% base: random sample
% better attack + meaning preserving
% search by optimum replacement why not search with the given optimum candidates?

\section{Experiments}

\subsection{Data Sets}
We test our adversarial example generations on Zh$\rightarrow$En, En$\rightarrow$Fr, and En$\rightarrow$De translation tasks, which provide relatively strong baselines for victim models and mass test samples. 

We train our agent using only parallel data that is used for victims' training.
we train on LDC Zh$\rightarrow$En\footnote{ldc2002E18, ldc2003E14, ldc2004T08, ldc2005T06}(1.3M pairs), WMT14 En$\rightarrow$De\footnote{https://nlp.stanford.edu/projects/nmt/} (4.5M pairs) and WMT15 En$\rightarrow$Fr\footnote{Europarl-v7, news-commentary-v10}(2.2M pairs) for victim models respectively.
For subword level translation, we apply byte pair encoding \citep[BPE]{sennrich2015neural} for both source and target languages with the vocabulary size of 37k. We also use join-BPE for En-De and En-Fr experiments with 34k and 33k vocabulary size, respectively.
For word-level translation, we use NLPIR-ICTCLAS and Moses tokenizer for Chinese and English tokenization, respectively.
We adopt 30k as vocabulary size for both source and target language.
We adopt NIST test sets \footnote{MT02,03,04,05,06} for Zh$\rightarrow$En and WMT test sets for En$\rightarrow$De and En$\rightarrow$Fr, then generate adversarial examples for these sources for analysis. 

\subsection{Victim Models}
We choose the state-of-the-art RNN-search and Transformer as victim translation models. 
For RNN-search, we train subword level models and strictly follow the architecture in \newcite{Bahdanau2015Neural}.
As for Transformer, we train both word-level and subword-level model for Zh$\rightarrow$En and only subword-level models for En$\rightarrow$De and En$\rightarrow$Fr with the architecture and the base parameter settings by \newcite{vaswani2017attention}.
For the above models, we apply the same batch scheme and Adam optimizer following \newcite{vaswani2017attention}. We choose MT03, newsdiscuss2015 and newstest2013 for Zh$\rightarrow$En, En$\rightarrow$Fr, En$\rightarrow$De as validation set respectively. 


\subsection{Metrics}
We first report attack results both in terms of char-level BLEU (\textit{chrBLEU}) of perturbed source by the origin to indicate modification rate, and relative decrease in target BLEU (\textit{RD}):
\begin{align}
    RD=\frac{\text{BLEU}(y,refs)-\text{BLEU}(y',refs)}{(1-\text{chrBLEU}(x',x))\times \text{BLEU}(y,refs)}
\end{align}
We adopt sacreBLEU \citep{post2018call} to test case-insensitive BLEU on detokenized targets.

As \newcite{michel2019evaluation} suggest, there is a trade-off between achieving high \textit{RD} and maintaining semantic. 
One can achieve rather high \textit{RD} by testing with mismatched references, making degradation less meaningful.
Therefore, we also test source semantic similarity with human evaluation (\textit{HE}) ranging from $0$ to $5$ used by \newcite{michel2019evaluation} by randomly sampling $10\%$ of total sequences mixed with baselines for a double-blind test. 
% we additionally propose a fine-tune degradation ($FD$) for an attacker to indicate its ability to maintain source semantic. That is, by noticing the fact that mismatched training pairs can severely damage test on clean data, we generate perturbed training sources by those attackers, then paired with original targets for fine-tuning, then collect degradation of tuned models on clean test sets.

\subsection{Results}
We implement state-of-the-art adversarial example generation by gradient search \cite{michel2019evaluation} (GS) as a baseline, which can be currently applied to various translation models. 
We also implemented random synthetic noise injection \cite{karpukhin2019training} (RSNI) as an unconstrained contrast. 
Both baselines are required to provide a ratio for the amount of tokens to perturb during an attack, where we present the best results.
Unlike our paradigm can generate on monolingual data, GS also requires target annotations, where we use one of the references to provide a strong baseline.
Note that RSNI can significantly break semantics with distinctly lower \textit{HE} to achieve rather high \textit{RD}, which we do not consider as legit adversarial example generation and noted with ``*'' for exclusion.


% % human reference of similarity
% \begin{table}[t]
%     \centering
%     \resizebox{0.45\textwidth}{!}{
%     \begin{tabular}{c|l}
% \hline
% 5 & Meaning is essentially equal, thus translation should stay the same. \\
% \hline
% 4 & Meaning is essnetially equal, but expressions are unnatural.\\
% \hline
% 3 & Key information is the same but details differ\\
% \hline
% 2 & Some key information is different\\
% \hline
% 1 & Original meaning is greatly changed and beyond recognition. \\
% \hline
%     \end{tabular}
%     }
%     \caption{Human evaluation used in \citep{michel2019evaluation}}
%     \label{tab:human_evaluation}
% \end{table}


\begin{table}[!t]
    \centering
\resizebox{0.45\textwidth}{!}{
\begin{tabular}{llccc}
\hline
                                      & \multicolumn{4}{c}{Zh-En MT02-06}                                                                \\ \cline{2-5} 
                                      & \multicolumn{1}{c}{BLEU} & \multicolumn{1}{c|}{chrBLEU} & \multicolumn{1}{c}{RD$\uparrow$} & HE$\uparrow$            \\ \hline
\multicolumn{1}{l|}{Transformer-word} & 41.16                    & \multicolumn{1}{c|}{-}        &            -            &          -     \\
\multicolumn{1}{l|}{RSNI (0.2)$^*$}    & 29.68                    & \multicolumn{1}{c|}{0.892}   & 2.580$^*$                  & 1.39$^*$          \\
\multicolumn{1}{l|}{RSNI (0.3)$^*$}    & 19.94                    & \multicolumn{1}{c|}{0.781}   & 2.350$^*$                  & 1.10$^*$          \\
\multicolumn{1}{l|}{GS (0.2)}     & 33.46                    & \multicolumn{1}{c|}{0.749}   & 0.746                  & 3.23          \\
\multicolumn{1}{l|}{GS (0.3)}     & 29.86                    & \multicolumn{1}{c|}{0.676}   & 0.847                  & 2.49          \\
\multicolumn{1}{l|}{Ours}             & 33.72                    & \multicolumn{1}{c|}{0.804}   & \textbf{0.952}         & \textbf{3.73} \\ \hline
\multicolumn{1}{l|}{Transformer-BPE}  & 44.06                    & \multicolumn{1}{c|}{-}        &      -                 &        -       \\
\multicolumn{1}{l|}{RSNI (0.2)$^*$}    & 34.44                    & \multicolumn{1}{c|}{0.892}   & 2.019$^*$                  & 1.45$^*$          \\
\multicolumn{1}{l|}{RSNI (0.4)$^*$}    & 25.78                    & \multicolumn{1}{c|}{0.781}   & 1.891$^*$                  & 1.08$^*$          \\
\multicolumn{1}{l|}{GS (0.2)}     & 35.52                    & \multicolumn{1}{c|}{0.823}   & \textbf{1.094}         & \textbf{3.88} \\
\multicolumn{1}{l|}{GS (0.4)}     & 28.18                    & \multicolumn{1}{c|}{0.675}   & 1.004                  & 2.90          \\
\multicolumn{1}{l|}{Ours}             & 35.48                    & \multicolumn{1}{c|}{0.807}   & 1.009                  & 3.79          \\ \hline
\multicolumn{1}{l|}{RNN-search-BPE}   & 40.90                    & \multicolumn{1}{c|}{-}        &  -                      &     -          \\
\multicolumn{1}{l|}{RSNI (0.2)$^*$}    & 32.54                    & \multicolumn{1}{c|}{0.892}   & 1.891$^*$                  & 1.44$^*$              \\
\multicolumn{1}{l|}{RSNI (0.4)$^*$}    & 25.54                    & \multicolumn{1}{c|}{0.781}   & 1.712$^*$                  & 1.36$^*$              \\
\multicolumn{1}{l|}{GS (0.2)}     & 32.94                    & \multicolumn{1}{c|}{0.823}   & \textbf{1.102}         & 3.79          \\
\multicolumn{1}{l|}{GS (0.4)}     & 27.02                    & \multicolumn{1}{c|}{0.678}   & 1.053                  & 2.88          \\
\multicolumn{1}{l|}{Ours}             & 31.58                    & \multicolumn{1}{c|}{0.785}   & 1.059                  & \textbf{3.81} \\ \hline
\end{tabular}
}
    \caption{Experiment results for Zh$\rightarrow$En MT attack. We list \textit{BLEU} for perturbed test sets generated by each adversarial example generation method, which is expect to deteriorate. An ideal adversarial example should achieve high \textit{RD} with respect to high \textit{HE}.
    % Note that random synthetic noise (Random*) can significantly break semantics (HE) by random token replacement to achieve rather high $RD$, which we do not consider as legit adversarial example generation.
    % Our model also achieves higher semantic similarity (HE) under similar modification ratio.
    }
    \label{tab:results}
\end{table}

As it is shown in Table \ref{tab:results} and \ref{tab:en_results}, 
our model stably generate adversarial examples without significant change in semantics \textit{by the same training setting} among different models and language pairs, achieving stably high \textit{HE}~($>$3.7) without any handcrafted semantic constraints, while search methods (GS) must tune for proper ratio of modification, which can hardly strike a balance between semantic constraints and degradation.
Unlike search paradigm relying on reference and victim gradients, our paradigm is model-agnostic yet still achieving comparable $RD$ with relatively high $HE$. 



\begin{table}[]
\centering
\resizebox{0.45\textwidth}{!}{
\begin{tabular}{lcccc}
\hline
                                     & \multicolumn{4}{c}{En-De newstest13-16}                                                                   \\ \cline{2-5} 
                                     & \multicolumn{1}{l}{BLEU} & \multicolumn{1}{l|}{chrBLEU} & \multicolumn{1}{l}{RD$\uparrow$} & \multicolumn{1}{l}{HE$\uparrow$} \\ \hline
\multicolumn{1}{l|}{RNN-search-BPE}       & 25.35                    & \multicolumn{1}{c|}{-}        &        -                &  -                      \\
\multicolumn{1}{l|}{RSNI (0.2)$^*$}     & 16.70                    & \multicolumn{1}{c|}{0.949}   & 6.691$^*$                  & 2.32$^*$                   \\
\multicolumn{1}{l|}{RSNI (0.4)$^*$}     & 10.05                    & \multicolumn{1}{c|}{0.897}   & 5.860$^*$                  & 1.58$^*$                   \\
\multicolumn{1}{l|}{GS (0.2)}     & 19.42	                    & \multicolumn{1}{c|}{0.881}	 & 1.966	              & 3.81                  \\
\multicolumn{1}{l|}{GS (0.4)}     & 9.27                     & \multicolumn{1}{c|}{0.680}   & 1.982                  & 3.01                   \\
\multicolumn{1}{l|}{Ours}            & 21.27                    & \multicolumn{1}{c|}{0.921}   & \textbf{2.037}         & \textbf{3.95}          \\ \hline
\multicolumn{1}{l|}{Transformer-BPE} & 29.05                    & \multicolumn{1}{c|}{-}        &      -                  &  -                      \\
\multicolumn{1}{l|}{RSNI (0.2)$^*$}     & 18.775                   & \multicolumn{1}{c|}{0.949}   & 6.935$^*$                  & 2.39$^*$                   \\
\multicolumn{1}{l|}{RSNI (0.4)$^*$}     & 11.125                   & \multicolumn{1}{c|}{0.897}   & 5.991$^*$                  & 1.58$^*$                   \\
\multicolumn{1}{l|}{GS (0.2)}     & 18.29                       &	\multicolumn{1}{c|}{0.861}	 & 2.665	              & 3.69                  \\
\multicolumn{1}{l|}{GS (0.4)}     & 10.03                    & \multicolumn{1}{c|}{0.751}   & 2.629                  & 3.33                   \\
\multicolumn{1}{l|}{Ours}            & 19.29                    & \multicolumn{1}{c|}{0.875}   & \textbf{2.688}         & \textbf{3.79}          \\ \hline
                                     & \multicolumn{4}{c}{En-Fr newstest13-14 + newsdiscuss15}                                                   \\ \hline
\multicolumn{1}{l|}{RNN-search-BPE}       & 32.6                     & \multicolumn{1}{c|}{-}        &    -                    &   -                     \\
\multicolumn{1}{l|}{RSNI (0.2)$^*$}     & 21.93                    & \multicolumn{1}{c|}{0.947}   & 6.175$^*$                  & 2.23$^*$                  \\
\multicolumn{1}{l|}{RSNI (0.4)$^*$}     & 14.3                     & \multicolumn{1}{c|}{0.894}   & 5.271$^*$                  & 1.56$^*$                  \\
\multicolumn{1}{l|}{GS (0.2)}     & 22.7	                    & \multicolumn{1}{c|}{0.833}	  &1.818	              &3.80                  \\
\multicolumn{1}{l|}{GS (0.4)}     & 15.2                     & \multicolumn{1}{c|}{0.708}   & 1.828                  & 3.25                  \\
\multicolumn{1}{l|}{Ours}            & 22.3                     & \multicolumn{1}{c|}{0.843}   & \textbf{2.009}                  & \textbf{3.87}                  \\ \hline
\multicolumn{1}{l|}{Transformer-BPE} & 34.7                     & \multicolumn{1}{c|}{-}        &            -          &         -               \\
\multicolumn{1}{l|}{RSNI (0.2)$^*$}     & 24.0                     & \multicolumn{1}{c|}{0.947}   & 5.774$^*$                  & 2.34$^*$                  \\
\multicolumn{1}{l|}{RSNI (0.4)$^*$}     & 15.8                     & \multicolumn{1}{c|}{0.894}   & 5.114$^*$                  & 1.67$^*$                  \\
\multicolumn{1}{l|}{GS (0.2)}     & 23.01                    &   	\multicolumn{1}{c|}{0.830}	 & 1.982	              & 3.74                 \\
\multicolumn{1}{l|}{GS (0.4)}     & 19.6                     & \multicolumn{1}{c|}{0.788}   & \textbf{2.053}         & 3.68                  \\
\multicolumn{1}{l|}{Ours}            & 21.33                    & \multicolumn{1}{c|}{0.798}   & 1.907                  & \textbf{3.78}         \\ \hline
\end{tabular}
}
\caption{Experiment results for En$\rightarrow$De and En$\rightarrow$Fr MT attack.}
\label{tab:en_results}
\end{table}

% For word level translation (Transformer-word), both search results and our methods share similar chrF1, however they achieve degradation with lower human evaluation scores, while our method achieves degradation more effectively with higher human evaluation.
% For subword level Transformer (Transformer-BPE), our model achieves significantly more BLEU degradation with very little sacrifice in semantics compared to search (0.2), while search (0.4) shares the similar modification rate with tremendous loss in human evaluation.
% For subword level RNN-search, our model also achieves similar degradation compared to search (0.2), while search (0.4) with similar modification rate still suffers tremendous loss in human evaluation while achieving the most degradation.

\subsection{Case Study}

As it is shown in Table \ref{tab:case_study}, our method is less likely to perturb some easily-modified \textit{semantics} (e.g. numbers are edited to other ``forms'', but not different numbers), while search tends to generate semantically different tokens to achieve degradation. 
Thus our agent can lead to more insightful and plausible analyses for neural machine translation than search by gradient.

\begin{table*}[t]
    \centering
    \resizebox{\textwidth}{!}{
        \begin{tabular}{c|l}
        \hline
        \multicolumn{2}{c}{a} \\
        \hline
        \textbf{origin in} & \begin{CJK}{UTF8}{gkai}全国 4000 万选民将在16名候选人中选举法兰西第五共和国第七任总统。\end{CJK} \\
        \textbf{origin out} & 40 million voters throughout the country will elect the seventh president of the fifth republic of france among the 16 candidates \\
        \hline 
        \multirow{4}{*}{\textbf{references}} & 40 million voters in the nation will elect the 7th president for the french fifth republic from 16 candidates. \\
        & there are 40 million voters and they have to pick the fifth republic  france's seventh president amongst the sixteen candidates.\\
        & forty million voters across the country are expected to choose the 7th president of the 5th republic of france from among 16 candidates. \\
        & 40 million voters around france are to elect the 7th president of the 5 republic of france from 16 candidates .\\
        \hline
        \textbf{GS (0.4) in} & \begin{CJK}{UTF8}{gkai}全国 \textit{\textbf{性}} 4000 万\textit{\textbf{市}}民将在 \textit{\textbf{6}} 名候选人中选举法兰西第五\textit{\textbf{国家}} 第七任 \textit{\textbf{外交部长}}。 \end{CJK}\\
        \textbf{GS (0.4) out} & of the 6 candidates, 40 million people will elect the seventh foreign minister of the five countries. \\
        \hline 
        \textbf{ours in} & \begin{CJK}{UTF8}{gkai}全国\textit{\textbf{性}}4000万选民将在16\textbf{\textit{位}}候选人中选举法兰西第\textit{\textbf{5}}共和国第\textit{\textbf{7}}任总统\end{CJK} \\
        \textbf{ours out} & among the 16 candidates , 40 million voters will elect five presidents of France and seven presidents of the republic of France. \\
        \hline
        \hline
        \multicolumn{2}{c}{b} \\
        \hline
        \textbf{origin in} & \begin{CJK}{UTF8}{gkai}干案者目前被也门当局扣留。\end{CJK}\\
        \textbf{origin out} & the persons involved in the case are currently detained by the yemeni authorities.\\
        \hline
        \multirow{4}{*}{\textbf{references}}& the perpetrator is currently in the custody of the yemeni authorities. \\
        & yemeni authority apprehended the suspect. \\
        & the suspect is now in custody of yemeni authorities . \\
        & the ones involed in this case were also detained by the authority. \\
        \hline
        \textbf{GS (0.4) in} & \begin{CJK}{UTF8}{gkai}干案者目前\textit{\textbf{为}}也门\textit{\textbf{现}}局留。\end{CJK}\\
        \textbf{GS (0.4) out} & the person involved in the case is now detained by the authorities!\\
        \hline
        \textbf{ours in} & \begin{CJK}{UTF8}{gkai}干案\textit{\textbf{方}} 目前被也门当局扣留。\end{CJK} \\
        \textbf{ours out} & the victim is currently detained by the yemeni authorities.\\
        \hline
        \end{tabular}
    }
    \caption{(a) an example of perturbed number and quantifier severely damaging outputs in Zh$\rightarrow$En translation, where we highlight the changes. ``\begin{CJK}{UTF8}{gkai}五\end{CJK}''  is the character for $5$ and ``\begin{CJK}{UTF8}{gkai}七\end{CJK}'' for $7$, ``\begin{CJK}{UTF8}{gkai}名\end{CJK}'' and ``\begin{CJK}{UTF8}{gkai}位\end{CJK}'' are both commonly used quantifiers for people. However, search-based attack achieves degradation by some significant changes of semantics, where number ``16'' is changed to ``6'', and ``\begin{CJK}{UTF8}{gkai}外交部长\end{CJK}'' means ``foreign minister''. (b) an example of changed suffix which breaks the result. ``\begin{CJK}{UTF8}{gkai}方\end{CJK}'' and ``\begin{CJK}{UTF8}{gkai}者\end{CJK}'' are common suffixes (K) sharing same meaning used for people. Our model spots that victim model's fragility upon such perturb, while search does not.
    }
    \label{tab:case_study}
\end{table*}