Don’t Retrain, Just Rewrite: Countering Adversarial Perturbations by Rewriting Text

Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics Volume 1: Long Papers, pages 13981–13998 July 9-14, 2023 ©2023 Association for Computational Linguistics Don’t Retrain, Just Rewrite: Countering Adversarial Perturbations by Rewriting Text Ashim Gupta1∗, Carter Wood Blum2, Temma Choji2, Yingjie Fei2, Shalin Shah2, Alakananda Vempala2, Vivek Srikumar1 1University of Utah, 2Bloomberg, {ashim, svivek}@cs.utah.edu, {szhang611, cblum18, yfei29, sshah804, tchoji, avempala}@bloomberg.net Abstract Can language models transform inputs to pro- tect text classifiers against adversarial attacks? In this work, we present ATINTER, a model that intercepts and learns to rewrite adversar- ial inputs to make them non-adversarial for a downstream text classifier. Our experiments on four datasets and five attack mechanisms reveal that ATINTER is effective at providing better adversarial robustness than existing defense ap- proaches, without compromising task accuracy. For example, on sentiment classification us- ing the SST-2 dataset, our method improves the adversarial accuracy over the best exist- ing defense approach by more than 4% with a smaller decrease in task accuracy (0.5 % vs. 2.5%). Moreover, we show that ATINTER gen- eralizes across multiple downstream tasks and classifiers without having to explicitly retrain it for those settings. For example, we find that when ATINTER is trained to remove adversar- ial perturbations for the sentiment classification task on the SST-2 dataset, it even transfers to a semantically different task of news classifica- tion (on AGNews) and improves the adversarial robustness by more than 10%. 1 Introduction Neural models in NLP have been shown to be vul- nerable to adversarial attacks both during training time (Gu et al., 2017; Wallace et al., 2019, 2021; Chen et al., 2021) and at deployment (Ebrahimi et al., 2018; Jin et al., 2020; Garg and Ramakr- ishnan, 2020a). The attacks of the latter type aim to craft adversarial inputs by introducing small, imperceptible perturbations in the input text that erroneously change the output label of a classifi- cation model. Defending against such attacks is important because it ensures the integrity and relia- bility of NLP systems. If undefended, for example, an attacker could adversarially manipulate a spam email to evade a spam detector. ∗Work done during internship at Bloomberg An ideal defense mechanism against such ad- versarial attacks should maintain good task perfor- mance on non-adversarial inputs, effectively mit- igate adversarial attacks, and be transferable to other models and datasets. The transferability of defenses is a valuable property because it allows easy application to new and unknown models with- out retraining the underlying classification model. This is particularly useful when complete access to the model is not possible; for example when the model is accessed through an API. Most existing methods do not satisfy these desiderata, typically lacking in one or more desired properties. For ex- ample, the methods that use input randomization like SAFER (Ye et al., 2020) and Sample Shield- ing (Rusert and Srinivasan, 2022) significantly de- grade task accuracies due to the smoothing and aggregation involved, and are thus ineffective de- fenses. Another set of methods— e.g., adversarial training …

Content truncated to 500 words