Achieving Model Robustness through Discrete Adversarial Training (2021.emnlp-main)
Copied to clipboard
| Challenge: | Discrete adversarial attacks are symbolic perturbations to a language input that preserve the output label but lead to predicting error. |
| Approach: | They propose a discrete adversarial attack based on best-first search and random sampling attacks that are not based upon expensive search procedures. |
| Outcome: | The proposed attack outperforms offline augmentation and speedups on three datasets. |
Similar Papers
Generative Adversarial Training with Perturbed Token Detection for Model Robustness (2023.emnlp-main)
Copied to clipboard
| Challenge: | Existing adversarial training methods use discrete tokens to deceive models . current approaches use embeddings, whereas actual text-based training uses discrete text tokens. |
| Approach: | They propose a framework that integrates gradient-based learning, adversarial example generation and perturbed token detection to enhance adversariarial robustness. |
| Outcome: | The proposed framework surpasses the state-of-the-art results of ChatGPT by 10% in average accuracy. |
Consistency Training with Virtual Adversarial Discrete Perturbation (2022.naacl-main)
Copied to clipboard
| Challenge: | Existing methods for regularizing a model are agnostic to the training model and may not be effective for perturbed inputs. |
| Approach: | They propose an augmentation method of adding a discrete noise that would incur the highest divergence between predictions by replacing tokens while keeping original semantics. |
| Outcome: | The proposed method outperforms baselines on semi-supervised text classification tasks and a robustness benchmark. |
End-to-end Adversarial Sample Generation for Data Augmentation (2023.findings-emnlp)
Copied to clipboard
| Challenge: | Existing methods for generating adversarial samples have deceived many neural inference models, such as text classification and machine translation. |
| Approach: | They propose an adversarial sample generator that consists of a conditioned paraphrasing model and a condition generator and introduce a pretrained discriminator to help the adversarial sample generator adapt to the data characteristics. |
| Outcome: | The proposed approach improves the performance of the trained model on several tasks and is robust for various attacking techniques. |
Impact of Adversarial Training on Robustness and Generalizability of Language Models (2023.findings-acl)
Copied to clipboard
| Challenge: | Adversarial training is widely acknowledged as the most effective defense against adversarial attacks, but achieving both robustness and generalization requires a trade-off. |
| Approach: | They propose to compare pre-training data augmentation and training time input perturbations with embedding space perturbations to find out whether they improve generalization. |
| Outcome: | The proposed methods improve generalization and robustness of the trained models. |
BERT-ATTACK: Adversarial Attack Against BERT Using BERT (2020.emnlp-main)
Copied to clipboard
| Challenge: | Current approaches to generate adversarial samples for discrete data are heuristic replacement strategies that are difficult to implement in continuous data. |
| Approach: | They propose a method to generate adversarial samples using pre-trained masked language models using BERT. |
| Outcome: | The proposed method outperforms state-of-the-art methods in success rate and perturb percentage while remaining fluent and semantically preserved. |
Virtual Data Augmentation: A Robust and General Framework for Fine-tuning Pre-trained Models (2021.emnlp-main)
Copied to clipboard
| Challenge: | Recent studies have shown that powerful pre-trained language models can be fooled by small perturbations or intentional attacks. |
| Approach: | They propose a framework for fine-tuning PLMs using a masked language model and Gaussian noise to augment semantically relevant examples with sufficient diversity. |
| Outcome: | The proposed framework improves the robustness of pre-trained language models and alleviates performance degradation under adversarial attacks. |
Self-Supervised Contrastive Learning with Adversarial Perturbations for Defending Word Substitution-based Attacks (2022.findings-naacl)
Copied to clipboard
| Challenge: | Existing methods to improve model robustness against word substitution-based adversarial attacks are too slow to generate adversarials on the fly. |
| Approach: | They propose an approach to improve the robustness of BERT models against word substitution-based adversarial attacks by leveraging adversarials for self-supervised contrastive learning. |
| Outcome: | The proposed method improves robustness of BERT models against word substitution-based adversarial attacks without using any labeled data. |
Towards Improving Adversarial Training of NLP Models (2021.findings-emnlp)
Copied to clipboard
| Challenge: | Recent methods for generating NLP adversarial examples involve combinatorial search and expensive sentence encoders for constraining the generated instances. |
| Approach: | They propose to use vanilla adversarial training to train NLP models using a word substitution attack optimized for vanilla adversary training. |
| Outcome: | The proposed approach improves model performance and standard accuracy and can defend against other types of word substitution attacks. |
Better Robustness by More Coverage: Adversarial and Mixup Data Augmentation for Robust Finetuning (2021.findings-acl)
Copied to clipboard
| Challenge: | Pretrained language models perform poorly under adversarial attacks due to the large search space. |
| Approach: | They propose a method to cover a much larger proportion of the attack search space by adding textual adversarial examples during training. |
| Outcome: | The proposed method covers a much larger proportion of the attack search space. |
[MASK] Insertion: a robust method for anti-adversarial attacks (2023.findings-eacl)
Copied to clipboard
| Challenge: | Existing studies have focused on adversarial defenses against pretrained language models. |
| Approach: | They propose an adversarial defensing algorithm that inserts tokens into input sequences . they show an improvement in accuracy between 3.2 and 11.1 absolute points . |
| Outcome: | The proposed algorithm improves model accuracy on clean and polluted inputs compared with state-of-the-art models . |