A Study of the Attention Abnormality in Trojaned BERTs

21062

Authors

nan

Abstract

AbstractTrojan attacks raise serious security concerns. In this paper, we investigate the underlying mechanism of Trojaned BERT models. We observe the attention focus drifting behavior of Trojaned models, i.e., when encountering an poisoned input, the trigger token hijacks the attention focus regardless of the context. We provide a thorough qualitative and quantitative analysis of this phenomenon, revealing insights into the Trojan mechanism. Based on the observation, we propose an attention-based Trojan detector to distinguish Trojaned models from clean ones. To the best of our knowledge, we are the first to analyze the Trojan mechanism and develop a Trojan detector based on the transformer’s attention.

Keywords

nan

Full Content

Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 475 - 493 July 10-15, 2022 ©2022 Association for Computational Linguistics Towards Robust and Semantically Organised Latent Representations for Unsupervised Text Style Transfer Sharan Narasimhan Suvodip Dey Maunendra Sankar Desarkar Indian Institute of Technology Hyderabad, India sharan.n21@gmail.com suvodip15@gmail.com maunendra@cse.iith.ac.in Abstract Recent studies show that auto-encoder based approaches successfully perform language gen- eration, smooth sentence interpolation, and style transfer over unseen attributes using un- labelled datasets in a zero-shot manner. The latent space geometry of such models is or- ganised well enough to perform on datasets where the style is “coarse-grained” i.e. small fraction of words alone in a sentencea are enough to determine the overall style la- bel. A recent study uses a discrete token-based perturbation approach to map “similar” sen- tences (“similar” defined by low Levenshtein distance/ high word overlap) close by in la- tent space. This definition of “similarity” does not look into the underlying nuances of the constituent words while mapping latent space neighbourhoods and therefore fails to recog- nise sentences with different style-based se- mantics while mapping latent neighbourhoods. We introduce EPAAEs (Embedding Perturbed Adversarial AutoEncoders) which completes this perturbation model, by adding a finely ad- justable noise component on the continuous em- beddings space. We empirically show that this (a) produces a better organised latent space that clusters stylistically similar sentences together, (b) performs best on a diverse set of text style transfer tasks than similar denoising-inspired baselines, and (c) is capable of fine-grained control of Style Transfer strength. We also ex- tend the text style transfer tasks to NLI datasets and show that these more complex definitions of style are learned best by EPAAE. To the best of our knowledge, extending style transfer to NLI tasks has not been explored before. * 1 Introduction The Text Style transfer (TST) task is a form of con- trolled language generation. The goal is to produce fluent style-altered sentences from a given base sen- tence, while also preserving its style-independent *Our code, data and outputs are available at https:// github.com/sharan21/EPAAE content. The definition of “style” depends on the class labels of the end task. Our work focuses on the unsupervised scenario i.e. performing the train- ing on completely unlabelled corpora. By inducing the latent space organization through input pertur- bation, TST can be performed using a simple vector arithmetic method (discussed in Section 6). Background. Several well-known architectures use auxiliary objectives that serve as regularizers to ensure that the latent space geometry is smoothly interpolatable and learns high-level semantic fea- tures (refer Appendix D). Inspired by successes in denoising approaches in vision (Creswell and Bharath, 2019; Vincent et al., 2008), we look at in- put perturbation based approaches for unsupervised style transfer. Unlike text, in vision, freedom exists to finely control the degree of Gaussian “blur” on the continuous input image space. We conjecture that this notion of “controlling blur” may be useful in the text domain …

Content truncated to 500 words

Labeled Text

AbstractTrojan attacks raise serious security concerns. In this paper, we investigate the underlying mechanism of Trojaned BERT models. We observe the attention focus drifting behavior of Trojaned models, i.e., when encountering an poisoned input, the trigger token hijacks the attention focus regardless of the context. We provide a thorough qualitative and quantitative analysis of this phenomenon, revealing insights into the Trojan mechanism. Based on the observation, we propose an attention-based Trojan detector to distinguish Trojaned models from clean ones. To the best of our knowledge, we are the first to analyze the Trojan mechanism and develop a Trojan detector based on the transformer’s attention.

Publication Details

Paper ID:
21062
Year:
2022
Publication:
TIPSTER
Publication Type:
conf
DOI:
nan