ADDMU: Detection of Far-Boundary Adversarial Examples with Data and Model Uncertainty Estimation

Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 6567 - 6584 December 7-11, 2022 ©2022 Association for Computational Linguistics ADDMU: Detection of Far-Boundary Adversarial Examples with Data and Model Uncertainty Estimation Fan Yin University of California, Los Angeles fanyin20@cs.ucla.edu Yao Li University of North Carolina, Chapel Hill yaoli@email.unc.edu Cho-Jui Hsieh University of California, Los Angeles chohsieh@cs.ucla.edu Kai-Wei Chang University of California, Los Angeles kwchang@cs.ucla.edu Abstract Adversarial Examples Detection (AED) is a crucial defense technique against adversarial attacks and has drawn increasing attention from the Natural Language Processing (NLP) com- munity. Despite the surge of new AED meth- ods, our studies show that existing methods heavily rely on a shortcut to achieve good per- formance. In other words, current search-based adversarial attacks in NLP stop once model predictions change, and thus most adversar- ial examples generated by those attacks are located near model decision boundaries. To surpass this shortcut and fairly evaluate AED methods, we propose to test AED methods with Far Boundary (FB) adversarial examples. Ex- isting methods show worse than random guess performance under this scenario. To overcome this limitation, we propose a new technique, ADDMU, adversary detection with data and model uncertainty, which combines two types of uncertainty estimation for both regular and FB adversarial example detection. Our new method outperforms previous methods by 3.6 and 6.0 AUC points under each scenario. Fi- nally, our analysis shows that the two types of uncertainty provided by ADDMU can be leveraged to characterize adversarial examples and identify the ones that contribute most to model’s robustness in adversarial training. 1 Introduction Deep neural networks (DNN) have achieved re- markable performance in a wide variety of NLP tasks. However, it has been shown that DNNs can be vulnerable to adversarial examples (Jia and Liang, 2017; Alzantot et al., 2018; Jin et al., 2020), i.e., perturbed examples that flip model predictions but remain imperceptible to humans, and thus im- pose serious security concerns about NLP models. To improve the robustness of NLP models, differ- ent kinds of techniques to defend against adversar- ial examples have been proposed (Li et al., 2021b). In this paper, we study AED, which aims to add a detection module to identify and reject malicious inputs based on certain characteristics. Different from adversarial training methods (Madry et al., 2018a; Jia et al., 2019) which require re-training of the model with additional data or regularization, AED operates in the test time and can be directly integrated with any existing model. Despite being well explored in the vision domain (Feinman et al., 2017; Raghuram et al., 2021), AED started to get attention in the field of NLP only re- cently. Many works have been proposed to conduct detection based on certain statistics (Zhou et al., 2019; Mozes et al., 2021; Yoo et al., 2022; Xie et al., 2022). Specifically, Yoo et al. (2022) propose a benchmark for AED methods and a competitive baseline by robust density estimation. However, by studying examples in the benchmark, we find …

Content truncated to 500 words