Improving the Robustness of Transformer-based Large Language Models with Dynamic Attention

Abstract

Transformer-based models, such as BERT and GPT, have been widely adopted in natural language processing (NLP) due to their exceptional performance. However, recent studies show their vulnerability to textual adversarial attacks where the model's output can be misled by intentionally manipulating the text inputs. Despite various methods that have been proposed to enhance the model's robustness and mitigate this vulnerability, many require heavy consumption resources (e.g., adversarial training) or only provide limited protection (e.g., defensive dropout). In this paper, we propose a novel method called dynamic attention, tailored for the transformer architecture, to enhance the inherent robustness of the model itself against various adversarial attacks. Our method requires no downstream task knowledge and does not incur additional costs. The proposed dynamic attention consists of two modules: (I) attention rectification, which masks or weakens the attention value of the chosen tokens, and (ii) dynamic modeling, which dynamically builds the set of candidate tokens. Extensive experiments demonstrate that dynamic attention significantly mitigates the impact of adversarial attacks, improving up to 33\% better performance than previous methods against widely-used adversarial attacks. The model-level design of dynamic attention enables it to be easily combined with other defense methods (e.g., adversarial training) to further enhance the model's robustness. Furthermore, we demonstrate that dynamic attention preserves the state-of-the-art robustness space of the original model compared to other dynamic modeling methods.

References in corpus (38)

• Explaining and Harnessing Adversarial Examples
• Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformer
• Character-level Convolutional Networks for Text Classification
• Language Models are Few-Shot Learners
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Certified Adversarial Robustness via Randomized Smoothing
• Pre-train, Prompt, and Predict: A Systematic Survey of Prompting Methods in Natural Language Processing
• Informer: Beyond Efficient Transformer for Long Sequence Time-Series Forecasting
• TextBugger: Generating Adversarial Text Against Real-world Applications
• Prefix-Tuning: Optimizing Continuous Prompts for Generation
• FreeLB: Enhanced Adversarial Training for Natural Language Understanding
• Adversarial Attacks on Deep Learning Models in Natural Language Processing: A Survey
• Stochastic Activation Pruning for Robust Adversarial Defense
• Adversarial Graph Augmentation to Improve Graph Contrastive Learning
• Adversarial Training Can Hurt Generalization
• Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailment
• A Closer Look at Accuracy vs. Robustness
• Backdoor Pre-trained Models Can Transfer to All
• Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifiers
• Defensive Dropout for Hardening Deep Neural Networks under Adversarial Attacks
• Recent Advances in Adversarial Training for Adversarial Robustness
• Robustness Verification for Transformers
• Why do Larger Models Generalize Better? A Theoretical Perspective via the XOR Problem
• Improving the Adversarial Robustness of NLP Models by Information Bottleneck
• SoK: Certified Robustness for Deep Neural Networks
• A Statistical Approach to Assessing Neural Network Robustness
• Learning to Discriminate Perturbations for Blocking Adversarial Attacks in Text Classification
• Gradient Obfuscation Gives a False Sense of Security in Federated Learning
• Towards Robust Detection of Adversarial Examples
• Blacklight: Scalable Defense for Neural Networks against Query-Based Black-Box Attacks
• Detecting Textual Adversarial Examples through Randomized Substitution and Vote
• Random Noise Defense Against Query-Based Black-Box Attacks
• Fast Certified Robust Training with Short Warmup
• Detecting Adversarial Examples from Sensitivity Inconsistency of Spatial-Transform Domain
• Why adversarial training can hurt robust accuracy
• Lipschitz Bounds and Provably Robust Training by Laplacian Smoothing
• Towards Improving Adversarial Training of NLP Models
• Defense of Word-level Adversarial Attacks via Random Substitution Encoding