Learning to Discriminate Perturbations for Blocking Adversarial Attacks in Text Classification

Abstract

Adversarial attacks against machine learning models have threatened various real-world applications such as spam filtering and sentiment analysis. In this paper, we propose a novel framework, learning to DIScriminate Perturbations (DISP), to identify and adjust malicious perturbations, thereby blocking adversarial attacks for text classification models. To identify adversarial attacks, a perturbation discriminator validates how likely a token in the text is perturbed and provides a set of potential perturbations. For each potential perturbation, an embedding estimator learns to restore the embedding of the original word based on the context and a replacement token is chosen based on approximate kNN search. DISP can block adversarial attacks for any NLP model without modifying the model structure or training procedure. Extensive experiments on two benchmark datasets demonstrate that DISP significantly outperforms baseline methods in blocking adversarial attacks for text classification. In addition, in-depth analysis shows the robustness of DISP across different situations.

10 pages, 8 tables, 4 figures

References in corpus (5)

• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Deep Text Classification Can be Fooled
• Towards Crafting Text Adversarial Samples
• HotFlip: White-Box Adversarial Examples for Text Classification
• Towards a Robust Deep Neural Network in Texts: A Survey

Cited by in corpus (5)

• Simplified DOM Trees for Transferable Attribute Extraction from the Web
• Improving the Robustness of Transformer-based Large Language Models with Dynamic Attention
• Enhancing Model Robustness By Incorporating Adversarial Knowledge Into Semantic Representation
• Adversarially Robust and Explainable Model Compression with On-Device Personalization for Text Classification
• Adversarial Machine Learning in Text Analysis and Generation