Certified Robustness to Adversarial Word Substitutions

By Robin Jia, Aditi Raghunathan, Kerem Göksel, Percy Liang. 2019

341 citations recorded by the source corpus.

State-of-the-art NLP models can often be fooled by adversaries that apply seemingly innocuous label-preserving transformations (e.g., paraphrasing) to input text. The number of possible transformations scales exponentially with text length, so data augmentation cannot cover all transformations of an input. This paper considers one exponentially large family of label-preserving transformations, in which every word in the input can be replaced with a similar word. We train the first models that are provably robust to all word substitutions in this family. Our training procedure uses Interval Bound Propagation (IBP) to minimize an upper bound on the worst-case loss that any combination of word substitutions can induce. To evaluate models’ robustness to these transformations, we measure accuracy on adversarially chosen word substitutions applied to test examples. Our IBP-trained models attain 75% adversarial accuracy on both sentiment analysis on IMDB and natural language inference on SNLI; in comparison, on IMDB, models trained normally and ones trained with data augmentation achieve adversarial accuracy of only 12% and 41%, respectively.

Subfields: Artificial Intelligence, Natural Language Processing, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Natural Language Processing

In Safety, Robustness & Interpretability

Citations in the corpus

Reducing Sentiment Bias in Language Models via Counterfactual Evaluation (2019, neutral): “Note that this speciﬁcation addresses the output distribution of a generative model, in which it differs from prior work on speciﬁcations in NLP models which concern individual predictions of discriminative models (Huang et al., 2019; Jia et al., 2019).”
A Survey of Data Augmentation Approaches for NLP (2021, background): “Adversarial examples can be generated using innocuous label-preserving transformations (e.g. paraphrasing) that fool state-of-the-art NLP models, as shown in Jia et al. (2019).”
Evaluating Models’ Local Decision Boundaries via Contrast Sets (2020, methodology): “tances for adversarial robustness in NLP (Michel et al., 2019; Jia et al., 2019), we find it more useful in our setting to simply rely on expert judgments to generate a similar but meaningfully different x′ given x, addressing both the distance function and the sampling method.”
Entailment as Few-Shot Learner (2021, methodology): “In synonym substitution (Jia et al., 2019), we sample dsub words and replace them with synonyms to construct one augmentation.”
CLEAR: Contrastive Learning for Sentence Representation (2020, neutral): “Substitution (shown in Figure 2d) has been proven efficient in improving model’s robustness (Jia et al., 2019).”
Automatic Perturbation Analysis for Scalable Certified Robustness and Beyond (2020, methodology): “We then conduct certified defense with δtrain = {1, 6} using IBP as in [19, 17] and our efficient IBP+Backward perturbation analysis.”
Utility Is in the Eye of the User: A Critique of NLP Leaderboard Design (2020, background): “Some recent work has addressed the problem of brittleness by offering certificates of performance against adversarial examples (Raghunathan et al., 2018a,b; Jia et al., 2019).”
Predicting Inductive Biases of Pre-Trained Models (2021, background): “Iyyer et al., 2018; Hsieh et al., 2019; Jia et al., 2019; Alzantot et al., 2018; Hsieh et al., 2019; Ilyas et al., 2019; Madry et al., 2017; Athalye et al., 2018) is also relevant, as it relates to the inﬂuence of dataset artifacts on models’ decisions.”
InfoBERT: Improving Robustness of Language Models from An Information Theoretic Perspective (2020, methodology): “Recent work (Huang et al., 2019; Jia et al., 2019) has applied IBP in the NLP domain to certify the robustness of models.”
Better Robustness by More Coverage: Adversarial Training with Mixup Augmentation for Robust Fine-tuning (2020, methodology): “This is the evaluation method adopted in (Zhang et al., 2019; Huang et al., 2019; Jia et al., 2019; Li et al., 2020; Zang et al., 2020; Li and Qiu, 2021, inter alia.”
Dynaboard: An Evaluation-As-A-Service Platform for Holistic Next-Generation Benchmarking (2021, background): “That is, following past work on NLP robustness [30, 31], we perturb examples and measure whether a model’s prediction changes.”
Beyond Leaderboards: A survey of methods for revealing weaknesses in Natural Language Inference data and models (2020, methodology): “Robustness: In line with the literature (Wang and Bansal, 2018; Jia et al., 2019), we call a model “robust” against a method that alters the underlying (unknown) distribution of the evaluation data when compared to the training data, such as introduced by adversarial evaluation or stress-tests, if t”
Imitation Attacks and Defenses for Black-box Machine Translation Systems (2020, background): “Recently, Jia et al. (2019) and Huang et al. (2019) train NLP models which are provably robust to word replacements.”
How Many Data Samples is an Additional Instruction Worth? (2022, methodology): “This is similar to the model robustness evaluation (Jia et al., 2019) that is done by creating variant data instances.”
Contextualized Perturbation for Textual Adversarial Attack (2020, methodology): “This aligns with previous observations (Jia et al., 2019).”
On Robust Prefix-Tuning for Text Classification (2022, methodology): “…different types of defense techniques are developed, including model functional improvement (Li & Sethy, 2019; Jones et al., 2020), certiﬁcation (Jia et al., 2019; Huang et al., 2019; Shi et al., 2020; Xu et al., 2020; Ye et al., 2020), adversary detection (Pruthi et al., 2019; Zhou et al.,…”
The statistical advantage of automatic NLG metrics at the system level (2021, background): “Optimistically, metrics could have provable guarantees, ensuring the correctness of metric decisions (Jia et al., 2019).”