On Evaluation of Adversarial Perturbations for Sequence-to-Sequence Models

Abstract

Adversarial examples --- perturbations to the input of a model that elicit large changes in the output --- have been shown to be an effective way of assessing the robustness of sequence-to-sequence (seq2seq) models. However, these perturbations only indicate weaknesses in the model if they do not change the input so significantly that it legitimately results in changes in the expected output. This fact has largely been ignored in the evaluations of the growing body of related literature. Using the example of untargeted attacks on machine translation (MT), we propose a new evaluation framework for adversarial attacks on seq2seq models that takes the semantic equivalence of the pre- and post-perturbation input into account. Using this framework, we demonstrate that existing methods may not preserve meaning in general, breaking the aforementioned assumption that source side perturbations should not result in changes in the expected output. We further use this framework to demonstrate that adding additional constraints on attacks allows for adversarial perturbations that are more meaning-preserving, but nonetheless largely change the output sequence. Finally, we show that performing untargeted adversarial training with meaning-preserving attacks is beneficial to the model in terms of adversarial robustness, without hurting test performance. A toolkit implementing our evaluation framework is released at https://github.com/pmichel31415/teapot-nlp.

NAACL-HLT 2019 long paper

References in corpus (6)

• End to End Learning for Self-Driving Cars
• Adversarial Perturbations Against Deep Neural Networks for Malware Classification
• On Adversarial Examples for Character-Level Neural Machine Translation
• Towards Crafting Text Adversarial Samples
• Deceiving Google's Perspective API Built for Detecting Toxic Comments
• Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples

Cited by in corpus (10)

• Adv-BERT: BERT is not robust on misspellings! Generating nature adversarial samples on BERT
• Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples
• Better Robustness by More Coverage: Adversarial Training with Mixup Augmentation for Robust Fine-tuning
• Adversarial Attacks and Defense on Texts: A Survey
• Generating Natural Language Adversarial Examples on a Large Scale with Generative Models
• A Reinforced Generation of Adversarial Examples for Neural Machine Translation
• Do Fine-tuned Commonsense Language Models Really Generalize?
• Generating Semantically Valid Adversarial Questions for TableQA
• On Robustness of Neural Semantic Parsers
• Doubly-Trained Adversarial Data Augmentation for Neural Machine Translation