Achieving Verified Robustness to Symbol Substitutions via Interval Bound Propagation (D19-1)
Copied to clipboard
Po-Sen Huang, Robert Stanforth, Johannes Welbl, Chris Dyer, Dani Yogatama, Sven Gowal, Krishnamurthy Dvijotham, Pushmeet Kohli
| Challenge: | Recent work has exposed the vulnerabilities of neural NLP models, e.g. with small, semantically invariant input alterations. |
| Approach: | They propose to model text classification under synonym replacements or character flip perturbations and then use a formal model verification method to verify its robustness. |
| Outcome: | The proposed models show little difference in terms of nominal accuracy, but have much improved verified accuracy under perturbations and come with an efficiently computable formal guarantee on worst case adversaries. |
Similar Papers
Certified Robustness to Adversarial Word Substitutions (D19-1)
Copied to clipboard
| Challenge: | State-of-the-art NLP models can be fooled by adversaries that apply seemingly innocuous label-preserving transformations to input text. |
| Approach: | They propose to train models that are provably robust to all word substitutions in a family of label-preserving transformations that can be replaced with a similar word without changing the original sentiment. |
| Outcome: | The proposed models achieve 75% adversarial accuracy on both sentiment analysis and natural language inference on IMDB and SNLI compared to models trained normally and ones trained with data augmentation. |
TextVerifier: Robustness Verification for Textual Classifiers with Certifiable Guarantees (2023.findings-acl)
Copied to clipboard
| Challenge: | a textual classifier must withstand word-level alteration attacks due to inherent vulnerability. |
| Approach: | They propose a formal verification framework with certifiable guarantees on deep neural networks in natural language processing against word-level alteration attacks. |
| Outcome: | The proposed framework provides an approximation of the maximal safe radius with tight bounds . it yields an efficient speed edge and reliable anytime estimation . |
Random Smooth-based Certified Defense against Text Adversarial Attack (2024.findings-eacl)
Copied to clipboard
| Challenge: | Textual adversarial examples train models on the worst-case text generated by substituting words in original texts with synonyms, but due to the discrete word embedding representations, the large search space hinders the robust training efficiency. |
| Approach: | They propose to treat the word substitution as a continuous perturbation on the word embedding representation and apply random smooth techniques to approximate the word replacement operation. |
| Outcome: | The proposed method outperforms conventional methods and improves the robustness in training. |
Evaluating Neural Model Robustness for Machine Comprehension (2021.eacl-main)
Copied to clipboard
| Challenge: | evaluating model robustness to adversarial attacks can provide deeper understanding of how deep neural networks work and what kind of linguistic information is actually captured by neural networks. |
| Approach: | They propose a method for strategic sentence-level perturbations to evaluate model robustness to adversarial attacks using character and word perturbations. |
| Outcome: | The proposed model improves model performance during adversarial attacks by using ensembles and predicts errors in adversarials. |
Robust Encodings: A Framework for Combating Adversarial Typos (2020.acl-main)
Copied to clipboard
| Challenge: | Existing procedures to defend against adversarial perturbations of inputs are heuristic in nature and susceptible to stronger attacks. |
| Approach: | They propose a framework that provides robustness without compromises on model architecture. |
| Outcome: | The proposed framework achieves robustness on six tasks while incompatible with state-of-the-art models like BERT. |
Robustness Evaluation of Text Classification Models Using Mathematical Optimization and Its Application to Adversarial Training (2022.findings-aacl)
Copied to clipboard
| Challenge: | Neural networks are vulnerable to adversarial examples due to slightly perturbed input data. |
| Approach: | They propose a method that evaluates the robustness of text classification models by an optimization problem that identifies a minimum synonym swap that changes the classification result. |
| Outcome: | The proposed method achieves high scores in human evaluations of grammatical correctness and semantic similarity for an IMDb dataset and implements adversarial training with the IMD and SST2 datasets. |
Self-Supervised Contrastive Learning with Adversarial Perturbations for Defending Word Substitution-based Attacks (2022.findings-naacl)
Copied to clipboard
| Challenge: | Existing methods to improve model robustness against word substitution-based adversarial attacks are too slow to generate adversarials on the fly. |
| Approach: | They propose an approach to improve the robustness of BERT models against word substitution-based adversarial attacks by leveraging adversarials for self-supervised contrastive learning. |
| Outcome: | The proposed method improves robustness of BERT models against word substitution-based adversarial attacks without using any labeled data. |
Bridging Robustness and Generalization Against Word Substitution Attacks in NLP via the Growth Bound Matrix Approach (2025.findings-acl)
Copied to clipboard
| Challenge: | Recent studies have shown that adversarial examples can alter models' predicted sentiment due to their sensitivity to specific word choices. |
| Approach: | They propose a regularization technique to improve NLP model robustness by reducing the impact of input perturbations on model outputs. |
| Outcome: | The proposed method outperforms state-of-the-art methods in adversarial defense. |
RobustSentEmbed: Robust Sentence Embeddings Using Adversarial Self-Supervised Contrastive Learning (2024.findings-naacl)
Copied to clipboard
| Challenge: | Existing pre-trained language models exhibit poor generalization and robustness in adversarial settings. |
| Approach: | They propose a self-supervised sentence embedding framework that improves generalization and robustness against adversarial attacks. |
| Outcome: | The proposed framework reduces the success rate of adversarial attacks by almost half . it also improves semantic text similarity tasks and various transfer tasks . |
Weight Perturbation as Defense against Adversarial Word Substitutions (2022.findings-emnlp)
Copied to clipboard
| Challenge: | Existence and pervasiveness of textual adversarial examples have raised serious concerns to security-critical applications. |
| Approach: | They propose to perform weight perturbations in the parameter space rather than the input feature space to improve adversarial robustness of NLP models. |
| Outcome: | The proposed method improves adversarial robustness of models by performing weight perturbations in the parameter space rather than the input feature space. |