Single Word Change Is All You Need: Using LLMs to Create Synthetic Training Examples for Text Classifiers

ABSTRACT In text classification, creating an adversarial example means subtly perturbing a few words in a sentence without changing its meaning, causing it to be misclassified by a classifier. A concerning observation is that a significant portion of adversarial examples generated by existing methods change only one word. This single‐word perturbation vulnerability represents a significant weakness in classifiers, which malicious users can exploit to efficiently create a multitude of adversarial examples. This paper studies this problem and makes the following key contributions: (1) We introduce a novel metric to quantitatively assess a classifier's robustness against single‐word perturbation . (2) We present the SP‐Attack, designed to exploit the single‐word perturbation vulnerability, achieving a higher attack success rate, better preserving sentence meaning, while reducing computation costs compared to state‐of‐the‐art adversarial methods. (3) We propose SP‐Defence, which aims to improve by applying data augmentation in learning. Experimental results on 4 datasets and 2 masked language models show that SP‐Defence improves by 14.6% and 13.9% and decreases the attack success rate of SP‐Attack by 30.4% and 21.2% on two classifiers respectively, and decreases the attack success rate of existing attack methods that involve multiple‐word perturbations.