Certified Robustness to Word Substitution Attack with Differential Privacy

Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 1102–1112 June 6–11, 2021. ©2021 Association for Computational Linguistics 1102 Certified Robustness to Word Substitution Attack with Differential Privacy Wenjie Wang, Pengfei Tang, Jian Lou⇤and Li Xiong Emory University Atlanta, GA, USA {wang.wenjie, pengfei.tang, jian.lou, lxiong}@emory.edu Abstract The robustness and security of natural lan- guage processing (NLP) models are signifi- cantly important in real-world applications. In the context of text classification tasks, adver- sarial examples can be designed by substitut- ing words with synonyms under certain se- mantic and syntactic constraints, such that a well-trained model will give a wrong predic- tion. Therefore, it is crucial to develop tech- niques to provide a rigorous and provable ro- bustness guarantee against such attacks. In this paper, we propose WordDP to achieve cer- tified robustness against word substitution at- tacks in text classification via differential pri- vacy (DP). We establish the connection be- tween DP and adversarial robustness for the first time in the text domain and propose a conceptual exponential mechanism-based al- gorithm to formally achieve the robustness. We further present a practical simulated expo- nential mechanism that has efficient inference with certified robustness. We not only provide a rigorous analytic derivation of the certified condition but also experimentally compare the utility of WordDP with existing defense al- gorithms. The results show that WordDP achieves higher accuracy and more than 30⇥ efficiency improvement over the state-of-the- art certified robustness mechanism in typical text classification tasks. 1 Introduction Deep neural networks (DNNs) have achieved state- of-the-art performance in many natural language processing (NLP) tasks, such as text classification (Zhang et al., 2015), sentiment analysis (Bakshi et al., 2016), and machine translation (Bahdanau et al., 2014), making the robustness and security of NLP models significantly important. Recent stud- ies have shown that DNNs can be easily fooled by adversarial examples, which are carefully crafted ⇤J. Lou is the corresponding author. by adding imperceptible perturbations to input ex- amples during inference time (Szegedy et al., 2013). In the context of text classification tasks, adversar- ial examples can be designed by manipulating the word or characters under certain semantic and syn- tactic constraints (Ren et al., 2019; Jin et al., 2019; Zang et al., 2020; Gao et al., 2018). Among all the attack strategies, word substitution attacks, in which attackers attempt to alter the model output by replacing input words with their synonyms, can maximally maintain the naturalness and semantic similarity of the input. Therefore, in this paper, we consider such word substitution attacks and fo- cus on defending against such attacks. Figure 1 shows an example of the word substitution attack where the clean input text is changed into adversar- ial text by substituting input words from a synonym list. Various mechanisms have been developed to Figure 1: Word Substitution Attack and Certified Ro- bustness via WordDP. defend against adversarial examples in text classifi- cation models. Miyato et al. (2016) applied adver- sarial training …

Content truncated to 500 words