An imperceptible attack on machine translation system and the countermeasure
摘要
Currently, neural machine translation plays an important role in cross-language communication and cooperation. Since it is very vulnerable to small perturbations in input text, it must face various injection attacks. Different from image data, text data are discrete, which makes it difficult to create imperceptible perturbation in text. In order to keep the similarity of the original input and the adversarial sample, similar words replacement-based heuristic strategy is often used by attackers to create perturbations in input text to manipulate the results of machine translation. It usually needs high overhead but is unable to achieve optimal attack performance. Imperceptible characters such as invisible characters and homoglyphs have very good concealment and deception to human eyes, using them to design adversarial samples against neural machine translation is a good option. Unfortunately, there are rare researchers paying attention to such attacks against neural machine translation. To defend against them, four types of special characters (zero-width space character (ZWSP), homoglyphs, reordering control characters, deletion control characters) that have the greatest influence on the translation result and the basic principle of character encoding and semantic understanding in the machine translation are systematically analyzed. And inspired by the feature filtering advantages of the LSTM’s gating mechanism in processing sequence data, the LSTM is employed to deal with imperceptible character in machine translation. Based on these, a machine translation model integrated with LSTM and Transformer is constructed. The experimental results show that LSTM can effectively identify and process illegal invisible characters, and the proposed LSTM + Transformer translation model can perform much better than the Transformer translation model in dealing with the imperceptible characters injection.