Learning to Discriminate Perturbations for Blocking Adversarial Attacks in Text Classification

Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing, pages 4904–4913, Hong Kong, China, November 3–7, 2019. c⃝2019 Association for Computational Linguistics 4904 Learning to Discriminate Perturbations for Blocking Adversarial Attacks in Text Classification Yichao Zhou∗, Jyun-Yu Jiang∗, Kai-Wei Chang and Wei Wang Computer Science Department University of California, Los Angeles {yz, jyunyu, kwchang, weiwang}@cs.ucla.edu Abstract Adversarial attacks against machine learning models have threatened various real-world ap- plications such as spam filtering and senti- ment analysis. In this paper, we propose a novel framework, learning to discriminate perturbations (DISP), to identify and adjust malicious perturbations, thereby blocking ad- versarial attacks for text classification models. To identify adversarial attacks, a perturbation discriminator validates how likely a token in the text is perturbed and provides a set of po- tential perturbations. For each potential per- turbation, an embedding estimator learns to re- store the embedding of the original word based on the context and a replacement token is cho- sen based on approximate kNN search. DISP can block adversarial attacks for any NLP model without modifying the model structure or training procedure. Extensive experiments on two benchmark datasets demonstrate that DISP significantly outperforms baseline meth- ods in blocking adversarial attacks for text classification. In addition, in-depth analysis shows the robustness of DISP across different situations. 1 Introduction Deep learning techniques (Goodfellow et al., 2016) have achieved enormous success in many fields, such as computer vision and NLP. How- ever, complex deep learning models are often sen- sitive and vulnerable to a tiny modification. In other words, malicious attackers can destroy the models by adding a few inconspicuous perturba- tions into input data, such as masking images with unrecognizable filters and making low-key mod- ifications for texts. Therefore, developing tech- niques to equip models against adversarial attacks becomes a prominent research problem. ∗Equal contribution. Listing order is random. Existing studies on adversarial attacks can be classified into two groups, generation of adversar- ial examples and defense against adversarial at- tacks (Yuan et al., 2019). In the field of NLP, most of the existing studies focus on the former. For example, Ebrahimi et al. (2017); Alzantot et al. (2018) replace a word with synonyms or simi- lar words while Gao et al. (2018); Liang et al. (2017); Ebrahimi et al. (2017) conduct character- level manipulations to fool the models. More- over, it is not straightforward to adapt existing approaches for blocking adversarial attacks, such as data augmentation (Krizhevsky et al., 2012; Ribeiro et al., 2018; Ren et al., 2019) and adversar- ial training (Goodfellow et al., 2015; Iyyer et al., 2018; Marzinotto et al., 2019; Cheng et al., 2019; Zhu et al., 2019), to NLP applications. Hence, the defense against adversarial attacks in NLP remains a challenging and unsolved problem. Recognizing and removing the inconspicuous perturbations are the core of defense against ad- versarial attacks. For instance, in computer vi- sion, denoising auto-encoders (Warde-Farley and Bengio, 2017; Gu and Rigazio, 2015) …

Content truncated to 500 words