Papers by Cho-Jui Hsieh
Searching for an Effective Defender: Benchmarking Defense against Adversarial Word Substitution (2021.emnlp-main)
Copied to clipboard
Zongyi Li, Jianhan Xu, Jiehang Zeng, Linyang Li, Xiaoqing Zheng, Qi Zhang, Kai-Wei Chang, Cho-Jui Hsieh
| Challenge: | Existing methods to defend against adversarial word-substitution attacks have not been evaluated or compared in a systematic manner. |
| Approach: | They propose to compare different defense methods under representative adversarial attacks . they propose a method that improves the robustness of neural text classifiers against such attacks a . |
| Outcome: | The proposed method improves robustness of neural text classifiers against such attacks by a significant margin. |
MulCode: A Multiplicative Multi-way Model for Compressing Neural Language Model (D19-1)
Copied to clipboard
| Challenge: | a large number of parameters dominate the memory usage of deep neural nets . compression of embedding layers is the key to reducing memory usage . |
| Approach: | They propose a multi-way multiplicative neural compressor to compress embedding layers . they use an adaptively created matrix and multiplicativative compositions to learn them . |
| Outcome: | a new multi-way multiplicative neural compressor can achieve 41.38 times compression rate with little loss in performance. |
QG-CoC: Question-Guided Chain-of-Captions for Large Multimodal Models (2025.emnlp-main)
Copied to clipboard
| Challenge: | Existing prompting methods for multimodal large language models lack fine-grained perception across disparate images . existing methods fail to integrate perception and reasoning, causing problems with general multi-image reasoning tasks. |
| Approach: | They propose a generalized prompting method that integrates perception and reasoning . they evaluate the method on open-source and closed-source MLLMs . |
| Outcome: | The proposed method shows competitive performance across tasks and improves in challenging scenarios. |
Extreme Zero-Shot Learning for Extreme Text Classification (2022.naacl-main)
Copied to clipboard
| Challenge: | Experimental results show that MACLR achieves superior performance compared to other baseline methods. |
| Approach: | They propose to pre-train Transformer-based encoders with self-supervised contrastive losses to learn the semantic embeddings of instances and labels with raw text. |
| Outcome: | The proposed method improves on the EZ-XMC model with a limited number of ground-truth positive pairs. |
MinPrompt: Graph-based Minimal Prompt Data Augmentation for Few-shot Question Answering (2024.acl-long)
Copied to clipboard
| Challenge: | Recent advances in few-shot question answering rely on pre-trained large language models and fine-tuning in specific settings. |
| Approach: | They propose to select the most informative data for fine-tuning to improve efficiency . they use an approximate graph algorithm and unsupervised question generation to generate QA pairs . |
| Outcome: | The proposed framework improves the performance of the few-shot question answering task on the open-domain QA task. |
Defending LLMs against Jailbreaking Attacks via Backtranslation (2024.findings-acl)
Copied to clipboard
| Challenge: | Recent advancement in large language models (LLMs) has shown their extensive applications and transformative potential to reshape people's lives. |
| Approach: | They propose a method which uses backtranslation to infer an input prompt from an input input prompt and then run it again on the backtranslated prompt. |
| Outcome: | The proposed method outperforms baselines and has little impact on the generation quality for benign input prompts. |
Rethinking RL Evaluation: Can Benchmarks Truly Reveal Failures of RL Methods? (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing benchmarks for reinforcement learning for large language models do not accurately assess generalization. |
| Approach: | They propose three core principles for designing more faithful benchmarks: sufficient difficulty, balanced evaluation, and distributional robustness. |
| Outcome: | The proposed benchmarks do not accurately assess generalization across distribution shifts, difficulty levels, and counterfactual scenarios. |
Evaluating and Enhancing the Robustness of Neural Network-based Dependency Parsing Models with Adversarial Examples (2020.acl-main)
Copied to clipboard
| Challenge: | Previously studies focused on semantic tasks such as sentiment analysis, question answering and reading comprehension. |
| Approach: | They propose two approaches to study where and how adversarial examples exist in dependency parsing . they use a state-of-the-art parser to find adversarials in existing texts . |
| Outcome: | The proposed approaches show that adversarial examples exist in dependency parsing . they show that up to 77% of input examples admit adversarials . |
ADDMU: Detection of Far-Boundary Adversarial Examples with Data and Model Uncertainty Estimation (2022.emnlp-main)
Copied to clipboard
| Challenge: | Existing methods show poor performance under Far Boundary (FB) adversarial examples. |
| Approach: | They propose to use a new technique to detect adversarial examples based on data and model uncertainty to outperform existing methods. |
| Outcome: | The proposed method outperforms existing methods by 3.6 and 6.0 AUC points under each scenario. |
On the Transferability of Adversarial Attacks against Neural Text Classifier (2021.emnlp-main)
Copied to clipboard
| Challenge: | Existing studies show that deep neural networks are vulnerable to adversarial examples . a small perturbation to an input alters the model prediction . |
| Approach: | They propose a genetic algorithm to find models that can induce adversarial examples to fool models . they propose word replacement rules that can be used for model diagnostics from these examples . |
| Outcome: | The proposed model can fool almost all existing models, while ignoring the data bias in the training set. |
An Efficient Rehearsal Scheme for Catastrophic Forgetting Mitigation during Multi-stage Fine-tuning (2025.findings-naacl)
Copied to clipboard
| Challenge: | Existing approaches to fine-tune foundational models on new tasks or domains are costly and time-consuming. |
| Approach: | They propose a sampling scheme that prioritizes rehearsal of "collateral damage" samples . the scheme is computationally efficient and easy to implement, they say . |
| Outcome: | a new approach prioritizes rehearsal of “collateral damage” samples outperforms other continual learning methods. |
Automatic Engineering of Long Prompts (2024.findings-acl)
Copied to clipboard
| Challenge: | Recent research has explored automatic prompt engineering for short prompts, typically consisting of one or a few sentences. |
| Approach: | They propose an algorithm that automatically improves long prompts by combining a greedy algorithm with beam-search to enhance the effectiveness of LLM-based mutation. |
| Outcome: | The proposed algorithm achieves 9.2% accuracy gain on eight tasks in Big Bench Hard and consistent improvements on GSM8K with various models. |
On the Robustness of Self-Attentive Models (P19-1)
Copied to clipboard
| Challenge: | Experimental results show that self-attentive neural models are more robust against adversarial perturbations compared to recurrent neural networks. |
| Approach: | They propose an adversarial attack algorithm that generates more natural adversarials . they propose to use the attention mechanism to learn a context-dependent representation . |
| Outcome: | The proposed attack algorithm generates more natural adversarial examples that could mislead models but not humans. |
Weight Perturbation as Defense against Adversarial Word Substitutions (2022.findings-emnlp)
Copied to clipboard
| Challenge: | Existence and pervasiveness of textual adversarial examples have raised serious concerns to security-critical applications. |
| Approach: | They propose to perform weight perturbations in the parameter space rather than the input feature space to improve adversarial robustness of NLP models. |
| Outcome: | The proposed method improves adversarial robustness of models by performing weight perturbations in the parameter space rather than the input feature space. |
Learning Word Embeddings for Low-Resource Languages by PU Learning (N18-1)
Copied to clipboard
| Challenge: | Existing approaches to learn word embedding on a corpus with only a few million tokens are limited to low-resource languages. |
| Approach: | They propose to use a sparse co-occurrence matrix to factorize the co-existence matrix and validate the proposed approaches in four different languages. |
| Outcome: | The proposed model is validated in four different languages. |
DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLMs Jailbreakers (2024.findings-emnlp)
Copied to clipboard
| Challenge: | Existing jailbreaking methods view a malicious prompt as a whole but they are not effective at reducing LLMs’ attention on combinations of words with malice. |
| Approach: | They propose an automatic prompt Decomposition and Reconstruction framework for jailbreaking Attack that decomposes a malicious prompt into separate sub-prompts and reassembles them implicitly by In-Context Learning. |
| Outcome: | The proposed framework reduces LLMs' attention on malice words by presenting them to LLM in a fragmented form, addressing these limitations and improving attack effectiveness. |
Double Perturbation: On the Robustness of Robustness and Counterfactual Bias Evaluation (2021.naacl-main)
Copied to clipboard
| Challenge: | Recent studies show that NLP models are vulnerable to adversarial perturbations such as synonym substitutions or syntax-guided paraphrasing. |
| Approach: | They propose a “double perturbation” framework to uncover model weaknesses beyond the test dataset. |
| Outcome: | The proposed attack achieves high success rates on both original and robustly trained CNNs and Transformers. |
Defense against Synonym Substitution-based Adversarial Attacks via Dirichlet Neighborhood Ensemble (2021.acl-long)
Copied to clipboard
| Challenge: | Recent studies show vulnerability of deep neural networks to adversarial examples that intentionally fool the networks. |
| Approach: | They propose a method for training a robust model to defense synonym substitution-based attacks by sampling embedding vectors for each word in an input sentence and augmenting them with the training data. |
| Outcome: | The proposed method outperforms other proposed defense methods by a significant margin across different network architectures and multiple data sets. |
Solving for X and Beyond: Can Large Language Models Solve Complex Math Problems with More-Than-Two Unknowns? (2024.findings-emnlp)
Copied to clipboard
| Challenge: | Existing benchmarks for Large Language Models often feature simple problems with only one or two unknown variables, which do not sufficiently challenge their reasoning capacities. |
| Approach: | They propose a new benchmark, BeyondX, which progressively increases complexity by expanding the number of unknowns in simpler problems. |
| Outcome: | The proposed approach improves performance on the BeyondX benchmark and provides deeper insights into the computational limits of LLMs when faced with more complex mathematical challenges. |
Improving the Adversarial Robustness of NLP Models by Information Bottleneck (2022.findings-acl)
Copied to clipboard
| Challenge: | Existing studies have shown that adversarial examples can be directly attributed to the presence of non-robust features. |
| Approach: | They propose to capture task-specific robust features while eliminating non-robust ones . they show that models can achieve significant improvement in robust accuracy . |
| Outcome: | The proposed method outperforms all defense methods on SST-2, AGNEWS and IMDB datasets while achieving no performance drop. |
Attacking Visual Language Grounding with Adversarial Examples: A Case Study on Neural Image Captioning (P18-1)
Copied to clipboard
| Challenge: | Visual language grounding is widely studied in modern neural image captioning systems . a novel algorithm for crafting adversarial examples in image captions is proposed . |
| Approach: | They propose an algorithm to craft adversarial examples in machine vision and perception . their approach provides two evaluation approaches to check if they can mislead systems . |
| Outcome: | The proposed algorithm can craft visually-similar adversarial examples with randomly targeted captions or keywords, and the results are transferable to other image captioning systems. |
UNICORN: A Unified Causal Video-Oriented Language-Modeling Framework for Temporal Video-Language Tasks (2024.emnlp-main)
Copied to clipboard
Yuanhao Xiong, Yixin Nie, Haotian Liu, Boxin Wang, Jun Chen, Rong Jin, Cho-Jui Hsieh, Lorenzo Torresani, Jie Lei
| Challenge: | Recent advances in large multimodal models have encouraged the development of large multi-modal models . however, it is unclear how to extend these models to the more complex video domain . |
| Approach: | They propose a visual instruction tuning framework to address temporal video-language tasks . they collect a dataset and fine-tune the framework on instruction-following data . |
| Outcome: | The proposed model can perform better on established temporal video-language tasks without training objectives and intensive pre-training. |
Enhancing Unsupervised Semantic Parsing with Distributed Contextual Representations (2023.findings-acl)
Copied to clipboard
| Challenge: | Existing methods to learn models on corpus of pairs of sentences require labor-intensive annotation. |
| Approach: | They propose to leverage distributed contextual word and phrase representations pre-trained on unlabelled texts to deal with homonymy and polysemy. |
| Outcome: | The proposed model achieves better accuracy on question-answering and relation extraction tasks. |
Evaluating and Enhancing the Robustness of Dialogue Systems: A Case Study on a Negotiation Agent (N19-1)
Copied to clipboard
| Challenge: | Recent research has demonstrated that goal-oriented dialogue agents can achieve striking performance when interacting with human users. |
| Approach: | They develop algorithms to evaluate the robustness of a goal-oriented dialogue agent by carefully designed attacks using adversarial agents. |
| Outcome: | The proposed attacks reduce the advantage of rewards between the attacker and the trained agent from 2.68 to -5.76 on a scale from -10 to 10 for randomized goals. |
Towards Adversarially Robust Text Classifiers by Learning to Reweight Clean Examples (2022.findings-acl)
Copied to clipboard
| Challenge: | Existing defense methods improve the adversarial robustness by making models adapt to training set augmented with some adversarials. |
| Approach: | They propose to introduce a reweighting mechanism to calibrate the training distribution to obtain robust models. |
| Outcome: | The proposed method minimizes the loss of validation set mixed with clean examples and adversarial ones in an online learning manner. |
On the Sensitivity and Stability of Model Interpretations in NLP (2022.acl-long)
Copied to clipboard
| Challenge: | Recent years have witnessed the emergence of post-hoc interpretations that aim to uncover how NLP models make predictions. |
| Approach: | They propose two new criteria that provide complementary notions of faithfulness to removal-based criteria. |
| Outcome: | The proposed methods overcome limitations of gradient-based methods on removal-based criteria and overcome limitations in the proposed methods. |
What Does BERT with Vision Look At? (2020.acl-main)
Copied to clipboard
| Challenge: | Pre-trained visual grounded language models have improved performance on vision-and-language tasks but what they learn during pre-training remains unclear. |
| Approach: | They show that attention heads of visual grounded language models actively ground elements of language to image regions. |
| Outcome: | The attention heads of a visual grounded language model can ground elements to image regions, demonstrating their ability to detect syntactic relations between non-entity words and image regions. |