Certified Robustness to Word Substitution Attack with Differential Privacy (2021.naacl-main)
Copied to clipboard
| Challenge: | Recent studies have shown that adversarial examples can be easily fooled by DNNs, making the robustness and security of NLP models significantly important. |
| Approach: | They propose a differential privacy-based algorithm to achieve certified robustness against word substitution at- tacks in text classification via differential privacy. |
| Outcome: | The proposed model achieves higher accuracy and more than 30X efficiency improvement over existing defense algorithms. |
Similar Papers
SAFER: A Structure-free Approach for Certified Robustness to Adversarial Word Substitutions (2020.acl-main)
Copied to clipboard
| Challenge: | State-of-the-art NLP models can be fooled by human-unaware transformations such as synonymous word substitution. |
| Approach: | They propose a method that constructs a stochastic ensemble by applying random word substitutions on the input sentences and leverages the statistical properties to provably certify the robustness. |
| Outcome: | The proposed method outperforms state-of-the-art methods on IMDB and Amazon text classification tasks with practically meaningful certified accuracy. |
Robustness-Aware Word Embedding Improves Certified Robustness to Adversarial Word Substitutions (2023.findings-acl)
Copied to clipboard
| Challenge: | Embedding interval bound constraint is important for NLP models to be certified robust, but adversarial examples can be crafted by synonym substitutions. |
| Approach: | They propose a triplet loss to train robustness-aware word embeddings for better certified robustness. |
| Outcome: | The proposed method outperforms state-of-the-art certified defense baselines and generalizes well to unseen substitutions. |
Certified Robustness to Adversarial Word Substitutions (D19-1)
Copied to clipboard
| Challenge: | State-of-the-art NLP models can be fooled by adversaries that apply seemingly innocuous label-preserving transformations to input text. |
| Approach: | They propose to train models that are provably robust to all word substitutions in a family of label-preserving transformations that can be replaced with a similar word without changing the original sentiment. |
| Outcome: | The proposed models achieve 75% adversarial accuracy on both sentiment analysis and natural language inference on IMDB and SNLI compared to models trained normally and ones trained with data augmentation. |
Differentially Private Representation for NLP: Formal Guarantee and An Empirical Study on Privacy and Fairness (2020.findings-emnlp)
Copied to clipboard
| Challenge: | Existing approaches to learn text representations can encode private information of the input, thus can be exploited to recover such information with reasonable accuracy. |
| Approach: | They propose a novel approach to preserve privacy of the extracted representation from text by combining differential privacy with dropout. |
| Outcome: | The proposed approach preserves privacy of the extracted representation from text while masking words via dropout can enhance privacy. |
CR-UTP: Certified Robustness against Universal Text Perturbations on Large Language Models (2024.findings-acl)
Copied to clipboard
| Challenge: | Existing certified robustness methods for certifying input-specific text perturbations have shown promise in certifyling UTPs, but masking only adversarial words can eliminate the attack. |
| Approach: | They propose a method to certify a language model’s robustness against UTPs by using random smoothing. |
| Outcome: | The proposed method achieves high certified accuracy under extensive masking and achieves state-of-the-art results in multiple settings. |
ADePT: Auto-encoder based Differentially Private Text Transformation (2021.eacl-main)
Copied to clipboard
| Challenge: | Differential privacy is an important privacy concern when building statistical models on data containing sensitive information. |
| Approach: | They propose a utility-preserving differentially private text transformation algorithm using auto-encoders that can be used to transform text to offer robustness against attacks and produce transformations with high semantic quality. |
| Outcome: | The proposed model performs better against membership inference attacks while offering lower to no degradation in the utility of the underlying transformation process compared to baselines. |
Synthetic Text Generation with Differential Privacy: A Simple and Practical Recipe (2023.acl-long)
Copied to clipboard
Xiang Yue, Huseyin Inan, Xuechen Li, Girish Kumar, Julia McAnallen, Hoda Shajari, Huan Sun, David Levitan, Robert Sim
| Challenge: | Privacy concerns have increased in data-driven products due to the tendency of machine learning models to memorize sensitive training data. |
| Approach: | They propose a method for generating useful synthetic text with a formal privacy guarantee by fine-tuning a pretrained generative language model with DP. |
| Outcome: | The proposed method produces synthetic text competitive in terms of utility with its non-private counterpart, while providing strong protection against potential privacy leakages. |
A Customized Text Sanitization Mechanism with Differential Privacy (2023.findings-acl)
Copied to clipboard
| Challenge: | Existing methods to sanitize texts subject to differential privacy do not work for non-metric semantic similarity measures. |
| Approach: | They propose a customized text sanitization mechanism based on a metric local differential privacy definition. |
| Outcome: | The proposed mechanism achieves better privacy-utility trade-offs than existing mechanisms on benchmark datasets. |
Differentially Private Natural Language Models: Recent Advances and Future Directions (2024.findings-eacl)
Copied to clipboard
| Challenge: | Recent advances in deep learning have led to great success in various natural language processing tasks. |
| Approach: | They propose a systematic review of recent advances in DP deep learning models . they discuss some differences and additional challenges of DP-NLP . |
| Outcome: | The proposed method can prevent reconstruction attacks and protect against potential side knowledge while maintaining the privacy of sensitive data. |
The Limits of Word Level Differential Privacy (2022.findings-naacl)
Copied to clipboard
| Challenge: | Existing methods to anonymize textual data have several shortcomings . authors show that they can overcome these weaknesses and offer a formal privacy guarantee . |
| Approach: | They propose a method that circumvents most of the identified weaknesses and offers a formal privacy guarantee. |
| Outcome: | The proposed method outperforms the proposed methods in thourough experimentation and shows superior performance. |