Combating Adversarial Misspellings with Robust Word Recognition

Abstract

To combat adversarial spelling mistakes, we propose placing a word recognition model in front of the downstream classifier. Our word recognition models build upon the RNN semi-character architecture, introducing several new backoff strategies for handling rare and unseen words. Trained to recognize words corrupted by random adds, drops, swaps, and keyboard mistakes, our method achieves 32% relative (and 3.3% absolute) error reduction over the vanilla semi-character model. Notably, our pipeline confers robustness on the downstream classifier, outperforming both adversarial training and off-the-shelf spell checkers. Against a BERT model fine-tuned for sentiment analysis, a single adversarially-chosen character attack lowers accuracy from 90.3% to 45.8%. Our defense restores accuracy to 75%. Surprisingly, better word recognition does not always entail greater robustness. Our analysis reveals that robustness also depends upon a quantity that we denote the sensitivity.

arXiv commentACL 2019, long paper

References in corpus (6)

• Google's Neural Machine Translation System: Bridging the Gap between Human and Machine Translation
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Understanding Neural Networks through Representation Erasure
• Generating Natural Adversarial Examples
• On Adversarial Examples for Character-Level Neural Machine Translation
• Spelling Error Correction Using a Nested RNN Model and Pseudo Training Data

Cited by in corpus (14)

• BERT-ATTACK: Adversarial Attack Against BERT Using BERT
• Human Instruction-Following with Deep Reinforcement Learning via Transfer-Learning from Text
• Natural Backdoor Attack on Text Data
• Adversarial Attacks and Defense on Texts: A Survey
• MALCOM: Generating Malicious Comments to Attack Neural Fake News Detection Models
• Adversarial Black-Box Attacks On Text Classifiers Using Multi-Objective Genetic Optimization Guided By Deep Networks
• Generating Semantically Valid Adversarial Questions for TableQA
• Android Security using NLP Techniques: A Review
• Learning Multi-level Dependencies for Robust Word Recognition
• Adversarial Evaluation of Multimodal Models under Realistic Gray Box Assumption
• Normalizing Text using Language Modelling based on Phonetics and String Similarity
• What's in a Name? Are BERT Named Entity Representations just as Good for any other Name?
• FireBERT: Hardening BERT-based classifiers against adversarial attack
• Robustness to Programmable String Transformations via Augmented Abstract Training