Defense against Synonym Substitution-based Adversarial Attacks via Dirichlet Neighborhood Ensemble

Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing, pages 5482–5492 August 1–6, 2021. ©2021 Association for Computational Linguistics 5482 Defense against Synonym Substitution-based Adversarial Attacks via Dirichlet Neighborhood Ensemble Yi Zhou1,2, Xiaoqing Zheng*1,2, Cho-Jui Hsieh3, Kai-Wei Chang3, Xuanjing Huang1,2 1School of Computer Science, Fudan University, Shanghai, China 2Shanghai Key Laboratory of Intelligent Information Processing 3Department of Computer Science, University of California, Los Angeles, USA {yizhou17, zhengxq}@fudan.edu.cn, chohsieh@cs.ucla.edu, kwchang@cs.ucla.edu, xjhuang@fudan.edu.cn Abstract Although deep neural networks have achieved prominent performance on many NLP tasks, they are vulnerable to adversarial examples. We propose Dirichlet Neighborhood Ensemble (DNE), a randomized method for training a ro- bust model to defense synonym substitution- based attacks. During training, DNE forms virtual sentences by sampling embedding vec- tors for each word in an input sentence from a convex hull spanned by the word and its syn- onyms, and it augments them with the training data. In such a way, the model is robust to ad- versarial attacks while maintaining the perfor- mance on the original clean data. DNE is ag- nostic to the network architectures and scales to large models (e.g., BERT) for NLP appli- cations. Through extensive experimentation, we demonstrate that our method consistently outperforms recently proposed defense meth- ods by a significant margin across different net- work architectures and multiple data sets. 1 Introduction Deep neural networks are powerful but vulnera- ble to adversarial examples that are intentionally crafted to fool the networks. Recent studies have shown the vulnerability of deep neural networks in many NLP tasks, including reading comprehension (Jia and Liang, 2017), text classification (Samanta and Mehta, 2017; Wong, 2017; Liang et al., 2018; Alzantot et al., 2018), machine translation (Zhao et al., 2018; Ebrahimi et al., 2018; Cheng et al., 2018), dialogue systems (Cheng et al., 2019), and dependency parsing (Zheng et al., 2020). These methods attack an NLP model by replacing, scram- bling, and erasing characters or words under certain semantic and syntactic constraints. In particular, most of them craft adversarial examples by substi- tuting words with their synonyms in an input text to maximally increase the prediction error while maintaining the adversarial examples’ fluency and naturalness. In this paper, we focus on these word substitution-based threat models and discuss the strategy to defend against such attacks. The goal of adversarial defenses is to learn a model capable of achieving high test accuracy on both clean and adversarial examples. Adversar- ial training is one of the most successful defense methods for NLP models (Miyato et al., 2017; Sato et al., 2019; Zhu et al., 2019). During the training time, they replace a word with one of its synonyms that maximizes the prediction loss. By augmenting these adversarial examples with the original train- ing data, the model is robust to such perturbations. However, it is infeasible to explore all possible combinations where each word in a sentence can be replaced with any of its synonyms. Also, when updating word …

Content truncated to 500 words