Improving Gradient-based Adversarial Training for Text Classification by Contrastive Learning and Auto-Encoder

Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021, pages 1698–1707 August 1–6, 2021. ©2021 Association for Computational Linguistics 1698 Improving Gradient-based Adversarial Training for Text Classification by Contrastive Learning and Auto-Encoder Yao Qiu, Jinchao Zhang, Jie Zhou Pattern Recognition Center, WeChat AI, Tencent Inc, China {yasinqiu, dayerzhang, withtomzhou}@tencent.com Abstract Recent work has proposed several efficient ap- proaches for generating gradient-based adver- sarial perturbations on embeddings and proved that the model’s performance and robustness can be improved when they are trained with these contaminated embeddings. While they paid little attention to how to help the model to learn these adversarial samples more effi- ciently. In this work, we focus on enhancing the model’s ability to defend gradient-based adversarial attack during the model’s train- ing process and propose two novel adversar- ial training approaches: (1) CARL narrows the original sample and its adversarial sam- ple in the representation space while enlarging their distance from different labeled samples. (2) RAR forces the model to reconstruct the original sample from its adversarial represen- tation. Experiments show that the proposed two approaches outperform strong baselines on various text classification datasets. Anal- ysis experiments find that when using our ap- proaches, the semantic representation of the in- put sentence won’t be significantly affected by adversarial perturbations, and the model’s per- formance drops less under adversarial attack. That is to say, our approaches can effectively improve the robustness of the model. Besides, RAR can also be used to generate text-form adversarial samples. 1 Introduction Text classification is a fundamental research topic in natural language processing (Pang et al., 2002; Lai et al., 2015; Neekhara et al., 2019; Sun et al., 2019). Neural networks have obtained state-of-the- art performance on many text classification datasets (Kim, 2014; Wang et al., 2018; Devlin et al., 2019). Despite these models’ success, recent work has shown that they can be easily fooled by intention- ally designed adversarial examples. These adver- sarial examples generated by adding little perturba- tions on original examples cannot affect human’s judgment but can fail models (Ren et al., 2019a; Xu et al., 2019). Adversarial training approaches are proposed to tackle this problem, which aims to enhance the model’s strength of generalization and robustness by generating adversarial samples and letting the model learn them (Ren et al., 2019b; Xu et al., 2019). The approaches for generating adversarial samples can be roughly classified into two cate- gories: text-based and gradient-based. The former can be further classified into three levels: character- level, word-level, and sentence-level. Compared to gradient-based adversarial approaches, the text- based are explainable, but they may suffer from low attack diversity and rely more on human knowl- edge which limits the kinds of adversarial patterns. In contrast, during the gradient-based adversar- ial training process, small perturbations calculated from the gradient are added to mini-batches embed- dings of original training samples, then the model’s parameters will be optimized to correctly classify the original embeddings together with adversarial embeddings (Miyato et al., 2017). This kind of approach consists of two …

Content truncated to 500 words