Elamur Research⌕
☰
home / papers / 2018 / On Adversarial Examples for Character-Level Neural Machine Translation

On Adversarial Examples for Character-Level Neural Machine Translation

Paper · 2018 · Javid Ebrahimi, Daniel Lowd and Dejing Dou

Summary

The paper asks how badly a character-level neural machine translation system can fail when an attacker sees its internals. Earlier robustness studies of NLP models mostly relied on black-box noise such as random typos. The authors build a white-box attacker by extending HotFlip. It scores four character edits (flip, swap, delete, insert) using gradients with respect to one-hot inputs, then applies the most damaging edits through greedy or beam search. Besides untargeted attacks that only lower BLEU, they define two goal-driven attacks specific to translation. A controlled attack makes a chosen word disappear from the output, and a targeted attack substitutes a different word for it. Experiments on CS-EN, FR-EN and DE-EN translation show that white-box edits damage translations far more than black-box noise does. Adversarial training with a fast one-shot attack makes models considerably more robust. This matters because subtle character edits can silently change a translation's meaning, which is a real risk for MT used in high-stakes settings.

Key points

  • Edit operations are represented as vectors in input space, and directional derivatives estimate how much each edit raises the loss. One forward pass and one backward pass are enough to rank all candidate flips.
  • The controlled attack maximizes the loss on the target word. The targeted attack minimizes the loss on the replacement word, for example turning "therapist" into "psychopath" in DE→EN output.
  • On FR-EN, the Vanilla model drops from 37.54 BLEU on clean text to 5.36 on white-box (FIDS-W) adversarial examples. The FIDS-W-trained model reaches 31.94 on the same examples.
  • Adversarial training applies one FIDS edit to all words in parallel (a one-shot attack). It costs only about 3 times the time of regular training, and it needs both clean and adversarial data to keep clean BLEU high.
  • An Ensemble model trained on white-box and black-box (Nat, Rand) examples performs best overall. Its average BLEU is 32.30 versus 15.95 for Vanilla on FR-EN, 27.82 versus 12.64 on DE-EN, and 19.99 versus 11.24 on CS-EN.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓University of OregonEugene · United States14 works · 3,167 citations

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 9,086 worksArtificial Intelligence · 8,889 worksArts and Humanities · 9,296 worksLanguage and Linguistics · 9,206 works

🧭 Topics 1Research subjects and languages the work is about.Machine translation · 958 works

Cite

Cite as Javid Ebrahimi, Daniel Lowd and Dejing Dou. 2018. On Adversarial Examples for Character-Level Neural Machine Translation. Proceedings of the 27th International Conference on Computational Linguistics.

The paper itself, not this page. BibTeX from the library's record of the work.

@inproceedings{ebrahimi2018adversarial,
  title = {{On Adversarial Examples for Character-Level Neural Machine Translation}},
  author = {Javid Ebrahimi, Daniel Lowd and Dejing Dou},
  booktitle = {Proceedings of the 27th International Conference on Computational Linguistics},
  year = {2018},
  url = {https://aclanthology.org/C18-1055/}
}

References

21 references, 10 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Yonatan Belinkov and Yonatan Bisk. 2018. Synthetic and natural noise both break neural machine translation. In Proceedings of ICLR. find
  2. Yotam Berger. 2017. Israel arrests Palestinian because Facebook translated ’good morning’ to ’attack them’. Retrieved from https://www.haaretz.com. ↗
  3. Stevie Chancellor, Jessica Annette Pater, Trustin Clear, Eric Gilbert, and Munmun De Choudhury. 2016. \# thyghgapp: Instagram content moderation and lexical variation in pro-eating disorder communities. In Proceedings of the 19th ACM Conference on Computer-Supported Cooperative Work & Social Computin… find
  4. Marta R Costa-Jussa and José AR Fonollosa. 2016. Character-based neural machine translation. In Proceedings of ACL.
  5. Nilesh Dalvi, Pedro Domingos, Sumit Sanghai, Deepak Verma, et al. 2004. Adversarial classification. In Proceedings of KDD, pages 99–108. find
  6. Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018. Hotflip: White-box adversarial examples for text classification. In Proceedings of ACL.
  7. Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and harnessing adversarial examples. In Proceedings of ICLR.
  8. Robin Jia and Percy Liang. 2017. Adversarial examples for evaluating reading comprehension systems. In Proceedings of EMNLP.
  9. Yoon Kim, Yacine Jernite, David Sontag, and Alexander M Rush. 2016. Character-aware neural language models. Proceedings of AAAI.
  10. Jason Lee, Kyunghyun Cho, and Thomas Hofmann. 2017. Fully character-level neural machine translation without explicit segmentation. TACL.
  11. Daniel Lowd and Christopher Meek. 2005. Adversarial learning. In Proceedings of KDD, pages 641–647. find
  12. Minh-Thang Luong, Hieu Pham, and Christopher D Manning. 2015. Effective approaches to attention-based neural machine translation. In Proceedings of EMNLP.
  13. Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083.
  14. Cettolo Mauro, Niehues Jan, Stüker Sebastian, Bentivogli Luisa, Cattoni Roldano, and Federico Marcello. 2016. The iwslt 2016 evaluation campaign. In International Workshop on Spoken Language Translation. find
  15. Takeru Miyato, Andrew M Dai, and Ian Goodfellow. 2017. Adversarial training methods for semi-supervised text classification. In Proceedings of ICLR.
  16. Rico Sennrich, Barry Haddow, and Alexandra Birch. 2016. Neural machine translation of rare words with subword units. Proceedings of ACL.
  17. Uri Shaham, Yutaro Yamada, and Sahand Negahban. 2015. Understanding adversarial training: Increasing local stability of neural nets through robust optimization. arXiv preprint arXiv:1511.05432. — [arXiv:1511.05432](https://arxiv.org/abs/1511.05432) find
  18. Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Dan Boneh, and Patrick McDaniel. 2018. Ensemble adversarial training: Attacks and defenses. In Proceedings of ICLR. find
  19. Sam Wiseman and Alexander M Rush. 2016. Sequence-to-sequence learning as beam-search optimization. In Proceedings of EMNLP. find
  20. Zhengli Zhao, Dheeru Dua, and Sameer Singh. 2018. Generating natural adversarial examples. In Proceedings of ICLR. find
  21. Arkaitz Zubiaga, Maria Liakata, Rob Procter, Geraldine Wong Sak Hoi, and Peter Tolmie. 2016. Analysing how people orient to and spread rumours in social media by looking at conversational threads. PloS one, 11(3):e0150989. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/ebrahimi-2018-adversarial-examples-character-level-neural/