Is BERT Really Robust? Natural Language Attack on Text Classiﬁcation and Entailment

By Di Jin, Zhijing Jin, Joey Tianyi Zhou, Peter Szolovits. 2019

Subfields: Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Safety, Robustness & Interpretability

Citations in the corpus

Adversarial Training for Large Neural Language Models (2020, background): “However, such models can still suffer catastrophic loss in adversarial scenarios (Nie et al., 2019; Hsieh et al., 2019; Madry et al., 2017; Jin et al., 2019), with attacks as simple as replacing a few words in input sentences while preserving the semantics.”
GraDA: Graph Generative Data Augmentation for Commonsense Reasoning (2022, methodology): “To evaluate this, we use the TextFooler system (Jin et al., 2020; Yang et al., 2020; Wei and Zou, 2019) to generate adversarial text by computing word importance ranking and replacing the most influential words with their synonym in the vector space.”
Behind the Scene: Revealing the Secrets of Pre-trained Vision-and-Language Models (2020, background): “The robustness of BERT with respect to adversarial attacks was studied in [15].”
G-DAug: Generative Data Augmentation for Commonsense Reasoning (2020, methodology): “…QA (Talmor et al., 2019), and C ODAH (Chen et al., 2019) benchmarks, and also improves model robustness in terms of resistance to adversarial attacks (Jin et al., 2020) and accuracy on perturbed evaluation sets (§4), and 4. a comprehensive analysis of the factors that inﬂuence G-DA UG c ’s…”
DynaSent: A Dynamic Benchmark for Sentiment Analysis (2020, background): “It has, however, entered into a more challenging phase for research and technology development: while present-day models achieve outstanding results on all available benchmark tasks, they still fall short when deployed as part of real-world systems (Burn-Murdoch, 2013; Grimes, 2014, 2017; Gossett, 2”
BERT Loses Patience: Fast and Robust Inference with Early Exit (2020, methodology): “[6] revealed that PLMs can also be attacked with a high success rate.”
Beyond Preserved Accuracy: Evaluating Loyalty and Robustness of BERT Compression (2021, methodology): “We use an off-the-shelf adversarial attack method, TextFooler (Jin et al., 2020), which demonstrates state-of-the-art performance on attacking BERT.”
Generating Adversarial Examples in Chinese Texts Using Sentence-Pieces (2020, methodology): “Jin et al. (2019) uses word embeddings to craft candidate list S to ﬁnd substitutions while Zang et al. (2020) uses knowledge extracted from Word-Net (Fellbaum, 1998).”
GraDA: Graph Generative Data Augmentation for Commonsense Reasoning (2022, methodology): “To evaluate this, we use the TextFooler system (Jin et al., 2020; Yang et al., 2020; Wei and Zou, 2019) to generate adversarial text by computing word importance ranking and replacing the most influential words with their synonym in the vector space.”
TextAttack: A Framework for Adversarial Attacks, Data Augmentation, and Adversarial Training in NLP (2020, methodology): “In just a few lines of code, the same search method, transformation and constraints used in Jin et al. (2019)’s TextFooler can be modiﬁed to attack a translation model with the goal of changing every word in the output.”
Comparing BERT against traditional machine learning text classification (2020, methodology): “Following this reasoning, in this work [7] the authors present the TextFooler baseline, that generates adversarial text in order to fool BERT’s classification [7].”
Linguistically-Informed Transformations (LIT): A Method for Automatically Generating Contrast Sets (2020, methodology): “Compared to previous work showing that BERT is not robust and fails to generalize on out-of-distribution test sets (McCoy et al., 2019; Zhou et al., 2019; Jin et al., 2019b), our method provides a more ﬁne-grained picture showing on which phenomenon the models fail.”
Explainability for Large Language Models: A Survey (2023, background): “Example-based explanations intend to explain model behavior from the perspective of individual instances (Koh & Liang, 2017) (Jin et al., 2020) have been advanced, which strategically target important words first based on ranking.”
Contextualized Perturbation for Textual Adversarial Attack (2020, methodology): “Following (Jin et al., 2020; Morris et al., 2020b), we calculate this using the universal sentence encoder (USE; Cer et al.”
It’s Morphin’ Time! Combating Linguistic Discrimination with Inflectional Perturbations (2020, background): “Alzantot et al. (2018) and Jin et al. (2019) explore the use of synonym substitution to create adversarial examples, using word embeddings to find the n nearest words.”
Token-Aware Virtual Adversarial Training in Natural Language Understanding (2021, methodology): “Instead of using gradients to craft perturbations, most common methods usually replace the original texts based on certain rules such as replacing words with semantically similar words (Alzantot et al. 2018; Jin et al. 2019; Li et al. 2020).”
BAE: BERT-based Adversarial Examples for Text Classification (2020, methodology): “Jin et al. (2019) combine both these works by proposing TextFooler, a strong black-box attack baseline for text classiﬁcation models.”
Adversarial Training for Commonsense Inference (2020, background): “Moreover, some researchers have shown that such pre-trained models are vulnerable to adversarial attacks ( Jin et al., 2020).”