[Paper Review] Towards Robustness Against Natural Language Word Substitutions

Xinshuai Dong, Anh Tuan Luu+2 more|arXiv (Cornell University)|Jul 28, 2021

Adversarial Robustness in Machine LearningComputer Science41 references63 citations

TL;DR

The paper introduces Adversarial Sparse Convex Combination (ASCC) to model word-substitution attack spaces as convex hulls and uses ASCC-defense with adversarial training to improve robustness across multiple NLP tasks and architectures.

ABSTRACT

Robustness against word substitutions has a well-defined and widely acceptable form, i.e., using semantically similar words as substitutions, and thus it is considered as a fundamental stepping-stone towards broader robustness in natural language processing. Previous defense methods capture word substitutions in vector space by using either $l_2$-ball or hyper-rectangle, which results in perturbation sets that are not inclusive enough or unnecessarily large, and thus impedes mimicry of worst cases for robust training. In this paper, we introduce a novel extit{Adversarial Sparse Convex Combination} (ASCC) method. We model the word substitution attack space as a convex hull and leverages a regularization term to enforce perturbation towards an actual substitution, thus aligning our modeling better with the discrete textual space. Based on the ASCC method, we further propose ASCC-defense, which leverages ASCC to generate worst-case perturbations and incorporates adversarial training towards robustness. Experiments show that ASCC-defense outperforms the current state-of-the-arts in terms of robustness on two prevailing NLP tasks, \emph{i.e.}, sentiment analysis and natural language inference, concerning several attacks across multiple model architectures. Besides, we also envision a new class of defense towards robustness in NLP, where our robustly trained word vectors can be plugged into a normally trained model and enforce its robustness without applying any other defense techniques.

Motivation & Objective

• Motivate robustness against word substitutions that preserve semantics and syntax in NLP models.
• Model the space of substitutions as a convex hull to capture inclusive yet compact perturbations.
• Develop ASCC to generate adversaries within the convex hull and promote alignment with discrete text space.
• Propose ASCC-defense to improve robustness via adversarial training using ASCC-generated perturbations.
• Demonstrate robustness improvements across diverse datasets and model architectures.

Proposed method

• Model substitutions for a word as a convex hull of its substitution vectors. Represent any adversarial vector as a convex combination of substitution vectors with weights w_ij.
• Relax the weight constraints with a softmax parameterization to enable gradient-based optimization.
• Introduce an entropy-based regularizer on w_i to promote sparsity and better align with discrete substitutions.
• Define ASCC as the maximization of the loss under ASCC perturbations with the sparsity regularizer (entropy term).
• Embed ASCC into adversarial training (ASCC-defense) by maximizing the loss over ASCC perturbations and minimizing it to obtain robust parameters.
• Train using Adam to solve the inner maximization and outer minimization for robustness.

Experimental results

Research questions

• RQ1 Can word substitution perturbations be effectively captured by a convex hull in embedding space to improve robustness?
• RQ2 Does sparsity regularization of convex combination weights lead to perturbations that better reflect actual substitutions?
• RQ3 Can ASCC-defense produce models more robust to common NLP attacks (Genetic, PWWS) across multiple architectures?
• RQ4 Do robust word vectors learned via ASCC-defense transfer robustness to standard models without extra defenses?

Key findings

• ASCC-defense consistently improves robustness over state-of-the-art defenses across IMDB and SNLI tasks and multiple architectures.
• Under Genetic attacks on IMDB, ASCC-defense with LSTM achieves 79.0% accuracy, surpassing the prior 75.0%.
• ASCC-defense shows robustness across attacks (Genetic and PWWS) and architectures (LSTM, CNN, BOW, DCOM).
• ASCC enables robust word vectors that, when used to initialize standard models, improve robustness without additional defenses (e.g., 73.4% robust accuracy for LSTM with ASCC-V vs 7.9% with Glove in Genetics attack).
• A sparsity-regularization term encourages perturbations to be near actual substitutions, aligning perturbations with discrete text space.