SHIELD: Defending Textual Neural Networks against Multiple Black-Box Adversarial Attacks with Stochastic Multi-Expert Patcher
38920Authors
nan
Abstract
AbstractEven though several methods have proposed to defend textual neural network (NN) models against black-box adversarial attacks, they often defend against a specific text perturbation strategy and/or require re-training the models from scratch. This leads to a lack of generalization in practice and redundant computation. In particular, the state-of-the-art transformer models (e.g., BERT, RoBERTa) require great time and computation resources. By borrowing an idea from software engineering, in order to address these limitations, we propose a novel algorithm, SHIELD, which modifies and re-trains only the last layer of a textual NN, and thus it “patches” and “transforms” the NN into a stochastic weighted ensemble of multi-expert prediction heads. Considering that most of current black-box attacks rely on iterative search mechanisms to optimize their adversarial perturbations, SHIELD confuses the attackers by automatically utilizing different weighted ensembles of predictors depending on the input. In other words, SHIELD breaks a fundamental assumption of the attack, which is a victim NN model remains constant during an attack. By conducting comprehensive experiments, we demonstrate that all of CNN, RNN, BERT, and RoBERTa-based textual NNs, once patched by SHIELD, exhibit a relative enhancement of 15%–70% in accuracy on average against 14 different black-box attacks, outperforming 6 defensive baselines across 3 public datasets. All codes are to be released.
Keywords
Full Content
Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics Volume 1: Long Papers, pages 596 - 609 May 22-27, 2022 c⃝2022 Association for Computational Linguistics Quality Controlled Paraphrase Generation Elron Bandel1,2 Ranit Aharonov1 Michal Shmueli-Scheuer1 Ilya Shnayderman1 Noam Slonim1 Liat Ein-Dor1 1IBM Research 2Computer Science Department, Bar Ilan University elron.bandel@ibm.com {shmueli,ilyashn,noams,liate}@il.ibm.com Abstract Paraphrase generation has been widely used in various downstream tasks. Most tasks benefit mainly from high quality paraphrases, namely those that are semantically similar to, yet lin- guistically diverse from, the original sentence. Generating high-quality paraphrases is chal- lenging as it becomes increasingly hard to pre- serve meaning as linguistic diversity increases. Recent works achieve nice results by control- ling specific aspects of the paraphrase, such as its syntactic tree. However, they do not al- low to directly control the quality of the gener- ated paraphrase, and suffer from low flexibil- ity and scalability. Here we propose QCPG, a quality-guided controlled paraphrase gener- ation model, that allows directly controlling the quality dimensions. Furthermore, we sug- gest a method that given a sentence, identi- fies points in the quality control space that are expected to yield optimal generated para- phrases. We show that our method is able to generate paraphrases which maintain the original meaning while achieving higher di- versity than the uncontrolled baseline. The models, the code, and the data can be found in https://github.com/IBM/quality-c ontrolled-paraphrase-generation. 1 Introduction Paraphrase generation, namely rewriting a sentence using different words and/or syntax while preserv- ing its meaning (Bhagat and Hovy, 2013), is an important technique in natural language processing, that has been widely used in various downstream tasks including question answering (Fader et al., 2014a; McCann et al., 2018), summarization (Rush et al., 2015), data augmentation (Yu et al., 2018) and adversarial learning (Iyyer et al., 2018). How- ever, not all paraphrases are equally useful. For most real-world applications, paraphrases which are too similar to the original sentence are of lim- ited value, while those with high linguistic diversity, High Quality Region !"#$%&'()!'#'*$+'&, -'%./0&'()1'2"+0'&, Figure 1: Density of paraphrases in WikiAnswers as a function of the semantic similarity and the linguistic diversity. The marked area, which contains high quality paraphrases, is very sparse (The measures used in the figure are described in Section 2.1) . i.e. with large syntactic/lexical differences between the paraphrase and the original sentence, are more beneficial to the robustness and accuracy of auto- matic text evaluation and classification, and can avoid the blandness caused by repetitive patterns (Qian et al., 2019). The quality of paraphrases is often evaluated using three dimensions, where high quality paraphrases are those with high semantic similarity as well as high lexical and/or syntactic diversity (McCarthy et al., 2009). Generating high quality paraphrases can be chal- lenging (for both humans and automatic models) since it is increasingly difficult to preserve meaning with increasing linguistic diversity. Indeed, when examining the quality of paraphrases among para- phrase generation datasets, one can find a wide range of paraphrase qualities, where the area of …
Content truncated to 500 words
Labeled Text
AbstractEven though several methods have proposed to defend textual neural network (NN) models against black-box adversarial attacks, they often defend against a specific text perturbation strategy and/or require re-training the models from scratch. This leads to a lack of generalization in practice and redundant computation. In particular, the state-of-the-art transformer models (e.g., BERT, RoBERTa) require great time and computation resources. By borrowing an idea from software engineering, in order to address these limitations, we propose a novel algorithm, SHIELD, which modifies and re-trains only the last layer of a textual NN, and thus it “patches” and “transforms” the NN into a stochastic weighted ensemble of multi-expert prediction heads. Considering that most of current black-box attacks rely on iterative search mechanisms to optimize their adversarial perturbations, SHIELD confuses the attackers by automatically utilizing different weighted ensembles of predictors depending on the input. In other words, SHIELD breaks a fundamental assumption of the attack, which is a victim NN model remains constant during an attack. By conducting comprehensive experiments, we demonstrate that all of CNN, RNN, BERT, and RoBERTa-based textual NNs, once patched by SHIELD, exhibit a relative enhancement of 15%–70% in accuracy on average against 14 different black-box attacks, outperforming 6 defensive baselines across 3 public datasets. All codes are to be released.
Publication Details
- Paper ID:
- 38920
- Year:
- 2022
- Publication:
- TIPSTER
- Publication Type:
- conf
- DOI:
- nan