BERT-Defense: A Probabilistic Model Based on BERT to Combat Cognitively Inspired Orthographic Adversarial Attacks

Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021, pages 1616–1629 August 1–6, 2021. ©2021 Association for Computational Linguistics 1616 BERT-Defense: A Probabilistic Model Based on BERT to Combat Cognitively Inspired Orthographic Adversarial Attacks Yannik Keller†, Jan Mackensen†, Steffen Eger‡ † Center of Cognitive Science ‡ Natural Language Learning Group Technische Universit¨at Darmstadt {yannik.keller,jan.mackensen}@stud.tu-darmstadt.de eger@aiphes.tu-darmstadt.de Abstract Adversarial attacks expose important blind spots of deep learning systems. While word- and sentence-level attack scenarios mostly deal with finding semantic paraphrases of the input that fool NLP models, character-level attacks typically insert typos into the input stream. It is commonly thought that these are easier to defend via spelling correction mod- ules. In this work, we show that both a stan- dard spellchecker and the approach of Pruthi et al. (2019), which trains to defend against in- sertions, deletions and swaps, perform poorly on the character-level benchmark recently pro- posed in Eger and Benz (2020) which includes more challenging attacks such as visual and phonetic perturbations and missing word seg- mentations. In contrast, we show that an untrained iterative approach which combines context-independent character-level informa- tion with context-dependent information from BERT’s masked language modeling can per- form on par with human crowd-workers from Amazon Mechanical Turk (AMT) supervised via 3-shot learning. 1 Introduction Adversarial attacks to machine learning systems are malicious modifications of their inputs designed to fool machines into misclassification but not hu- mans (Goodfellow et al., 2015). One of their goals is to expose blind-spots of deep learning models, which can then be shielded against. In the NLP community, typically two different kinds of attack scenarios are considered. “High-level” attacks para- phrase (semantically or syntactically) the input sen- tence (Iyyer et al., 2018; Alzantot et al., 2018; Jin et al., 2020) so that the classification label does not change, but the model changes its decision. Of- Aɠuyĩˢpɬayįng aṱrǜmₚèt. Substring Levenshtein distance 1. a buy is paying trumpet. 3. abuyla paying trumpet. 2. a buy is paying a trumpet. Hypothesis before BERT improvements 4. abuyla paying a trumpet. BERT 1. a guy is playing trumpet. 3. andyla playing trumpet.. 2. a guy is playing a trumpet. Hypothesis after BERT improvements 4. abuyla playing a trumpet. GPT A guy is playing a trumpet. Figure 1: A high-level overview of the processing of an example sentence in our adversarial-defense pipeline. The sentences shown for the hypothesis have been cre- ated by choosing the maximum of their associated prob- ability distributions over words. ten, this is framed as a search problem where the attacker has at least access to model predictions (Zang et al., 2020). “Low-level” attackers operate on the level of characters and may consist of adver- sarial typos (Belinkov and Bisk, 2018; Ebrahimi et al., 2018a; Pruthi et al., 2019; Jones et al., 2020) or replacement of characters with similarly look- ing ones (Eger et al., 2019; Li et al., 2020a). Such attacks may also be successful when the attacker operates in a blind mode, without having access to model predictions, and they …

Content truncated to 500 words