ROSE: Robust Selective Fine-tuning for Pre-trained Language Models

Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 2886 - 2897 December 7-11, 2022 ©2022 Association for Computational Linguistics ROSE: Robust Selective Fine-tuning for Pre-trained Language Models Lan Jiang1∗, Hao Zhou2∗, Yankai Lin3,4†, Peng Li5†, Jie Zhou2, Rui Jiang1‡ 1MOE Key Laboratory of Bioinformatics, Center for Synthetic and Systems Biology, Department of Automation, BNRist, Tsinghua University, China 2Pattern Recognition Center, WeChat AI, Tencent Inc., China 3Gaoling School of Artificial Intelligence, Renmin University of China, Beijing, China 4Beijing Key Laboratory of Big Data Management and Analysis Methods , Beijing, China 5Institute for AI Industry Research (AIR), Tsinghua University, China jiangl20@mails.tsinghua.edu.cn Abstract Even though the large-scale language models have achieved excellent performances, they suffer from various adversarial attacks. A large body of defense methods has been pro- posed. However, they are still limited due to redundant attack search spaces and the inabil- ity to defend against various types of attacks. In this work, we present a novel fine-tuning approach called RObust SEletive fine-tuning (ROSE) to address this issue. ROSE conducts selective updates when adapting pre-trained models to downstream tasks, filtering out in- valuable and unrobust updates of parameters. Specifically, we propose two strategies: the first-order and second-order ROSE for select- ing target robust parameters. The experimen- tal results show that ROSE achieves signifi- cant improvements in adversarial robustness on various downstream NLP tasks, and the en- semble method even surpasses both variants above. Furthermore, ROSE can be easily in- corporated into existing fine-tuning methods to improve their adversarial robustness further. The empirical analysis confirms that ROSE eliminates unrobust spurious updates during fine-tuning, leading to solutions corresponding to flatter and wider optima than the conven- tional method. Code is available at https: //github.com/jiangllan/ROSE. 1 Introduction Recently, the discipline of fine-tuning large-scale pre-trained language models has gained promi- nence, achieving remarkable performances across various natural language processing benchmarks. However, recent studies (Ribeiro et al., 2020; Jin et al., 2020; Nie et al., 2020; Lin et al., 2021; Jiang et al., 2022) have highlighted the lack of adver- sarial robustness in models fine-tuned on specific ∗Equal contribution †Part of the work was done while Yankai Lin and Peng Li were working at Tencent. ‡Corresponding Author. downstream tasks, i.e., adapted models are vul- nerable to various types of adversarial attacks. A majority of adversarial examples fool models via character or word-level perturbations, either those tokens that aren’t found in training sets or super- ficial cues attached to labels (Li et al., 2021b; Le et al., 2022). The vulnerability of adapted mod- els can be attributed to their tendency to capture shallow and spurious patterns when fine-tuning on downstream tasks, instead of utilizing the general linguistic knowledge they have learned during the pre-training stage (Sagawa et al., 2020; Warstadt et al., 2020; Gouk et al., 2021; Dong et al., 2021). To address this issue, various defense methods have been proposed, including adversarial train- ing (Goodfellow et al., 2015; Zhu et al., 2020; Ivgi and Berant, 2021), adversarial data augmen- tation (Zhang et …

Content truncated to 500 words