Assessing Robustness of Text Classification through Maximal Safe Radius Computation

Findings of the Association for Computational Linguistics: EMNLP 2020, pages 2949–2968 November 16 - 20, 2020. c⃝2020 Association for Computational Linguistics 2949 Assessing Robustness of Text Classification through Maximal Safe Radius Computation Emanuele La Malfa† Min Wu† Luca Laurenti† Benjie Wang† Anthony Hartshorn§ Marta Kwiatkowska† †Department of Computer Science, University of Oxford, United Kingdom §Genie AI, London, United Kingdom {emanuele.lamalfa, min.wu, luca.laurenti, benjie.wang, marta.kwiatkowska}@cs.ox.ac.uk {anthony.hartshorn}@genieai.co Abstract Neural network NLP models are vulnerable to small modifications of the input that maintain the original meaning but result in a different prediction. In this paper, we focus on robust- ness of text classification against word substi- tutions, aiming to provide guarantees that the model prediction does not change if a word is replaced with a plausible alternative, such as a synonym. As a measure of robustness, we adopt the notion of the maximal safe ra- dius for a given input text, which is the min- imum distance in the embedding space to the decision boundary. Since computing the ex- act maximal safe radius is not feasible in prac- tice, we instead approximate it by comput- ing a lower and upper bound. For the upper bound computation, we employ Monte Carlo Tree Search in conjunction with syntactic fil- tering to analyse the effect of single and multi- ple word substitutions. The lower bound com- putation is achieved through an adaptation of the linear bounding techniques implemented in tools CNN-Cert and POPQORN, respec- tively for convolutional and recurrent network models. We evaluate the methods on senti- ment analysis and news classification models for four datasets (IMDB, SST, AG News and NEWS) and a range of embeddings, and pro- vide an analysis of robustness trends. We also apply our framework to interpretability analy- sis and compare it with LIME. 1 Introduction Deep neural networks (DNNs) have shown great promise in Natural Language Processing (NLP), outperforming other machine learning techniques in sentiment analysis (Devlin et al., 2018), lan- guage translation (Chorowski et al., 2015), speech recognition (Jia et al., 2018) and many other tasks1. 1See https://paperswithcode.com/area/ natural-language-processing Despite these successes, concerns have been raised about robustness and interpretability of NLP mod- els (Arras et al., 2016). It is known that DNNs are vulnerable to adversarial examples, that is, im- perceptible perturbations of a test point that cause a prediction error (Goodfellow et al., 2014). In NLP this issue manifests itself as a sensitivity of the prediction to small modifications of the input text (e.g., replacing a word with a synonym). In this paper we work with DNNs for text analysis and, given a text and a word embedding, consider the problem of quantifying the robustness of the DNN with respect to word substitutions. In par- ticular, we define the maximal safe radius (MSR) of a text as the minimum distance (in the embed- ding space) of the text from the decision boundary, i.e., from the nearest perturbed text that is classi- fied differently from the original. Unfortunately, computation of the MSR for a neural network is an …

Content truncated to 500 words