Code-Mixing on Sesame Street: Dawn of the Adversarial Polyglots

Code-Mixing on Sesame Street: Dawn of the Adversarial Polyglots Samson Tan§♮ Shafiq Joty§‡ §Salesforce Research Asia ♮National University of Singapore ‡Nanyang Technological University {samson.tan,sjoty}@salesforce.com Abstract Multilingual models have demonstrated im- pressive cross-lingual transfer performance. However, test sets like XNLI are monolingual at the example level. In multilingual commu- nities, it is common for polyglots to code-mix when conversing with each other. Inspired by this phenomenon, we present two strong black- box adversarial attacks (one word-level, one phrase-level) for multilingual models that push their ability to handle code-mixed sentences to the limit. The former uses bilingual dictionar- ies to propose perturbations and translations of the clean example for sense disambiguation. The latter directly aligns the clean example with its translations before extracting phrases as perturbations. Our phrase-level attack has a success rate of 89.75% against XLM-Rlarge, bringing its average accuracy of 79.85 down to 8.18 on XNLI. Finally, we propose an effi- cient adversarial training scheme that trains in the same number of steps as the original model and show that it improves model accuracy.1 1 Introduction The past year has seen incredible breakthroughs in cross-lingual generalization with the advent of mas- sive multilingual models that aim to learn universal language representations (Pires et al., 2019; Wu and Dredze, 2019; Conneau et al., 2020b). These models have demonstrated impressive cross-lingual transfer abilities: simply fine-tuning them on task data from a high resource language such as English after pretraining on monolingual corpora was suffi- cient to manifest such abilities. This was observed even for languages with different scripts and no vocabulary overlap (K et al., 2020). However, transferring from one language to an- other is insufficient for NLP systems to understand multilingual speakers in an increasingly multilin- gual world (Aronin and Singleton, 2008). In many 1Code: github.com/salesforce/adversarial-polyglots (a) Aligned words across sentences (b) Extracted candidate perturbations (c) Final multilingual adversary Figure 1: BUMBLEBEE’s three key stages of adver- sary generation: (a) Align words in the matrix (En- glish) and embedded sentences (top: Indonesian, bottom: Chinese); (b) Extract candidate perturba- tions from embedded sentences; (c) Construct final adversary by maximizing the target model’s loss. multilingual societies (e.g., Singapore, Papua New Guinea, etc.), it is common for multilingual inter- locutors to produce sentences by mixing words, phrases, and even grammatical structures from the languages in their repertoires (Matras and Sakel, 2007). This is known as code-mixing (Poplack et al., 1988), a phenomenon common in casual con- versational environments such as social media and text messages.2 Hence, it is crucial for NLP sys- tems serving multilingual communities to be robust to code-mixing if they are to understand and estab- lish rapport with their users (Tay, 1989; Bawa et al., 2020) or defend against adversarial polyglots. Although gold standard data (Bali et al., 2014; Patwa et al., 2020) is important for definitively evaluating code-mixed text processing ability, such datasets are expensive to collect and annotate. The 2Examples of real code-mixing in Appendix A. dizzying range of potential language combinations further compounds the immensity of such an …

Content truncated to 500 words