DSRM: Boost Textual Adversarial Training with Distribution Shift Risk Minimization (2023.acl-long)
Copied to clipboard
| Challenge: | Existing adversarial training methods require multi-step gradient ascents or word substitutions to obtain adversarials, which impairs the effectiveness of adversariarial training. |
| Approach: | They propose a procedure for instead adversarial training with only clean data that estimates the adversarials loss by perturbing the input data’s probability distribution rather than their embeddings. |
| Outcome: | The proposed procedure reduces time consumption by up to 70% compared to current best-performing adversarial training methods. |
Similar Papers
Flooding-X: Improving BERT’s Resistance to Adversarial Attacks via Loss-Restricted Fine-Tuning (2022.acl-long)
Copied to clipboard
Qin Liu, Rui Zheng, Bao Rong, Jingyi Liu, ZhiHua Liu, Zhanzhan Cheng, Liang Qiao, Tao Gui, Qi Zhang, Xuanjing Huang
| Challenge: | Existing approaches to generating adversarial perturbations scale up the cost of training computational complexity by the number of gradient steps it takes to obtain the adversarials. |
| Approach: | They propose a flood method which aims at better generalization and a criterion to bring hyper-parameter-dependent flooding into effect with a narrowed-down search space by measuring how the gradient steps taken within one epoch affect the loss of each batch. |
| Outcome: | The proposed method improves BERT’s resistance to textual adversarial attacks by a large margin and achieves state-of-the-art robust accuracy on various text classification and GLUE tasks. |
SemRoDe: Macro Adversarial Training to Learn Representations that are Robust to Word-Level Attacks (2024.naacl-long)
Copied to clipboard
| Challenge: | Existing approaches to defend against word-level attacks have been limited. |
| Approach: | They propose a new approach called Semantic Robust Defence to enhance the robustness of language models by aligning the domains with a distance-based objective. |
| Outcome: | The proposed approach can be generalized across word embeddings, even when they share minimal overlap at both vocabulary and word-substitution levels. |
Don’t Take the Easy Way Out: Ensemble Based Methods for Avoiding Known Dataset Biases (D19-1)
Copied to clipboard
| Challenge: | Recent advances in neural models exploit dataset-specific patterns that do not generalize well to out-of-domain or adversarial settings. |
| Approach: | They propose to train a model to be more robust to domain shift if it has prior knowledge of dataset biases. |
| Outcome: | The proposed model can be more robust to domain shift if it has prior knowledge of dataset biases. |
DA3: A Distribution-Aware Adversarial Attack against Language Models (2024.emnlp-main)
Copied to clipboard
| Challenge: | Recent attacks have shown that adversarial examples have a different data distribution than the original examples, reducing their effectiveness under detection methods. |
| Approach: | They propose a distribution-aware adversarial attack method that considers the distribution shifts of adversarials to improve attacks’ effectiveness under detection methods. |
| Outcome: | The proposed method improves the effectiveness of adversarial examples under detection methods and integrates both ASR and detectability. |
Domain Adversarial Fine-Tuning as an Effective Regularizer (2020.findings-emnlp)
Copied to clipboard
| Challenge: | Existing fine-tuning techniques can degrade general-domain representations . however, fine-timing can lead to catastrophic forgetting of knowledge . |
| Approach: | They propose a new regularization technique that complements the task-specific loss used during fine-tuning with an adversarial objective. |
| Outcome: | Empirical results show that AFTER improves performance on various natural language understanding tasks compared to standard fine-tuning. |
Improving Gradient-based Adversarial Training for Text Classification by Contrastive Learning and Auto-Encoder (2021.findings-acl)
Copied to clipboard
| Challenge: | Recent work has shown that models can be easily fooled by intentionally designed adversarial examples. |
| Approach: | They propose two efficient approaches for generating adversarial perturbations on embeddings and propose two new approaches to help model learn adversarials more efficiently. |
| Outcome: | The proposed approaches outperform strong baselines on various text classification datasets and the model's performance drops less under adversarial attack. |
Adversarial Preference Learning for Robust LLM Alignment (2025.findings-acl)
Copied to clipboard
Yuanfu Wang, Pengyu Wang, Chenyang Xi, Bo Tang, Junyi Zhu, Wenqiang Wei, Chen Chen, Chao Yang, Jingfeng Zhang, Chaochao Lu, Yijun Niu, Keming Mao, Zhiyu Li, Feiyu Xiong, Jie Hu, Mingchuan Yang
| Challenge: | Modern language models rely on Reinforcement Learning from Human Feedback (RLHF) to encourage safe behaviors, but they remain vulnerable to adversarial attacks due to three key limitations: (1) the inefficiency and high cost of human annotation; (2) the vast diversity of potential adversarials; and (3) the risk of feedback bias and reward hacking. |
| Approach: | They propose an iterative adversarial training method that incorporates three key innovations to address these challenges. |
| Outcome: | Experiments on Mistral-7B-Instruct-v0.3 show that the proposed method significantly enhances robustness and reduces harmful outputs from 5.88% to 0.43%. |
BERT-ATTACK: Adversarial Attack Against BERT Using BERT (2020.emnlp-main)
Copied to clipboard
| Challenge: | Current approaches to generate adversarial samples for discrete data are heuristic replacement strategies that are difficult to implement in continuous data. |
| Approach: | They propose a method to generate adversarial samples using pre-trained masked language models using BERT. |
| Outcome: | The proposed method outperforms state-of-the-art methods in success rate and perturb percentage while remaining fluent and semantically preserved. |
Generative Adversarial Training with Perturbed Token Detection for Model Robustness (2023.emnlp-main)
Copied to clipboard
| Challenge: | Existing adversarial training methods use discrete tokens to deceive models . current approaches use embeddings, whereas actual text-based training uses discrete text tokens. |
| Approach: | They propose a framework that integrates gradient-based learning, adversarial example generation and perturbed token detection to enhance adversariarial robustness. |
| Outcome: | The proposed framework surpasses the state-of-the-art results of ChatGPT by 10% in average accuracy. |
Step by Step Loss Goes Very Far: Multi-Step Quantization for Adversarial Text Attacks (2023.eacl-main)
Copied to clipboard
| Challenge: | Existing gradient-based attacks quantize all tokens in a text at once, which creates a significant gap between adversarial loss for continuous and discrete text representations. |
| Approach: | They propose a gradient-based attack that quantizes tokens one by one and reoptimizes adversarial example after each quantization. |
| Outcome: | The proposed method outperforms other approaches on various natural language processing tasks. |