Salience Allocation as Guidance for Abstractive Summarization

Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 632 - 647 December 7-11, 2022 ©2022 Association for Computational Linguistics Balanced Adversarial Training: Balancing Tradeoffs between Fickleness and Obstinacy in NLP Models Hannah Chen, Yangfeng Ji, David Evans Department of Computer Science University of Virginia Charlottesville, VA 22904 {yc4dx,yangfeng,evans}@virginia.edu Abstract Traditional (fickle) adversarial examples in- volve finding a small perturbation that does not change an input’s true label but confuses the classifier into outputting a different prediction. Conversely, obstinate adversarial examples oc- cur when an adversary finds a small perturba- tion that preserves the classifier’s prediction but changes the true label of an input. Adversar- ial training and certified robust training have shown some effectiveness in improving the ro- bustness of machine learnt models to fickle adversarial examples. We show that standard adversarial training methods focused on reduc- ing vulnerability to fickle adversarial examples may make a model more vulnerable to obsti- nate adversarial examples, with experiments for both natural language inference and para- phrase identification tasks. To counter this phe- nomenon, we introduce Balanced Adversarial Training, which incorporates contrastive learn- ing to increase robustness against both fickle and obstinate adversarial examples. 1 Introduction Interpreted broadly, an adversarial example is an in- put crafted intentionally to confuse a model. Most research on adversarial examples, however, focuses on a definition of an adversarial example as an in- put that is constructed by making minimal perturba- tions to a normal input that change the model’s out- put, assuming that the small perturbations preserve the original true label (Goodfellow et al., 2015). Such adversarial examples occur when a model is overly influenced by small changes in the input. Attackers can also target the opposite objective—to find inputs with minimal changes that change the ground truth label but for which the model retains its prior prediction (Jacobsen et al., 2019b). Various names have been used in the research literature for these two types of adversarial ex- amples including perturbation or sensitivity-based and invariance-based examples (Jacobsen et al., 2019b,a), and over-sensitive and over-stable exam- ples (Niu and Bansal, 2018; Kumar and Boulanger, 2020). To avoid confusions associated with these names, we refer them as fickle adversarial ex- amples (the model changes its output too easily) and obstinate adversarial examples (the model doesn’t change its output even though the input has changed in a way that it should). In NLP, synonym-based word substitution is a common method for constructing fickle adversarial examples (Alzantot et al., 2018; Jin et al., 2020) since synonym substitutions are assumed to not change the true label for an input. These methods target a model’s weakness of being invariant to cer- tain types of changes which makes its predictions insufficiently responsive to small input changes. Attacks based on antonyms and negation have been proposed to create obstinate adversarial examples for dialogue models (Niu and Bansal, 2018). Adversarial training is considered as the most effective defense strategy yet found against adver- sarial examples (Madry et al., 2018; Goodfellow et …

Content truncated to 500 words