Adv-BERT: BERT is not robust on misspellings! Generating nature adversarial samples on BERT

By Lichao Sun, Kazuma Hashimoto, Wenpeng Yin, Akari Asai, Jia Li, Philip S. Yu, Caiming Xiong. 2020

117 citations recorded by the source corpus.

There is an increasing amount of literature that claims the brittleness of deep neural networks in dealing with adversarial examples that are created maliciously. It is unclear, however, how the models will perform in realistic scenarios where \textit{natural rather than malicious} adversarial instances often exist. This work systematically explores the robustness of BERT, the state-of-the-art Transformer-style model in NLP, in dealing with noisy data, particularly mistakes in typing the keyboard, that occur inadvertently. Intensive experiments on sentiment analysis and question answering benchmarks indicate that: (i) Typos in various words of a sentence do not influence equally. The typos in informative words make severer damages; (ii) Mistype is the most damaging factor, compared with inserting, deleting, etc.; (iii) Humans and machines have different focuses on recognizing adversarial attacks.

Subfields: Artificial Intelligence, Sociology and Political Science

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Sociology and Political Science

Citations in the corpus

Pre-trained models for natural language processing: A survey (2020, background): “[168] showed BERT is not robust on misspellings.”
Charformer: Fast Character Transformers via Gradient-based Subword Tokenization (2021, background): “As a result, models are brittle to rare words (Gong et al., 2018) and perturbations, both natural and adversarial (Belinkov and Bisk, 2018; Pruthi et al., 2019; Sun et al., 2020).”
Canine: Pre-training an Efficient Tokenization-Free Encoder for Language Representation (2021, methodology): “BERT, which uses WordPiece tokenization, is sensitive to corruptions of the input, both natural typos (Sun et al., 2020) and adversarial manipulations (Pruthi et al.”
Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attacks (2023, background): “The simplest form of obfuscation is to add typos or use synonyms for terms that trigger input or output ﬁlters (Sun et al., 2020; Jones et al., 2020).”
AMMUS : A Survey of Transformer-based Pretrained Models in Natural Language Processing (2021, background): “Transformer-based PTLMs are brittle to noise which includes both adversarial and natural noise [291], [292] .”
CharacterBERT: Reconciling ELMo and BERT for Word-Level Open-Vocabulary Representations From Characters (2020, background): “This improved robustness is desirable since BERT seems to be sensitive to misspellings (Pruthi et al., 2019; Sun et al., 2020).”
User Preference-aware Fake News Detection (2021, methodology): “For example, SAFE [36] and FakeBERT [11] used the TextCNN [35] and BERT [5, 28, 29] to encode the news textual information, respectively; GCNFN [17] and GNN-CL [8] leveraged the GCN [14] to encode the news propagation patterns on social media (e.”