Perturbing Inputs for Fragile Interpretations in Deep Natural Language Processing

Abstract

Interpretability methods like Integrated Gradient and LIME are popular choices for explaining natural language model predictions with relative word importance scores. These interpretations need to be robust for trustworthy NLP applications in high-stake areas like medicine or finance. Our paper demonstrates how interpretations can be manipulated by making simple word perturbations on an input text. Via a small portion of word-level swaps, these adversarial perturbations aim to make the resulting text semantically and spatially similar to its seed input (therefore sharing similar interpretations). Simultaneously, the generated examples achieve the same prediction label as the seed yet are given a substantially different explanation by the interpretation methods. Our experiments generate fragile interpretations to attack two SOTA interpretation methods, across three popular Transformer models and on two different NLP datasets. We observe that the rank order correlation drops by over 20% when less than 10% of words are perturbed on average. Further, rank-order correlation keeps decreasing as more words get perturbed. Furthermore, we demonstrate that candidates generated from our method have good quality metrics.

arXiv commentEMNLP-BlackboxNLP, 2021

References in corpus (10)

• Axiomatic Attribution for Deep Networks
• Learning Important Features Through Propagating Activation Differences
• Universal Sentence Encoder
• Model-Agnostic Interpretability of Machine Learning
• Understanding Neural Networks through Representation Erasure
• Generating Natural Adversarial Examples
• Deep Text Classification Can be Fooled
• Towards Crafting Text Adversarial Samples
• TextAttack: A Framework for Adversarial Attacks, Data Augmentation, and Adversarial Training in NLP
• A simple defense against adversarial attacks on heatmap explanations