Select a position
At each iteration, find the output position where the target keyword has the smallest logit gap.
01 · Motivation
Targeted failures are harder - and potentially more dangerous
Untargeted attacks only need to reduce translation quality. A targeted attack must make the model produce a specific word while keeping the modified source sentence close enough to the original to avoid easy detection.
This work formulates that objective directly: encourage a chosen target keyword in the translation and penalize source-side changes that damage semantic similarity.
02 · Method
Optimize continuously, then return to valid language
The attack combines an adversarial objective with a language-model embedding similarity term, then solves the discrete text problem through iterative gradient projection.
Take a gradient step
Optimize target insertion and source similarity jointly in the continuous NMT embedding space.
Project to text
Map the updated representation to the nearest valid token using language-model embeddings.
03 · Evaluation
Evaluated across two WMT14 translation tasks
Experiments attack Marian models using 1,000 randomly selected sentences for each of English-to-French and English-to-German. They include a predefined malicious keyword and multiple nth-most-likely target-token settings.
>75%attack success in every reported target setting
>0.8source similarity in almost all reported settings
4.7×faster than Seq2Sick in the reported French keyword experiment
| Translation | Method | Attack success | Similarity |
|---|---|---|---|
| English-French | Proposed | 99.29% | 0.83 |
| English-French | Seq2Sick | 86.68% | 0.73 |
| English-German | Proposed | 83.84% | 0.77 |
| English-German | Seq2Sick | 27.41% | 0.74 |
04 · Takeaway
Similarity constraints and dynamic positioning both matter
The proposed attack outperforms Seq2Sick in success rate and relative BLEU decrease while remaining competitive on semantic similarity. Language-model embeddings help preserve meaning in harder scenarios, and recomputing the easiest target position at every iteration prevents the sharp success-rate drop seen with a fixed position.
05 · Citation
Cite this work
@inproceedings{sadrizadeh2023targeted,
title={Targeted Adversarial Attacks Against Neural Machine Translation},
author={Sadrizadeh, Sahar and Dabiriaghdam, Amirhossein and Dolamic, Ljiljana and Frossard, Pascal},
booktitle={2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)},
year={2023},
organization={IEEE}
}