Generating Natural Language Adversarial Examples through Probability Weighted Word Saliency

We address the problem of adversarial attacks on text classification, which is rarely studied comparing to attacks on image classification. The challenge of this task is to generate adversarial examples that maintain lexical correctness, grammatical correctness and semantic similarity. Based on the synonyms substitution strategy, we introduce a new word replacement order determined by both the word saliency and the classification probability, and propose a greedy algorithm called probability weighted word saliency (PWWS) for text adversarial attack. Experiments on three popular datasets using convolutional as well as LSTM models show that PWWS reduces the classification accuracy to the most extent, and keeps a very low word substitution rate. A human evaluation study shows that our generated adversarial examples maintain the semantic similarity well and are hard for humans to perceive. Performing adversarial training using our perturbed datasets improves the robustness of the models. At last, our method also exhibits a good transferability on the generated adversarial examples.


Introduction
Deep neural networks (DNNs) have exhibited vulnerability to adversarial examples primarily for image classification (Szegedy et al., 2013;Goodfellow et al., 2015;Nguyen et al., 2015). Adversarial examples are input data that are artificially modified to cause mistakes in models. For image classifications, the researchers have proposed various methods to add small perturbations on images that are imperceptible to humans but can cause misclassification in DNN classifiers. Due to the variety of key applications of DNNs in computer vision, the security issue raised by adversarial examples has attracted much attention in liter- * Corresponding author. atures since 2014, and numerous approaches have been proposed for either attack (Goodfellow et al., 2015;Kurakin et al., 2016;Tramèr et al., 2018;Dong et al., 2018), as well as defense (Goodfellow et al., 2015;Tramèr et al., 2018;Wong and Kolter, 2018;Song et al., 2019).
In the area of Natural Language Processing (NLP), there is only a few lines of works done recently that address adversarial attacks for NLP tasks (Liang et al., 2018;Samanta and Mehta, 2017;Alzantot et al., 2018). This may be due to the difficulty that words in sentences are discrete tokens, while the image space is continuous to perform gradient descent related attacks or defnses. It is also hard in human's perception to make sense of the texts with perturbations while for images minor changes on pixels still yield a meaningful image for human eyes. Meanwhile, the existence of adversarial examples for NLP tasks, such as span filtering, fake news detection, sentiment analysis, etc., raises concerns on significant security issues in their applications.
In this work, we focus on the problem of generating valid adversarial examples for text classification, which could inspire more works for NLP attack and defense. In the area of NLP, as the input feature space is usually the word embedding space, it is hard to map a perturbed vector in the feature space to a valid word in the vocabulary. Thus, methods of generating adversarial examples in the image field can not be directly transferred to NLP attacks. The general approach, then, is to modify the original samples in the word level or in the character level to achieve adversarial attacks (Liang et al., 2018;Gao et al., 2018;Ebrahimi et al., 2018).
We focus on the text adversarial example generation that could guarantee the lexical correctness with little grammatical error and semantic shifting. In this way, it achieves "small per-turbation" as the changes will be hard for humans to perceive. We introduce a new synonym replacement method called Probability Weighted Word Saliency (PWWS) that considers the word saliency as well as the classification probability. The change value of the classification probability is used to measure the attack effect of the proposed substitute word, while word saliency shows how well the original word affects the classification. The change value of the classification probability weighted by word saliency determines the final substitute word and replacement order.
Extensive experiments on three popular datasets using convolutional as well as LSTM models demonstrate a good attack effect of PWWS. It reduces the accuracy of the DNN classifiers by up to 84.03%, outperforms existing text attacking methods. Meanwhile, PWWS has a much lower word substitution rate and exhibits a good transferability. We also do a human evaluation to show that our perturbations are hard for humans to perceive. In the end, we demonstrate that adversarial training using our generated examples can help improve robustness of the text classification models.

Related Work
We first provide a brief review on related works for attacking text classification models. Liang et al. (2018) propose to find appropriate words for insertion, deletion and replacement by calculating the word frequency and the highest gradient magnitude of the cost function. But their method involves considerable human participation in crafting the adversarial examples. To maintain semantic similarity and avoid human detection, it requires human efforts such as searching related facts online for insertion.
Therefore, subsequent research are mainly based on the word substitution strategy so as to avoid artificial fabrications and achieve automatic generations. The key difference of these subsequent methods is on how they generate substitute words. Samanta and Mehta (2017) propose to build a candidate pool that includes synonyms, typos and genre specific keywords. They adopt Fast Gradient Sign Method (FGSM) (Goodfellow et al., 2015) to pick a candidate word for replacement. Papernot et al. (2016b) perturb a word vector by calculating forward derivative (Papernot et al., 2016a) and map the perturbed word vector to a closest word in the word embedding space. Yang et al. (2018) derive two methods, Greedy Attack based on perturbation, and Gumbel Attack based on scalable learning. Aiming to restore the interpretability of adversarial attacks based on word substitution strategy, Sato et al. (2018) restrict the direction of perturbations towards existing words in the input embedding space.
As the above methods all need to calculate the gradient with access to the model structure, model parameters, and the feature set of the inputs, they are classified as white-box attacks. To achieve attack under a black-box setting, which assumes no access to the details of the model or the feature representation of the inputs, Alzantot et al. (2018) propose to use a population-based optimization algorithm. Gao et al. (2018) present a DeepWord-Bug algorithm to generate small perturbations in the character-level for black-box attack. They sort the tokens based on the importance evaluated by four functions, and make random token transformations such as substitution and deletion with the constraint of edit distance. Ebrahimi et al. (2018) also propose a token transformation method, and it is based on the gradients of the one-hot input vectors. The downside of the character-level perturbations is that they usually lead to lexical errors, which hurts the readability and can easily be perceived by humans.
The related works have achieved good results for text adversarial attacks, but there is still much room for improvement regarding the percentage of modifications, attacking success rate, maintenance on lexical as well as grammatical correctness and semantic similarity, etc. Based on the synonyms substitution strategy, we propose a novel blackbox attack method called PWWS for the NLP classification tasks and contribute to the field of adversarial machine learning.

Text Classification Attack
Given an input feature space X containing all possible input texts (in vector form x) and an output space Y = {y 1 , y 2 , . . . , y K } containing K possible labels of x, the classifier F needs to learn a mapping f : X → Y from an input sample x ∈ X to a correct label y true ∈ Y. In the following, we first give a definition of adversarial example for natural language classification, and then introduce our word substitution strategy.

Text Adversarial Examples
Given a trained natural language classifier F , which can correctly classify the original input text x to the label y true based on the maximum posterior probability.
arg max We attack the classifier by adding an imperceptible perturbation ∆x to x to craft an adversarial example x * , for which F is expected to give a wrong label: arg max Eq.
(2) gives the definition of the adversarial example x * : (2) The original input text can be expressed as x = w 1 w 2 . . . w i . . . w n , where w i ∈ D is a word and D is a dictionary of words. ∆x p defined in Eq.
(3) uses p-norm to represent the constraint on perturbation ∆x, and L ∞ , L 2 and L 0 are commonly used.
To make the perturbation small enough so that it is imperceptible to humans, the adversarial examples need to satisfy lexical, grammatical, and semantic constraints. Lexical constraint requires that the correct word in the input sample cannot be changed to a common misspelled word, as a spell check before the input of the classifier can easily remove such perturbation. The perturbed samples, moreover, must be grammatically correct. Third, the modification on the original samples should not lead to significant changes in semantics as the semantic constraint requires. To meet the above constraints, we replace words in the input texts with synonyms and replace named entities (NEs) with similar NEs to generate adversarial samples. Synonyms for each word can be found in WordNet 1 , a large lexical database for the English language. NE refers to an entity that has a specific meaning in the sample text, such as a person's name, a location, an organization, or a proper noun. Replacement of an NE with a similar NE imposes a slight change in semantics but invokes no lexical or grammatical changes.
The candidate NE for replacement is picked in the following. Assuming that the current input sample belongs to the class y true and dictionary D y true ⊆ D contains all NEs that appear in the texts with class y true , we can use the most frequently occurring named entity NE adv in the complement dictionary D−D y true as a substitute word. In addition, the substitute NE adv must have the consistent type with the original NE, e.g., they must be both locations.

Word Substitution by PWWS
In this work, we propose a new text attacking method called Probability Weighted Word Saliency (PWWS). Our approach is based on synonym replacement, and there are two key issues that we resolve in the greedy PWWS algorithm: the selection of synonyms or NEs and the decision of the replacement order.

Word Substitution Strategy
For each word w i in x, we use WordNet to build a synonym set L i ⊆ D that contains all synonyms of w i . If w i is an NE, we find NE adv which has a consistent type of w i to join L i . Then, every w i ∈ L i is a candidate word for substitution of the original w i . We select a w i from L i as the proposed substitute word w * i if it causes the most significant change in the classification probability after replacement. The substitute word selection method R(w i , L i ) is defined as follows: and x i is the text obtained by replacing w i with each candidate word w i ∈ L i . Then we replace w i with w * i and get a new text x * i : The change in classification probability between x and x * i represents the best attack effect that can be achieved after replacing w i . ∆P * i = P (y true |x) − P (y true |x * i ).
For each word w i ∈ x, we find the corresponding substitute word w * i by Eq. (4), which solves the first key issue in PWWS.

Replacement Order Strategy
Furthermore, in the text classification tasks, each word in the input sample may have different level of impact on the final classification. Thus, we incorporate word saliency (Li et al., 2016b,a) into our algorithm to determine the replacement order. Word saliency refers to the degree of change in the output probability of the classifier if a word is set to unknown (out of vocabulary). The saliency of a word is computed as S(x, w i ).
S(x, w i ) = P (y true |x) − P (y true |x i ) where We calculate the word saliency S(x, w i ) for all w i ∈ x to obtain a saliency vector S(x) for text x.
To determine the priority of words for replacement, we need to consider the degree of change in the classification probability after substitution as well as the word saliency for each word. Thus, we score each proposed substitute word w * i by evaluating the ∆P * i in Eq. (5) and i th value of S(x).
z in Eq. (8) is a vector. z i and φ(z) i indicate the i th component of vector z and φ(z), respectively. φ(S(x)) in Eq. (7) indicates a softmax operation on word saliency vector S(x) and K = |S(x)|.
Eq. (7) defined by probability weighted word saliency determines the replacement order. We sort all the words w i in x in descending order based on H(x, x * i , w i ), then consider each word w i under this order and select the proposed substitute word w * i for w i to be replaced. We greedily iterate through the process until enough words have been replaced to make the final classification label change.
The final PWWS Algorithm is as shown in Algorithm 1.

Empirical Evaluation
For empirical evaluation, we compare PWWS with other attacking methods on three popular datasets involving four neural network classification models.

Algorithm 1 PWWS Algorithm
Input: Sample text x (0) before iteration; Input: Length of sample text x (0) : n = |x (0) |; Input: Classifier F ; Output: Adversarial example x (i) 1: for all i = 1 to n do 2: ; 9: end for 10: Reorder w i such that 11: IMDB. IMDB is a large movie review dataset consisting of 25,000 training samples and 25,000 test samples, labeled as positive or negative. We use this dataset to train a word-based CNN model and a Bi-directional LSTM network for sentiment classification (Maas et al., 2011).
AG's News. This is a collection of more than one million news articles, which can be categorized into four classes: World, Sports, Business and Sci/Tech. Each class contains 30,000 training samples and 1,900 testing samples.
Yahoo! Answers. This dataset consists of ten topic categories: Society

Deep Neural Models
For deep neural models, we consider several classic as well as state-of-the-art models used for text classification. These models include both convolutional neural networks (CNN) and recurrent neural networks (RNN), for word-level or characterlevel data processing. Word-based CNN (Kim, 2014) consists of an embedding layer that performs 50-dimensional word embeddings on 400-dimensional input vectors, an 1D-convolutional layer consisting of 250 filters of kernel size 3, an 1D-max-pooling layer, and two fully connected layers. This word-based classification model is used on all three datasets.
Bi-directional LSTM consists of a 128dimensional embedding layer, a Bi-directional LSTM layer whose forward and reverse are respectively composed of 64 LSTM units, and a fully connected layer. This word-based classification model is used on IMDB dataset.
Char-based CNN is identical to the structure in (Zhang et al., 2015) which includes two Con-vNets. The two networks are both 9 layers deep with 6 convolutional layers and 3 fully-connected layers. This char-based classification model is used for AG's News dataset.
LSTM consists of a 100-dimensional embedding layer, an LSTM layer composed of 128 units, and a fully connected layer. This word-based classification model is used for Yahoo! Answers dataset.
Column 3 in Table 2 demonstrates the classification accuracies of these models on original (clean) examples, which almost achieves the best results of the classification task on these datasets.

Attacking Methods
We compare our PWWS 2 attacking method with the following baselines. All the baselines use WordNet to build the candidate synonym sets L.
Random. We randomly select a synonym for each word in the original input text to replace, and keep performing such replacement until the classification output changes.
Gradient. This method draws from FGSM (Goodfellow et al., 2015), which is previously proposed for image adversarial attack: 2 https://github.com/JHL-HUST/PWWS/ where J (F, y true ) is the cost function used for training the neural network.
For the sake of calculation, we will use the synonym that maximizes the change of prediction output ∆F (x) as the substitute word, where ∆F (x) is approximated by forward derivative: This method using Eq. (10) is the main concept introduced in (Papernot et al., 2016b). Traversing in word order (TiWO). This method of traversing input sample text in word order finds substitute for each word according to Eq. (4).
Word Saliency (WS). WS (Samanta and Mehta, 2017) sorts words in the input text based on word saliency in Eq. (6) in descending order, and finds substitute for each word according to Eq. (4).

Attacking Results
We evaluate the merits of all above methods by using them to generate 2,000 adversarial examples respectively. The more effective the attacking method is, the more the classification accuracy of the model drops. Table 2 shows the classification accuracy of different models on the original samples and the adversarial samples generated by these attack methods.
Results show that our method reduces the classification accuracies to the most extent. The classification accuracies on the three datasets IMDB, AG's News, and Yahoo! Answers are reduced by an average of 81.05%, 33.62%, and 38.65% respectively. The effectiveness of the attack against multi-classification tasks is not as good as that for binary classification tasks.
Our method achieves such effects by very few word replacements.       Table 6: Comparison with human evaluation. The fourth and fifth columns represent the classification accuracy of the model and human, respectively. The last column represents how much the workers think the text is likely to be modified by a machine. The larger the score, the higher the probability.
versarial examples generated by different methods, see details in Appendix.
Text classifier based on DNNs is widely used in NLP tasks. However, the existence of such adversarial samples exposes the vulnerability of these models, limiting their applications in securitycritical systems like spam filtering and fake news detection.

Discussions on Previous Works
Yang et al. (2018) introduce a perturbationbased method called Greedy Attack and a scalable learning-based method called Gumbel Attack. They perform experiments on IMDB dataset with the same word-based CNN model, and on AG's News dataset with a LSTM model. Their method greatly reduces the classification accuracy to less than 5% after replacing 5 words (Yang et al., 2018). However, the semantics of the replacement words are not constrained, as antonyms sometimes appear in their adversarial examples. Moreover, for instance, Table 3 in (Yang et al., 2018) shows that they change "... The plot could give a rise a must (better) movie if the right pieces was in the right places" to switch from negative to positive; and they change "The premise is good, the plot line script (interesting) and the screenplay was OK" to switch from positive to negative. The first sample changes the meaning of the sentence, while the second has grammatical errors. Under such condition, the perturbations could be recognized by humans. Gao et al. (2018) present a novel algorithm, DeepWordBug, that generates small text perturbations in the character-level for black-box attack. This method can cause a decrease of 68% on average for word-LSTM and 48% on average for char-CNN model when 30 edit operations were allowed. However, since their perturbation exists in the character-level, the generated adversarial examples often do not conform to the lexical constraint: misspelled words may exist in the text. For instance, they change a positive review of "This film has a special place in my heart" to get a negative review of "This film has a special plcae in my herat". For such adversarial examples, a spell check on the input can easily remove the perturbation, and the effectiveness of such adversarial attack will be removed also. DeepWordBug is still useful, as we could improve the robustness in the training of classifiers by replacing misspelled word with out-of-vocabulary word, or simply remove misspelled words. However, as DeepWord-Bug can be easily defended by spell checking, we did not consider it as a baseline in our comparison.

Further Analysis
This section provides a human evaluation to show that our perturbation is hard for humans to perceive, and studies the transferability of the generated examples by our methods. In the end, we show that using the generated examples for adversarial training helps improving the robustness of the text classification model.

Human Evaluation
To further verify that the perturbations in the adversarial examples are hard for humans to recognize, we find six workers on Amazon Mechanical Turk to evaluate the examples generated by PWWS. Specifically, we select 100 clean texts in IMDB and the corresponding adversarial examples generated on word-based CNN. Then we select another 100 clean texts in IMDB and the corresponding adversarial examples generated on Bidirectional LSTM. For the third group, we select 100 clean texts from AG's News and the corresponding adversarial examples generated on charbased CNN. For each group of date, we mix the clean data and generated examples for the workers to classify. To evaluate the similarity, we ask the workers to give scores from 1-5 to indicate the likelihood that the text is modified by machine.  Table 6 shows the comparison with human evaluation. The generated examples can cause misclassification on three different models, while the classification accuracy of humans is still very high comparing to their judgement on clean data. Since there are four categories for AG's News, the classification accuracy of workers on this dataset is significantly lower than that on IMDB (binary classification tasks). Thus, we did not try human evaluation on Yahoo! Answers as there are 10 categories to classify. The likelihood scores of machine perturbation on adversarial examples are slightly higher than that on the original texts, indicating that the semantics of some synonyms are not as accurate as the original words. Nevertheless, as the accuracy of humans on the two sets of data are close, and the traces of machine modifications are still hard for humans to perceive.

Transferability
The transferability of adversarial attack refers to its ability to reduce the accuracy of other models to a certain extent when the examples are generated on a specific classification model (Goodfellow et al., 2015;Szegedy et al., 2013).
To illustrate this, we record the original wordbased CNN (described in Section 4.2) as wordbased CNN-1, and train three new proximity classification models on the IMDB dataset, labeled respectively as word-based CNN-2, word-based CNN-3 and Bi-directional LSTM network. Compared to word-based CNN-1, word-based CNN-2 has an additional fully connected layer. Wordbased CNN-3 has the same network structure as CNN-1 except using GloVe (Pennington et al., 2014) as a pretrained word embedding. The network structure of Bi-directional LSTM is the one introduced in Section 4.2.
When the adversarial examples generated by our method are transferred to word-based CNN-2 or Bi-dir LSTM, the attacking effect is slightly inferior, as illustrated in Figure 1 (a). But note that the word replacement rate of our method on IMDB is only 3.81%, which is much lower than other methods (Table 3). When we use the same replacement ratio (say 10%) in the input text for all methods, the transferability of PWWS is significantly better than other methods. Figure 1 (b) illustrates that the word substitution order determined by PWWS corresponds well to the importance of the words for classification, and the transformation is effective across various models.

Adversarial Training
Adversarial training (Shrivastava et al., 2017) is a popular technique mainly used in image classification to improve model robustness. To verify whether incorporating adversarial training would help improve the robustness of the test classifiers, we randomly select clean samples from the training set of IMDB and use PWWS to generate 4000 adversarial examples as a set A, and train the word-based CNN model. We then evaluate the classification accuracy of the model on the original test data and of the adversarial examples generated using various methods. Figure 2

Conclusion
We propose an effective method called Probability Weighted Word Saliency (PWWS) for generating adversarial examples on text classification tasks. PWWS introduces a new word substitution order determined by the word saliency and weighted by the classification probability. Experiments show that PWWS can greatly reduce the text classification accuracy with a low word substitution rate, and such perturbation is hard for human to perceive.
Our work demonstrates the existence of adversarial examples in discrete input spaces and shows the vulnerability of NLP models using neural networks. Comparison with existing baselines shows the advantage of our method. PWWS also exhibits a good transferability, and by performing adversarial training we can improve the robustness of the models at test time. In the future, we would like to evaluate the attacking effectiveness and efficiency of our methods on more datasets and models, and do elaborate human evaluation on the similarity between clean texts and the corresponding adversarial examples.

Attack
Perturbed Texts Methods Random The One and the Only (Solitary) ! Agreed this movie (pic) is well (comfortably) shot (hit), but it just (scarcely) makes no sense (mother) and no use (enjoyment) as to how they made 2 hours seem like 3 (7) just (scarcely) over a small (belittled) love (honey) story (taradiddle), this could have been an episode (sequence) of the bold (sheer) and the beautiful or the o.c, in short please don't watch (learn) this movie (pic) because there is a song every 5 minutes just to wake (stir) you up from you're sleep (quietus), i gave this movie (pic) 1/10! cause (induce) that was the lowest, and no this is not based completely on a true story, more than half of it is made up. I repeat the direction of photography is 7 or 8 out of 10, but the movie is just a little too much, the actor's nasal voice just makes me want to go blow my nose. Unless you are a real him mesh fan this movie is a huge no-no.

Gradient
The One and the Only (Solitary) ! Agreed this movie (pic) is well (easily) shot (hit), but it just (scarcely) makes no sense (gumption) and no use (enjoyment) as to how they made 2 hours seem like 3 (7) just (simply) over a small (belittled) love (honey) story (taradiddle), this could have been an episode (sequence) of the bold (bluff ) and the beautiful or the o.c, in short please don't watch (learn) this movie (pic) because there is a song every 5 minutes just to wake (stir) you up from you're sleep (quietus), i gave this movie (pic) 1/10! cause (induce) that was the lowest, and no this is not based completely on a true story, more than half of it is made up. I repeat the direction of photography is 7 or 8 out of 10, but the movie is just a little too much, the actor's nasal voice just makes me want to go blow my nose. Unless you are a real him mesh fan this movie is a huge no-no.

TiWO
The One and the Only (Solitary) ! Agreed this movie (film) is well (easily) shot (hit), but it just (simply) makes no sense and no use (manipulation) as to how they made 2 hours seem like 3 (7) just (simply) over a small (humble) love (passion) story (level), this could have been an episode (sequence) of the bold (sheer) and the beautiful or the o.c, in short please don't watch (keep) this movie (film) because there is a song every 5 minutes just to wake you up from you're sleep (quietus), i gave this movie (motion) 1/10 (7)! cause (induce) that was the lowest, and no this is not based completely on a true story, more than half of it is made up. I repeat the direction of photography is 7 or 8 out of 10, but the movie is just a little too much, the actor's nasal voice just makes me want to go blow my nose. Unless you are a real him mesh fan this movie is a huge no-no.

WS
The One and the Only (Solitary) ! Agreed this movie is well shot (hit), but it just (simply) makes no sense and no use as to how they made 2 hours seem like 3 just over a small (belittled) love (passion) story (taradiddle), this could have been an episode of the bold and the beautiful or the o.c, in short please don't watch this movie because there is a song every 5 minutes just to wake you up from you're sleep (quietus), i gave this movie (motion) 1/10! cause (induce) that was the lowest, and no this is not based (found) completely (wholly) on a true story (level), more than half of it is made up. I repeat the direction of photography (picture) is 7 or 8 (7) out of 10 (7), but the movie is just a little too much, the actor's nasal voice just makes me want to go blow my nose (nozzle). Unless you are a real him mesh fan this movie is a huge no-no.

PWWS
The One and the Only! Agreed this movie is well shot, but it just makes no sense and no use as to how they made 2 hours seem like 3 just over a small love story, this could have been an episode of the bold and the beautiful or the o.c, in short please don't watch this movie because there is a song every 5 minutes just to wake you up from you're sleep, i gave this movie 1/10 (7)! cause that was the lowest, and no this is not based completely on a true story, more than half of it is made up. I repeat the direction of photography is 7 or 8 out of 10, but the movie is just a little too much, the actor's nasal voice just makes me want to go blow my nose.
Unless you are a real him mesh fan this movie is a huge no-no. Confidence = 89.77% Table 7: Adversarial examples generated for the same clean input text using different attack methods on wordbased CNN. We select a clean input text from the IMDB. The correct category of the original text is negative, and the classification confidence of word-based CNN is 82.77%. The adversarial examples generated by all methods succeeded in making the model misclassify from negative class into positive class. There is only one word substitution needed in our approach(PWWS) to make the attack successful, and it also maintains a high degree of confidence in the classification of wrong class.

Original Adversarial Perturbed Texts Prediction Prediction Positive
Negative This is a great (big) show despite many negative user reviews. The aim of this show is to entertain you by making you laugh. Two guys compete against each other to get a girl's phone number. Simple. The fun in this show is watching the two males try to accomplish their goal. Some appear to hate the show for various reasons, but I think, they misunderstood this as an "educational" show on how to pick up chicks. Well it is not, it is a comedy show, and the whole point of it is to make you laugh, not teach you anything. The One and the Only! Agreed this movie is well shot, but it just makes no sense and no use as to how they made 2 hours seem like 3 just over a small love story, this could have been an episode of the bold and the beautiful or the o.c, in short please don't watch this movie because there is a song every 5 minutes just to wake you up from you're sleep, i gave this movie 1/10 (7)! cause that was the lowest,and no this is not based completely on a true story, more than half of it is made up. I repeat the direction of photography is 7 or 8 out of 10, but the movie is just a little too much, the actor's nasal voice just makes me want to go blow my nose. Unless you are a real him mesh fan this movie is a huge no-no. Negative Positive This is a very strange (unusual) film, with a no-name cast and virtually nothing known about it on the web. It uses an approach familiar to those who have watched the likes of Creepshow in that it introduces a trilogy of so-called "horror" shorts and blends them together into a connecting narrative of the people who are involved in the segments getting off a bus. There is a narrator who prattles on about relationships, but his talking adds absolutely nothing to the mix at all and just adds to the confusion. As for the stories themselves, well.. I swear I have not got a clue why this movie got an 18 (7) certificate in the UK, which would bring it into line with the likes of Nightmare On Elm Street and The Exorcist. Nothing here is even remotely scary.. there is no gore, sex, nudity or even a swear word to liven things up, this is the kind of thing you could put out on Children's TV and no-one would bat an eyelid. I can only think if it had got the rating it truly deserved (a PG) no serious horror fan would be seen dead with it, so the distributor probably buffeted the BBFC until they relented. Anyway, here are the 3 (7) tales in summary: 1. A man becomes dangerously obsessed with his telekinetic car to the point of alienating his fiancee. 2. A man who lives in a filthy apartment is understandably freaked out when a living organism evolved from his six-month old tuna casserole. 3. A woman thinks she has found the perfect man through a computer dating service.. that is until he starts to act weird.. And there you have it. Some of them are pretty amusing due to their outlandish premises (my favourite being number 2) but you get the feeling they were meant to be a) frightening and b) morality plays, unfortunately they fail miserably on both counts. To sum up then, this flick is an obscure curiosity.. for very good reasons." Confidence Confidence = 83.24% = 52.19% Sports post-olympic greece tightens purse, sells family silver to fill budget holes (afp). afp -squeezed by a swelling public deficit (shortage) and debt following last month's costly athens olympics, the greek government said it would cut defence spending and boost revenue by 1.5 billion euros (1.84 billion dollars) in privatisation receipts.
Confidence Confidence = 45.73% = 38.48% Sci/Tech Sports prediction unit helps forecast (calculate) wildfires (ap). ap -it's barely dawn when mike fitzpatrick starts his shift with a blur of colorful maps, figures and endless charts, but already he knows what the day will bring. lightning will strike in places he expects. winds will pick up, moist places will dry and flames will roar.