Technical Summary: Research on the Generation of Tibetan Word-level Adversarial Samples Based on Morphosyntactic Linkage

Problem Statement

While Tibetan intelligent information processing has advanced significantly with the emergence of large language models (e.g., DEEPZANG, YangGuang QingYan), the security and robustness of these models against adversarial attacks remain under-researched compared to English and Chinese. Existing Tibetan adversarial attack methods primarily rely on character-level or syllable-level perturbations (e.g., syllable replacement, insertion, deletion). A critical limitation of these approaches is their neglect of Tibetan grammatical norms, specifically the rules governing function words (particles indicating case, possession, location, etc.).

When existing methods perform word-level substitutions without adhering to morphosyntactic linkage, the resulting adversarial samples often suffer from broken sentence logic and invalid grammatical rules. For instance, replacing a content word in Tibetan often necessitates a corresponding change in the subsequent function word (e.g., genitive, ergative, or locative particles) to maintain grammatical legality. Failure to update these function words renders the adversarial sample linguistically invalid, reducing its effectiveness and quality.

Methodology: TWLAS-BMSL

The paper proposes TWLAS-BMSL (Tibetan Word-Level Adversarial Sample Generation Based on Morphosyntactic Linkage), a method designed to generate high-quality, grammatically correct adversarial examples. The framework operates under a white-box attack paradigm and consists of four core steps:

1. Random Word Perturbation:

   • Utilizing a constructed Tibetan Sememe Knowledge Base (containing 32,745 entries), the method identifies content words in the original text.
   • It randomly matches these words with semantically similar alternatives from the knowledge base.
   • A single-word replacement is performed to create a perturbed text that preserves the original semantic meaning as much as possible.

2. Function Word Detection and Correction:

   • Recognizing that Tibetan deep semantic relationships are organized through function words, the method employs a function word attachment detection and correction algorithm.
   • Upon replacing a keyword, the algorithm dynamically analyzes the grammatical category of the new word (e.g., whether it acts as an agent subject or requires specific case marking).
   • It automatically updates the subsequent function words (genitive, ergative, locative, and personal noun suffixes) to align with Tibetan grammatical rules (specifically the "Thirty Verses" rules regarding suffix letters).

3. Reconstruction:

   • The system reconstructs the sentence by integrating the semantically similar keyword with the grammatically corrected function words.

4. Attack Execution:

   • The final reconstructed adversarial sample is input into the target model to induce misclassification.

Key Contributions

The authors highlight three primary contributions:

• Morphosyntactic Linkage Method: The proposal of a word-level adversarial generation method that explicitly incorporates morphosyntactic linkage, ensuring that function words are automatically adapted to match replaced content words. This enhances the robustness of Tibetan language models against white-box perturbation attacks.
• Automatic Adaptation Algorithms: The establishment of criteria and algorithms for the automatic adaptation and updating of Tibetan function words during perturbation, addressing a gap in existing Chinese and English-centric attack strategies.
• Tibetan Sememe Knowledge Base: The construction of a specialized Tibetan Sememe Knowledge Base with 32,745 entries, specifically designed to facilitate word-level adversarial experiments in Tibetan text.

Experimental Results

The study evaluated the TWLAS-BMSL method on four datasets (TNCC, TU_SA, QHNUTSA, MZUCTSA) covering text classification and sentiment analysis tasks. The target models included TiBERT, CINO-base-v2, and CINO-large.

• Attack Effectiveness:

  • The method caused an average Accuracy Drop (ADV) of 2.69% across models.
  • The average Attack Success Rate (ASR) reached 28.83%.
  • The average Levenshtein Distance (LD) was 6.80%, indicating that the attacks required relatively small perturbations to be effective.
  • The CINO-base-v2 model showed the highest sensitivity to the attack, while CINO-large demonstrated the strongest robustness.

• Grammatical Correction Performance:

  • In the task of automatic adaptation and error correction for function words, the method achieved 100% in three key metrics:
    • Function word error detection rate.
    • Overall accuracy.
    • Complete error sentence correction success rate.

• Qualitative Analysis:

  • Without the morphosyntactic linkage, generated samples often contained grammatical errors that broke sentence logic. With the proposed method, the adversarial samples maintained grammatical rigor while successfully misleading the target models.

Significance and Claims

The paper claims that the proposed TWLAS-BMSL method effectively addresses the issue of "imprecise syntactic logic" in existing Tibetan adversarial attacks. By ensuring that function words are updated in sync with content word substitutions, the method guarantees the grammatical logical rigor of the generated samples.

The authors assert that this approach not only successfully misleads models into making incorrect classification decisions but also ensures the text quality of the adversarial examples, making them indistinguishable from natural text in terms of grammatical correctness. This is presented as a crucial step toward improving the security and robustness of Tibetan large language models.

The paper concludes modestly, acknowledging limitations such as the finite size of the constructed Sememe Knowledge Base (32,745 entries) and the scarcity of Tibetan-specific large models for testing. Future work is suggested to apply this method to Tibetan large models to further enhance their anti-interference capabilities.