[Paper Review] CAT-Gen: Improving Robustness in NLP Models via Controlled Adversarial Text Generation

Tianlu Wang, Xuezhi Wang+6 more|arXiv (Cornell University)|Oct 5, 2020

Topic Modeling25 references7 citations

TL;DR

CAT-Gen proposes a controlled adversarial text generation framework that improves NLP model robustness by generating diverse, fluent adversarial examples through controllable, task-irrelevant attributes (e.g., product category in sentiment classification). By disentangling attribute learning from attack generation and leveraging pre-trained language models, CAT-Gen produces more robust adversarial examples that outperform existing methods in fluency, diversity, and transferability across model retraining and architectures.

ABSTRACT

NLP models are shown to suffer from robustness issues, i.e., a model's prediction can be easily changed under small perturbations to the input. In this work, we present a Controlled Adversarial Text Generation (CAT-Gen) model that, given an input text, generates adversarial texts through controllable attributes that are known to be invariant to task labels. For example, in order to attack a model for sentiment classification over product reviews, we can use the product categories as the controllable attribute which would not change the sentiment of the reviews. Experiments on real-world NLP datasets demonstrate that our method can generate more diverse and fluent adversarial texts, compared to many existing adversarial text generation approaches. We further use our generated adversarial examples to improve models through adversarial training, and we demonstrate that our generated attacks are more robust against model re-training and different model architectures.

Motivation & Objective

• Address the lack of diversity and fluency in existing adversarial text generation methods that perturb inputs via word substitution or continuous representations.
• Improve model robustness by generating high-quality adversarial examples that remain semantically close to original inputs while fooling classifiers.
• Enable robustness evaluation and training through adversarial examples that are resilient to model retraining and architectural changes.
• Decouple attribute learning from attack generation by using pre-specified, label-irrelevant attributes (e.g., domain, gender, category) to guide text generation.
• Demonstrate that controlled attribute manipulation leads to more effective adversarial training and stronger generalization across models.

Proposed method

• Employ an encoder-decoder architecture pre-trained on a large text corpus to generate fluent and diverse adversarial texts.
• Introduce a module network that encodes controllable attributes (e.g., product category, gender) known to be irrelevant to the main task label.
• Control text generation by conditioning the decoder on both the input text and the specified attribute, enabling targeted perturbations.
• Train the attribute module using an auxiliary dataset without requiring parallel data, allowing disentangled learning of attributes.
• Optimize the generation process to maximize attack success rate while minimizing deviation from the original input in semantic and syntactic space.
• Use language model perplexity and BLEU-4 score as automatic metrics to evaluate fluency and diversity of generated adversarial examples.

Experimental results

Research questions

• RQ1 Can controlled attribute manipulation in text generation produce more fluent and diverse adversarial examples compared to word substitution or embedding-level perturbations?
• RQ2 How does the robustness of adversarial examples generated by CAT-Gen compare to existing methods under model retraining and architecture changes?
• RQ3 To what extent can adversarial examples generated by CAT-Gen improve model robustness through adversarial training?
• RQ4 Does the use of pre-specified, task-irrelevant attributes lead to more semantically coherent and transferable adversarial attacks?
• RQ5 Can the framework be extended to automatically identify vulnerable attributes without manual specification?

Key findings

• CAT-Gen generates adversarial examples with significantly lower perplexity (e.g., 729.5 on Language Model 1) than TextFooler (1853.7) and NL-adv (964.3), indicating higher fluency.
• CAT-Gen achieves higher BLEU-4 scores (38.8) than TextFooler (68.9) and NL-adv (64.3), demonstrating greater diversity in generated outputs.
• On retrained WordCNN models, CAT-Gen attacks maintain a 49.3% success rate, outperforming TextFooler (84.7%) and NL-adv (82.9%) in transferability.
• When tested on a different architecture (WordLSTM), CAT-Gen attacks show the lowest success rate (51.5%), indicating superior robustness to architectural shifts.
• Adversarial training with CAT-Gen examples improves model accuracy on hold-out adversarial sets to 92.5%, significantly outperforming baselines (e.g., 52.7% with TextFooler augmentation).
• Models trained with CAT-Gen examples maintain high accuracy (84.4–83.4) on attacks generated by other methods, showing strong generalization and robustness.