Single Word Change Is All You Need: Using LLMs to Create Synthetic Training Examples for Text Classifiers

Abstract

In text classification, creating an adversarial example means subtly perturbing a few words in a sentence without changing itsmeaning, causing it to be misclassified by a classifier. A concerning observation is that a significant portion of adversarial exam-ples generated by existing methods change only one word. This single-word perturbation vulnerability represents a significantweakness in classifiers, which malicious users can exploit to efficiently create a multitude of adversarial examples. This paperstudies this problem and makes the following key contributions: (1) We introduce a novel metric 𝜌 to quantitatively assess a clas-sifier's robustness against single-word perturbation. (2) We present the SP-Attack, designed to exploit the single-word perturbationvulnerability, achieving a higher attack success rate, better preserving sentence meaning, while reducing computation costscompared to state-of-the-art adversarial methods. (3) We propose SP-Defence, which aims to improve 𝜌 by applying data augmen-tation in learning. Experimental results on 4 datasets and 2 masked language models show that SP-Defence improves 𝜌 by 14.6%and 13.9% and decreases the attack success rate of SP-Attack by 30.4% and 21.2% on two classifiers respectively, and decreasesthe attack success rate of existing attack methods that involve multiple-word perturbation.