Human-in-the-Loop Generation of Adversarial Texts: A Case Study on Tibetan Script

arXiv:2412.12478 · cs.CL, cs.CR, cs.HC · Submitted 2024-12-17 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: Today's paper: "Human-in-the-Loop Generation of Adversarial Texts".

Jane: The gist The authors introduce HITL-GAT, an interactive system for human-in-the-loop generation of adversarial texts,

Tom: First, who's behind it and why it matters.

Paper summary: Tom: Okay, so to recap this paper on "Human-in-the-Loop Generation of Adversarial Texts: A Case Study on Tibetan Script," it's addressing three specific hurdles. First, how do you generate adversarial texts for these lower-resourced languages, which is tough because of linguistic differences and limited data.

Jane: And second, how do you construct benchmarks that are actually high quality? They point out that automated attacks often produce invalid or ambiguous texts, and around ninety percent of the time they either change the original meaning or make it hard for human annotators to agree.

Lu: That’s a big problem because if the generated adversarial examples aren't good, then your benchmark won't be reliable for testing robustness. They also highlight a third problem: language models keep changing and can become immune to parts of the adversarial texts you already generated, so we need a way to update those benchmarks constantly.

Meng: So the system they propose is HITL-GAT, which is this interactive system that lets researchers cycle through constructing victim models, generating examples, building benchmarks with human input, and then evaluating robustness.

Lalam: It seems like the whole point is that by bringing humans into that loop for quality control at specific stages, you can create a more reliable and evolving benchmark.

Tom: And they prove this concept using a case study on Tibetan script. They fine-tuned models like Tibetan-BERT and CINO series on datasets such as TNCC-title and TU SA to get their victim models.

Jane: Then they ran specific attacks, including TSAttacker, TSTricker, and TSCheater, to generate those first-round adversarial texts. The result is this benchmark called AdvTS Evaluation which they use to test models like the CINO series.

Lu: And the robustness values they got for those models on that benchmark were zero point five six zero nine, zero point five five seven two, and zero point five seven two six respectively. Those numbers give a concrete idea of how robust these specific models are on this newly constructed data set for Tibetan script.

Meng: So it shows that the human-in-the-loop approach can actually produce a usable benchmark even in this challenging, lower-resourced context.

Lalam: It really emphasizes that for languages where resources are scarce, you need more than just automated generation; you need careful human guidance to make sure the adversarial examples are actually meaningful.

Conclusion: Tom: Looking at the "Human-in-the-Loop Generation of Adversarial Texts: A Case Study on Tibetan Script," what we see is a system, HITL-GAT, that allows for the continuous evolution of adversarial robustness benchmarks. It moves beyond just generating one set and stopping.

Jane: The authors are showing us that this iterative loop—where new models, datasets, or attack methods pop up—allows the benchmark to keep moving forward alongside those changes. They aren't just making a static test; they are building a living evaluation system.

Lu: It suggests that for languages that have fewer resources, you need this kind of adaptive methodology built into your evaluation pipeline from the start, instead of treating it as an afterthought.

Meng: From an engineering standpoint, it means the infrastructure needs to support this feedback loop seamlessly so researchers can keep feeding new information back in without getting stuck on a single set of results.

Lalam: It gives me a feeling that this approach could really help improve how we understand and secure models for smaller languages, making the security research more relevant to a wider variety of NLP applications.

Tom: So, the authors are giving us a framework that lets researchers stay ahead of the curve in adversarial robustness testing for less-resourced languages by building benchmarks that can keep growing with the technology.

Institute of National Security, Minzu University of China · School of Information Science and Technology, Xizang University · National Language Resource Monitoring & Research Center | Minority Languages Branch, Beijing, China · The State Key Laboratory of Tibetan Intelligence, Lhasa, China

cs.CL, cs.CR, cs.HC

Submitted: 2024-12-17

Updated: 2025-11-15

Comments: Camera-Ready Version; Accepted at IJCNLP-AACL 2025 Demo

Journal ref: Proceedings of The 14th International Joint Conference on Natural Language Processing and The 4th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics: System Demonstrations (IJCNLP-AACL 2025 Demo)

DOI: 10.18653/v1/2025.ijcnlp-demo.2

Code: https://github.com/CMLI-NLP/HITL-GAT

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Importance score: 79/100

The gist: The gist The authors introduce HITL-GAT, an interactive system for human-in-the-loop generation of adversarial texts, which enables the construction and updating of high-quality adversarial

Key concepts

HITL-GAT: An interactive system designed to create adversarial texts by involving humans in the generation process. It operates in a loop where models are built, attacks are generated, benchmarks are created with human input, and robustness is evaluated. This allows for continuous improvement of the benchmark.
Victim Models: Language models that are fine-tuned on specific downstream datasets. In this research, models like Tibetan-BERT and CINO series were used as the 'victims' to see how they respond to adversarial attacks, making them the target for robustness testing.
Adversarial Robustness Benchmark: A high-quality collection of texts used to rigorously test how well a language model resists malicious adversarial attacks. This benchmark is constructed by screening automatically generated texts and then having human annotators score their relevance and similarity, ensuring the benchmark is practical and reliable.
Filter Conditions: Metrics used to automatically screen initial adversarial text generations before human review. These conditions include Edit Distance, Cosine Similarity, BERTScore, and Normalized Cross-Correlation Coefficient to quickly filter out invalid or low-quality adversarial examples.

Terminology

Benchmark — 75× in this paper · explained in 2 episodes
Robustness — 72× in this paper · explained in 5 episodes
Adversarial Robustness — 59× in this paper · explained in 3 episodes
Adversarial Robustness Benchmark — 34× in this paper · explained in 1 episode
Human-in-the-Loop — 16× in this paper · explained in 3 episodes
Adversarial Attacks — 11× in this paper · explained in 1 episode
Adversarial Examples — 10× in this paper · explained in 2 episodes
Semantic Similarity — 7× in this paper · explained in 2 episodes
Fine-Tuning — 6× in this paper · explained in 5 episodes
Accuracy — 3× in this paper · explained in 1 episode
Papers — 3× in this paper · explained in 3 episodes
Transformer — 3× in this paper · explained in 2 episodes
Adaptability — 2× in this paper · explained in 1 episode
Data Augmentation — 2× in this paper · explained in 7 episodes
Embeddings — 2× in this paper · explained in 2 episodes
Explainability — 2× in this paper · explained in 4 episodes
Minzu University of China — 2× in this paper
Adversarial Training — 1× in this paper · explained in 1 episode
Cosine Similarity — 1× in this paper · explained in 3 episodes
Downstream Tasks — 1× in this paper · explained in 2 episodes
Graphical User Interface — 1× in this paper
Hyperparameters — 1× in this paper · explained in 2 episodes

Summary

The gist The authors introduce HITL-GAT, an interactive system for human-in-the-loop generation of adversarial texts, which enables the construction and updating of high-quality adversarial robustness benchmarks through an iterative loop involving victim model construction, adversarial example generation, benchmark construction, and evaluation.

Problem Statement

The research addresses three primary challenges in constructing robust benchmarks for lower-resourced languages:

How do we generate adversarial texts for lower-resourced languages? This is complicated due to linguistic differences and limited resources
How do we construct high-quality adversarial robustness benchmarks? Previous methods are prone to generating invalid or ambiguous texts, with around 90% either changing the original semantics or hindering the annotators’ unanimity
How do we update adversarial robustness benchmarks? Language models continuously evolve and may be immune to parts of previously generated adversarial texts, necessitating a sustainable evaluation paradigm

HITL-GAT Workflow

HITL-GAT is an interactive system based on a general approach to human-in-the-loop generation of adversarial texts The workflow involves four stages in one pipeline

Construct Victim Models: This stage aims at constructing victim language models via a fine-tuning paradigm
Generate Adversarial Examples: This stage aims at automatically generating the first-round adversarial texts with the help of various textual adversarial attack methods
Construct High-Quality Benchmarks: This stage aims at constructing a high-quality adversarial robustness benchmark by customizing filter conditions and conducting human annotation
Evaluate Adversarial Robustness: This stage aims at quantitatively and thoroughly evaluating the adversarial robustness of new language models using the constructed high-quality adversarial robustness benchmark

Benchmark Construction Details

The construction of a high-quality benchmark relies heavily on human input to ensure practicality and relevance To reduce the cost of human annotation, first-round adversarial texts must be screened automatically using appropriate filter conditions Filter conditions can include metrics like Edit Distance, Normalized Cross-Correlation Coefficient (from the perspective of visual similarity), Cosine Similarity, and BERTScore (from the perspective of semantic similarity) Human annotation requires annotators to score human acceptance based on visual and semantic similarity between original texts and adversarial texts, from 1 to 5 An adversarial text is included in the benchmark if all annotators score its human acceptance as 4 or 5

Case Study on Tibetan Script

The paper demonstrates HITL-GAT through a case study on Tibetan script The process involves fine-tuning models like Tibetan-BERT and CINO series on downstream datasets such as TNCC-title and TU SA to construct victim models Adversarial attacks such as TSAttacker, TSTricker, and TSCheater are implemented on these models to generate first-round adversarial texts The resulting high-quality benchmark is called AdvTS Evaluation of models like CINO series on this benchmark resulted in AdvRobust values of 0.5609, 0.5572, and 0.5726 respectively

Conclusion

The paper introduces HITL-GAT as an interactive system that facilitates the evolution of adversarial robustness benchmarks by allowing the loop to continue when new language models, downstream datasets, or textual adversarial attack methods emerge This approach provides a valuable reference for other lower-resourced languages The system is open-sourced under GNU General Public License v3.0 This work highlights the critical gap and urgent need for research in NLP security for lower-resourced languages

Limitations and Ethical Considerations

The system is currently applicable only to classification tasks The authors emphasize that their work adheres to the ACM Code of Ethics and stresses that textual adversarial attack methods must be used positively to prevent malicious misuse This preliminary work serves as an early paradigm for researching the evolution of adversarial robustness benchmarks

Acknowledgments

The work benefited greatly from encouragement and advice from Heather Lent at Aalborg University The research was supported by several national foundations in China <ref:2412.

Improvements for AI systems

We propose a general human-in-the-loop approach to adversarial text generation. This allows for creating and updating high quality adversarial robustness benchmarks with the emergence of new language models, downstream datasets, and textual adversarial attack methods.
We develop an interactive system called HITL-GAT based on the general approach to human-in-the-loop generation of adversarial texts. This system can be applied to construct victim models, generate adversarial examples, construct high quality benchmarks, and finally, evaluate adversarial robustness iteratively.
We demonstrate the utility of HITL-GAT through a case study on Tibetan script, employing three customized adversarial text generation methods and establishing its first adversarial robustness benchmark. This provides a valuable reference for other lower-resourced languages, specifically those using abugidas as their writing system.
The system can now dynamically adapt to emerging threats by entering a loop where a new language model, downstream dataset, or textual adversarial attack method emerges to update the benchmark and evaluation process.