Elamur Research
☰
home / papers / 2019 / Certified Robustness to Adversarial Word Substitutions

Certified Robustness to Adversarial Word Substitutions

Written for the Research library (claude-opus-5-5) from the paper text. Original — aclanthology.org/D19-1423.pdf

Summary

NLP classifiers can often be broken by swapping words for near-synonyms that leave the label unchanged. Because every word may be replaced independently, the number of variants grows exponentially with text length. Neither heuristic attack search nor data augmentation can cover that space. The authors address this by training models whose robustness to every combination of allowed substitutions can be formally verified.

They adapt Interval Bound Propagation (IBP) from computer vision. Each word's substitution set becomes an axis-aligned box in embedding space, and interval bounds are pushed forward through the network. This yields an upper bound on the worst-case loss, which training then minimizes. To support NLP models, they derive new interval rules for softmax, element-wise multiplication and dot products, which extends IBP to LSTMs and attention.

On IMDB sentiment classification and SNLI inference, across bag-of-words, CNN, LSTM and attention models, IBP training reaches about 75% adversarial accuracy on both tasks. It clearly beats normal training and data augmentation. The work shows that provable guarantees are achievable for discrete text perturbations.

Key points

  • Search space size: IMDB reviews have a median of roughly 10^31 possible substitution variants and up to 10^271, so exhaustive checking is impossible.

  • Adversarial accuracy:

    TrainingIMDBSNLI
    Normal8%41%
    Data augmentation35%71%
    IBP-based certified training75%75%

  • Technical additions to IBP: new bound formulas for softmax, multiplication and dot-product operations, plus support for discrete (rather than continuous) perturbation sets.

  • Ablations:

    • Adding a trainable feed-forward layer over pre-trained word vectors, and bounding its outputs, is essential. Without it, the CNN stayed at or below 52.2% certified accuracy on the development set.
    • Keeping ε fixed at 1 during training, instead of ramping it up, lowered certified accuracy by 5 points.

  • Availability: code, data and experiments are released on Codalab.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

Fields: Natural language processing

Cited by

114 papers of our library cite it (of the 140673 whose bibliographies we read); 4 of them have a page here, 110 not yet.

Cite

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/d19-1423

@inproceedings{jia2019certified,
  title = {{Certified Robustness to Adversarial Word Substitutions}},
  author = {Jia, Robin and Raghunathan, Aditi and Göksel, Kerem and Liang, Percy},
  booktitle = {Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP)},
  year = {2019},
  doi = {10.18653/v1/d19-1423},
  url = {https://doi.org/10.18653/v1/d19-1423}
}

References

28 references, 13 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. M. Alzantot, Y. Sharma, A. Elgohary, B. Ho, M. Srivastava, and K. Chang. 2018. Generating natural language adversarial examples. In Empirical Methods in Natural Language Processing (EMNLP). find our card
  2. A. Athalye, N. Carlini, and D. Wagner. 2018. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. arXiv preprint arXiv:1802.00420. — [arXiv:1802.00420](https://arxiv.org/abs/1802.00420) find
  3. D. Bahdanau, K. Cho, and Y. Bengio. 2015. Neural machine translation by jointly learning to align and translate. In International Conference on Learning Representations (ICLR). find our card
  4. Y. Belinkov and Y. Bisk. 2017. Synthetic and natural noise both break neural machine translation. arXiv preprint arXiv:1711.02173. find
  5. S. Bowman, G. Angeli, C. Potts, and C. D. Manning. 2015. A large annotated corpus for learning natural language inference. In Empirical Methods in Natural Language Processing (EMNLP). find
  6. C. Chelba, T. Mikolov, M. Schuster, Q. Ge, T. Brants, P. Koehn, and T. Robinson. 2013. One billion word benchmark for measuring progress in statistical language modeling. arXiv preprint arXiv:1312.3005. find our card
  7. N. Dalvi, P. Domingos, Mausam, S. Sanghai, and D. Verma. 2004. Adversarial classification. In International Conference on Knowledge Discovery and Data Mining (KDD). find
  8. K. Dvijotham, S. Gowal, R. Stanforth, R. Arandjelovic, B. O’Donoghue, J. Uesato, and P. Kohli. 2018. Training verified learners with learned verifiers. arXiv preprint arXiv:1805.10265. — [arXiv:1805.10265](https://arxiv.org/abs/1805.10265) find
  9. M. Iyyer, J. Wieting, K. Gimpel, and L. Zettlemoyer. 2018. Adversarial example generation with syntactically controlled paraphrase networks. In North American Association for Computational Linguistics (NAACL). find our card
  10. R. Jia and P. Liang. 2017. Adversarial examples for evaluating reading comprehension systems. In Empirical Methods in Natural Language Processing (EMNLP). find our card
  11. D. Kingma and J. Ba. 2014. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980. find
  12. N. F. Liu, R. Schwartz, and N. A. Smith. 2019. Inoculation by fine-tuning: A method for analyzing challenge datasets. In North American Association for Computational Linguistics (NAACL). find
  13. A. L. Maas, R. E. Daly, P. T. Pham, D. Huang, A. Y. Ng, and C. Potts. 2011. Learning word vectors for sentiment analysis. In Association for Computational Linguistics (ACL). find our card
  14. A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. 2017. Towards deep learning models resistant to adversarial attacks (published at ICLR 2018). arXiv. find our card
  15. A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. 2018. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations (ICLR). find our card
  16. P. Michel, X. Li, G. Neubig, and J. M. Pino. 2019. On evaluation of adversarial perturbations for sequence-to-sequence models. In North American Association for Computational Linguistics (NAACL). find
  17. J. Ebrahimi, A. Rao, D. Lowd, and D. Dou. 2017. Hotflip: White-box adversarial examples for text classification. arXiv preprint arXiv:1712.06751. find our card
  18. N. Mrkšić, D. Ó Séaghdha, B. Thomson, M. Gašić, L. Rojas-Barahona, P. Su, D. Vandyke, T. Wen, and S. Young. 2016. Counter-fitting word vectors to linguistic constraints. In North American Association for Computational Linguistics (NAACL). find
  19. A. Globerson and S. Roweis. 2006. Nightmare at test time: robust learning by feature deletion. In International Conference on Machine Learning (ICML), pages 353–360. find
  20. A. Parikh, O. Täckström, D. Das, and J. Uszkoreit. 2016. A decomposable attention model for natural language inference. In Empirical Methods in Natural Language Processing (EMNLP). find our card
  21. I. J. Goodfellow, J. Shlens, and C. Szegedy. 2015. Explaining and harnessing adversarial examples. In International Conference on Learning Representations (ICLR). find our card
  22. J. Pennington, R. Socher, and C. D. Manning. 2014. GloVe: Global vectors for word representation. In Empirical Methods in Natural Language Processing (EMNLP), pages 1532–1543. find
  23. S. Gowal, K. Dvijotham, R. Stanforth, R. Bunel, C. Qin, J. Uesato, T. Mann, and P. Kohli. 2018. On the effectiveness of interval bound propagation for training verifiably robust models. arXiv preprint arXiv:1810.12715. — [arXiv:1810.12715](https://arxiv.org/abs/1810.12715) find
  24. D. Pruthi, B. Dhingra, and Z. C. Lipton. 2019. Combating adversarial misspellings with robust word recognition. In Association for Computational Linguistics (ACL). find our card
  25. S. Hochreiter and J. Schmidhuber. 1997. Long short-term memory. Neural Computation, 9(8):1735– 1780. find
  26. A. Raghunathan, J. Steinhardt, and P. Liang. 2018. Certified defenses against adversarial examples. In International Conference on Learning Representations (ICLR). find
  27. M. T. Ribeiro, S. Singh, and C. Guestrin. 2018. Semantically equivalent adversarial rules for debugging NLP models. In Association for Computational Linguistics (ACL). find
  28. C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus. 2014. Intriguing properties of neural networks. In International Conference on Learning Representations (ICLR). find our card