Hard-label adversarial attack with dual-granularity optimization on texts

The advancement of artificial intelligence security research has led to the emergence of adversarial attack technology as a critical approach for identifying potential security vulnerabilities in artificial intelligence models. When targeting natural language processing models, conducting adversarial attacks in the hard-label setting presents a more practical and challenging black-box scenario due to the difficulty in computing gradients directly from discrete word sequences. Current textual adversarial attack methods are inefficient due to the lack of consideration for the limited number of queries available during the adversarial text generation process, creating a disparity between these approaches and real-world adversarial attack scenarios. To this end, this work proposes a dual-granularity optimization strategy that consists of a single-word semantic optimization and a multi-word joint semantic optimization procedure, and presents a query-efficient hard-label attack method called DualAttack by incorporating the proposed dual-granularity optimization strategy into the mutation and crossover process of the Genetic Algorithm framework. Extensive experimental results demonstrate that DualAttack can effectively produce high-quality adversarial texts with superior semantic similarity and minimal perturbation rates within fewer queries compared to existing methods in the hard-label setting. • This work proposes a dual-granularity optimization strategy, and presents an effective and efficient word-level adversarial attack method named DualAttack, which produces high-quality adversarial texts with a minimal number of queries in challenging hard-label black-box attack scenarios. • This work proposes a single-word semantic optimization method, which first utilizes the locality sensitive hashing to choose several noised texts with various semantic scores, and then employs multiple agents to calculate both the semantic and adversarial weights of these noised texts to identify better substitutions for individual words. • This work proposes a multi-word joint semantic optimization method, which first employs two agents to obtain the gradients by calculating the semantic scores of two noised texts plus random perturbations, and then combines the gradients following the Adam method to decide more appropriate substitutions for multiple words simultaneously. • This work verifies the effectiveness of DualAttack through extensive experiments, and demonstrates that DualAttack is capable of producing adversarial texts with high imperceptibility and quality through fewer queries compared to existing state-of-the-art attack methods.