Improving Robustness of Language Models from a Geometry-aware Perspective

Findings of the Association for Computational Linguistics: ACL 2022, pages 3115 - 3125 May 22-27, 2022 c⃝2022 Association for Computational Linguistics Improving Robustness of Language Models from a Geometry-aware Perspective Bin Zhu1 , Zhaoquan Gu1,2∗, Le Wang1,2, Jinyin Chen3, Qi Xuan3 1 Cyberspace Institute of Advanced Technology (CIAT), Guangzhou University, Guangzhou 510006, China 2 Institute of Cyberspace Platform, Peng Cheng Laboratory, Shenzhen 999077, China 3 Institute of Cyberspace Security, Zhejiang University of Technology, Hangzhou 310023, China zhubin@e.gzhu.edu.cn, {zqgu,wangle}@gzhu.edu.cn {chenjinyin,xuanqi}@zjut.edu.cn Abstract Recent studies have found that removing the norm-bounded projection and increasing search steps in adversarial training can significantly improve robustness. However, we observe that a too large number of search steps can hurt accuracy. We aim to obtain strong robustness efficiently using fewer steps. Through a toy experiment, we find that perturbing the clean data to the decision boundary but not crossing it does not degrade the test accuracy. Inspired by this, we propose friendly adversarial data augmentation (FADA) to generate friendly ad- versarial data. On top of FADA, we propose geometry-aware adversarial training (GAT) to perform adversarial training on friendly adver- sarial data so that we can save a large number of search steps. Comprehensive experiments across two widely used datasets and three pre- trained language models demonstrate that GAT can obtain stronger robustness via fewer steps. In addition, we provide extensive empirical re- sults and in-depth analyses on robustness to facilitate future studies. 1 Introduction Deep neural networks (DNNs) have achieved great success on many natural language processing (NLP) tasks (Kim, 2014; Vaswani et al., 2017; De- vlin et al., 2019). However, recent studies (Szegedy et al., 2013; Goodfellow et al., 2015) have shown that DNNs are vulnerable to crafted adversarial examples . For instance, an attacker can mislead an online sentiment analysis system by making minor changes to the input sentences (Papernot et al., 2016; Liang et al., 2017). It has raised concerns among researchers about the security of DNN-based NLP systems. As a result, a grow- ing number of studies are focusing on enhancing robustness to defend against textual adversarial at- tacks (Jia et al., 2019; Ye et al., 2020; Jones et al., 2020; Zhu et al., 2020). ∗Corresponding author 0 500 1000 1500 iter 0.2 0.4 0.6 0.8 1.0 training vs test acc ada training acc fada training acc ada test acc fada test acc clean test acc Figure 1: The clean accuracy achieved with ADA, FADA, and the original training set. During training, both ADA and FADA have close to 100% accuracy. However, ADA only achieves ∼15% accuracy during testing while FADA maintains the same test accuracy with the original training set. This indicates that train- ing data which crosses the decision boundary hurts the accuracy significantly. Existing adversarial defense methods fall into two categories: empirical and certified defenses. Empirical defenses include gradient-based adver- sarial training (AT) and discrete adversarial data augmentation (ADA). Certified defenses provide a provable guaranteed robustness boundary for NLP models. This work focuses on empirical defenses. There was a common …

Content truncated to 500 words