{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,11]],"date-time":"2025-12-11T09:14:39Z","timestamp":1765444479983,"version":"3.37.3"},"reference-count":48,"publisher":"Springer Science and Business Media LLC","issue":"11","license":[{"start":{"date-parts":[[2022,10,20]],"date-time":"2022-10-20T00:00:00Z","timestamp":1666224000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2022,10,20]],"date-time":"2022-10-20T00:00:00Z","timestamp":1666224000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100001775","name":"University of Technology Sydney","doi-asserted-by":"crossref","id":[{"id":"10.13039\/501100001775","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Mach Learn"],"published-print":{"date-parts":[[2022,11]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Deep-learning based natural language processing (NLP) models are proven vulnerable to adversarial attacks. However, there is currently insufficient research that studies attacks to neural machine translations (NMTs) and examines the robustness of deep-learning based NMTs. In this paper, we aim to fill this critical research gap. When generating word-level adversarial examples in NLP attacks, there is a conventional trade-off in existing methods between the attacking performance and the amount of perturbations. Although some literature has studied such a trade-off and successfully generated adversarial examples with a reasonable amount of perturbations, it is still challenging to generate highly successful translation attacks while concealing the changes to the texts. To this end, we propose a novel Hybrid Attentive Attack method to locate language-specific and sequence-focused words, and make semantic-aware substitutions to attack NMTs. We evaluate the effectiveness of our attack strategy by attacking three high-performing translation models. The experimental results show that our method achieves the highest attacking performance compared with other existing attacking strategies.<\/jats:p>","DOI":"10.1007\/s10994-022-06249-x","type":"journal-article","created":{"date-parts":[[2022,10,20]],"date-time":"2022-10-20T22:15:42Z","timestamp":1666304142000},"page":"3977-4002","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":4,"title":["Attacking neural machine translations via hybrid attention learning"],"prefix":"10.1007","volume":"111","author":[{"given":"Mingze","family":"Ni","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ce","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Tianqing","family":"Zhu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Shui","family":"Yu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3003-1313","authenticated-orcid":false,"given":"Wei","family":"Liu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2022,10,20]]},"reference":[{"key":"6249_CR1","doi-asserted-by":"crossref","unstructured":"Alzantot, M., Sharma, Y., Elgohary, A., Ho, B.-J., Srivastava, M., & Chang, K.-W. (2018). Generating natural language adversarial examples. In Proceedings of the 2018 conference on EMNLP.","DOI":"10.18653\/v1\/D18-1316"},{"key":"6249_CR2","unstructured":"Belinkov, Y., & Bisk, Y. (2017).Synthetic and natural noise both break neural machine translation. In International conference on learning representations (ICLR)."},{"key":"6249_CR3","unstructured":"Berant, J., Chou, A. K., Frostig, R., & Liang, P. (2013). Semantic parsing on freebase from question-answer pairs. In Emnlp."},{"key":"6249_CR4","doi-asserted-by":"crossref","unstructured":"Cheng, M., Yi, J., Chen, P.-Y., Zhang, H., & Hsieh, C.-J. (2020). Seq2sick: Evaluating the robustness of sequence-to-sequence models with adversarial examples. In Proceedings of the aaai conference on artificial intelligence(Vol.34, pp. 3601\u20133608).","DOI":"10.1609\/aaai.v34i04.5767"},{"key":"6249_CR5","doi-asserted-by":"crossref","unstructured":"Cheng, Y., Jiang, L., & Macherey, W.(2019). Robust neural machine translation with doubly adversarial inputs. In Proceedings of the 57th annual meeting of the association for computational linguistics pp. 4324\u20134333.","DOI":"10.18653\/v1\/P19-1425"},{"key":"6249_CR6","doi-asserted-by":"crossref","unstructured":"Chivukula, A, S., & Liu, W.(2017). Adversarial learning games with deep learning models. In 2017 international joint conference on neural networks (ijcnn) pp. 2758\u20132767.","DOI":"10.1109\/IJCNN.2017.7966196"},{"key":"6249_CR7","first-page":"1066","volume":"316","author":"AS Chivukula","year":"2018","unstructured":"Chivukula, A. S., & Liu, W. (2018). Adversarial deep learning models with multiple adversaries. IEEE Transactions on Knowledge and Data Engineering, 316, 1066\u20131079.","journal-title":"IEEE Transactions on Knowledge and Data Engineering"},{"key":"6249_CR8","unstructured":"Devlin, J., Chang, M.-W., Lee, K., & Toutanova, K. (2019). Bert: pre-training of deep bidirectional transformers for language understanding. In Naacl."},{"key":"6249_CR9","unstructured":"Dzmitry\u00a0Bahdanau, K. C., & Bengio, Y. (2015). Neural machine translation by jointly learning to align and translate. arXiv:1409.0473"},{"key":"6249_CR10","unstructured":"Ebrahimi, J., Lowd, D., & Dou, D. (2018). On adversarial examples for character-level neural machine translation. InProceedings of the 27th international conference on computational linguistics(pp. 653\u2013663)."},{"key":"6249_CR11","doi-asserted-by":"crossref","unstructured":"Gao, J., Lanchantin, J., Soffa, M., & Qi, Y. (2018). Black-box generation of adversarial text sequences to evade deep learning classifiers. 2018 IEEE Security and Privacy Workshops (SPW),50\u201356.","DOI":"10.1109\/SPW.2018.00016"},{"key":"6249_CR12","unstructured":"Goodfellow, I., Shlens, J., & Szegedy, C.(2015). Explaining and harnessing adversarial examples. CoRR, arXiv:1412.6572"},{"key":"6249_CR13","doi-asserted-by":"crossref","unstructured":"Hu, D. (2019). An introductory survey on attention mechanisms in nlp problems. In Proceedings of sai intelligent systems conference pp. 432\u2013448.","DOI":"10.1007\/978-3-030-29513-4_31"},{"key":"6249_CR14","unstructured":"Ilyas, A., Santurkar, S., Tsipras, D., Engstrom, L., Tran, B., & Madry, A.(2019). Adversarial examples are not bugs, they are features. In Neurips."},{"key":"6249_CR15","doi-asserted-by":"crossref","unstructured":"Junczys-Dowmunt, M., Grundkiewicz, R., Dwojak, T., Hoang, H., Heafield, K., Neckermann, T., Seide, F., Germann, U., Aji, A.F., Bogoychev, N., Martins, A.F., Birch, A. (2018). Marian: Fast neural machine translation in C++. In Proceedings of acl 2018, system demonstrations(pp. 116\u2013121). Melbourne, Australia.","DOI":"10.18653\/v1\/P18-4020"},{"key":"6249_CR16","unstructured":"Kalchbrenner, N., & Blunsom, P. (2013).Recurrent continuous translation models. In Proceedings of the 2013 conference on empirical methods in natural language processing(pp. 1700\u20131709). Seattle, Washington, USA."},{"key":"6249_CR17","unstructured":"Lan, Z., Chen, M., Goodman, S., Gimpel, K., Sharma, P., & Soricut, R. (2020). Albert: A lite bert for self-supervised learning of language representations. arXiv:1909.11942"},{"key":"6249_CR18","doi-asserted-by":"crossref","unstructured":"Li, L., Ma, R., Guo, Q., Xue, X., & Qiu, X.(2020). Bert-attack: Adversarial attack against bert using bert. In Proceedings of the 2020 conference on empirical methods in natural language processing (emnlp) pp. 6193\u20136202.","DOI":"10.18653\/v1\/2020.emnlp-main.500"},{"key":"6249_CR19","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2020.106618","volume":"212","author":"Z Li","year":"2021","unstructured":"Li, Z., Wang, X., Li, J., & Zhang, Q. (2021). Deep attributed network representation learning of complex coupling and interaction. Knowledge-Based Systems, 212, 106618.","journal-title":"Knowledge-Based Systems"},{"key":"6249_CR20","doi-asserted-by":"crossref","unstructured":"Liang, B., Li, H., Su, M., Bian, P., Li, X., & Shi, W. (2017). Deep text classification can be fooled. arXiv preprintarXiv:1704.08006.","DOI":"10.24963\/ijcai.2018\/585"},{"key":"6249_CR21","unstructured":"Liu, Y., Ott, M., Goyal, N., Du, J., Joshi, M., Chen, D., Levy O, Lewis M, Zettlemoyer, L., Stoyanov, V. (2019). Roberta: A robustly optimized bert pretraining approach. arXiv:1907.11692."},{"key":"6249_CR22","unstructured":"Luong, M., Brevdo, E., & Zhao, R. (2017). Neural machine translation (seq2seq) tutorial. https:\/\/github.com\/tensorflow\/nmt."},{"key":"6249_CR23","doi-asserted-by":"crossref","unstructured":"Luong, T., Pham, H., & Manning, C. D. (2015). Effective approaches to attention-based neural machine translation. In Emnlp.","DOI":"10.18653\/v1\/D15-1166"},{"key":"6249_CR24","doi-asserted-by":"crossref","unstructured":"Michel, P., Li, X., Neubig, G., & Pino, J. (2019). On evaluation of adversarial perturbations for sequence-to-sequence models. In Proceedings of the 2019 conference of the north american chapter of the association for computational linguistics: Human language technologies, volume 1.","DOI":"10.18653\/v1\/N19-1314"},{"key":"6249_CR25","unstructured":"Miller, G. A. (1998). Wordnet: An electronic lexical database. MIT press."},{"key":"6249_CR26","doi-asserted-by":"crossref","unstructured":"Papernot, N., Mcdaniel, P., Swami, A., & Harang, R. E. (2016). Crafting adversarial input sequences for recurrent neural networks. MILCOM 2016: 2016 IEEE Military Communications Conference 49\u201354.","DOI":"10.1109\/MILCOM.2016.7795300"},{"key":"6249_CR27","doi-asserted-by":"crossref","unstructured":"Pennington, J., Socher, R., & Manning, C. D. (2014). Glove: Global vectors for word representation. In Proceedings of the 2014 conference on empirical methods in natural language processing (emnlp) pp. 1532\u20131543.","DOI":"10.3115\/v1\/D14-1162"},{"key":"6249_CR28","doi-asserted-by":"crossref","unstructured":"Rajpurkar, P., Jia, R., & Liang, P. (2018). Know what you don\u2019t know: Unanswerable questions for squad. In Proceedings of the 56th annual meeting of the association for computational linguistics (volume 2: Short papers) pp. 784\u2013789.","DOI":"10.18653\/v1\/P18-2124"},{"key":"6249_CR29","doi-asserted-by":"crossref","unstructured":"Rajpurkar, P., Zhang, J., Lopyrev, K., & Liang, P. (2016). Squad: 100,000+ questions for machine comprehension of text. In Proceedings of the 2016 conference on empirical methods in natural language processing pp. 2383\u20132392.","DOI":"10.18653\/v1\/D16-1264"},{"key":"6249_CR30","doi-asserted-by":"publisher","unstructured":"Riza, H., Purwoadi, M., Gunarso, Uliniansyah, T., Ti, A. A., Aljunied, S. M., Mai, L.C., Thang, V.T., Thai, N.P., Chea, V., Sam, S., Seng, S., Ding, C. (2016). Introduction of the asian language treebank. In 2016 conference of the oriental chapter of international committee for coordination and standardization of speech databases and assessment techniques (o-cocosda)(p. 1-6). https:\/\/doi.org\/10.1109\/ICSDA.2016.7918974","DOI":"10.1109\/ICSDA.2016.7918974"},{"key":"6249_CR31","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2022.108274","volume":"241","author":"X Song","year":"2022","unstructured":"Song, X., Li, J., Lei, Q., Zhao, W., Chen, Y., & Mian, A. (2022). Bi-clkt: Bi-graph contrastive learning based knowledge tracing. Knowledge-Based Systems, 241, 108274.","journal-title":"Knowledge-Based Systems"},{"key":"6249_CR32","doi-asserted-by":"publisher","first-page":"510","DOI":"10.1016\/j.ins.2021.08.100","volume":"580","author":"X Song","year":"2021","unstructured":"Song, X., Li, J., Tang, Y., Zhao, T., Chen, Y., & Guan, Z. (2021). Jkt: A joint graph convolutional network based deep knowledge tracing. Information Sciences, 580, 510\u2013523.","journal-title":"Information Sciences"},{"key":"6249_CR33","doi-asserted-by":"crossref","unstructured":"Tan, S., Joty, S., Kan, M.-Y., & Socher, R. (2020). It\u2019s morphin\u2019time! combating linguistic discrimination with inflectional perturbations. In Proceedings of the 58th annual meeting of the association for computational linguistics pp. 2920\u20132935.","DOI":"10.18653\/v1\/2020.acl-main.263"},{"key":"6249_CR34","unstructured":"Tang, Y., Tran, C., Li, X., Chen, P.-J., Goyal, N., Chaudhary, V., Gu, V., Fan, A. (2020). Multilingual translation with extensible multilingual pretraining and finetuning."},{"key":"6249_CR35","unstructured":"Tiedemann, J.(2012). Parallel data, tools and interfaces in opus. In Lrec."},{"key":"6249_CR36","unstructured":"Tiedemann, J.(2020). The Tatoeba Translation Challenge: Realistic data sets for low resource and multilingual MT. In Proceedings of the fifth conference on machine translation(pp. 1174\u20131182). Association for Computational Linguistics."},{"key":"6249_CR37","doi-asserted-by":"crossref","unstructured":"Toutanova, K., Klein, D., Manning, C. D., & Singer, Y. (2003). Feature-rich part-of-speech tagging with a cyclic dependency network. In Proceedings of the 2003 human language technology conference of the north american chapter of the association for computational linguistics pp. 252\u2013259.","DOI":"10.3115\/1073445.1073478"},{"key":"6249_CR38","unstructured":"Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, L., Polosukhin, I. (2017). Attention is all you need Attention is all you need. In Advances in neural information processing systems pp. 5998\u20136008."},{"key":"6249_CR39","doi-asserted-by":"crossref","unstructured":"Wang, A., Singh, A., Michael, J., Hill, F., Levy, O., & Bowman, S. (2018). Glue: A multi-task benchmark and analysis platform for natural language understanding. In Proceedings of the 2018 emnlp workshop blackboxnlp: Analyzing and interpreting neural networks for nlp pp. 353\u2013355.","DOI":"10.18653\/v1\/W18-5446"},{"key":"6249_CR40","doi-asserted-by":"crossref","unstructured":"Wang, J., Xu, C., Guzm\u00e1n, F., El-Kishky, A., Tang, Y., Rubinstein, B., & Cohn, T. (2021). A targeted attack on neural machine translation using monolingual data poisoning. In Findings of the association for computational linguistics: Acl-ijcnlp 2021 pp. 1463\u20131473.","DOI":"10.18653\/v1\/2021.findings-acl.127"},{"key":"6249_CR41","doi-asserted-by":"crossref","unstructured":"Xu, C., Wang, J., Tang, Y., Guzm\u00e1n, F., Rubinstein, B. I., & Cohn, T. (2021). A targeted attack on black-box neural machine translation with parallel data poisoning. In Proceedings of the web conference 2021 pp. 3638\u20133650.","DOI":"10.1145\/3442381.3450034"},{"key":"6249_CR42","doi-asserted-by":"publisher","first-page":"212","DOI":"10.1016\/j.neucom.2021.03.138","volume":"472","author":"G Xue","year":"2022","unstructured":"Xue, G., Zhong, M., Li, J., Chen, J., Zhai, C., & Kong, R. (2022). Dynamic network embedding survey. Neurocomputing, 472, 212\u2013223.","journal-title":"Neurocomputing"},{"key":"6249_CR43","doi-asserted-by":"crossref","unstructured":"Yang, X., Liu, W., Bailey, J., Tao, D., & Liu, W. (2021). Bigram and unigram based text attack via adaptive monotonic heuristic search. In Proceedings of the aaai conference on artificial intelligence (Vol. 35, pp. 706\u2013714).","DOI":"10.1609\/aaai.v35i1.16151"},{"key":"6249_CR44","first-page":"4980","volume":"86","author":"X Yang","year":"2020","unstructured":"Yang, X., Liu, W., Zhang, S., Liu, W., & Tao, D. (2020). Targeted attention attack on deep learning models in road sign recognition. IEEE Internet of Things Journal, 86, 4980\u20134990.","journal-title":"IEEE Internet of Things Journal"},{"key":"6249_CR45","doi-asserted-by":"crossref","unstructured":"Yang, Y., Cer, D., Ahmad, A., Guo, M., Law, J., Constant, N., Abrego, G.H., Yuan, S., Tar, C., Sung, Y.H., Strope, B. (2019). Multilingual universal sentence encoder for semantic retrieval. arXiv preprintarXiv:1907.04307.","DOI":"10.18653\/v1\/2020.acl-demos.12"},{"key":"6249_CR46","doi-asserted-by":"publisher","first-page":"1164","DOI":"10.1109\/TKDE.2018.2790928","volume":"306","author":"Z Yin","year":"2018","unstructured":"Yin, Z., Wang, F., Liu, W., & Chawla, S. (2018). Sparse feature attacks in adversarial learning. IEEE Transactions on Knowledge and Data Engineering, 306, 1164\u20131177.","journal-title":"IEEE Transactions on Knowledge and Data Engineering"},{"key":"6249_CR47","doi-asserted-by":"crossref","unstructured":"Zang, Y., Qi, F., Yang, C., Liu, Z., Zhang, M., Liu, Q., & Sun, M. (2020). Word-level textual adversarial attacking as combinatorial optimization. In Proceedings of the 58th annual meeting of the association for computational linguistics pp. 6066\u20136080.","DOI":"10.18653\/v1\/2020.acl-main.540"},{"key":"6249_CR48","doi-asserted-by":"crossref","unstructured":"Zellers, R., Bisk, Y., Schwartz, R., & Choi, Y. (2018). Swag: A large-scale adversarial dataset for grounded commonsense inference. In Emnlp.","DOI":"10.18653\/v1\/D18-1009"}],"container-title":["Machine Learning"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10994-022-06249-x.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10994-022-06249-x\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10994-022-06249-x.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,11,23]],"date-time":"2022-11-23T19:16:59Z","timestamp":1669231019000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10994-022-06249-x"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,10,20]]},"references-count":48,"journal-issue":{"issue":"11","published-print":{"date-parts":[[2022,11]]}},"alternative-id":["6249"],"URL":"https:\/\/doi.org\/10.1007\/s10994-022-06249-x","relation":{},"ISSN":["0885-6125","1573-0565"],"issn-type":[{"type":"print","value":"0885-6125"},{"type":"electronic","value":"1573-0565"}],"subject":[],"published":{"date-parts":[[2022,10,20]]},"assertion":[{"value":"6 April 2022","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"28 July 2022","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"13 September 2022","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"20 October 2022","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"Not applicable.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"Not applicable.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethics approval"}},{"value":"The authors give their consent to participate.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent to participate"}},{"value":"The authors give their consent to the publication of all information in this paper.","order":5,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent for publication"}},{"value":"All codes from our experiments are available at","order":6,"name":"Ethics","group":{"name":"EthicsHeading","label":"Code availability"}}]}}