Certified Robustness to Adversarial Word Substitutions

Abstract

State-of-the-art NLP models can often be fooled by adversaries that apply seemingly innocuous label-preserving transformations (e.g., paraphrasing) to input text. The number of possible transformations scales exponentially with text length, so data augmentation cannot cover all transformations of an input. This paper considers one exponentially large family of label-preserving transformations, in which every word in the input can be replaced with a similar word. We train the first models that are provably robust to all word substitutions in this family. Our training procedure uses Interval Bound Propagation (IBP) to minimize an upper bound on the worst-case loss that any combination of word substitutions can induce. To evaluate models' robustness to these transformations, we measure accuracy on adversarially chosen word substitutions applied to test examples. Our IBP-trained models attain $75\%$ adversarial accuracy on both sentiment analysis on IMDB and natural language inference on SNLI. In comparison, on IMDB, models trained normally and ones trained with data augmentation achieve adversarial accuracy of only $8\%$ and $35\%$, respectively.

EMNLP 2019

References in corpus (6)

• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Certified Defenses against Adversarial Examples
• Synthetic and Natural Noise Both Break Neural Machine Translation
• On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
• Training verified learners with learned verifiers
• HotFlip: White-Box Adversarial Examples for Text Classification

Cited by in corpus (11)

• CLEAR: Contrastive Learning for Sentence Representation
• Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifiers
• Learning perturbation sets for robust machine learning
• Reducing Sentiment Bias in Language Models via Counterfactual Evaluation
• Does Data Augmentation Improve Generalization in NLP?
• Pair the Dots: Jointly Examining Training History and Test Stimuli for Model Interpretability
• Searching for a Search Method: Benchmarking Search Algorithms for Generating NLP Adversarial Examples
• On a Utilitarian Approach to Privacy Preserving Text Generation
• Improving Robustness and Generality of NLP Models Using Disentangled Representations
• Grey-box Adversarial Attack And Defence For Sentiment Classification
• Auditing AI models for Verified Deployment under Semantic Specifications