | 0.57 | 107.8 | 0.14 |  | 89.6 | 15.7 | 0.70 | 89.9 | 0.09
CLARE | 90.5 | 12.4 | 0.63 | 80.3 | 0.05 |  | 91.9 | 10.3 | 0.79 | 80.1 | 0.07
PDBS | 97.4 | 9.8 | 0.65 | 74.3 | 0.05 |  | 95.9 | 8.9 | 0.81 | 67.9 | 0.08
Table 11: Performance comparisons of attacking the two target models of Word-
LSTM and ESIM and their corresponding two datasets. Word-LSTM corresponds to
Yelp and AG datasets for text classification tasks, and ESIM corresponds to
MNLI and QNLI datasets for natural language inference tasks. Bold font values
denote the best results for each metric. $\uparrow$($\downarrow$) indicates
the higher (lower) the better. MNLI
---
Model | A-rate($\%$)$\uparrow$ | Mod($\%$)$\downarrow$ | Sim$\uparrow$ | PPL$\downarrow$ | GErr$\downarrow$
CLARE | 88.1 | 7.5 | 0.82 | 82.7 | 0.02
PDBS | 98.9 | 4.8 | 0.82 | 77.6 | 0.08
-P&D | 93.2 | 4.6 | 0.84 | 74.9 | 0.07
AG
Model | A-rate($\%$)$\uparrow$ | Mod($\%$)$\downarrow$ | Sim$\uparrow$ | PPL$\downarrow$ | GErr$\downarrow$
CLARE | 79.1 | 6.1 | 0.76 | 86.0 | 0.17
PDBS | 93.5 | 9.2 | 0.75 | 87.1 | 0.09
-P&D | 88.1 | 7.8 | 0.76 | 85.5 | 0.08
Table 12: Ablation results on probability difference when $T$=20.

##  Appendix B Baselines Details

We compare our model with recent state-of-the-art word-level black-box
adversarial models, which from heuristic rule-based and PLM-based two aspects,
including:

Heuristic Rule-based Adversarial Attack.

  * •

TextFooler: a state-of-the-art heuristic rule-based model proposed by Jin et
al. (2020). It rank tokens and replaces tokens with their synonyms by using
counter-fitting word embeddings Mrkšić et al. (2016) in a greedy way.

  * •

TextFooler+LM: an improved variant model of TextFooler, which is implemented
by Li et al. (2021). It builds on the token replacement of TextFooler, and
adds a small size GPT-2 language model to filter out candidate tokens that do
not fit in the context by calculated perplexity.

PLM-based Adversarial Attack. We refer to models that generate candidates
using a pertrained language model (PLM) as PLM-based models.

  * •

BERT-Attack: one of the earliest PLM-based models proposed by Li et al.
(2020). It ranks tokens and replaces tokens with their synonyms by using
BERTDevlin et al. (2019) in a greedy way. In addition, BAEGarg and
Ramakrishnan (2020) is one of the earliest PLM-based models, but we do not
include it since it has a similar performance to BERTAttack.

  * •

CLARE: a state-of-the-art PLM-based model by Li et al. (2021). It masks tokens
and greedily infill masked tokens generated from a distill version of RoBERTa
Liu et al. (2019).

##  Appendix C Details of the Performance of PDBS when Maximum Number of
Iteration Times Changes

We analyze the performance of PDBS when the maximum number of iteration times
$T$ changes. As shown in Figure 3 and 4, as the maximum number of iterations
increases, the A-rate increases, but the quality of the generated adversarial
examples decreases, as indicated by the rise in Mod, PPL, and GErr, as well as
the drop in textual similarity. Note that the larger the values of A-rate and
Sim, the better, and the smaller the values of Mod, PPL, and GErr, the better.
To make a trade-off A-rate and the quality of adversarial examples, we select
a uniform maximum number of iteration times $T$ = 10 for each dataset.

##  Appendix D Results on Different Target Models

To demonstrate that PDBS is also applicable to other target models, not
limited to fine-tuned BERTs, we conduct experiments on two other target
models, namely Word-LSTM and ESIM, where Word-LSTM is used for text
classification tasks and ESIM is used for natural language inference tasks. As
seen in Table 11, PDBS is feasible for a wide range of target models. Similar
to $\S$4.4, PDBS outperforms previous best models, which can successfully
trigger errors in Word-LSTM and ESIM with fewer modifications and higher
quality adversarial examples. Note that the results of TextFooler+LM are not
listed because this section is not open in CLARE source code that proposes
TextFooler+LM. The findings for TextFooler+LM are listed in the other sections
since we directly take the results from the CLARE paper’s relevant section.

##  Appendix E Automatic Evaluation Metrics Details

We evaluate the performance of attack models including their attack success
rate and the quality of adversarial examples.

Attack Success Rate (A-rate). The percentage of adversarial examples which can
trigger errors in the target model. It is the core metric to measure the
success of the attacking method.

Adversarial Example Quality. To evaluate the quality of the adversarial
examples, we list four following evaluation metrics:

  * •

Modification Rate (Mod): the percentage of the modified tokens to the text
length. Following to Li et al. (2021), each Replace and Insert operation
represents one modified token; the Merge action is regarded to have modified
one token if one of the two merged tokens is preserved, else it is considered
to have modified two.

  * •

Textual Similarity (Sim): the semantic consistency between the adversarial
example and the original text sequence. Following Jin et al. (2020); Li et al.
(2021), we use universal sentence encoder Cer et al. (2018) to calculate the
cosine semantic similarity.

  * •

Perplexity (PPL): the metric to measure the fluency of the adversarial
examples Zang et al. (2020). Following Li et al. (2021), we calculate
perplexity by using a small size of GPT-2 with a 50K-sized vocabulary Radford
et al. (2019).

  * •

Grammar Error (GErr): the metric calculated by the increase rate of
grammatical error numbers of adversarial examples with the help of
LanguageTool Naber et al. (2018).999https://www.languagetool.org/

##  Appendix F Ablation Study on Probability Difference when $T$=20

In MNLI and AG datasets, the attack success rate of -P&D does not outperform
CLARE, and we attribute the fact that -P&D and CLARE employ different $T$
values which have a significant impact on the attack success rate
(experimentally demonstrated in Appendix C), where $T$=10 in -P&D and $T$=20
in CLARE. However, some input sequences in –P&D may require a $T$ value
greater than 10 and less than 20 in order to be successfully attacked. In
order to verify our idea, as well as for a fair comparison, we set $T$ in PDBS
to 20 and conducted an ablation study on the probability difference. As Table
12 shows, P&D significantly promotes the A-rate, and using probability
difference is more effective than using the gold label probability, which is
consistent with our observation in 5.1. Additionally, it is demonstrated that
the reason why –P&D does not outperform CLARE in $\S$5.1 is that CLARE and
–P&D adopt different $T$ values.

##  Appendix G Case Study

We display some adversarial examples generated by CLARE and PDBS on Yelp, AG,
MNLI and QNLI datasets in Table 13, 14, 15, and 16 respectively.

Figure 3: Performance of attack success rate (A-rate) on different datasets
with different maximum number of iteration times $T$. The x-coordinate is on a
log-2 scale. The larger the A-rate value, the better.  Figure 4: Performance
of adervsarial example quality, that is, modification rate (Mod), textual
similarity (Sim), perplexity (PPL), and grammar error (GErr) on different
datasets with the different maximum number of iteration times $T$. The
x-coordinate is on a log-2 scale. The larger the Sim, the better, and the
smaller the Mod, PPL, and GErr, the better.

Yelp Example 1
---
Original Input (Prediction = Positive)
This hotel is really nice, but it’s mostly for the over 40 crowd. The
restaurants are great, though. I stayed for 4 nights and could not have been
happier with the room accommodations or the friendliness of the staff.
However, if you don’t take Centrum and you want to go balls out Vegas crazy I
recommend the Hard Rock.
CLARE (Prediction = Negative)
This hotel is really nice, but it’s mostly for the over rated 40 crowd. The
restaurants are great, though. I stayed for 4 nights flatand could not have
been happier with the room accommodations or appreciate the friendliness of
the staff. However, but if you don ’t take Centrum and you want to go balls
out Vegas crazy I recommend the Hard Rock.
PDBS (Prediction = Negative)
This hotel is really being nice, but it’s mostly for the over 40 crowd. The
restaurants are great, though. I stayed for 4 nights and could not have been
happier with the room accommodations or the friendliness of the staff.
However, if you don’t take Centrum and you want to go balls out Vegas crazy I
recommend the Hard Rock.
Yelp Example 2
Original Input (Prediction = Positive)
Their food is always excellent, no matter what I’ve ordered (though I must say
I love the Salmon salad with jalapeno dressing and the butternut squash
ravioli with truffle oil). The firepit is relaxing. The music is fun. The
service is sketchy … touch and go. Don’t go if you’ve got a timeline.
CLARE (Prediction = Negative)
Their food is always excellent, no matter what I’ve ordered (though I must say
I love the Salmon salad with jalapeno dressing and the burnt squash ravioli
with truffle oil). The firepit is relaxing. The music is fun. The service is
sketchy … Stay and not go. Don’t go if you’ve established a timeline.
PDBS (Prediction = Negative)
Their food styling is always excellent, no matter what I’ve ordered (though I
must say I love the Salmon salad with
jalapeno dressing and the butternut squash ravioli with truffle oil). The
firepit is relaxing. The music is fun. The service
is sketchy … touch and go. Don’t go if you’ve got a timeline.

Table 13: Adversarial examples generated by CLARE and PDBS on Yelp dataset.
Replace, Insert and Merge are highlighted in red, yellow and blue.

AG Example 1
---
Original Input (Prediction = Science&Technology)
ANOTHER VOICE Sugary drinks bad for you. Many studies have linked the
consumption of nondiet soda and fruit juices with added sugars to obesity and
attendant risks of diabetes.
CLARE (Prediction = World)
ANOTHER VOICE Sugary drinks bad for you. Many European studies have linked the
consumption of nondiet soda and fruit juices with added sugars to obesity and
attendant risks of diabetes.
PDBS (Prediction = World)
RELATED VOICE Sugary drinks bad for you. Many studies have linked the
consumption of nondiet soda and fruit juices with added sugars to obesity and
attendant risks of diabetes.
AG Example 2
Original Input (Prediction = Business)
Federated sales decline in August. A slow August snapped an eight-month
winning streak for Federated Department Stores Inc., which reported its first
drop in sales since November.
CLARE (Prediction = Science&Technology)
Federated sales decline in August. A slow August snapped an eight-month
winning streak for Federated Department Apple Stores Inc., which reported its
first drop in sales since November.
PDBS (Prediction = Science&Technology)
Federated’s sales decline in August. A slow August snapped an eight-month
winning streak for Federated Department Stores Inc., which reported its first
drop in online sales since November.

Table 14: Adversarial examples generated by CLARE and PDBS on AG dataset.
Replace, Insert and Merge are highlighted in red, yellow and blue.

MNLI Example 1
---
Original Input (Prediction = Contradiction)
|  Premise: But I still don’t see how he managed to prove his alibi, and yet
go to the chemist’s shop? Poirot stared at me in surprise.
---
Hypothesis: It’s hard to see how he managed to prove his story is true.
CLARE (Prediction = Neutral)
|  Premise: But I absolutely don’t see how he managed to prove his alibi, and
instead purposefully wandered to the chemist’s shop? Poirot stared hard at me
in surprise gaze.
---
Hypothesis: It’s hard to see how he managed to prove his story is true.
PDBS (Prediction = Neutral)
|  Premise: But I still don’t see how hard he managed to prove his alibi, and
yet proceeded to the chemist’s shop? Poirot stared at me in surprise.
---
Hypothesis: It’s hard to see how he managed to prove his story is true.
MNLI Example 2
Original Input (Prediction = Contradiction)
|  Premise: And then i had well you know i’d eat like at lunch at work we’d
have a TV or whatever and then um as my kids got older and started you know
recognizing what was going on and i thought this isn’t really very good.
---
Hypothesis: I’d watch TV at work during lunch, and as my children got older
and started understanding the shows, I realized
that it is not good content for them to be viewing.
CLARE (Prediction = Neutral)
|  Premise: And then i had well you know i’d eat like at lunch at work we’d
have a TV or whatever and then … as my kids got older and started you know
about what was going on and i thought don’t … very good.
---
Hypothesis: I’d watch TV at work during lunch, and as my children got older
and started understanding the shows, I realized
that it is not good content for them to be viewing.
PDBS (Prediction = Neutral)
|  Premise: And then i had well you know i’d eat like at lunch at work we’d
have a TV or whatever and then um as my kids
---
got older and started you know … what was going on and i thought this isn’t
really very good.
Hypothesis: I’d watch TV at work during lunch, and as my children got older
and started understanding the shows, I realized
that it is not good content for them to be viewing.

Table 15: Adversarial examples generated by CLARE and PDBS on MNLI dataset.
Replace, Insert and Merge are highlighted in red, yellow and blue.

QNLI Example 1
---
Original Input (Prediction = Not-Entailment)
|  Premise: Where can the public view the Royal Collection?
---
Hypothesis: Unlike the palace and the castle, the purpose-built gallery is
open continually and displays a changing selection of items from the
collection.
CLARE (Prediction = Entailment)
|  Premise: Where can the public view the Royal Collection?
---
Hypothesis: Unlike the palace and the castle, the visitor-built gallery is
open continually touring and boasting a changing selection of items from the
collection.
PDBS (Prediction = Entailment)
|  Premise: Where can the public view the Royal Collection?
---
Hypothesis: Unlike the palace grounds and the castle, the purpose-built
visitor gallery is open continually and displays a changing selection of items
from the collection.
QNLI Example 2
Original Input (Prediction = Entailment)
|  Premise: Europe has a large market for what?
---
Hypothesis: When Germany could no longer afford war payments, Wall Street
invested heavily in European debts to keep the European economy afloat as a
large consumer market for American mass-produced goods.
CLARE (Prediction = Not-Entailment)
|  Premise: Europe has a large market for what?
---
Hypothesis: When Germany could no longer afford war payments, Wall Street
invested heavily in European debts to keep an economy afloat as a large
consumer base market for American mass-produced goods.
PDBS (Prediction = Not-Entailment)
|  Premise: Europe has a large market for what?
---
Hypothesis: When Germany could no longer afford war payments, Wall Street
invested heavily in European debts to keep the European economy afloat as a
large dumping market for American mass-produced goods.

Table 16: Adversarial examples generated by CLARE and PDBS on QNLI dataset.
Replace, Insert and Merge are highlighted in red, yellow and blue.