KEM-Attack: knowledge-enhanced metaheuristic framework for hard-label textual adversarial attacks

Hard-label black-box adversarial attacks on text classification models present significant challenges due to both the discrete, non-differentiable nature of text data and the lack of direct access to model predictions. Existing methods remain limited in efficiency and effectiveness—often becoming trapped in local optima or requiring excessive queries—which hinders the generation of high-quality adversarial examples with preserved semantic coherence under query constraints. To address these limitations, this study proposes KEM-Attack: a knowledge-enhanced metaheuristic framework that efficiently generates adversarial examples through synergistic integration of linguistic knowledge and metaheuristic optimization. KEM-Attack pioneers a two-stage methodology: first, constructing a knowledge-enhanced substitution space using WordNet’s taxonomic relationships and HowNet’s fine-grained sememe representations; second, introducing the first adaptation of Grey Wolf Optimization (GWO) to textual adversarial attacks, which is augmented with hierarchical position updating and adaptive mutation strategies. Extensive experiments show that KEM-Attack outperforms advanced baseline methods in terms of attack success rates, semantic similarity, and perturbation rates, while also improving query efficiency. The proposed approach demonstrates how integrating linguistic knowledge with metaheuristic optimization can significantly enhance adversarial attack performance, providing a deeper understanding of neural model vulnerabilities in natural language processing (NLP).