Flooding-X: Improving BERT’s Resistance to Adversarial Attacks via Loss-Restricted Fine-Tuning

Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics Volume 1: Long Papers, pages 5634 - 5644 May 22-27, 2022 c⃝2022 Association for Computational Linguistics Flooding-X: Improving BERT’s Resistance to Adversarial Attacks via Loss-Restricted Fine-Tuning Qin Liu⋆∗, Rui Zheng⋆∗, Rong Bao⋆, Jingyi Liu⋆, ZhiHua Liu⋆, Zhanzhan Cheng♠, Liang Qiao♠, Tao Gui♦, Qi Zhang⋆,♣, Xuanjing Huang⋆ ⋆School of Computer Science, Fudan University ♦Institute of Modern Languages and Linguistics, Fudan University ♣Shanghai Key Laboratory of Intelligent Information Processing ♠Hikvision Research Institute, Hangzhou, China {liuq19,rzheng20,rbao18,tgui,qz,xjhuang}@fudan.edu.cn Abstract Adversarial robustness has attracted much at- tention recently, and the mainstream solution is adversarial training. However, the tradition of generating adversarial perturbations for each input embedding (in the settings of NLP) scales up the training computational complexity by the number of gradient steps it takes to ob- tain the adversarial samples. To address this problem, we leverage Flooding method which primarily aims at better generalization and we find promising in defending adversarial attacks. We further propose an effective criterion to bring hyper-parameter-dependent flooding into effect with a narrowed-down search space by measuring how the gradient steps taken within one epoch affect the loss of each batch. Our approach requires zero adversarial sample for training, and its time consumption is equiva- lent to fine-tuning, which can be 2-15 times faster than standard adversarial training. We experimentally show that our method improves BERT’s resistance to textual adversarial attacks by a large margin, and achieves state-of-the-art robust accuracy on various text classification and GLUE tasks. 1 Introduction Despite their impressive performances on various NLP tasks, deep neural networks such as BERT (Devlin et al., 2019) suffer a sharp performance degradation against deliberately constructed ad- versarial attacks (Zeng et al., 2021; Wang et al., 2021b; Nie et al., 2020; Zang et al., 2020; Ren et al., 2019; Zhang et al., 2019). A line of work attempts to alleviate this problem by creating adversarially robust models via defense methods, including ad- versarial data augmentation (Chen et al., 2021; Si et al., 2021), regularization (Wang et al., 2021a), and adversarial training (Wang et al., 2020; Zhu et al., 2020; Madry et al., 2018). Data augmentation ∗ Equal Contribution. and adversarial training rely on additional adver- sarial examples generated either by hand-crafting or conducting gradient ascent on the clean data for virtual adversarial samples. However, generating adversarial examples scales up the cost of training computationally, which makes vanilla adversarial training almost impracti- cal on large-scale NLP tasks like QNLI (Question- answering NLI, Rajpurkar et al., 2016). An increas- ing amount of researchers express their concern about the time-consuming property of standard adversarial training and offer cheaper but compet- itive alternatives by (i) replacing the perturbation generation with an additional generator network (Baluja and Fischer, 2017; Xiao et al., 2018), or by (ii) combining the gradient computation of clean data and perturbations into one backward pass (Shafahi et al., 2019). These approaches still rely on additional adversarial examples generated either by the model itself or by an extra module. In this work, …

Content truncated to 500 words