Interpretable Adversarial Perturbation in Input Embedding Space for Text

By Motoki Sato, Jun Suzuki, Hiroyuki Shindo, Yuji Matsumoto. 2018

208 citations recorded by the source corpus.

Following great success in the image processing field, the idea of adversarial training has been applied to tasks in the natural language processing (NLP) field. One promising approach directly applies adversarial training developed in the image processing field to the input word embedding space instead of the discrete input space of texts. However, this approach abandons such interpretability as generating adversarial texts to significantly improve the performance of NLP tasks. This paper restores interpretability to such methods by restricting the directions of perturbations toward the existing words in the input embedding space. As a result, we can straightforwardly reconstruct each input with perturbations to an actual text by considering the perturbations to be the replacement of words in the sentence while maintaining or even improving the task performance.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Natural Language Processing, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Natural Language Processing

In Safety, Robustness & Interpretability

Citations in the corpus

Analysis Methods in Neural Language Processing: A Survey (2018, background): “, 2016b) White 7 Word Sentiment (Samanta and Mehta, 2017) White 7 Word Sentiment, gender detection (Sato et al., 2018) White 7 Word Text classification, sentiment, grammatical error detection (Liang et al.”
Humpty Dumpty: Controlling Word Meanings via Corpus Poisoning (2020, background): “Dozens of attacks and defenses have been proposed [4, 10, 22, 29, 34, 46, 62, 63, 72, 73].”
Aleatoric and epistemic uncertainty in machine learning: an introduction to concepts and methods (2019, methodology): “Figure 2: Adversarial example (right) misclassified by a machine learning model trained on textual data: Changing only a single — and apparently not very important — word (highlighted in bold font) is enough to turn the correct prediction “negative sentiment” into the incorrect prediction “positive ”
Interpretable and Trustworthy Deepfake Detection via Dynamic Prototypes (2021, background): “One prominent approach to explaining deep neural networks is posthoc analysis via gradient [54, 52, 56, 5, 53] and perturbation-based methods [19, 51, 71, 43]; however, it is known that these methods do not modify the complex underlying architecture of the network.”
Generating Natural Language Adversarial Examples through Probability Weighted Word Saliency (2019, background): “Aiming to restore the interpretability of adversarial attacks based on word substitution strategy, Sato et al. (2018) restrict the direction of perturbations towards existing words in the input embedding space.”
Adversarial Attacks on Deep Learning Models in Natural Language Processing: A Survey (2019, methodology): “These representative works received the interests of evaluation with adversarial examples recently [35, 54, 55, 92, 104, 112, 118, 130, 156].”
Aleatoric and Epistemic Uncertainty in Machine Learning: A Tutorial Introduction (2019, methodology): “Figure 2: Adversarial example (right) misclassified by a machine learning model trained on textual data: Changing only a single — and apparently not very important — word (highlighted in bold font) is enough to turn the correct prediction “negative sentiment” into the incorrect prediction “positive ”
Adv-BERT: BERT is not robust on misspellings! Generating nature adversarial samples on BERT (2020, unknown): “Both (Ribeiro et al., 2018) and (Sato et al., 2018) inﬂuence.”