Searching for an Effective Defender: Benchmarking Defense against Adversarial Word Substitution

Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 3137–3147 November 7–11, 2021. c⃝2021 Association for Computational Linguistics 3137 Searching for an Effective Defender: Benchmarking Defense against Adversarial Word Substitution Zongyi Li1,2∗, Jianhan Xu1,2∗, Jiehang Zeng1,2∗, Linyang Li1,2, Xiaoqing Zheng1,2, Qi Zhang1,2, Kai-Wei Chang3, Cho-Jui Hsieh3 1School of Computer Science, Fudan University, Shanghai, China 2Shanghai Key Laboratory of Intelligent Information Processing 3Department of Computer Science, University of California, Los Angeles, USA {zongyili19,jianhanxu20,jhzeng18,zhengxq,qz}@fudan.edu.cn {kwchang,chohsieh}@cs.ucla.edu Abstract Recent studies have shown that deep neural network-based models are vulnerable to inten- tionally crafted adversarial examples, and var- ious methods have been proposed to defend against adversarial word-substitution attacks for neural NLP models. However, there is a lack of systematic study on comparing dif- ferent defense approaches under the same at- tacking setting. In this paper, we seek to fill the gap through comprehensive studies on the behavior of neural text classifiers trained with various defense methods against repre- sentative adversarial attacks. In addition, we propose an effective method to further im- prove the robustness of neural text classifiers against such attacks, and achieved the highest accuracy on both clean and adversarial exam- ples on AGNEWS and IMDB datasets, outper- forming existing methods by a significant mar- gin. We hope this study could provide use- ful clues for future research on text adversar- ial defense. Codes are available at https:// github.com/RockyLzy/TextDefender. 1 Introduction Deep neural networks have achieved impressive re- sults on NLP tasks. However, they are vulnerable to intentionally crafted textual adversarial examples, which do not change human understanding of sen- tences but can easily fool deep neural networks. As a result, studies on adversarial attacks and defenses in the text domain have drawn significant attention, especially in recent years (Ebrahimi et al., 2017; Gao et al., 2018; Li et al., 2018; Ren et al., 2019a; Jin et al., 2020a; Li et al., 2020; Jia et al., 2019; Zhu et al., 2020; Zheng et al., 2020; Zhou et al., 2020; Garg and Ramakrishnan, 2020; Zeng et al., 2021). The goal of adversarial defenses is to learn a model that is capable of achieving high test accuracy on both clean (i.e., original) and adversarial examples. We are eager to find out which adversarial defense ∗Equal contribution method can improve the robustness of NLP models to the greatest extent while suffering no or little performance drop on the clean input data. To the best of our knowledge, existing adversar- ial defense methods for NLP models have yet to be evaluated or compared in a fair and controlled man- ner. Lack of evaluative and comparative researches impedes understanding of strengths and limitations of different defense methods, thus making it diffi- cult to choose the best defense method for practical use. There are several reasons why previous studies are not sufficient for comprehensive understanding of adversarial defense methods. Firstly, settings of attack algorithms in previous defense works are far from “standardized”, and they vary greatly in ways such as synonym-generating methods, number of queries …

Content truncated to 500 words