Analyzing Semantic Changes in Japanese Words Using BERT

SEPP: Similarity Estimation of Predicted Probabilities for Defending and Detecting Adversarial Text Hoang-Quoc Nguyen-Son, Seira Hidano, Kazuhide Fukushima, and Shinsaku Kiyomoto KDDI Research, Inc. 2-1-15 Ohara, Fujimino, Saitama, 356-8502, Japan {ho-nguyen, se-hidano, ka-fukushima, kiyomoto}@kddi-research.jp Abstract There are two cases describing how a classi- fier processes input text, namely, misclassi- fication and correct classification. In terms of misclassified texts, a classifier handles the texts with both incorrect predictions and ad- versarial texts, which are generated to fool the classifier, which is called a victim. Both types are misunderstood by the victim, but they can still be recognized by other classi- fiers. This induces large gaps in predicted probabilities between the victim and the other classifiers. In contrast, text correctly classified by the victim is often successfully predicted by the others and induces small gaps. In this paper, we propose an ensemble model based on similarity estimation of predicted probabil- ities (SEPP) to exploit the large gaps in the misclassified predictions in contrast to small gaps in the correct classification. SEPP then corrects the incorrect predictions of the mis- classified texts. We demonstrate the resilience of SEPP in defending and detecting adversar- ial texts through different types of victim clas- sifiers, classification tasks, and adversarial at- tacks. 1 Introduction Recent deep learning models have reached the hu- man level in many NLP tasks. However, these mod- els are sensitive to changes in the input data. An adversarial text can be generated from an original text while the original meaning is still preserved and bypasses human recognition. However, adversarial text can fool many victims, such as sentiment anal- ysis (Ren et al., 2019), question answering (Jia and Liang, 2017), and search engines (Gil et al., 2019). Popular adversarial text defenders are based on adversarial training (Shrivastava et al., 2017; Tram`er et al., 2018) or modification detection (Pruthi et al., 2019). N-gram (Juuti et al., 2018) and text similar- ity (Nguyen-Son et al., 2019) address the adversarial text detection problem. However, recent generators can generate adversarial text via a very small change from the original by replacing a few words (Ren et al., 2019; Jin et al., 2020), few characters (Gao et al., 2018; Jones et al., 2020), or both (Li et al., 2019). High duplication in word usage between the origi- nal and adversarial texts confuses both the existing defenders and detectors. 1.1 Motivation Correct classification of text by a classifier often in- duces small gaps to other classifiers. An adversary can fool a victim classifier’s predictions by gener- ating misclassified text, but it does not fool other classifiers. For instance, we randomly choose cor- rectly classified text t1 and its adversarial text t2 tar- geting a CNN classifier (Figure 1). The predictions are made with popular deep learning models includ- ing CNN (Kim, 2014), BiLSTM, BERT-large (De- vlin et al., 2019), RoBERTa-large (Liu et al., 2019), and XLNet-large (Yang et al., 2019). The predic- tion is indicated by pair values of positive and neg- ative prediction probabilities. The original text t1 is …

Content truncated to 500 words