Elamur Research
☰
home / papers / 2019 / Combating Adversarial Misspellings with Robust Word Recognition

Combating Adversarial Misspellings with Robust Word Recognition

Written for the Research library (claude-opus-5-5) from the paper text. Original — aclanthology.org/P19-1561.pdf

Summary

The paper examines how text classifiers can be fooled by small, deliberately chosen misspellings: dropping, adding, or swapping internal characters, plus keyboard typos. Such edits leave text readable for people but can push BiLSTM and fine-tuned BERT classifiers close to chance accuracy. Word-piece and character-level inputs turn out to be especially exposed, because every edit gives the attacker a new, distinct input to try. As a task-agnostic defense, the authors insert a word recognizer before the classifier. It extends the semi-character ScRNN of Sakaguchi et al. (2017) and adds fallback strategies for words it would otherwise label UNK:

  • leave the word unchanged,
  • replace it with a neutral word,
  • consult a broader background recognizer trained on a larger corpus.

This setup protects better than adversarial training, data augmentation, or an off-the-shelf spell checker. The authors also show that a low word error rate alone does not guarantee robustness. They introduce a sensitivity measure, which counts how many distinct outputs an attacker can elicit, and find that low sensitivity is often the more decisive property.

Key points

  • Against BERT fine-tuned for sentiment analysis, one adversarial character edit drops accuracy from 90.3% to 45.8%. The defense recovers about 75%.
  • Under 1-character attacks, the defended BERT reaches 88.3 (swap), 81.1 (drop) and 78.0 (add), compared with 69.2, 63.6 and 50.0 with adversarial training.
  • The improved recognizer cuts word recognition error by 32% relative (3.3% absolute) over the vanilla ScRNN.
  • Neutral-word backoff has the lowest sensitivity and gives the most robustness for most attack types. On MRPC paraphrase detection, BERT falls from 89% to 31% under 2-character attacks, while the pass-through and neutral variants recover 81.5% and 82.5%.
  • In a human check, 48 of 50 attacked reviews kept their sentiment. Code is available in the Adversarial-Misspellings GitHub repository.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

Fields: Natural language processing

Cited by

113 papers of our library cite it (of the 140673 whose bibliographies we read); 7 of them have a page here, 106 not yet.

Cite

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/p19-1561 · arXiv 1905.11268

@inproceedings{pruthi2019combating,
  title = {{Combating Adversarial Misspellings with Robust Word Recognition}},
  author = {Pruthi, Danish and Dhingra, Bhuwan and Lipton, Zachary C.},
  booktitle = {Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics},
  year = {2019},
  doi = {10.18653/v1/p19-1561},
  eprint = {1905.11268},
  archivePrefix = {arXiv},
  url = {https://doi.org/10.18653/v1/p19-1561}
}

References

30 references, 7 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Yonatan Belinkov and Yonatan Bisk. 2018. Synthetic and natural noise both break neural machine translation. In International Conference on Learning Representations (ICLR). find
  2. Constance Bitso, Ina Fourie, and Theo JD Bothma. 2013. Trends in transition from classical censorship to internet censorship: selected country overviews. Innovation: journal of appropriate librarianship and information work in Southern Africa, 2013(46):166–191. find
  3. Eric Brill and Robert C. Moore. 2000. An improved error model for noisy channel spelling correction. In Proceedings of the 38th Annual Meeting on Association for Computational Linguistics, ACL ’00, pages 286–293, Stroudsburg, PA, USA. Association for Computational Linguistics. find
  4. Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. In International Conference on Learning Representations (ICLR). find our card
  5. Robin Jia and Percy Liang. 2017. Adversarial examples for evaluating reading comprehension systems. Empirical Methods in Natural Language Processing (EMNLP). find our card
  6. Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. 2012. Imagenet classification with deep convolutional neural networks. In Advances in neural information processing systems (NIPS). find
  7. Karen Kukich. 1992. Techniques for automatically correcting words in text. Acm Computing Surveys (CSUR), 24(4):377–439. find
  8. Honglak Lee and Andrew Y Ng. 2005. Spam deobfuscation using a hidden markov model. In CEAS. find
  9. Hao Li, Yang Wang, Xinyu Liu, Zhichao Sheng, and Si Wei. 2018. Spelling error correction using a nested rnn model and pseudo training data. arXiv preprint arXiv:1811.00238. — [arXiv:1811.00238](https://arxiv.org/abs/1811.00238) find
  10. Jiwei Li, Will Monroe, and Dan Jurafsky. 2016. Understanding neural networks through representation erasure. arXiv preprint arXiv:1612.08220. — [arXiv:1612.08220](https://arxiv.org/abs/1612.08220) find
  11. Jacob Buckman, Aurko Roy, Colin Raffel, and Ian Goodfellow. 2018. Thermometer encoding: One hot way to resist adversarial examples. International Conference on Learning Representations (ICLR). find
  12. Andrew L. Maas, Raymond E. Daly, Peter T. Pham, Dan Huang, Andrew Y. Ng, and Christopher Potts. 2011. Learning word vectors for sentiment analysis. In Association for Computational Linguistics (ACL). find our card
  13. Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2018. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805. find
  14. Matt Davis. 2003. Psycholinguistic evidence on scrambled letters in reading. https://www.mrc-cbu.cam.ac.uk/ people/matt.davis/cmabridge/. ↗
  15. William B Dolan and Chris Brockett. 2005. Automatically constructing a corpus of sentential paraphrases. In Proceedings of the Third International Workshop on Paraphrasing (IWP2005). find our card
  16. Eric Mays, Fred J. Damerau, and Robert L. Mercer. 1991. Context based spelling correction. Information Processing & Management, 27(5):517 – 522. find
  17. Javid Ebrahimi, Daniel Lowd, and Dejing Dou. 2018a. On adversarial examples for character-level neural machine translation. In International Conference on Computational Linguistics (COLING). find
  18. Hwee Tou Ng, Siew Mei Wu, Ted Briscoe, Christian Hadiwinoto, Raymond Hendy Susanto, and Christopher Bryant. 2014. The conll-2014 shared task on grammatical error correction. In Proceedings of the Eighteenth Conference on Computational Natural Language Learning: Shared Task, pages 1–14. find
  19. Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018b. Hotflip: White-box adversarial examples for nlp. In Association for Computational Linguistics (ACL). find
  20. Pranav Rajpurkar, Jian Zhang, Konstantin Lopyrev, and Percy Liang. 2016. SQuAD: 100,000+ questions for machine comprehension of text. In Empirical Methods in Natural Language Processing (EMNLP). find our card
  21. Giorgio Fumera, Ignazio Pillai, and Fabio Roli. 2006. Spam filtering based on the analysis of text information embedded into images. Journal of Machine Learning Research (JMLR). find
  22. Graham Ernest Rawlinson. 1976. The significance of letter position in word recognition. Ph.D. thesis, University of Nottingham. find
  23. Max Glockner, Vered Shwartz, and Yoav Goldberg. 2018. Breaking nli systems with sentences that require simple lexical inferences. In Association for Computational Linguistics (ACL). find our card
  24. Keisuke Sakaguchi, Kevin Duh, Matt Post, and Benjamin Van Durme. 2017. Robsut wrod reocginiton via semi-character recurrent neural network. In Association for the Advancement of Artificial Intelligence (AAAI). find
  25. Allen Schmaltz, Yoon Kim, Alexander M. Rush, and Stuart Shieber. 2016. Sentence-level grammatical error identification as sequence-to-sequence correction. In Proceedings of the 11th Workshop on Innovative Use of NLP for Building Educational Applications, pages 242–251, San Diego, CA. Association for… find
  26. Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Ng, and Christopher Potts. 2013. Recursive deep models for semantic compositionality over a sentiment treebank. In Empirical Methods in Natural Language Processing (EMNLP). find
  27. Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199. find our card
  28. Yonghui Wu, Mike Schuster, Zhifeng Chen, Quoc V Le, Mohammad Norouzi, Wolfgang Macherey, Maxim Krikun, Yuan Cao, Qin Gao, Klaus Macherey, et al. 2016. Google’s neural machine translation system: Bridging the gap between human and machine translation. arXiv preprint arXiv:1609.08144. find
  29. Weilin Xu, David Evans, and Yanjun Qi. 2017. Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01155. — [arXiv:1704.01155](https://arxiv.org/abs/1704.01155) find
  30. Zhengli Zhao, Dheeru Dua, and Sameer Singh. 2018. Generating natural adversarial examples. In International Conference on Learning Representations (ICLR). find