CAT-Gen: Improving Robustness in NLP Models via Controlled Adversarial Text Generation

Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing, pages 5141–5146, November 16–20, 2020. c⃝2020 Association for Computational Linguistics 5141 CAT-Gen: Improving Robustness in NLP Models via Controlled Adversarial Text Generation Tianlu Wang†∗ Xuezhi Wang§ Yao Qin§ Ben Packer§ Kang Lee§ Jilin Chen§ Alex Beutel§ Ed Chi§ †University of Virginia tw8cb@virginia.edu §Google Research {xuezhiw, yaoqin, bpacker, kanlig, jilinc, alexbeutel, edchi}@google.com Abstract NLP models are shown to suffer from ro- bustness issues, i.e., a model’s prediction can be easily changed under small perturbations to the input. In this work, we present a Controlled Adversarial Text Generation (CAT- Gen) model that, given an input text, gener- ates adversarial texts through controllable at- tributes that are known to be irrelevant to task labels. For example, in order to attack a model for sentiment classification over product re- views, we can use the product categories as the controllable attribute which should not change the sentiment of the reviews. Experiments on real-world NLP datasets demonstrate that our method can generate more diverse and flu- ent adversarial texts, compared to many ex- isting adversarial text generation approaches. We further use our generated adversarial ex- amples to improve models through adversarial training, and we demonstrate that our gener- ated attacks are more robust against model re- training and different model architectures. 1 Introduction It has been shown that NLP models are often sen- sitive to random initialization (Zhou et al., 2020), out-of-distribution data (Hendrycks et al., 2020; Wang et al., 2019), and adversarially generated at- tacks (Jia and Liang, 2017; Jin et al., 2020; Alzan- tot et al., 2018). One line of research to improve models’ robustness to adversarial attacks is by gen- erating adversarial examples in either the input text space (discrete, e.g., Alzantot et al. (2018); Jin et al. (2020)) or some intermediate representation space (continuous, e.g., Zhao et al. (2018); Zhu et al. (2020)). However, existing adversarial text genera- tion approaches that try to perturb in the input text space might lead to generations lacking diversity or ∗This research was conducted during the author’s intern- ship at Google Research. fluency. On the other hand, approaches focusing on perturbing in the intermediate representation space can often lead to generations that are not related to the input. We show some adversarial examples generated by existing works in Table 1. In this work, we aim to explore adversarial text generation through controllable attributes. We pro- pose to utilize text generation models to produce more diverse and fluent outputs. Meanwhile, we constrain the language generation within certain controllable attributes, leading to high quality out- puts that are semantically close to input sentences. Formally, we denote the input text as x, the label for the main task (e.g., text classification) as y, a model’s prediction over x as f(x), and controllable attributes (e.g., category, gender, domain) as a. Our goal is to create adversarial attacks x′ that can suc- cessfully fool the classifier into making an incorrect prediction f(x) ̸= f(x′), while keeping the ground truth …

Content truncated to 500 words