Robust Encodings: A Framework for Combating Adversarial Typos

Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 2752–2765 July 5 - 10, 2020. c⃝2020 Association for Computational Linguistics 2752 Robust Encodings: A Framework for Combating Adversarial Typos Erik Jones Robin Jia∗ Aditi Raghunathan∗ Percy Liang Computer Science Department, Stanford University {erjones,robinjia,aditir,pliang}@stanford.edu Abstract Despite excellent performance on many tasks, NLP systems are easily fooled by small adver- sarial perturbations of inputs. Existing pro- cedures to defend against such perturbations are either (i) heuristic in nature and suscep- tible to stronger attacks or (ii) provide guar- anteed robustness to worst-case attacks, but are incompatible with state-of-the-art mod- els like BERT. In this work, we introduce ro- bust encodings (RobEn): a simple framework that confers guaranteed robustness, without making compromises on model architecture. The core component of RobEn is an encoding function, which maps sentences to a smaller, discrete space of encodings. Systems using these encodings as a bottleneck confer guaran- teed robustness with standard training, and the same encodings can be used across multiple tasks. We identify two desiderata to construct robust encoding functions: perturbations of a sentence should map to a small set of encod- ings (stability), and models using encodings should still perform well (fidelity). We instan- tiate RobEn to defend against a large family of adversarial typos. Across six tasks from GLUE, our instantiation of RobEn paired with BERT achieves an average robust accuracy of 71.3% against all adversarial typos in the fam- ily considered, while previous work using a typo-corrector achieves only 35.3% accuracy against a simple greedy attack. 1 Introduction State-of-the-art NLP systems are brittle: small per- turbations of inputs, commonly referred to as ad- versarial examples, can lead to catastrophic model failures (Belinkov and Bisk, 2018; Ebrahimi et al., 2018b; Ribeiro et al., 2018; Alzantot et al., 2018). For example, carefully chosen typos and word sub- stitutions have fooled systems for hate speech de- tection (Hosseini et al., 2017), machine translation ∗Authors contributed equally. Positive Positive Inspired acting Inspikred ating Complete flop Copmlete fljop Irnspired atcing Negative Inspired acting Complete flop Inspikred ating Sentences Encodings Predictions Figure 1: Example of a defense using RobEn. An adversary can perturb sentences (blue, underlined) to many different perturbations (red, not-underlined) within the attack surface (red, ovals). We define an en- coding function α such that each perturbation of the input sentences maps to one of a few encodings (grey, rounded rectangles). We can then use any model g to make predictions given the encodings. (Ebrahimi et al., 2018a), and spam filtering (Lee and Ng, 2005), among others. We aim to build systems that achieve high ro- bust accuracy: accuracy against worst-case attacks. Broadly, existing methods to build robust mod- els fall under one of two categories: (i) adversar- ial training, which augments the training set with heuristically generated perturbations and (ii) cer- tifiably robust training, which bounds the change in prediction between an input and any of its al- lowable perturbations. Both these approaches have major shortcomings, especially in NLP. Adversar- ial training, …

Content truncated to 500 words