RMLM: A Flexible Defense Framework for Proactively Mitigating Word-level Adversarial Attacks

Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics Volume 1: Long Papers, pages 2757–2774 July 9-14, 2023 ©2023 Association for Computational Linguistics RMLM: A Flexible Defense Framework for Proactively Mitigating Word-level Adversarial Attacks Zhaoyang Wang† 1, Zhiyue Liu† 2, Xiaopeng Zheng1, Qinliang Su1, Jiahai Wang∗ 1,3,4 School of Computer Science and Engineering, Sun Yat-sen University, Guangzhou, China1 School of Computer, Electronics and Information, Guangxi University, Nanning, China2 Guangdong Key Laboratory of Big Data Analysis and Processing, Guangzhou, China3 Key Laboratory of Machine Intelligence and Advanced Computing, Ministry of Education4 {wangzhaoy22,zhengxp26}@mail2.sysu.edu.cn liuzhy@gxu.edu.cn {suqliang,wangjiah}@mail.sysu.edu.cn Abstract Adversarial attacks on deep neural networks keep raising security concerns in natural lan- guage processing research. Existing defenses focus on improving the robustness of the vic- tim model in the training stage. However, they often neglect to proactively mitigate adversar- ial attacks during inference. Towards this over- looked aspect, we propose a defense framework that aims to mitigate attacks by confusing at- tackers and correcting adversarial contexts that are caused by malicious perturbations. Our framework comprises three components: (1) a synonym-based transformation to randomly corrupt adversarial contexts in the word level, (2) a developed BERT defender to correct ab- normal contexts in the representation level, and (3) a simple detection method to filter out adver- sarial examples, any of which can be flexibly combined. Additionally, our framework helps improve the robustness of the victim model during training. Extensive experiments demon- strate the effectiveness of our framework in de- fending against word-level adversarial attacks. 1 Introduction Deep neural networks (DNNs) have achieved re- markable success in natural language processing (NLP). However, they are vulnerable when facing adversarial attacks (Alzantot et al., 2018; Liang et al., 2018; Zhong et al., 2020a; Wang et al., 2020). Textual adversarial attacks craft adversarial con- texts by perturbing the input in order to fool the victim model, which keeps raising security issues. General textual adversarial attacks can be catego- rized into three broad classes according to the per- turbation grain, including character-level attacks (e.g., word misspelling) (Ebrahimi et al., 2018; Eger et al., 2019), word-level attacks (e.g., word † Contribute equally. ∗ Corresponding author. substitution) (Huang et al., 2019; Ren et al., 2019; Li et al., 2020; Garg and Ramakrishnan, 2020; Jin et al., 2020), and sentence-level attacks (e.g., paraphrasing) (Ribeiro et al., 2018; Wang et al., 2020; Maheshwary et al., 2021). Character-level and sentence-level attacks often tend to create il- legal and unnatural sentences, which could be de- tected by the spelling and grammar checker, re- spectively (Pruthi et al., 2019; Ge et al., 2019). Word-level attacks utilize synonym substitutions to craft adversarial examples that do not violate gram- matical and semantic requirements (Samanta and Mehta, 2017; Garg and Ramakrishnan, 2020), and thus it is more challenging to defend against them. In this paper, we focus on the defense against such synonym-based word-level adversarial attacks. Defense methods for textual adversarial attacks can be roughly divided into two categories (Li et al., 2021): empirical defense and certified robustness. Most …

Content truncated to 500 words