Defending Pre-trained Language Models from Adversarial Word Substitution Without Performance Sacrifice

Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021, pages 3248–3258 August 1–6, 2021. ©2021 Association for Computational Linguistics 3248 Defending Pre-trained Language Models from Adversarial Word Substitution Without Performance Sacrifice Rongzhou Bao, Jiayi Wang, Hai Zhao∗ Department of Computer Science and Engineering, Shanghai Jiao Tong University 2 Key Laboratory of Shanghai Education Commission for Intelligent Interaction and Cognitive Engineering, Shanghai Jiao Tong University, Shanghai, China MoE Key Lab of Artificial Intelligence, AI Institute, Shanghai Jiao Tong University, Shanghai, China rongzhou.bao@outlook.com {wangjiayi 102 23}@sjtu.edu.cn,zhaohai@cs.sjtu.edu.cn Abstract Pre-trained contextualized language models (PrLMs) have led to strong performance gains in downstream natural language understand- ing tasks. However, PrLMs can still be easily fooled by adversarial word substitution, which is one of the most challenging textual adver- sarial attack methods. Existing defence ap- proaches suffer from notable performance loss and complexities. Thus, this paper presents a compact and performance-preserved frame- work, Anomaly Detection with Frequency- Aware Randomization (ADFAR). In detail, we design an auxiliary anomaly detection clas- sifier and adopt a multi-task learning proce- dure, by which PrLMs are able to distin- guish adversarial input samples. Then, in or- der to defend adversarial word substitution, a frequency-aware randomization process is applied to those recognized adversarial input samples. Empirical results show that AD- FAR significantly outperforms those newly proposed defense methods over various tasks with much higher inference speed. Remark- ably, ADFAR does not impair the overall per- formance of PrLMs. The code is available at https://github.com/LilyNLP/ADFAR. 1 Introduction Deep neural networks (DNNs) have achieved re- markable success in various areas. However, pre- vious works show that DNNs are vulnerable to adversarial samples (Goodfellow et al., 2015; Ku- rakin et al., 2017; Wang et al., 2021), which are inputs with small, intentional modifications that cause the model to make false predictions. Pre- trained language models (PrLMs) (Devlin et al., *Corresponding author. This paper was partially sup- ported by National Key Research and Development Pro- gram of China (No. 2017YFB0304100), Key Projects of National Natural Science Foundation of China (U1836222 and 61733011). This work was supported by Huawei Noah’s Ask Lab 2019; Liu et al., 2019; Clark et al., 2020; Zhang et al., 2020, 2019) are widely adopted as an es- sential component for various NLP systems. How- ever, as DNN-based models, PrLMs can still be easily fooled by textual adversarial samples (Wal- lace et al., 2019; Jin et al., 2019; Nie et al., 2020; Zang et al., 2020). Such vulnerability of PrLMs keeps raising potential security concerns, therefore researches on defense techniques to help PrLMs against textual adversarial samples are imperatively needed. Different kinds of textual attack methods have been proposed, ranging from character-level word misspelling (Gao et al., 2018), word-level sub- stitution (Alzantot et al., 2018; Ebrahimi et al., 2018; Ren et al., 2019; Jin et al., 2019; Zang et al., 2020; Li et al., 2020; Garg and Ramakr- ishnan, 2020), phrase-level insertion and removal (Liang et al., 2018), to sentence-level paraphrasing (Ribeiro et al., 2018; Iyyer et al., 2018). Thanks to the discrete …

Content truncated to 500 words