Security token

White box

Computer security

Classifier (UML)

Computer science

Pattern recognition (psychology)

Mathematics

Artificial intelligence

Geometry

Word (group theory)

Machine learning

Adversarial system

We propose an efficient method to generate white-box adversarial examples to trick a character-level neural classifier. We find that only a few manipulations are needed to greatly decrease the accuracy. Our method relies on an atomic flip operation, which swaps one token for another, based on the gradients of the one-hot input vectors. Due to efficiency of our method, we can perform adversarial training which makes the model more robust to attacks at test time. With the use of a few semantics-preserving constraints, we demonstrate that HotFlip can be adapted to attack a word-level classifier as well.

HotFlip: White-Box Adversarial Examples for Text Classification