DSRM: Boost Textual Adversarial Training with Distribution Shift Risk Minimization

Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics Volume 1: Long Papers, pages 12177–12189 July 9-14, 2023 ©2023 Association for Computational Linguistics DSRM: Boost Textual Adversarial Training with Distribution Shift Risk Minimization Songyang Gao1, Shihan Dou1, Yan Liu1, Xiao Wang1, Qi Zhang12∗, Zhongyu Wei3, Jin Ma4, Ying Shan4 1 School of Computer Science, Fudan University, Shanghai, China 2 Shanghai Key Laboratory of Intelligent Information Processing, Shanghai, China 3School of Data Science, Fudan University, Shanghai, China 4Tencent PCG {gaosy21, shdou21}@m.fudan.edu.cn Abstract Adversarial training is one of the best- performing methods in improving the robust- ness of deep language models. However, robust models come at the cost of high time consump- tion, as they require multi-step gradient ascents or word substitutions to obtain adversarial sam- ples. In addition, these generated samples are deficient in grammatical quality and semantic consistency, which impairs the effectiveness of adversarial training. To address these prob- lems, we introduce a novel, effective procedure for instead adversarial training with only clean data. Our procedure, distribution shift risk min- imization (DSRM), estimates the adversarial loss by perturbing the input data’s probabil- ity distribution rather than their embeddings. This formulation results in a robust model that minimizes the expected global loss under adver- sarial attacks. Our approach requires zero ad- versarial samples for training and reduces time consumption by up to 70% compared to current best-performing adversarial training methods. Experiments demonstrate that DSRM consid- erably improves BERT’s resistance to textual adversarial attacks and achieves state-of-the-art robust accuracy on various benchmarks. 1 Introduction Despite their impressive performance on various NLP tasks, deep neural networks (DNNs), like BERT (Devlin et al., 2019), are highly vulnerable to adversarial exemplars, which arise by adding imper- ceptible perturbations among natural samples un- der semantic and syntactic constraints (Zeng et al., 2021; Lin et al., 2021). Such vulnerability of DNNs has attracted extensive attention in enhancing de- fence techniques against adversarial examples (Li et al., 2021; Xi et al., 2022), where the adversarial training approach (AT) (Goodfellow et al., 2015) is empirically one of the best-performing algorithms to train networks robust to adversarial perturbations ∗ Corresponding author. (Uesato et al., 2018; Athalye et al., 2018). Formally, adversarial training attempts to solve the following min-max problem under loss function L: min θ∈Θ E(x,y)∼P0 �Adversarial Samples (AT) �� � max ∥δ∥p⩽ε L(θ, x + δ, y) � �� � Distribution Shift (Ours) , where θ ∈ Θ are the model parameters, and (x, y) denotes the input data and label, which follow the joint distribution P0. The curly brackets show the difference in research focus between our approach and vanilla adversarial training. Due to the non-convexity of neural networks, finding the analytic solution to the above inner max- imization (marked in red) is very difficult (Wang et al., 2021). The most common approach is to estimate the adversarial loss from the results of sev- eral gradient ascents, such as PGD (Madry et al., 2018) and FreeLB (Zhu et al., 2019). Li and Qiu (2021) and …

Content truncated to 500 words