Random Smooth-based Certified Defense against Text Adversarial Attack (2024.findings-eacl)
Copied to clipboard
| Challenge: | Textual adversarial examples train models on the worst-case text generated by substituting words in original texts with synonyms, but due to the discrete word embedding representations, the large search space hinders the robust training efficiency. |
| Approach: | They propose to treat the word substitution as a continuous perturbation on the word embedding representation and apply random smooth techniques to approximate the word replacement operation. |
| Outcome: | The proposed method outperforms conventional methods and improves the robustness in training. |
Similar Papers
Searching for an Effective Defender: Benchmarking Defense against Adversarial Word Substitution (2021.emnlp-main)
Copied to clipboard
Zongyi Li, Jianhan Xu, Jiehang Zeng, Linyang Li, Xiaoqing Zheng, Qi Zhang, Kai-Wei Chang, Cho-Jui Hsieh
| Challenge: | Existing methods to defend against adversarial word-substitution attacks have not been evaluated or compared in a systematic manner. |
| Approach: | They propose to compare different defense methods under representative adversarial attacks . they propose a method that improves the robustness of neural text classifiers against such attacks a . |
| Outcome: | The proposed method improves robustness of neural text classifiers against such attacks by a significant margin. |
Synonym-unaware Fast Adversarial Training against Textual Adversarial Attacks (2025.findings-naacl)
Copied to clipboard
| Challenge: | Existing adversarial defense methods rely on predetermined linguistic knowledge and assume that attackers’ synonym candidates are known, which is often unrealistic. |
| Approach: | They propose a Fast Adversarial Training method that leverages single-step perturbation generation and effective perturbation initialization to improve model robustness without requiring synonym awareness. |
| Outcome: | Experiments show that the proposed method outperforms existing models under character-level and word-level attacks while still maintaining the correct syntax. |
In and Out-of-Domain Text Adversarial Robustness via Label Smoothing (2023.acl-short)
Copied to clipboard
| Challenge: | Existing studies show that state-of-the-art NLP models are vulnerable to adversarial attacks . label smoothing has been proven effective in a variety of applications and modalities . |
| Approach: | They propose to use label smoothing to improve adversarial robustness in pre-trained models against various popular attacks. |
| Outcome: | The proposed method significantly improves adversarial robustness in pre-trained models against various popular attacks. |
SAFER: A Structure-free Approach for Certified Robustness to Adversarial Word Substitutions (2020.acl-main)
Copied to clipboard
| Challenge: | State-of-the-art NLP models can be fooled by human-unaware transformations such as synonymous word substitution. |
| Approach: | They propose a method that constructs a stochastic ensemble by applying random word substitutions on the input sentences and leverages the statistical properties to provably certify the robustness. |
| Outcome: | The proposed method outperforms state-of-the-art methods on IMDB and Amazon text classification tasks with practically meaningful certified accuracy. |
Weight Perturbation as Defense against Adversarial Word Substitutions (2022.findings-emnlp)
Copied to clipboard
| Challenge: | Existence and pervasiveness of textual adversarial examples have raised serious concerns to security-critical applications. |
| Approach: | They propose to perform weight perturbations in the parameter space rather than the input feature space to improve adversarial robustness of NLP models. |
| Outcome: | The proposed method improves adversarial robustness of models by performing weight perturbations in the parameter space rather than the input feature space. |
Fooling the Textual Fooler via Randomizing Latent Representations (2024.findings-acl)
Copied to clipboard
| Challenge: | Several adversarial attacks can compromise the model without accessing the model architecture or model parameters (i.e., a blackbox setting) Several studies have revealed that deep NLP models are vulnerable to adversarials that slightly perturb the input to cause the models to misbehave. |
| Approach: | They propose a lightweight and attack-agnostic defense that perplexes the process of generating an adversarial example in query-based black-box attacks. |
| Outcome: | The proposed defense is lightweight and attack-agnostic and does not necessitate additional computational overhead during training nor does it rely on assumptions about the potential adversarial perturbation set while having a negligible impact on the model’s accuracy. |
RobustSentEmbed: Robust Sentence Embeddings Using Adversarial Self-Supervised Contrastive Learning (2024.findings-naacl)
Copied to clipboard
| Challenge: | Existing pre-trained language models exhibit poor generalization and robustness in adversarial settings. |
| Approach: | They propose a self-supervised sentence embedding framework that improves generalization and robustness against adversarial attacks. |
| Outcome: | The proposed framework reduces the success rate of adversarial attacks by almost half . it also improves semantic text similarity tasks and various transfer tasks . |
Robust Encodings: A Framework for Combating Adversarial Typos (2020.acl-main)
Copied to clipboard
| Challenge: | Existing procedures to defend against adversarial perturbations of inputs are heuristic in nature and susceptible to stronger attacks. |
| Approach: | They propose a framework that provides robustness without compromises on model architecture. |
| Outcome: | The proposed framework achieves robustness on six tasks while incompatible with state-of-the-art models like BERT. |
BERT-ATTACK: Adversarial Attack Against BERT Using BERT (2020.emnlp-main)
Copied to clipboard
| Challenge: | Current approaches to generate adversarial samples for discrete data are heuristic replacement strategies that are difficult to implement in continuous data. |
| Approach: | They propose a method to generate adversarial samples using pre-trained masked language models using BERT. |
| Outcome: | The proposed method outperforms state-of-the-art methods in success rate and perturb percentage while remaining fluent and semantically preserved. |
Randomized Smoothing with Masked Inference for Adversarially Robust Text Classifications (2023.acl-long)
Copied to clipboard
| Challenge: | Large-scale pre-trained language models are brittle against specifically crafted adversarial examples, leading to increasing interest in probing the adversariality of NLP systems. |
| Approach: | They propose a two-stage framework that combines randomized smoothing and masked inference to improve the adversarial robustness of NLP systems. |
| Outcome: | The proposed framework improves adversarial robustness by 2 to 3 times over existing state-of-the-art methods on benchmark datasets. |