[Paper Review] Certified Robustness for Large Language Models with Self-Denoising

Zhen Zhang, Guanhua Zhang+6 more|arXiv (Cornell University)|Jul 14, 2023

Topic Modeling5 citations

TL;DR

This paper proposes SelfDenoise, a certified robustness framework for large language models (LLMs) that enhances randomized smoothing by leveraging the LLM itself to denoise perturbed inputs through masked token completion. By applying self-denoising before prediction, the method achieves significantly larger certification radii, outperforming existing baselines in both certified and empirical robustness across SST-2 and Agnews datasets.

ABSTRACT

Although large language models (LLMs) have achieved great success in vast real-world applications, their vulnerabilities towards noisy inputs have significantly limited their uses, especially in high-stake environments. In these contexts, it is crucial to ensure that every prediction made by large language models is stable, i.e., LLM predictions should be consistent given minor differences in the input. This largely falls into the study of certified robust LLMs, i.e., all predictions of LLM are certified to be correct in a local region around the input. Randomized smoothing has demonstrated great potential in certifying the robustness and prediction stability of LLMs. However, randomized smoothing requires adding noise to the input before model prediction, and its certification performance depends largely on the model's performance on corrupted data. As a result, its direct application to LLMs remains challenging and often results in a small certification radius. To address this issue, we take advantage of the multitasking nature of LLMs and propose to denoise the corrupted inputs with LLMs in a self-denoising manner. Different from previous works like denoised smoothing, which requires training a separate model to robustify LLM, our method enjoys far better efficiency and flexibility. Our experiment results show that our method outperforms the existing certification methods under both certified robustness and empirical robustness. The codes are available at https://github.com/UCSB-NLP-Chang/SelfDenoise.

Motivation & Objective

• To address the limited certified robustness of large language models (LLMs) under input perturbations, especially in high-stakes applications.
• To overcome the performance bottleneck of vanilla randomized smoothing in LLMs, which stems from poor performance on corrupted inputs.
• To develop an efficient, parameter-free method that enhances robustness without requiring access to model weights or retraining.
• To improve both certified robustness (local stability) and empirical robustness (resistance to adversarial attacks) in LLMs.

Proposed method

• The method applies randomized smoothing by generating multiple perturbed inputs through random word masking.
• Instead of directly feeding perturbed inputs to the LLM, it first denoises them by prompting the LLM to complete masked tokens, restoring semantic coherence.
• The denoised inputs are then used for prediction and certification, improving the model's performance on corrupted inputs.
• Certification relies on the consensus of predictions across multiple denoised and smoothed inputs, with the certified radius derived from the frequency of consistent predictions.
• The approach is plug-and-play, requiring no fine-tuning or architectural changes, and works with any LLM via prompt-based inference.
• The self-denoising mechanism is inspired by denoised smoothing but replaces an external denoiser with the LLM itself, improving efficiency and flexibility.

Experimental results

Research questions

• RQ1 Can self-denoising improve the certified robustness of LLMs under randomized smoothing without requiring model fine-tuning?
• RQ2 How does self-denoising compare to baseline methods like RanMask and Safer in terms of certified and empirical robustness?
• RQ3 Does the self-denoising mechanism lead to a larger certification radius while maintaining high clean accuracy?
• RQ4 Can the LLM effectively act as a denoiser for its own perturbed inputs to stabilize predictions?

Key findings

• On the SST-2 dataset, SelfDenoise achieved 64.5% empirical robust accuracy under the DeepWordBug attack, outperforming the second-best method by 13.2%.
• On the Agnews dataset, SelfDenoise achieved 70.0% empirical robust accuracy under the DeepWordBug attack, a 19.7% improvement over the second-best method.
• With a perturbation scale of d=5%, SelfDenoise improved certified accuracy by 11.5% on SST-2 and 26.3% on Agnews compared to RanMask.
• SelfDenoise maintained the highest clean accuracy (90.0%) on SST-2 while achieving the best trade-off between clean accuracy and robustness.
• The method achieved 66.0% empirical robust accuracy on Agnews under the TextBugger attack, a 24.5% improvement over the second-best method.
• The self-denoising strategy enabled a 19.7% improvement in empirical robust accuracy on SST-2 with only a 1.2% drop in clean accuracy compared to the vanilla Alpaca model.