Training NLI Models Through Universal Adversarial Attack

Training NLI Models Through Universal Adversarial Attack Jieyu Lin, Wei Liu, Jiajie Zou, Nai Ding ∗ Key Laboratory for Biomedical Engineering of Ministry of Education, College of Biomedical Engineering and Instrument Sciences, Zhejiang University, Hangzhou, China {jieyu lin,liuweizju,jiajiezou,ding nai}@zju.edu.cn Abstract Pre-trained language models are sensitive to adversarial attacks, and recent works have demon- strated universal adversarial attacks that can apply input-agnostic perturbations to mislead mod- els. Here, we demonstrate that universal adversarial attacks can also be used to harden NLP models. Based on NLI task, we propose a simple universal adversarial attack that can mislead models to produce the same output for all premises by replacing the original hypothesis with an irrelevant string of words. To defend against this attack, we propose Training with UNiversal Adversarial Samples (TUNAS), which iteratively generates universal adversarial samples and utilizes them for fine-tuning. The method is tested on two datasets, i.e., MNLI and SNLI. It is demonstrated that, TUNAS can reduce the mean success rate of the universal adversarial attack from above 79% to below 5%, while maintaining similar performance on the original datasets. Furthermore, TUNAS models are also more robust to the attack targeting at individual samples: When search for hypotheses that are best entailed by a premise, the hypotheses found by TUNAS models are more compatible with the premise than those found by baseline models. In sum, we use universal adversarial attack to yield more robust models. 1 Introduction Pre-trained models have achieved impressive performance among natural language processing (NLP) tasks, including natural language inference (NLI) and machine reading comprehension (MRC) (Liu et al., 2019; He et al., 2020). Nevertheless, these models are vulnerable under adversarial attacks (Behjati et al., 2019). For most adversarial attack methods, the adversarial samples are input-specific, i.e., the adversarial perturbation is targeted at a specific input. More recently, however, studies have also shown the existence of universal adversarial attacks, which are input-agnostic (Wallace et al., 2019; Behjati et al., 2019). Multiple methods have been proposed to find universal adversarial samples. One method is to append an input-agnostic string of words to any input to convert the input into an adversarial sample. For example, Wallace et al. (2019) use gradient-based search to find strings that, when concatenated to any input, could result in specific model output. For instance, for models trained on SNLI, prepending “nobody” to the hypothesis could cause >99% of the samples to be judged as being contradictory to the premise, even when all the tested hypotheses are in fact entailed by the premises. Another method is to randomly sample a large number of sentences and screen for universal adversarial samples. For example, Lin et al. (2021) use such a method to find sentences that a model always judges as the correct answer to multiple-choice MRC questions. The mainstream method to increase the robustness of models against adversarial attacks is adversarial training (Madry et al., 2018; Goodfellow et al., 2015; Zhang et al., 2019). In this process, adversarial samples are generated and injected into the training …

Content truncated to 500 words