Improving the Adversarial Robustness of NLP Models by Information Bottleneck

Findings of the Association for Computational Linguistics: ACL 2022, pages 3588 - 3598 May 22-27, 2022 c⃝2022 Association for Computational Linguistics Improving the Adversarial Robustness of NLP Models by Information Bottleneck Cenyuan Zhang1,2∗, Xiang Zhou1,2∗, Yixin Wan3, Xiaoqing Zheng1,2, Kai-Wei Chang3, Cho-Jui Hsieh3 1School of Computer Science, Fudan University, Shanghai, China 2Shanghai Key Laboratory of Intelligent Information Processing 3Department of Computer Science, University of California, Los Angeles, USA {zhouxiang20,cenyuanzhang17,zhengxq}@fudan.edu.cn elaine1wan@g.ucla.edu, {kwchang,chohsieh}@cs.ucla.edu Abstract Existing studies have demonstrated that adver- sarial examples can be directly attributed to the presence of non-robust features, which are highly predictive, but can be easily manipu- lated by adversaries to fool NLP models. In this study, we explore the feasibility of captur- ing task-specific robust features, while elimi- nating the non-robust ones by using the infor- mation bottleneck theory. Through extensive experiments, we show that the models trained with our information bottleneck-based method are able to achieve a significant improvement in robust accuracy, exceeding performances of all the previously reported defense methods while suffering almost no performance drop in clean accuracy on SST-2, AGNEWS and IMDB datasets. 1 Introduction Recently, a number of studies (Han et al., 2020; Jin et al., 2020; Shafahi et al., 2019) have revealed the fact that the performance of deep neural networks (DNNs) can be severely undermined by adversar- ial examples. In the text domain, these adversar- ial examples are crafted by semantic-preserving perturbations to inputs with word synonym sub- stitution (Ebrahimi et al., 2018; Ren et al., 2019; Alzantot et al., 2018) and character-level transfor- mations (Gao et al., 2018; Zang et al., 2020). The vulnerability of DNN models results in inferior performances under adversarial attacks in many NLP tasks including text classification, natural lan- guage inference (NLI), question answering (QA), etc. To resolve this problem, researchers have pro- posed various methods to defend against adversar- ial attacks (Goodfellow et al., 2014; Szegedy et al., 2013; Jia and Liang, 2017; Kang et al., 2018; Zhou et al., 2021). In particular, Tsipras et al. (2019) and Ilyas et al. (2019) showed that the vulnerability of computer ∗Equal contribution vision models can be attributed to “non-robust fea- tures,” which are features in the representation space that are sensitive to adversarial attacks and can be easily manipulated by attackers. The pres- ence of these features will weaken the robustness of deep learning models. Therefore, a potential defense strategy is to filter out such non-robust features in the inputs. In this paper, we posit that the robustness of text classification models can be improved by filtering out the non-robust features. However, unlike the continuous input in the computer vision domain, input in the NLP domain is a sequence of words, which makes it difficult to model its distribution. We thus research into means to filter out the non- robust features in language model inputs. Inspired by (Li and Eisner, 2019; Wang et al., 2021a), we propose to use the information bottle- neck method (Tishby et al., 2000) in text classifica- tion tasks. Specifically, we plug …

Content truncated to 500 words