Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper proposes an attacking method to attack the explanations of text classification in NLP. The proposed method is easy to follow.
In particular, they first do the word importance ranking for each token of the input sample. High-important words are prioritized during substitution.  Second, candidate selection via counter-fitted GloVe is proposed to replace the word to attack explanations while maintaining the same confidence in the correctly predicted class. The authors conducted comprehensive experiments to evaluate the effectiveness of their methods. 

main_review: 
The proposed task is very interesting and important. Attacking explanations of deep neural networks have already been explored in the image domain [1,2] and graph domain (GNNs)[3]. It's interesting to have the investigation on NLP task. 


The proposed attacking method is a general framework for attacking NLP model [4,5]. In particular, they compute the importance score for words. And then search the substitution to replace the words.


The proposed attribution robustness sounds nice in Eq. 4 and 6.
Although they are almost the first work to attack explanations in NLP task (???), the solution is not too novel and straightforward. In fact, they just change the objective function of attackers to achieve their goal.

 So most existing attacking methods in NLP can be applied to attack explanation of text classification. 
In this case, the solutions to attack the explanation of text classification would be trivial. Are there any advanced attacking methods for this problem?

Minior: Chapter 2 -> section 2.




[1] Fooling Network Interpretation in Image Classification

[2] Fooling Neural Network Interpretations via Adversarial Model Manipulation

[3] Jointly Attacking Graph Neural Network and its Explanations

[4] Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailment

[5] Adversarial Attacks and Defense on Texts: A Survey

summary_of_the_review: The proposed task is very interesting and important. Attacking explanations of deep neural networks have already been explored in the image domain [1,2] and graph domain (GNNs)[3]. It's interesting to have the investigation on the NLP task.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper focuses on the issue of assessing the robustness of the "explanations" for NLP models (how the explanation, not the prediction, for NLP models, change with respect to small perturbations in the input). Particularly, the authors

1. formalized the problem of attribution (explanation) robustness estimation as an optimization tasks in eqn (4, 5, 6), which involves finding the perturbations that keep the model's output the same, while maximizing the difference in attribution (explanation) compared to the case without these perturbations.

2. developed a black-box attack model that estimate AR, without requiring gradient information. The authors also further conducted ablation studies on the components of the black-box model.

3. conducted evaluations of the authors' attack model, analyzing three existing popular attribution estimation methods (saliency maps, integrated gradients and attention as explanation)


main_review: Strength:
1. The authors provide good explanations in the background of the issue. I find section 2 and 3 generally well-written and some discussions and intuitions were given about the attack algorithm.

2. The method proposed is novel. The authors follow Ghorbani et al 2019 in looking at the issue on perturbation to explanations and extend the problem to text (discrete input). I believe the robustness of model's explanations is not a very well-studied issue in NLP and the community can benefit from this paper.

Weakness:
1. My first concern is that I am confused by section 4.3. I fail to see how the modified attack method provides universal perturbations to text explanations (without querying the model). I think this section would be clearer if the authors could use stick with their notations in section 2, 3 and algorithm 1 and provide further explanations.

2. Another concern is that I wish the authors could have made it clearer how finding s_adv (eqn 6) gives an attribution robustness estimation. I think many practitioners could benefit from a quantitative measure on the robustness of explanations.

3. Would the authors clarify an unreferenced $\tilde{W}$ in eqn 4? 

4. One minor issue is that in investigating the attribution robustness in NLP models, the authors actually only studied sequence classification tasks (as opposed to span-labelling, text generation ...). I think this is a fine scope but also believe that the authors should perhaps make that clearer.

Look forward to the discussions with the authors/other reviewers and I am willing to adjust my scores if the authors could clarify weakness 1 and 2.
summary_of_the_review: Novel paper investigating attribution (explanation) robustness in NLP models. Some sections read confusing. I recommend "weak accept".
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: The authors introduce a text explanation attack algorithm called “Text Explanation Fooler”, that changes output of explanation methods while keeping the classification output the same. This is done by maximizing the distance between attribution maps of original and perturbed sequences, while forcing these inputs have the same prediction outcome. In the proposed attack, the authors apply word importance ranking for substitutions, and take POS tags and stopping words into account. They evaluate their methods with AG’s News, IMDB, Fake News, MR, and Yelp datasets along with CNN, LSTM, LSTMAtt, and BERT models and report significant decrease in correlations compared to RandomAttack (RA).
main_review: --- Strengths:
-	The manuscript is well written in general and overall methodology makes sense. 
-	Decreased correlations are indeed a valuable finding in terms of the proposed attack.
-	Proposed work is connected quite nicely to the previous work.
-	Evaluations on several datasets and methods are a plus.

--- Weaknesses:
-	Even though the claim is evaluation on five datasets, only the subset of the results is reported. As not much related work is available in this domain claimed by the authors, I would expect somehow reporting complete set of results. 
-	Despite extensive evaluation, a limited amount of discussion exists. Implications on unchanged predictions are also not discussed.
-	As RA utilizes a straightforward baseline, I think it is relatively straightforward to have lower correlations with the proposed method compared to RA. 
-	Please report different perturbation ratios in the plots.
summary_of_the_review: While the technical methodology seems to be valid and confirmed with the experiments, there are some drawbacks such as not reporting all the results, limited discussion, and partly applying some methods from vision domain to text processing, also reported in the weaknesses field of the main review. Even though, I think the contribution is timely and valid, however, there should be several updates on the manuscript before it is ready for publication.
review_title: null

Meta-review: This paper presents an "attack"—TextExplanationFooler (TEF)—that adversarially (minimally) edits inputs such that the resultant attribution assigned by common explanation methods changes substantially, while the prediction does not. This is an extension of methods and results in vision to NLP. The authors find that all methods are vulnerable to this attack. 

Reviewers agreed that the demonstration that perturbation attacks used in vision are applicable in NLP is interesting and may lead to follow-up work. The paper would benefit from technical clarifications in several places (see R2), which were largely resolved in discussion.
Decision: Accept (Poster)