On the Robustness of Self-Attentive Models

Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pages 1520–1529 Florence, Italy, July 28 - August 2, 2019. c⃝2019 Association for Computational Linguistics 1520 On the Robustness of Self-Attentive Models Yu-Lun Hsieh1,2, Minhao Cheng3, Da-Cheng Juan4, Wei Wei4, Wen-Lian Hsu1,5, Cho-Jui Hsieh3,4 1SNHCC, TIGP, Academia Sinica, Taiwan 2National Chengchi University, Taiwan 3University of California, Los Angeles, USA 4Google Research, USA 5PAIR Labs, Ministry of Science and Technology, Taiwan morphe@iis.sinica.edu.tw, mhcheng@cs.ucla.edu, x@dacheng.info, wewei@google.com, hsu@iis.sinica.edu.tw, chohsieh@cs.ucla.edu Abstract This work examines the robustness of self- attentive neural networks against adversarial input perturbations. Specifically, we investi- gate the attention and feature extraction mech- anisms of state-of-the-art recurrent neural net- works and self-attentive architectures for sen- timent analysis, entailment and machine trans- lation under adversarial attacks. We also pro- pose a novel attack algorithm for generating more natural adversarial examples that could mislead neural models but not humans. Exper- imental results show that, compared to recur- rent neural models, self-attentive models are more robust against adversarial perturbation. In addition, we provide theoretical explana- tions for their superior robustness to support our claims. 1 Introduction Self-attentive neural models have recently become a prominent component that achieves state-of-the- art performances on many natural language pro- cessing (NLP) tasks such as text classification and machine translation (MT). This type of mod- els, including Transformer (Vaswani et al., 2017) and “Bidirectional Encoder Representations from Transformers,” shortened as BERT (Devlin et al., 2019), rely on the attention mechanism (Luong et al., 2015) to learn a context-dependent repre- sentation; compared to recurrent neural networks (RNN), these self-attention-based models have faster encoding speed and the capacity of mod- eling a wider context. Particularly, BERT is re- cently proposed to extend the directionality of the Transformer model, and “pre-trained” using mul- tiple objectives to strengthen its encoding capabil- ity. Then, this pre-trained model can be fine-tuned for various downstream tasks. BERT achieves state-of-the-art performance on several NLP tasks including classification and sequence-to-sequence problems, often outperforming task-specific fea- ture engineering or model architecture; therefore, BERT is poised to be a key component in almost every neural model for NLP tasks. Despite the superior performance, it remains unclear whether the self-attentive structure de- ployed by Transformer or BERT is robust to ad- versarial attacks compared with other neural net- works. Adversarial attack refers to applying a small perturbation on the model input to craft an adversarial example, ideally imperceptible by hu- mans, and cause the model to make an incorrect prediction (Goodfellow et al., 2015). Unlike com- puter vision models, generating an effective, tex- tual adversarial example that misleads a model but can go unnoticed by humans is a challeng- ing and thriving research problem (Alzantot et al., 2018). Therefore, the goal of this paper is to an- swer the following questions: “Are self-attentive models more robust to adversarial examples com- pared with recurrent models? If so, why?” “Do attention scores expose vulnerability in these self- attentive models?” This work verifies the robustness of self- attentive models through performing adversarial attacks …

Content truncated to 500 words