Elamur Research⌕
☰
home / papers / 2023 / Certified Robustness to Text Adversarial Attacks by Randomized [MASK]

Certified Robustness to Text Adversarial Attacks by Randomized [MASK]

Paper · 2023 · Jiehang Zeng, Jianhan Xu, Xiaoqing Zheng et al.

Summary

Text classifiers, including BERT-based ones, can be fooled by small edits such as synonym swaps or deliberate misspellings. Earlier certified defenses, such as IBP-based methods and SAFER, only guarantee robustness if the defender knows the attacker's synonym list in advance, which is unrealistic. The authors propose RanMASK, a randomized smoothing defense that drops this assumption. At inference, it creates many copies of the input with a random subset of words replaced by [MASK]. A base classifier, also trained on masked inputs, labels each copy, and the copies vote on the final answer. The intuition is that heavy random masking will rarely keep every adversarially changed word, and keeping only some of them is usually not enough to flip the prediction. A theorem gives a probabilistic certificate against any change to a bounded number of words, at either the word or character level. Experiments on AGNEWS and SST2 show that RanMASK beats recent empirical and certified defenses under several attack algorithms. It also scales to large models like BERT and RoBERTa.

Key points

  • For more than half of test texts, RanMASK certifies robustness to any edit of up to 5 words on AGNEWS and up to 2 words on SST2.
  • AGNEWS texts average about 43 words, so the certificate covers roughly 11.62% of tokens. The image-domain ℓ0 smoothing of Levine and Feizi, which inspired this work, certifies only about 1.02% of pixels.
  • The certificate bounds how much a class probability can change. The bound depends on the chance that the masked positions overlap the perturbed positions, computed combinatorially from text length, masking count, and number of edits.
  • An LM-based sampling variant chooses which words to mask using probabilities from a BERT language model. It improves robust accuracy with little loss on clean data.
  • The masking step reuses BERT's own [MASK] token, so the method works with any pretrained masked language model. The authors list three directions for future work:
    • combining RanMASK with FreeLB or Dirichlet Neighborhood Ensemble;
    • adding an adversarial-input detector;
    • automatically tuning the masking rate.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Fudan UniversityShanghai · China167 works · 20,987 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 works

Cite

Cite as Jiehang Zeng, Jianhan Xu, Xiaoqing Zheng and Xuanjing Huang. 2023. Certified Robustness to Text Adversarial Attacks by Randomized [MASK]. Computational Linguistics.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.1162/coli_a_00476

@article{zeng2023certified,
  title = {{Certified Robustness to Text Adversarial Attacks by Randomized [MASK]}},
  author = {Jiehang Zeng, Jianhan Xu, Xiaoqing Zheng and Xuanjing Huang},
  journal = {Computational Linguistics},
  year = {2023},
  doi = {10.1162/coli\_a\_00476},
  url = {https://doi.org/10.1162/coli_a_00476}
}

References

31 references, 14 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Alzantot, Moustafa, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, and Kai-Wei Chang. 2018. Generating natural language adversarial examples. In Proceedings of the Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 2890–2896. https://doi.org/10.18653/v1/D18-13… ↗
  2. Bowman, Samuel R., Gabor Angeli, Christopher Potts, and Christopher D. Manning. 2015. A large annotated corpus for learning natural language inference. In Proceedings of the Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 632–642. https://doi.org/10.18653/v1/D15-1075 C… ↗
  3. Cheng, Minhao, Wei Wei, and Cho-Jui Hsieh. 2019. Evaluating and enhancing the robustness of dialogue systems: A case study on a negotiation agent. In Proceedings of the Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL), pag… find
  4. Seq2Sick: Evaluating the robustness of sequence-to-sequence models with adversarial examples. In Proceedings of the Thirty-Fourth AAAI Conference on Artificial Intelligence (AAAI), pages 3601–3608. https://doi.org/10.1609/aaai.v34i04.5767 Clopper, Charles J. and Egon S. Pearson. 1934. The use of co… ↗
  5. Deng, Li. 2012. The MNIST database of handwritten digit images for machine learning research [best of the web]. IEEE Signal Processing Magazine, 29(6):141–142. https://doi.org/10.1109/MSP .2012.2211477 Devlin, Jacob, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-training of dee… — [doi:10.1109/msp](https://doi.org/10.1109/msp) ↗
  6. Dong, Xinshuai, Hong Liu, Rongrong Ji, and Anh Tuan Luu. 2021. Towards robustness against natural language word substitutions. In Proceedings of the International Conference on Learning Representations (ICLR). Dvijotham, Krishnamurthy, Sven Gowal, Robert Stanforth, Relja Arandjelović, Brendan O’Don… — [arXiv:1805.10265](https://arxiv.org/abs/1805.10265) find
  7. Ebrahimi, Javid, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018. HotFlip: White-box adversarial examples for text classification. In Proceedings of the Annual Meeting of the Association for Computational Linguistics (ACL), pages 31–36. https://doi.org/10.18653/v1/P18-2006 Eger, Steffen, Gozde Gul Sahi… ↗
  8. Goodfellow, Ian J., Jonathon Shlens, and Christian Szegedy. 2015b. Explaining and harnessing adversarial examples. In Proceedings of the International Conference on Learning Representations (ICLR). Gowal, Sven, Krishnamurthy (Dj) Dvijotham, Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Uesato,…
  9. Han, Wenjuan, Liwen Zhang, Yong Jiang, and Kewei Tu. 2020. Adversarial attack and defense of structured prediction models. In Proceedings of the Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 2327–2338. https://doi.org/10.18653/v1/2020.emnlp-main.182 Hsieh, Yu Lun, Mi… ↗
  10. Jia, Robin and Percy Liang. 2017. Adversarial examples for evaluating reading comprehension systems. In Proceedings of the Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 2021–2031. https://doi.org/10.18653/v1/D17-1215 Jia, Robin, Aditi Raghunathan, Kerem Göksel, and… ↗
  11. Loshchilov, Ilya and Frank Hutter. 2019. Decoupled weight decay regularization. In Proceedings of the International Conference on Learning Representations (ICLR). find
  12. Maas, Andrew L., Raymond E. Daly, Peter T. Pham, Dan Huang, Andrew Y. Ng, and Christopher Potts. 2011. Learning word vectors for sentiment analysis. In Proceedings of the Annual Meeting of the Association for Computational Linguistics: Human Language Technologies (NAACL), pages 142–150.
  13. Madry, Aleksander, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards deep learning models resistant to adversarial attacks. In Proceedings of International Conference on Learning Representations (ICLR).
  14. Maheshwary, Rishabh, Saket Maheshwary, and Vikram Pudi. 2020. Generating natural language attacks in a hard label black box setting. arXiv preprint arXiv:2012.14956. https://doi.org/10.1609/aaai .v35i15.17595 Mathias, Lecuyer, Atlidakis Vaggelis, Geambasu Roxana, Hsu Daniel, and Jana Suman. 2019. Ce… ↗
  15. Moosavi-Dezfooli, Seyed-Mohsen, Alhussein Fawzi, and Pascal Frossard. 2016. DeepFool: A simple and accurate method to fool deep neural networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 2574–2582. https://doi.org/10.1109/CVPR.2016.282 Morris, Jo… ↗
  16. Ren, Shuhuai, Yihe Deng, Kun He, and Wanxiang Che. 2019a. Generating natural language adversarial examples through probability weighted word saliency. In Proceedings of the Annual Meeting of the Association for Computational Linguistics (ACL), pages 1085–1097. https://doi.org/10.18653/v1/P19-1103 R… ↗
  17. Samanta, Suranjana and Sameep Mehta. 2017. Towards crafting text adversarial samples. arXiv preprint arXiv:1707.02812 Sato, Motoki, Jun Suzuki, Hiroyuki Shindo, and Yuji Matsumoto. 2018. Interpretable adversarial perturbation in input embedding space for text. In Proceedings of the Twenty-Seventh In… find
  18. Socher, Richard, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D. Manning, Ng Andrew, and Christopher Potts. 2013. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 1…
  19. Szegedy, Christian, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. 2014. Intriguing properties of neural networks. In Proceedings of the International Conference on Learning Representations (ICLR).
  20. Vaswani, Ashish, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Lukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. In Proceedings of Advances in Neural Information Processing Systems (NeurIPS), pages 5998–6008.
  21. Wallace, Eric, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. 2019. Universal adversarial triggers for NLP. arXiv preprint arXiv:1908.07125. https://doi.org/10.18653/v1/D19-1221 ↗
  22. Wang, Wenqi, Lina Wang, Benxiao Tang, Run Wang, and Aoshuang Ye. 2019. A survey: Towards a robust deep neural network in text domain. arXiv preprint arXiv: 1902.07285. — [arXiv:1902.07285](https://arxiv.org/abs/1902.07285) find
  23. Wong, Catherine. 2017. DANCin SEQ2SEQ: Fooling text classifiers with adversarial text example generation. arXiv preprint arXiv: 1712.05419. — [arXiv:1712.05419](https://arxiv.org/abs/1712.05419) find
  24. Xu, Han, Yao Ma, Haochen Liu, Debayan Deb, Hui Liu, Jiliang Tang, and Anil K. Jain. 2019. Adversarial attacks and defenses in images, graphs and text: A review. arXiv preprint arXiv: 1909.08072. — [arXiv:1909.08072](https://arxiv.org/abs/1909.08072) find
  25. Xu, Kaidi, Zhouxing Shi, Huan Zhang, Yihan Wang, Kai-Wei Chang, Minlie Huang, Bhavya Kailkhura, Xue Lin, and Cho-Jui Hsieh. 2020. Automatic perturbation analysis for scalable certified robustness and beyond. In Proceedings of the Advances in Neural Information Processing Systems (NeurIPS). find
  26. Yang, Puyudi, Jianbo Chen, Cho-Jui Hsieh, Jane-Ling Wang, and Michael I. Jordan. 2018. Greedy attack and Gumbel attack: Generating adversarial examples for discrete data. arXiv preprint arXiv 1805.12316. — [arXiv:1805.12316](https://arxiv.org/abs/1805.12316) find
  27. Ye, Mao, Chengyue Gong, and Qiang Liu. 2020. SAFER: A structure-free approach for certified robustness to adversarial word substitutions. In Proceedings of the Annual Meeting of the Association for Computational Linguistics (ACL), pages 3465–3475. https://doi.org/10.18653/v1/2020.acl -main.317 Yuan… ↗
  28. Zhang, Xiang, Junbo Jake Zhao, and Yann LeCun. 2015. Character-level convolutional networks for text classification. In Proceedings of the Advances in Neural Information Processing Systems (NeurIPS), pages 649–657.
  29. Zhao, Zhengli, Dheeru Dua, and Sameer Singh. 2018. Generating natural adversarial examples. In Proceedings of the International Conference on Learning Representations (ICLR). find
  30. Zheng, Xiaoqing, Jiehang Zeng, Yi Zhou, Cho-Jui Hsieh, Minhao Cheng, and Xuanjing Huang. 2020. Evaluating and enhancing the robustness of neural network-based dependency parsing models with adversarial examples. In Proceedings of the Annual Meeting of the Association for Computational Linguistics (A…
  31. Zhu, Zheng-An, Yun-Zhong Lu, and Chen-Kuo Chiang. 2019. Generating adversarial examples by makeup attacks on face recognition. In Proceedings of the IEEE International Conference on Image Processing (ICIP), pages 2516–2520. https://doi.org/10.1109/ICIP .2019.8803269 — [doi:10.1109/icip](https://doi.org/10.1109/icip) ↗

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/zeng-2023-certified-robustness-text-adversarial-attacks/