Vulnerability of Natural Language Classifiers to Evolutionary Generated Adversarial Text

As deep learning models become increasingly central to automated text analysis and sentiment-based decision-making, their vulnerability to adversarial inputs—small, often imperceptible changes to text that cause misclassification—poses significant risks. This paper investigates whether a genetic algorithm (GA) can effectively generate these adversarial examples in a black-box setting, where the internal structure of the target model is unknown, and how such an approach compares to existing state-of-the-art techniques.

The authors propose GAversary, a hybrid genetic algorithm designed to evolve adversarial text. Unlike previous GA-based attacks that rely on random mutations, GAversary uses GloVe word embeddings to identify contextually plausible replacements. By masking a target word and analyzing its surrounding context, the algorithm selects replacements that are both semantically similar and highly effective at shifting the model's output logit toward a misclassification. The system treats the target model as a black box, requiring only the output logit values to guide the evolutionary search.

GAversary demonstrates superior performance in reducing the accuracy of benchmark natural language models compared to existing methods like BAE and A2T. In the best-case scenario, the authors report a reduction in model accuracy from 76.8% to 5.8%, whereas the BAE method only reduced accuracy to 27.6%. This suggests that the GA-based search, when guided by contextual embeddings, is highly effective at finding adversarial perturbations that evade standard classifiers.

This research highlights the persistent vulnerability of NLP models to adversarial attacks, even when the attacker has no knowledge of the model's internal architecture. By demonstrating that a relatively efficient, black-box evolutionary approach can cause substantial drops in classification accuracy, the study underscores the need for more robust training procedures and defensive mechanisms in NLP applications where reliability and reputation are at stake.