Character-level White-Box Adversarial Attacks against Transformers via Attachable Subwords Substitution

Understand

We propose the first character-level white-box adversarial attack method against transformer models.

• The intuition of our method comes from the observation that words are split into subtokens before being fed into the transformer models and the substitution between two close subtokens has a similar effect to the character modification.
• Our method mainly contains three steps.
• First, a gradient-based method is adopted to find the most vulnerable words in the sentence.