[Paper Review] TextAT: Adversarial Training for Natural Language Understanding with Token-Level Perturbation

Linyang Li, Xipeng Qiu|arXiv (Cornell University)|Apr 30, 2020

Topic ModelingComputer Science28 references12 citations

TL;DR

This paper proposes TextAT, a token-level adversarial training method for natural language understanding that uses fine-grained, constrained perturbations at the token level to improve model robustness. By applying normalization tailored to discrete token semantics rather than continuous vector norms, TextAT enhances performance on GLUE and NER benchmarks with state-of-the-art Transformer models.

ABSTRACT

Adversarial training is effective in improving the robustness of neural networks. In NLP, languages are discrete in nature, separate tokens possess discrete semantics. Therefore, to incorporate adversarial training in sequence-level tasks, we introduce a novel training strategy: Text Adversarial Training with token-level perturbation. We fist craft perturbations that are initialized using a fine-grained token-level accumulated perturbations. Then we constrain these perturbations considering that inputs are separate tokens, rather than constraining them under a naive normalization ball. We validate the effectiveness of such normalization method using large-scale Transformer-based language models. Experiments on GLUE benchmark and NER task show that our adversarial training strategy improves the performances on various tasks including text classification and sequence labeling.

Motivation & Objective

• To address the challenge of applying adversarial training to discrete, token-based natural language sequences.
• To improve model robustness in NLU tasks by designing perturbations that respect the discrete nature of tokens.
• To develop a normalization strategy that constrains perturbations at the token level rather than using standard L2 or L∞ norms.
• To validate the effectiveness of the proposed method on large-scale Transformer-based models across diverse NLU tasks.

Proposed method

• Perturbations are initialized using fine-grained, token-level accumulated gradients to guide adversarial example generation.
• The method applies a novel normalization constraint that respects the discrete semantics of individual tokens, avoiding naive vector norm constraints.
• Adversarial examples are generated by perturbing tokens while maintaining semantic coherence and linguistic plausibility.
• The adversarial training pipeline integrates these perturbed examples into the standard training loop to improve generalization.
• The approach is compatible with large-scale Transformer-based models and applied to sequence-level tasks such as text classification and sequence labeling.

Experimental results

Research questions

• RQ1 How can adversarial training be effectively adapted to the discrete, token-level structure of natural language?
• RQ2 What normalization strategy best preserves semantic integrity while generating effective adversarial perturbations in NLP?
• RQ3 Can token-level perturbations improve robustness and performance on standard NLU benchmarks?
• RQ4 How does the proposed method compare to standard adversarial training baselines in terms of accuracy and robustness?

Key findings

• TextAT improves model performance on the GLUE benchmark through adversarial training with token-level perturbations.
• The method achieves consistent gains across multiple text classification and sequence labeling tasks.
• The proposed normalization strategy effectively constrains perturbations while preserving linguistic coherence and semantic meaning.
• Experiments demonstrate that the token-level adversarial training strategy enhances robustness without compromising performance on standard benchmarks.