SAFER: A Structure-free Approach for Certified Robustness to Adversarial Word Substitutions

Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 3465–3475 July 5 - 10, 2020. c⃝2020 Association for Computational Linguistics 3465 SAFER: A Structure-free Approach for Certified Robustness to Adversarial Word Substitutions Mao Ye∗ UT Austin my21@cs.utexas.edu Chengyue Gong∗ UT Austin cygong@cs.utexas.edu Qiang Liu UT Austin lqiang@cs.utexas.edu Abstract State-of-the-art NLP models can often be fooled by human-unaware transformations such as synonymous word substitution. For security reasons, it is of critical importance to develop models with certified robustness that can provably guarantee that the predic- tion is can not be altered by any possible syn- onymous word substitution. In this work, we propose a certified robust method based on a new randomized smoothing technique, which constructs a stochastic ensemble by applying random word substitutions on the input sen- tences, and leverage the statistical properties of the ensemble to provably certify the robust- ness. Our method is simple and structure-free in that it only requires the black-box queries of the model outputs, and hence can be applied to any pre-trained models (such as BERT) and any types of models (world-level or subword- level). Our method significantly outperforms recent state-of-the-art methods for certified ro- bustness on both IMDB and Amazon text clas- sification tasks. To the best of our knowledge, we are the first work to achieve certified robust- ness on large systems such as BERT with prac- tically meaningful certified accuracy. 1 Introduction Deep neural networks have achieved state-of-the- art results in many NLP tasks, but also have been shown to be brittle to carefully crafted adversarial perturbations, such as replacing words with sim- ilar words (Alzantot et al., 2018), adding extra text (Wallace et al., 2019), and replacing sentences with semantically similar sentences (Ribeiro et al., 2018). These adversarial perturbations are imper- ceptible to humans, but can fool deep neural net- works and break their performance. Efficient meth- ods for defending these attacks are of critical im- ∗Equal contribution portance for deploying modern deep NLP models to practical automatic AI systems. In this paper, we focus on defending the synony- mous word substitution attacking (Alzantot et al., 2018), in which an attacker attempts to alter the output of the model by replacing words in the in- put sentence with their synonyms according to a synonym table, while keeping the meaning of this sentence unchanged. A model is said to be certi- fied robust if such an attack is guaranteed to fail, no matter how the attacker manipulates the input sentences. Achieving and verifying certified ro- bustness is highly challenging even if the synonym table used by the attacker is known during training (see Jia et al., 2019), because it requires to check ev- ery possible synonymous word substitution, whose number is exponentially large. Various defense methods against synonymous word substitution attacks have been developed (e.g., Wallace et al., 2019; Ebrahimi et al., 2018), most of which, however, are not certified robust in that they may eventually be broken by stronger attackers. Recently, Jia et al. (2019); Huang …

Content truncated to 500 words