Textual Manifold-based Defense Against Natural Language Adversarial Examples

Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 6612 - 6625 December 7-11, 2022 ©2022 Association for Computational Linguistics Textual Manifold-based Defense Against Natural Language Adversarial Examples Dang Minh Nguyen VinAI Research, Vietnam v.dangnm12@vinai.io Luu Anh Tuan∗ Nanyang Technological University, Singapore anhtuan.luu@ntu.edu.sg Abstract Recent studies on adversarial images have shown that they tend to leave the underlying low-dimensional data manifold, making them significantly more challenging for current mod- els to make correct predictions. This so-called off-manifold conjecture has inspired a novel line of defenses against adversarial attacks on images. In this study, we find a similar phe- nomenon occurs in the contextualized embed- ding space induced by pretrained language models, in which adversarial texts tend to have their embeddings diverge from the manifold of natural ones. Based on this finding, we propose Textual Manifold-based Defense (TMD), a de- fense mechanism that projects text embeddings onto an approximated embedding manifold be- fore classification. It reduces the complexity of potential adversarial examples, which ulti- mately enhances the robustness of the protected model. Through extensive experiments, our method consistently and significantly outper- forms previous defenses under various attack settings without trading off clean accuracy. To the best of our knowledge, this is the first NLP defense that leverages the manifold structure against adversarial attacks. Our code is avail- able at https://github.com/dangne/tmd. 1 Introduction The field of NLP has achieved remarkable suc- cess in recent years, thanks to the development of large pretrained language models (PLMs). How- ever, multiple studies have shown that these mod- els are vulnerable to adversarial examples - care- fully optimized inputs that cause erroneous predic- tions while remaining imperceptible to humans (Jin et al., 2020; Li et al., 2020; Garg and Ramakrish- nan, 2020). This problem raises serious security concerns as PLMs are widely deployed in many modern NLP applications. ∗Corresponding author Various defenses have been proposed to counter adversarial attacks, which can be broadly catego- rized into empirical (Si et al., 2021; Dong et al., 2021b; Miyato et al., 2017) and certified (Jia et al., 2019; Ye et al., 2020; Zeng et al., 2021; Zhao et al., 2022) defenses. Adversarial training is currently the most successful empirical method (Athalye et al., 2018; Dong et al., 2021a; Zhou et al., 2021). It operates by jointly training the victim model on clean and adversarial examples to improve the ro- bustness. However, one major drawback of this approach is the prohibitively expensive computa- tional cost. Schmidt et al. (2018) has theoretically shown that with just simple models, the sample complexity of adversarial training already grows substantially compared to standard training. Al- ternatively, certified defenses aim to achieve a the- oretical robustness guarantee for victim models under specific adversarial settings. However, most certified defenses for NLP are based on strong as- sumptions on the network architecture (Jia et al., 2019; Shi et al., 2020), and the synonym set used by attackers is often assumed to be accessible to the defenders (Ye et al., 2020). Li et al. …

Content truncated to 500 words