Randomized Smoothing with Masked Inference for Adversarially Robust Text Classifications

Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics Volume 1: Long Papers, pages 5145–5165 July 9-14, 2023 ©2023 Association for Computational Linguistics Randomized Smoothing with Masked Inference for Adversarially Robust Text Classifications Han Cheol Moon♣, Shafiq Joty♣♢, Ruochen Zhao ♣, Megh Thakkar†, and Xu Chi♠ ♣Nanyang Technological University, Singapore ♢Salesforce AI † Birla Institute of Technology and Science, Pilani ♠A*STAR, Singapore {hancheol001@e., sjoty@, ruochen002@e.}ntu.edu.sg Abstract Large-scale pre-trained language models have shown outstanding performance in a variety of NLP tasks. However, they are also known to be significantly brittle against specifically crafted adversarial examples, leading to increasing in- terest in probing the adversarial robustness of NLP systems. We introduce RSMI, a novel two-stage framework that combines random- ized smoothing (RS) with masked inference (MI) to improve the adversarial robustness of NLP systems. RS transforms a classifier into a smoothed classifier to obtain robust repre- sentations, whereas MI forces a model to ex- ploit the surrounding context of a masked to- ken in an input sequence. RSMI improves ad- versarial robustness by 2 to 3 times over ex- isting state-of-the-art methods on benchmark datasets. We also perform in-depth qualita- tive analysis to validate the effectiveness of the different stages of RSMI and probe the impact of its components through extensive ablations. By empirically proving the stabil- ity of RSMI, we put it forward as a practical method to robustly train large-scale NLP mod- els. Our code and datasets are available at https://github.com/Han8931/rsmi_nlp. 1 Introduction In response to the threat of textual adversarial at- tacks (Ebrahimi et al., 2018; Jin et al., 2020), a vari- ety of defense schemes have been proposed (Goyal et al., 2022; Ye et al., 2020; Zhou et al., 2021; Dong et al., 2021). Defense schemes typically involve solving a min-max optimization problem, consist- ing of an inner maximization that seeks the worst (adversarial) example and an outer minimization that aims to minimize a system’s loss over such examples (Madry et al., 2018). The solution to the inner maximization problem is typically ob- tained through iterative optimization algorithms, such as stochastic gradient descent (Ilyas et al., 2019; Madry et al., 2018). Class-2 AdvEx Class-1 (a) Randomized Smoothing This is an OK adaptation of the breath taking book.... This is an OK changing of the breath taking book.... This is an OK [MASK] of the breath taking book... Context Info Context Info De-noising (b) Gradient-Guided Masking Positive Sentiment Negative Sentiment Figure 1: An overview of RSMI. (a) Randomized smoothing (RS) provides a certifiable robustness within a ball with a radius R around an input point x (c.f., R can be computed by Theorem 1) and (b) masked infer- ence (MI) denoises “adversarially salient” tokens via a gradient-based feature attribution analysis to make a decision on the input sample with the surrounding con- texts of a masked token in the input. For texts, however, the gradients cannot be di- rectly computed due to the discrete nature of the texts. Thus, the gradients are often computed with respect …

Content truncated to 500 words