Evaluating and Enhancing the Robustness of Neural Network-based Dependency Parsing Models with Adversarial Examples

Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 6600–6610 July 5 - 10, 2020. c⃝2020 Association for Computational Linguistics 6600 Evaluating and Enhancing the Robustness of Neural Network-based Dependency Parsing Models with Adversarial Examples Xiaoqing Zheng1,2∗, Jiehang Zeng1,2∗, Yi Zhou1,2∗, Cho-Jui Hsieh3, Minhao Cheng3, Xuanjing Huang1,2 1School of Computer Science, Fudan University, Shanghai, China 2Shanghai Key Laboratory of Intelligent Information Processing 3Department of Computer Science, University of California, Los Angeles, USA {zhengxq, jhzeng18, yizhou17}@fudan.edu.cn {chohsieh, mhcheng}@cs.ucla.edu, xjhuang@fudan.edu.cn Abstract Despite achieving prominent performance on many important tasks, it has been reported that neural networks are vulnerable to adversarial examples. Previously studies along this line mainly focused on semantic tasks such as sen- timent analysis, question answering and read- ing comprehension. In this study, we show that adversarial examples also exist in depen- dency parsing: we propose two approaches to study where and how parsers make mis- takes by searching over perturbations to exist- ing texts at sentence and phrase levels, and de- sign algorithms to construct such examples in both of the black-box and white-box settings. Our experiments with one of state-of-the-art parsers on the English Penn Treebank (PTB) show that up to 77% of input examples admit adversarial perturbations, and we also show that the robustness of parsing models can be improved by crafting high-quality adversaries and including them in the training stage, while suffering little to no performance drop on the clean input data. 1 Introduction Deep neural network-based machine learning (ML) models are powerful but vulnerable to adversarial examples. Adversarial examples also yield broader insights into the targeted models by exposing them to such maliciously crafted examples. The intro- duction of the adversarial example and training ushered in a new era to understand and improve the ML models, and has received significant at- tention recently (Szegedy et al., 2013; Goodfellow et al., 2015; Moosavi-Dezfooli et al., 2016; Paper- not et al., 2016b; Carlini and Wagner, 2017; Yuan et al., 2019; Eykholt et al., 2018; Xu et al., 2019). Even though generating adversarial examples for texts has proven to be a more challenging task ∗These authors contributed equally to this work. The DT link NN between IN the DT futures NNS and CC stock NN markets NNS ripped VBD apart RB . . det advmod prep det cc nn conj pobj punct nsubj The DT link NN between IN the DT futures NNS and CC exchange NN markets NNS ripped VBD apart RB . . det advmod prep cc conj punct nn det pobj nsubj Figure 1: Sentence-level attack: An adversarial exam- ple (bottom) for the output (top) of a deep neural depen- dency parser (Dozat and Manning, 2017). Replacing a word “stock” with an adversarially-chosen word “ex- change” in the sentence causes the parser to make four mistakes (blue, dashed) in arc prediction. The adversar- ial example preserves the original syntactic structures, and the substitute word is assigned to the same part of speech (POS) as the replaced one. The assigned POS tags …

Content truncated to 500 words