Defense against Adversarial Attacks in NLP via Dirichlet Neighborhood Ensemble

Abstract

Despite neural networks have achieved prominent performance on many natural language processing (NLP) tasks, they are vulnerable to adversarial examples. In this paper, we propose Dirichlet Neighborhood Ensemble (DNE), a randomized smoothing method for training a robust model to defense substitution-based attacks. During training, DNE forms virtual sentences by sampling embedding vectors for each word in an input sentence from a convex hull spanned by the word and its synonyms, and it augments them with the training data. In such a way, the model is robust to adversarial attacks while maintaining the performance on the original clean data. DNE is agnostic to the network architectures and scales to large models for NLP applications. We demonstrate through extensive experimentation that our method consistently outperforms recently proposed defense methods by a significant margin across different network architectures and multiple data sets.

References in corpus (11)

• Certified Adversarial Robustness via Randomized Smoothing
• Robust Physical-World Attacks on Deep Learning Models
• Deep Text Classification Can be Fooled
• On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
• Mitigating Adversarial Effects Through Randomization
• Towards Crafting Text Adversarial Samples
• Training verified learners with learned verifiers
• Robustness Verification for Transformers
• Word Embedding Perturbation for Sentence Classification
• DANCin SEQ2SEQ: Fooling Text Classifiers with Adversarial Text Example Generation
• Interpretable Adversarial Training for Text

Cited by in corpus (10)

• "That Is a Suspicious Reaction!": Interpreting Logits Variation to Detect NLP Adversarial Attacks
• Improving the Adversarial Robustness of NLP Models by Information Bottleneck
• Better Robustness by More Coverage: Adversarial Training with Mixup Augmentation for Robust Fine-tuning
• Defending Against Backdoor Attacks in Natural Language Generation
• Pair the Dots: Jointly Examining Training History and Test Stimuli for Model Interpretability
• Developing Future Human-Centered Smart Cities: Critical Analysis of Smart City Security, Interpretability, and Ethical Challenges
• Improving Robustness and Generality of NLP Models Using Disentangled Representations
• Grey-box Adversarial Attack And Defence For Sentiment Classification
• Adversarial Machine Learning in Text Analysis and Generation
• Searching for an Effective Defender: Benchmarking Defense against Adversarial Word Substitution