Adv-BERT: BERT is not robust on misspellings! Generating nature adversarial samples on BERT

Abstract

There is an increasing amount of literature that claims the brittleness of deep neural networks in dealing with adversarial examples that are created maliciously. It is unclear, however, how the models will perform in realistic scenarios where \textit{natural rather than malicious} adversarial instances often exist. This work systematically explores the robustness of BERT, the state-of-the-art Transformer-style model in NLP, in dealing with noisy data, particularly mistakes in typing the keyboard, that occur inadvertently. Intensive experiments on sentiment analysis and question answering benchmarks indicate that: (i) Typos in various words of a sentence do not influence equally. The typos in informative words make severer damages; (ii) Mistype is the most damaging factor, compared with inserting, deleting, etc.; (iii) Humans and machines have different focuses on recognizing adversarial attacks.

References in corpus (7)

• Google's Neural Machine Translation System: Bridging the Gap between Human and Machine Translation
• Generating Natural Adversarial Examples
• Deep Text Classification Can be Fooled
• Synthetic and Natural Noise Both Break Neural Machine Translation
• HotFlip: White-Box Adversarial Examples for Text Classification
• Interpretable Adversarial Perturbation in Input Embedding Space for Text
• On Evaluation of Adversarial Perturbations for Sequence-to-Sequence Models

Cited by in corpus (27)

• Pre-trained Models for Natural Language Processing: A Survey
• Adversarial Example Detection for DNN Models: A Review and Experimental Comparison
• Named Entity Recognition and Classification on Historical Documents: A Survey
• CANINE: Pre-training an Efficient Tokenization-Free Encoder for Language Representation
• Charformer: Fast Character Transformers via Gradient-based Subword Tokenization
• AMMUS : A Survey of Transformer-based Pretrained Models in Natural Language Processing
• Measuring a hate speech spectrum with faceted Rasch item response theory and perspective-aware, explainable-by-design deep learning
• CharacterBERT: Reconciling ELMo and BERT for Word-Level Open-Vocabulary Representations From Characters
• CharacterBERT and Self-Teaching for Improving the Robustness of Dense Retrievers on Queries with Typos
• Natural Backdoor Attack on Text Data
• Transformers: "The End of History" for NLP?
• Analysing the Robustness of Dual Encoders for Dense Retrieval Against Misspellings
• Language Modelling with Pixels
• Model Extraction and Adversarial Transferability, Your BERT is Vulnerable!
• An Effective, Robust and Fairness-aware Hate Speech Detection Framework
• Do We Need Online NLU Tools?
• Analyzing Semantic Faithfulness of Language Models via Input Intervention on Question Answering
• Noisy Text Data: Achilles' Heel of popular transformer based NLP models
• A little goes a long way: Improving toxic language classification despite data scarcity
• Robust Transfer Learning with Pretrained Language Models through Adapters
• User Preference-aware Fake News Detection
• Contrastive Fine-tuning Improves Robustness for Neural Rankers
• Dual Head Adversarial Training
• Breaking BERT: Understanding its Vulnerabilities for Named Entity Recognition through Adversarial Attack
• Adversarial Attacks Against Deep Learning Systems for ICD-9 Code Assignment
• What's in a Name? Are BERT Named Entity Representations just as Good for any other Name?
• Robust Learning for Text Classification with Multi-source Noise Simulation and Hard Example Mining