Certified Robustness to Adversarial Word Substitutions

Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing, pages 4129–4142, Hong Kong, China, November 3–7, 2019. c⃝2019 Association for Computational Linguistics 4129 Certified Robustness to Adversarial Word Substitutions Robin Jia Aditi Raghunathan Kerem G¨oksel Computer Science Department, Stanford UniversityPercy Liang {robinjia,aditir,kerem,pliang}@cs.stanford.edu Abstract State-of-the-art NLP models can often be fooled by adversaries that apply seemingly innocuous label-preserving transformations (e.g., paraphrasing) to input text. The num- ber of possible transformations scales expo- nentially with text length, so data augmenta- tion cannot cover all transformations of an in- put. This paper considers one exponentially large family of label-preserving transforma- tions, in which every word in the input can be replaced with a similar word. We train the first models that are provably robust to all word substitutions in this family. Our train- ing procedure uses Interval Bound Propaga- tion (IBP) to minimize an upper bound on the worst-case loss that any combination of word substitutions can induce. To evaluate models’ robustness to these transformations, we mea- sure accuracy on adversarially chosen word substitutions applied to test examples. Our IBP-trained models attain 75% adversarial ac- curacy on both sentiment analysis on IMDB and natural language inference on SNLI. In comparison, on IMDB, models trained nor- mally and ones trained with data augmentation achieve adversarial accuracy of only 8% and 35%, respectively. 1 Introduction Machine learning models have achieved impres- sive accuracy on many NLP tasks, but they are surprisingly brittle. Adding distracting text to the input (Jia and Liang, 2017), paraphrasing the text (Iyyer et al., 2018; Ribeiro et al., 2018), replacing words with similar words (Alzantot et al., 2018), or inserting character-level “typos” (Belinkov and Bisk, 2017; Ebrahimi et al., 2017) can signifi- cantly degrade a model’s performance. Such per- turbed inputs are called adversarial examples, and have shown to break models in other domains as well, most notably in vision (Szegedy et al., 2014; … made one of the made accomplished delivered one of the best better finest nicest good films… films movies film cinema x1 x2 x3 x4 x5 ˜x1 ˜x2 ˜x3 ˜x4 ˜x5 best x6 ˜x6 S(x, 1) S(x, 2) S(x, 3) S(x, 4) S(x, 5) S(x, 6) Input reviewaaa x Substitution words …delivered one of the movies… better Perturbed reviewaaa Positive CNN Negative CNN ˜x Figure 1: Word substitution-based perturbations in sen- timent analysis. For an input x, we consider perturba- tions ˜x, in which every word xi can be replaced with any similar word from the set S(x, i), without chang- ing the original sentiment. Models can be easily fooled by adversarially chosen perturbations (e.g., changing “best” to “better”, “made” to “delivered”, “films” to “movies”), but the ideal model would be robust to all combinations of word substitutions. Goodfellow et al., 2015). Since humans are not fooled by the same perturbations, the widespread existence of adversarial examples exposes trou- bling gaps in models’ understanding. In this paper, we focus on the word substitution perturbations …

Content truncated to 500 words