Achieving Model Robustness through Discrete Adversarial Training

Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 1529–1544 November 7–11, 2021. c⃝2021 Association for Computational Linguistics 1529 Achieving Model Robustness through Discrete Adversarial Training Maor Ivgi Tel-Aviv University maorivgi@mail.tau.ac.il Jonathan Berant Tel-Aviv University The Allen Institute for AI joberant@cs.tau.ac.il Abstract Discrete adversarial attacks are symbolic per- turbations to a language input that preserve the output label but lead to a prediction error. While such attacks have been extensively ex- plored for the purpose of evaluating model ro- bustness, their utility for improving robustness has been limited to offline augmentation only. Concretely, given a trained model, attacks are used to generate perturbed (adversarial) exam- ples, and the model is re-trained exactly once. In this work, we address this gap and lever- age discrete attacks for online augmentation, where adversarial examples are generated at every training step, adapting to the changing nature of the model. We propose (i) a new discrete attack, based on best-first search, and (ii) random sampling attacks that unlike prior work are not based on expensive search-based procedures. Surprisingly, we find that random sampling leads to impressive gains in robust- ness, outperforming the commonly-used of- fline augmentation, while leading to a speedup at training time of ∼10x. Furthermore, on- line augmentation with search-based attacks justifies the higher training cost, significantly improving robustness on three datasets. Last, we show that our new attack substantially im- proves robustness compared to prior methods. 1 Introduction Adversarial examples are inputs that are slightly, but intentionally, perturbed to create a new exam- ple that is misclassified by a model (Szegedy et al., 2014). Adversarial examples have attracted im- mense attention in machine learning (Goodfellow et al., 2015; Carlini and Wagner, 2017; Papernot et al., 2017) for two important, but separate, rea- sons. First, they are useful for evaluating model robustness, and have revealed that current mod- els are over-sensitive to minor perturbations. Sec- ond, adversarial examples can improve robustness: training on adversarial examples reduces the brittle- ness and over-sensitivity of deep learning models to Figure 1: Robust accuracy vs. slowdown in training time, comparing different methods to Baseline (purple pentagon); x-axis in logarithmic scale. The popular ADVOFF (blue squares, offline augmentation with ad- versarial example) is 10x slower than our simple aug- mentation of 4 (8) random samples (triangles, RAND- OFF-4, RANDOFF-8) and achieves similar or worse ro- bust accuracy. Our online augmentation of adversar- ial examples (ADVON, yellow circles) significantly im- proves robust accuracy, but is expensive to train. such perturbations (Alzantot et al., 2018; Jin et al., 2020; Li et al., 2020; Lei et al., 2019; Wallace et al., 2019; Zhang et al., 2020; Garg and Ramakrishnan, 2020; Si et al., 2020a; Goel et al., 2021). Training and evaluating models with adversarial examples has had considerable success in computer vision, with gradient-based techniques like FGSM (Goodfellow et al., 2015) and PGD (Madry et al., 2018). In computer vision, adversarial examples can be constructed by considering a continuous space of imperceptible perturbations around im- age pixels. …

Content truncated to 500 words