MockingBERT: A Method for Retroactively Adding Resilience to NLP Models

Proceedings of the 29th International Conference on Computational Linguistics, pages 4640–4650 October 12–17, 2022. 4640 MockingBERT: A Method for Retroactively Adding Resilience to NLP Models∗ Jan Jezabek Hedgefrog Software LLC jjezabek@hedgefrogsoft.com Akash Singh Salesforce Inc. singh.akash@salesforce.com Abstract Protecting NLP models against misspellings whether accidental or adversarial has been the object of research interest for the past few years. Existing remediations have typically either compromised accuracy or required full model re-training with each new class of attacks. We propose a novel method of retroactively adding resilience to misspellings to transformer-based NLP models. This robustness can be achieved without the need for re-training of the original NLP model and with only a minimal loss of language understanding performance on inputs without misspellings. Additionally we propose a new efficient approximate method of gener- ating adversarial misspellings, which consid- erably reduces the cost needed to evaluate a model’s resilience to adversarial attacks. 1 Introduction While artificial neural networks have been able to achieve human level performance on many real- world tasks, they sometimes fail in surprising ways. (Szegedy et al., 2013) showed that state of the art computer vision models can be fooled into mis- classifying objects with only limited perturbations imperceptible to human viewers. Along similar lines, it was shown in (Pruthi et al., 2019) that very constrained attacks can successfully trick classifica- tion algorithms into making incorrect predictions. In fact such attacks have been used for a long time, chiefly for evading spam classifiers while remain- ing legible to human readers. Protecting against such misspellings, whether accidental or intentional, has been a focus of re- search in the NLP field for many years (Lee and Ng, 2005). Recently, defenses suggested by (Pruthi *MockingBERT is a reference to mockingbirds, a group of birds known for mimicking the sounds of other animals. The code for reproducing our results as well as instructions for obtaining the trained models are available at https:// github.com/akash13singh/resilient_nlp/. et al., 2019) and (Jones et al., 2020) can par- tially remediate adversarial attacks by adding a pre-processing step, at the cost of a drop in classi- fication performance. (Liu et al., 2020) proposed replacing a fixed word embeddings with trained character-based ones and observed improved re- silience to adversarial attacks. In existing systems a tension exists between modularity and accuracy. (Pruthi et al., 2019) and (Jones et al., 2020) propose fully modular systems that are completely oblivious of the downstream language understanding model. This provides ex- plainability (by providing a verbatim sequence of corrected tokens) but comes at a cost of reduced accuracy on unperturbed inputs. Additionally there is an added drawback of not being able to preserve potential ambiguity present in the input, making these systems ‘destructive’. Conversely, (Liu et al., 2020) is able to represent ambiguous inputs, how- ever at the cost of losing modularity. Our central hypothesis is that original accuracy can be preserved while at the same time ensuring modularity. In particular we show that existing clas- sifiers based on BERT and RoBERTa, two widely used pre-trained …

Content truncated to 500 words