Towards Adversarially Robust Text Classifiers by Learning to Reweight Clean Examples

Findings of the Association for Computational Linguistics: ACL 2022, pages 1694 - 1707 May 22-27, 2022 c⃝2022 Association for Computational Linguistics Towards Adversarially Robust Text Classifiers by Learning to Reweight Clean Examples Jianhan Xu1,2∗, Cenyuan Zhang1,2∗, Xiaoqing Zheng1,2, Linyang Li1,2, Cho-Jui Hsieh3, Kai-Wei Chang3, Xuanjing Huang1,2 1School of Computer Science, Fudan University, Shanghai, China 2Shanghai Key Laboratory of Intelligent Information Processing 3Department of Computer Science, University of California, Los Angeles, USA {jianhanxu20,cenyuanzhang17,zhengxq}@fudan.edu.cn {chohsieh,kwchang}@cs.ucla.edu Abstract Most of the existing defense methods improve the adversarial robustness by making the mod- els adapt to the training set augmented with some adversarial examples. However, the aug- mented adversarial examples may not be natu- ral, which might distort the training distribution, resulting in inferior performance both in clean accuracy and adversarial robustness. In this study, we explore the feasibility of introduc- ing a reweighting mechanism to calibrate the training distribution to obtain robust models. We propose to train text classifiers by a sam- ple reweighting method in which the example weights are learned to minimize the loss of a validation set mixed with the clean examples and their adversarial ones in an online learn- ing manner. Through extensive experiments, we show that there exists a reweighting mecha- nism to make the models more robust against adversarial attacks without the need to craft the adversarial examples for the entire training set. 1 Introduction Even though deep neural networks have achieved impressive performance on many natural language processing (NLP) tasks, they are vulnerable to ad- versarial examples intentionally crafted under cer- tain semantic and syntactic constraints (Jia and Liang, 2017; Ebrahimi et al., 2017; Gao et al., 2018a; Zhao et al., 2018; Cheng et al., 2019; Zheng et al., 2020). The existence and pervasiveness of adversarial examples raise serious concerns, especially when deploying such NLP models to security-sensitive applications. Recently, many methods have been proposed to defend against adversarial attacks for neural NLP models (Miyato et al., 2017a; Sato et al., 2018a; Jiang et al., 2020; Li and Qiu, 2020; Zhu et al., 2020; Zhou et al., 2021; Dong et al., 2021; Si et al., 2021). Existing defense methods usually augment ∗Equal contribution the clean training examples with the adversarial ones in one way or another in the training stage and fit the models on the augmented training set. How- ever, the introduced adversarial examples may not be natural, which may even hurt the distribution of original training examples, resulting in lower performance on both clean and adversarial test sets. Besides, these methods usually need to generate the adversarial examples for an entire training set, which is computationally intensive. We hypothe- size that one of the reasons that NLP models are not robust is because they overfit to training data biases (Bras et al., 2020) — the training data is biased to- wards a certain distribution, so the resulting model can be broken under some perturbations. Despite augmenting training set by adversarial examples can partially mitigate this problem, are there bet- ter and more direct ways to …

Content truncated to 500 words