Learning to Ignore Adversarial Attacks

Proceedings of the 17th Conference of the European Chapter of the Association for Computational Linguistics, pages 2970–2984 May 2-6, 2023 ©2023 Association for Computational Linguistics Learning to Ignore Adversarial Attacks Yiming Zhang† Yangqiaoyu Zhou† Samuel Carton‡ Chenhao Tan† † University of Chicago ‡ University of New Hampshire {yimingz0,zhouy1,chenhao}@uchicago.edu samuel.carton@unh.edu Abstract Despite the strong performance of current NLP models, they can be brittle against adversarial attacks. To enable effective learning against adversarial inputs, we introduce the use of ra- tionale models that can explicitly learn to ig- nore attack tokens. We find that the rationale models can successfully ignore over 90% of attack tokens. This approach leads to consis- tent and sizable improvements (∼10%) over baseline models in robustness on three datasets for both BERT and RoBERTa, and also reliably outperforms data augmentation with adversar- ial examples alone. In many cases, we find that our method is able to close the gap between model performance on a clean test set and an attacked test set and hence reduce the effect of adversarial attacks. 1 Introduction Adversarial robustness is an important issue in NLP, asking how to proof models against confounding tokens designed to maliciously manipulate model outputs. As such models become more powerful and ubiquitous, research continues to discover sur- prising vulnerabilities (Wallace et al., 2019), de- manding improved robustness methods. A common defense method to combat adversar- ial attacks is adversarial training. Given knowledge of attack strategies, it constructs synthetic adver- sarial examples to augment clean examples during training (Zhang et al., 2020). Intuitively, the model will implicitly learn to ignore attacking tokens and become robust to that type of attack. In practice, however, this goal can be challenging through data augmentation alone. In this study, we propose a simple yet effective adversarial training schema for additive attacks: explicitly training the model to ignore adversarial tokens. We do this by augmenting the underlying model with a rationale extractor (Lei et al., 2016) to serve as an input filter, and then training this Figure 1: Example illustration of an ideal rationale model that is robust to added attack tokens. The ra- tionale extractor filters out the confounding sentence (“Lisa invited two friends”) added by the adversary, and extracts the supporting spans (“Helen invited some friends” and “She bought five cakes, so everyone had exactly one”) to help the model deduce the correct an- swer (“Four”). extractor to ignore attacking tokens as an additional joint objective to overall label accuracy (Fig. 1). In addition to training the extractor to distinguish the attacking/non-attacking token dichotomy, we also explore the utility of human-provided expla- nations in this regard. In doing so, we ask: does learning from human rationales help the model avoid attending to attacking tokens? Fine-tuning BERT (Devlin et al., 2018) and RoBERTa (Liu et al., 2019) on multiple datasets, we demonstrate that the additive attack proposed by Jia and Liang (2017) does reduce model accuracy, and that data augmentation with adversarial exam- ples provides limited benefit in defending these models from this …

Content truncated to 500 words