SlowGuess/ACL_2020_OCR huggingface dataset:
Recall our graph  $G = (G, E)$  used to define the connected component clusters. We say two clusters  $C_i$  and  $C_j$  are adjacent, and thus returned by Adjacent Pairs, if there exists a  $v_i \in C_i$  and a  $v_j \in C_j$  such that  $(v_i, v_j) \in G_E$ . The runtime of our algorithm is  $O(N^2 E)$  since at each of a possible  $N$  total iterations, we compute the objective for one of at most  $E$  pairs of clusters. Computation of the objective can be reframed as computing the difference between  $\Phi$  and  $\Phi_{\mathrm{new}}$ , where the latter is
computed using new clusters, which can be done in  $O(N)$  time.
A.2 Attacks
We use two heuristic attacks to compute an upper bound for robust accuracy: one for ED1 perturbations and one for internal permutations. Each heuristic attack is a beam search, with beam width 5. However, because  $|B(x_i)|$  is very large for many tokens  $x_i$ , even the beam search is intractable. Instead, we run a beam search where the allowable perturbations are  $B'(x_i) \subseteq B(x_i)$ , where  $|B'(x_i)| < B(x_i)$  for sufficiently long  $x_i$ . For our ED1 attack, we define  $B'(x_i)$  to be four randomly sampled perturbations from  $B(x_i)$  when the length of  $x_i$  is less than five, and all deletions when  $x_i$  is greater than five. Thus, the number of perturbations of each word is bounded above by  $\min\{4, \text{len}(x_i) - 2\}$ . For our internal permutations,  $B'(x_i)$  is obtained by sampling five permutations at random.
We use six out of the nine tasks from GLUE: SST, MRPC, QQP, MNLI, QNLI, and RTE, all of which are classification tasks measured by accuracy. The Stanford Sentiment Treebank (SST-2) (Socher et al., 2013) contains movie reviews that are classified as positive and negative. The Microsoft Research Paraphrase Corpus (MRPC) (Dolan and Brockett, 2005) and the Quora Question Pairs dataset<sup>4</sup> contain pairs of input which are classified as semantically equivalent or not; QQP contains question pairs from Quora, while MRPC contains pairs from online news sources. MNLI, and RTE are entailment tasks, where the goal is to predict whether or not a premise sentence entails a hypothesis (Williams et al., 2018). MNLI gathers premise sentences from ten different sources, while RTE gathers premises from entailment challenges. QNLI gives pairs of sentences and questions extracted from the Stanford Question Answering Dataset (Rajpurkar et al., 2016), and the task is to predict whether or not the answer to the question is in the sentence.
We use the GLUE splits for the six datasets and evaluate on test labels when available (SST-2, MRPC), and otherwise the publicly released development labels. We tune hyperparameters by
training on  $80\%$  of the original train set and using the remaining  $20\%$  as a validation set. We then retrain using the chosen hyperparameters on the full training set.
For our methods using transformers, we start with the pretrained uncased BERT (Devlin et al., 2019), using the same hyperparameters as the pytorch-transformers repo. In particular, we use the base uncased version of BERT. We use a batch size of 8, and learning rate  $2e - 5$ . For examples where  $|B_{\alpha}(x)| > 10000$ , we assume the prediction is not robust to make computation tractible. Each typo corrector uses the defaults for training from; it is trained on a specific task using perturbations of the training data as input and the true sentence (up to OOV) as output. The vocabulary size of the typo correctors is 10000 including the unknown token, as in (Pruthi et al., 2019). The typo corrector is chosen based on word-error rate on the validation set.
A.5 Constrained adversaries
Using RobEn, since we can tractably compute robust accuracy, it is easy to additionally consider adversaries that cannot perturb every input token. We may assume that an attacker has a budget of  $b \leq L$  words that they may perturb as in (Pruthi et al., 2019). Exiting methods for certification (Jia et al., 2019; Huang et al., 2019) require attack to be factorized over tokens, and cannot give tighter guarantees in the budget-constrained case compared to the unconstrained setting explored in previous sections. However, our method lets us easily compute robust accuracy exactly in this situation: we just enumerate the possible perturbations that satisfy the budget constraint, and query the model.
Figure 6 plots average robust accuracy across the six tasks using AGGCLUST as a function of  $b$ . Note that  $b = 0$  is simply standard accuracy. Interestingly, for each dataset there is an attack only perturbing 4 tokens with attack accuracy equal to robust accuracy.
A.6 Number of representations
We include here histograms for the datasets we did not cover in the main body. The histograms for
$^{4}$ data.quora.com/First-Quora-Dataset-Release-Question-Pairs
$^{5}$ https://github.com/huggingface/pytorch-transformers $^{6}$ https://github.com/danishpruthi/Adversarial-Misspellings
Figure 6: Robust accuracy averaged across all tasks based on different adversarial budgets  $b$ .  $b = 0$  corresponds to clean performance, and robust performance is reached at  $b = 4$
MRPC and QQP are shown in Figure 7(a), while the histograms for MNLI and QNLI are shown in Figure 7(b). The fraction of  $x$  such that  $|B_{\alpha}(x)| = 1$  for each dataset and each set of encodings is provided in Table 2.
A.7 Internal Permutation Results
We consider the internal permutation attack surface, where interior characters in a word can be permuted, assuming the first and last characters are fixed. For example, "perturbation" can be permuted to "peabreuottin" but not "repturbation". Normally, context helps humans resolve these typos. Interestingly, for internal permutations it is impossible for an adversary to change the cluster assignment of both in-vocab and out of vocab tokens since a cluster can be uniquely represented by the first character, a sorted version of the internal characters, and the last character. Therefore, using CONNCOMP encodings, robust, attack, and standard accuracy are all equal. We use the attack described in A.2 to attack the clean model. The results are in Table 3.
(a) Size of  $B_{\alpha}$  over MRPC and QQP
(b) Size of  $B_{\alpha}$  over MNLI and QNLI
Figure 7: Histograms showing sizes of  $B_{\alpha}$  for MRPC, QQP, MNLI, and QNLI.
Encodings	SST-2	MRPC	QQP	MNLI	QNLI	RTE	Avg
Con. Comp.	86.9	71.6	72.7	45.3	54.6	40.4	61.9
Agg. Clust.	65.6	50.0	62.7	35.4	36.6	25.2	45.9
Table 2: Percentage of test examples with  $\left| {B}_{\alpha }\left( x\right) \right|  = 1$  for each dataset.
Accuracy	System	SST-2	MRPC	QQP	MNLI	QNLI	RTE	Avg
Standard	BERT	93.8	87.7	91.2	84.3	88.9	71.1	86.2
Con. Comp. + BERT	93.2	87.7	86.9	75.9	83.4	61.4	81.4
Attack	BERT	28.1	15.9	33.0	4.9	6.2	5.8	15.7
Con. Comp. + BERT	93.2	87.7	86.9	75.9	83.4	61.4	81.4
Robust	Con. Comp. + BERT	93.2	87.7	86.9	75.9	83.4	61.4	81.4
Table 3: Results from internal permutation attacks. Internal permutation attacks bring the average performance for BERT across the six listed tasks from 86.2 to 15.7. Our CONNCOMP encodings, generated using the internal permutation attack surface, achieve a robust accuracy of 81.4, which is only 4.8 points below standard accuracy.