VertAttack: Taking advantage of Text Classifiers' horizontal vision
Jonathan Rusert
Text classification systems have continuously improved in performance over
the years. However, nearly all current SOTA classifiers have a similar
shortcoming, they process text in a horizontal manner. Vertically written words
will not be recognized by a classifier. In contrast, humans are easily able to
recognize and read words written both horizontally and vertically. Hence, a
human adversary could write problematic words vertically and the meaning would
still be preserved to other humans. We simulate such an attack, VertAttack.
VertAttack identifies which words a classifier is reliant on and then rewrites
those words vertically. We find that VertAttack is able to greatly drop the
accuracy of 4 different transformer models on 5 datasets. For example, on the
SST2 dataset, VertAttack is able to drop RoBERTa's accuracy from 94 to 13%.
Furthermore, since VertAttack does not replace the word, meaning is easily
preserved. We verify this via a human study and find that crowdworkers are able
to correctly label 77% perturbed texts perturbed, compared to 81% of the
original texts. We believe VertAttack offers a look into how humans might
circumvent classifiers in the future and thus inspire a look into more robust
algorithms.