[Paper Review] Toward Adversarial Training on Contextualized Language Representation

Hongqiu Wu, Yongxiang Liu+3 more|arXiv (Cornell University)|May 8, 2023

Topic Modeling4 citations

TL;DR

This paper proposes Contextualized representation-Adversarial Training (CreAT), a method that explicitly optimizes adversarial attacks to deviate the contextualized representations from the BERT encoder, leading to more robust and consistent performance gains across diverse NLP tasks. CreAT achieves state-of-the-art results on benchmarks like AdvGLUE (61.1), HellaSWAG (94.9), and ANLI (69.3), outperforming standard adversarial training by better fooling the entire model, including the encoder.

ABSTRACT

Beyond the success story of adversarial training (AT) in the recent text domain on top of pre-trained language models (PLMs), our empirical study showcases the inconsistent gains from AT on some tasks, e.g. commonsense reasoning, named entity recognition. This paper investigates AT from the perspective of the contextualized language representation outputted by PLM encoders. We find the current AT attacks lean to generate sub-optimal adversarial examples that can fool the decoder part but have a minor effect on the encoder. However, we find it necessary to effectively deviate the latter one to allow AT to gain. Based on the observation, we propose simple yet effective extit{Contextualized representation-Adversarial Training} (CreAT), in which the attack is explicitly optimized to deviate the contextualized representation of the encoder. It allows a global optimization of adversarial examples that can fool the entire model. We also find CreAT gives rise to a better direction to optimize the adversarial examples, to let them less sensitive to hyperparameters. Compared to AT, CreAT produces consistent performance gains on a wider range of tasks and is proven to be more effective for language pre-training where only the encoder part is kept for downstream tasks. We achieve the new state-of-the-art performances on a series of challenging benchmarks, e.g. AdvGLUE (59.1 $ ightarrow $ 61.1), HellaSWAG (93.0 $ ightarrow $ 94.9), ANLI (68.1 $ ightarrow $ 69.3).

Motivation & Objective

• To investigate why adversarial training (AT) yields inconsistent performance gains across NLP tasks, especially on commonsense reasoning and NER.
• To identify that current AT methods primarily fool the decoder but have limited impact on the encoder's contextualized representations.
• To propose a new adversarial training paradigm that explicitly optimizes perturbations to deviate the encoder's contextualized representations for global robustness.
• To improve the consistency and robustness of adversarial training, especially in scenarios where only the encoder is fine-tuned.
• To achieve state-of-the-art performance on challenging NLP benchmarks using a more effective and hyperparameter-stable attack direction.

Proposed method

• CreAT modifies the adversarial attack to directly optimize for deviation in the contextualized representations produced by the BERT encoder, rather than focusing solely on the final prediction.
• The attack is formulated to maximize the perturbation's effect on the hidden states and attention maps of intermediate BERT layers, particularly the deeper layers (10–12).
• The method uses a gradient-based optimization to generate adversarial examples that maximize the divergence in contextualized representations under a Frobenius norm constraint.
• CreAT explicitly targets the encoder's representation space, ensuring that adversarial examples affect the entire model, not just the classifier head.
• The approach maintains the standard fine-tuning protocol of retraining the decoder from scratch while freezing the encoder weights, making it suitable for language pre-training.
• Hyperparameter sensitivity is reduced because the attack direction is more stable and globally optimized, leading to better convergence.

Experimental results

Research questions

• RQ1 Why does adversarial training yield inconsistent performance gains across different NLP tasks, especially on commonsense reasoning and named entity recognition?
• RQ2 To what extent do current adversarial attacks affect the contextualized representations of the BERT encoder versus the decoder head?
• RQ3 Can explicitly optimizing adversarial attacks to deviate the encoder's contextualized representations lead to more consistent and robust performance gains?
• RQ4 Does targeting the encoder representation improve the effectiveness of adversarial training in settings where only the encoder is fine-tuned?
• RQ5 How does the new attack direction in CreAT affect hyperparameter sensitivity compared to standard AT?

Key findings

• CreAT achieves a new state-of-the-art performance of 61.1 on AdvGLUE, improving from 59.1 under standard AT.
• On HellaSWAG, CreAT achieves 94.9 accuracy, a significant improvement from 93.0 under standard AT.
• On ANLI, CreAT reaches 69.3 accuracy, up from 68.1 under standard AT.
• Visualization shows that CreAT causes significantly stronger deviation in the hidden states and attention maps of deeper BERT layers (10–12) compared to standard AT.
• CreAT is less sensitive to hyperparameters such as inner ascent steps and step size, indicating better convergence and stability.
• The method demonstrates that effective adversarial training fundamentally relies on deviating the contextualized representations of the encoder, not just the decoder.