Don’t sweat the small stuff, classify the rest: Sample Shielding to protect text classifiers against adversarial attacks

Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 2716 - 2725 July 10-15, 2022 ©2022 Association for Computational Linguistics Don’t sweat the small stuff, classify the rest: Sample Shielding to protect text classifiers against adversarial attacks Jonathan Rusert, Padmini Srinivasan University of Iowa {jonathan-rusert, padmini-srinivasan}@uiowa.edu Abstract Deep learning (DL) is being used extensively for text classification. However, researchers have demonstrated the vulnerability of such classifiers to adversarial attacks. Attackers modify the text in a way which misleads the classifier while keeping the original meaning close to intact. State-of-the-art (SOTA) attack algorithms follow the general principle of mak- ing minimal changes to the text so as to not jeopardize semantics. Taking advantage of this we propose a novel and intuitive defense strat- egy called Sample Shielding. It is attacker and classifier agnostic, does not require any recon- figuration of the classifier or external resources and is simple to implement. Essentially, we sample subsets of the input text, classify them and summarize these into a final decision. We shield three popular DL text classifiers with Sample Shielding, test their resilience against four SOTA attackers across three datasets in a realistic threat setting. Even when given the ad- vantage of knowing about our shielding strategy the adversary’s attack success rate is <= 10% with only one exception and often < 5%. Addi- tionally, Sample Shielding maintains near orig- inal accuracy when applied to original texts. Crucially, we show that the ‘make minimal changes’ approach of SOTA attackers leads to critical vulnerabilities that can be defended against with an intuitive sampling strategy.1 1 Introduction Text classifiers have become ubiquitous. Unfortu- nately, they are subject to attacks from adversaries, typically executed using machine learning methods. Attackers work by making small modifications to the text that mislead the classifier. Adversarial at- tackers are now a growing part of the ecosystem. Like classifiers, attack algorithms have achieved strong success due to advances in machine learn- ing/deep learning. Current text attackers, like 1Our code and data are available at: https://github.com/JonRusert/SampleShielding TextFooler (Jin et al., 2020) and Bert-Attack (Li et al., 2020), are able to reduce near perfect classi- fication accuracy down to 5%. Additionally, these attackers achieve this while perturbing (changing) only a small amount of the original text. This helps preserve the original meaning so that humans are able to understand the original message even though classifiers are duped. As a counter, classifier shielding techniques are being explored. One such approach is adversarial training where the classifier, assumed to have ac- cess to the attacker, uses it to generate perturbed texts - these are added to the classifier’s training data. While this leads to model resilience against that attacker it leaves the classifier open to attacks by new attackers. Other defenses involve modify- ing classifier structure to reduce the information an attacker can glean from it (Goel et al., 2020). However, this type of reconfiguration will not be possible if a third party classifier (e.g. …

Content truncated to 500 words