SlowGuess/NAACL_2022_OCR huggingface dataset:
Siyu Lai $^{1*}$ , Zhen Yang $^{2}$ , Fandong Meng $^{2}$ , Xue Zhang $^{1}$ , Yufeng Chen $^{1\dagger}$ , Jinan Xu $^{1}$  and Jie Zhou $^{2}$
<sup>1</sup>Beijing Key Lab of Traffic Data Analysis and Mining, Beijing Jiaotong University, Beijing, China
$^{2}$ Pattern Recognition Center, WeChat AI, Tencent Inc, China
{siyulai,xue_zhang,chenyf,jaxu}@bjtu.edu.cn, {zieenyang,fandongmeng,withtomzhou}@tencent.com
Generating adversarial examples for Neural Machine Translation (NMT) with single Round-Trip Translation (RTT) has achieved promising results by releasing the meaning-preserving restriction. However, a potential pitfall for this approach is that we cannot decide whether the generated examples are adversarial to the target NMT model or the auxiliary backward one, as the reconstruction error through the RTT can be related to either. To remedy this problem, we propose a new criterion for NMT adversarial examples based on the Doubly Round-Trip Translation (DRTT). Specifically, apart from the source-target-source RTT, we also consider the target-source-target one, which is utilized to pick out the authentic adversarial examples for the target NMT model. Additionally, to enhance the robustness of the NMT model, we introduce the masked language models to construct bilingual adversarial pairs based on DRTT, which are used to train the NMT model directly. Extensive experiments on both the clean and noisy test sets (including the artificial and natural noise) show that our approach substantially improves the robustness of NMT models.
In recent years, neural machine translation (NMT) (Cho et al., 2014; Bahdanau et al., 2014; Vaswani et al., 2017) has achieved rapid advancement in the translation performance (Yang et al., 2020; Lu et al., 2021). However, the NMT model is not always stable enough, as its performance can drop significantly when small perturbations are added into the input sentences (Belinkov and Bisk, 2017; Cheng et al., 2020). Such perturbed inputs are often referred to as adversarial examples in the literature, and how to effectively generate and utilize adversarial examples for NMT is still an open question.
Figure 1: An example of the source-target-source RTT process on a perturbed input  $\mathbf{x}_{\delta}$  by replacing "巨大 (huge)" to "轻便 (light)".
Conventional approaches (Ebrahimi et al., 2018; Cheng et al., 2019) for generating NMT adversarial examples always follow the meaning-preserving assumption, i.e., an NMT adversarial example should preserve the meaning of the source sentence but destroy the translation performance drastically (Michel et al., 2019; Niu et al., 2020). With the meaning-preserving restriction, the researchers try to add perturbations on the source inputs as small as possible to ensure the meaning of the source sentence is unchanged, which severely limits the search space of the adversarial examples. Additionally, it is much problematic to craft a minor perturbation on discrete text data, since some random transformations (e.g., swap, deletion and replacement) may change, or even reverse semantics of the text data, breaking the aforementioned meaning-preserving assumption. To break this limitation, Zhang et al. (2021) introduce a new criterion for NMT adversarial examples: an effective NMT adversarial example imposes minor shifting on the source and degrades the translation dramatically, would naturally lead to a semantic-destroyed round-trip translation result. Take the case in Figure 1 as an example:  $\mathbf{x}_{\delta}$  reverses the semantics of input  $\mathbf{x}$  by replacing "巨大 (huge)" to "轻便 (light)". Since the semantics of  $\mathbf{x}$  and  $\mathbf{x}_{\delta}$  are com
* Work was done when Siyu were interning at Pattern Recognition Center, WeChat AI, Tencent Inc, China.
† Yufeng Chen is the corresponding author.
Human Language Technologies, pages 4256 - 4266
ppletely different, it is unreasonable to use the original target sentence of  $\mathbf{x}$  to evaluate the attacks directly. Therefore, Zhang et al. (2021) propose to evaluate the BLEU score between  $\mathbf{x}_{\delta}$  and its reconstructed sentence  $\hat{\mathbf{x}}_{\delta}$  from the source-target-source round-trip translation (RTT), as well as the BLEU score between the original sentence  $\mathbf{x}$  and its reconstructed sentence  $\hat{\mathbf{x}}$ . They take the decrease between the two BLEU scores mentioned above as the adversarial effect. Specifically, if the BLEU decrease exceeds a predefined threshold,  $\mathbf{x}_{\delta}$  is concluded to be an adversarial example for the target NMT model.
While achieving promising results by breaking the meaning-preserving constraint, there are two potential pitfalls in the work of Zhang et al. (2021): (1) Since the source-target-source RTT involves two stages, i.e., the source-to-target translation (S2T) performed by the target NMT model and target-to-source translation (T2S) performed by an auxiliary backward NMT model, we cannot decide whether the BLEU decrease is really caused by the target NMT model. As we can see from the example in Figure 1, the translation from  $\mathbf{x}_{\delta}$  to  $\mathbf{y}_{\delta}^{\prime}$  is pretty good, but the translation from  $\mathbf{y}_{\delta}^{\prime}$  to  $\hat{\mathbf{x}}_{\delta}$  is really poor. We can conclude that the BLEU decrease is actually caused by the auxiliary backward model and thus  $\mathbf{x}_{\delta}$  is not the adversarial example for the target NMT model. Even if Zhang et al. (2021) try to mitigate this problem by fine-tuning the auxiliary backward model on the test sets, we find this problem still remains. (2) They only generate the monolingual adversarial examples on the source side to attack the NMT model, without proposing methods on how to defend these adversaries and improve the robustness of the NMT model.
To address the issues mentioned above, we first propose a new criterion for NMT adversarial examples based on Doubly Round-Trip Translation (DRTT), which can ensure the examples that meet our criterion are the authentic adversarial examples for the target NMT model. Specifically, apart from the source-target-source RTT (Zhang et al., 2021), we additionally consider a target-source-target RTT on the target side. The main intuition is that an effective adversarial example for the target NMT model shall cause a large BLEU decrease on the source-target-source RTT while maintaining a small BLEU decrease on target-source-target RTT. Based on this criterion, we craft the candidate adversarial examples with the source-target-source
RTT as Zhang et al. (2021), and then pick out the authentic adversaries with the target-source-target RTT. Furthermore, to solve the second problem, we introduce the masked language models (MLMs) to construct the bilingual adversarial pairs by performing phrasal replacement on the generated monolingual adversarial examples and the original target sentences synchronously, which are then utilized to train the NMT model directly. Experiments on both clean and noisy test sets (including five types of artificial and nature noise) show that the proposed approach not only generates effective adversarial examples, but also improves the robustness of the NMT model over all kinds of noises. To conclude, our main contributions are summarized as follows:
- We propose a new criterion for NMT adversarial examples based on the doubly round-trip translation, which can pick out the authentic adversarial examples for the target NMT model.
- We introduce the masked language models to construct the bilingual adversarial pairs, which are then utilized to improve the robustness of the NMT model.
- Extensive experiments show that the proposed approach not only improves the robustness of the NMT model on both artificial and natural noise, but also performs well on the clean test sets<sup>1</sup>.
2.1 Adversarial Examples for NMT
The previous approaches for constructing NMT adversarial examples can be divided into two branches: white-box and black-box. The white-box approaches are based on the assumption that the architecture and parameters of the NMT model are accessible (Ebrahimi et al., 2018; Cheng et al., 2019; Chen et al., 2021). These methods usually achieve superior performance since they can construct and defend the adversaries tailored for the model. However, in the real application scenario, it is always impossible for us to access the inner architecture of the model. On the contrary, the black-box approaches never access to inner architecture and parameters of the model. In this line, Belinkov and Bisk (2017) rely on synthetic and naturally occurring language error to generate adversarial examples and Michel et al. (2019) propose a meaning-preserving method by swapping the word internal
The code is publicly available at: https://github. com/lisasiyu/DRTT
Figure 2: The overview of the bilingual adversarial pair generation under the criterion of DRTT.  $(\mathbf{x},\mathbf{y})$  denote the source and target sentence.  $(\mathbf{x}_{\delta},\mathbf{y}_{\delta})$  denote the generated bilingual adversarial pair.
character. Recently, Zhang et al. (2021) craft adversarial examples beyond the meaning-preserving restriction with the round-trip translation and our work builds on top of it.
Masked Language Model (MLM) (Devlin et al., 2018; Conneau and Lample, 2019) has achieved state-of-the-art results on many monolingual and cross-lingual language understanding tasks. MLM randomly masks some of the tokens in the input, and then predicts those masked tokens. Recently, some work adopt MLM to do word replacement as a data augmentation strategy. Jiao et al. (2019) leverage an encoder-based MLM to predict word replacements for single-piece words. Liu et al. (2021) construct augmented sentence pairs by sampling new source phrases and corresponding target phrases with transformer-based MLMs. Following Liu et al. (2021), we introduce the transformer-based MLMs to construct the bilingual adversarial pairs. The main difference between our work and Liu et al. (2021) is that we choose to mask the adversarial phrases or words at each step and Liu et al. (2021) mask the words randomly.
In this section, we first describe our proposed criterion for NMT adversarial examples, and then present the way of constructing the bilingual adversarial pairs.
3.1 Adversarial Examples for NMT
For clarity, we first introduce the traditional criteria for NMT adversarial examples, i.e., the criteria
based on the meaning-preserving (Michel et al., 2019; Karpukhin et al., 2019) and RTT (Zhang et al., 2021), and then elaborate our new criterion based on DRTT. We will use the following notations:  $\mathbf{x}$  and  $\mathbf{y}$  denotes the source and target sentence, respectively.  $\mathbf{x}_{\delta}$  and  $\mathbf{y}_{\delta}$  denote the perturbed version of  $\mathbf{x}$  and  $\mathbf{y}$ , respectively.  $f(\cdot)$  is the forward translation process performed by the target NMT model and  $g(\cdot)$  is the backward translation process performed by the auxiliary backward NMT model.  $\mathrm{sim}(\cdot, \cdot)$  is a function for evaluating the similarity of two sentences, and we use BLEU (Papineni et al., 2002) as the similarity function.
Criterion based on meaning-preserving. Suppose  $\mathbf{y}' = f(\mathbf{x})$  and  $\mathbf{y}_{\delta}' = f(\mathbf{x}_{\delta})$  is the forward translation of the input  $\mathbf{x}$  and its perturbed version  $\mathbf{x}_{\delta}$ , respectively.  $\mathbf{x}_{\delta}$  is an adversarial example when it meets:
$$
\left\{ \begin{array}{l} \operatorname {s i m} (\mathbf {x}, \mathbf {x} _ {\delta}) > \eta , \\ \operatorname {s i m} (\mathbf {y}, \mathbf {y} ^ {\prime}) - \operatorname {s i m} (\mathbf {y}, \mathbf {y} _ {\delta} ^ {\prime}) > \alpha , \end{array} \right. \tag {1}
$$
where  $\eta$  is a threshold to ensure a high similarity between  $\mathbf{x}_{\delta}$  and  $\mathbf{x}$ , so that they can meet the meaning-preserving restriction. A larger  $\alpha$  indicates a more strict criterion of the NMT adversarial example.
Criterion based on RTT. Zhang et al. (2021) point out that the perturbation  $\delta$  may change, even reverse the meaning of  $\mathbf{x}$ , so it is incorrect to use  $\mathbf{y}$  as a target sentence to measure the semantic alteration on the target side. Therefore, they introduce the criterion based on RTT which gets rid of the meaning-preserving restriction. The percentage decrease of similarity between  $\mathbf{x}$  and  $\mathbf{x}_{\delta}$  through the
source-target-source RTT is regarded as the adversarial effect  $\mathrm{d_{src}}(\mathbf{x},\mathbf{x}_{\delta})$ , is calculated as:
$$
\mathrm {d} _ {\mathrm {s r c}} (\mathbf {x}, \mathbf {x} _ {\delta}) = \frac {\mathrm {s i m} (\mathbf {x} , \hat {\mathbf {x}}) - \mathrm {s i m} (\mathbf {x} _ {\delta} , \hat {\mathbf {x}} _ {\delta})}{\mathrm {s i m} (\mathbf {x} , \hat {\mathbf {x}})}, (2)
$$
where  $\hat{\mathbf{x}}$  and  $\hat{\mathbf{x}}_{\delta}$  are reconstructed sentences generated with source-target-source RTT:  $\hat{\mathbf{x}} = g(f(\mathbf{x}))$ ,  $\hat{\mathbf{x}}_{\delta} = g(f(\mathbf{x}_{\delta}))$ . A large  $\mathrm{d_{src}(x,x_{\delta})}$  indicates that the perturbed sentence  $\mathbf{x}_{\delta}$  can not be well reconstructed by RTT when compared to the reconstruction quality of the original source sentence  $\mathbf{x}$ , so  $\mathbf{x}_{\delta}$  is likely to be an adversarial example.
Criterion based on DRTT. In Eq.(2),  $\mathrm{sim}(\mathbf{x},\hat{\mathbf{x}})$  is a constant value given the input  $\mathbf{x}$  and the NMT models. Therefore, the  $\mathrm{d_{src}}(\mathbf{x},\mathbf{x}_{\delta})$  is actually determined by  $-\mathrm{sim}(\mathbf{x}_{\delta},\hat{\mathbf{x}}_{\delta})$ , which can be interpreted as the reconstruction error between  $\mathbf{x}_{\delta}$  and  $\hat{\mathbf{x}}_{\delta}$ . As we mentioned above, the reconstruction error can be caused by two independent translation processes: the forward translation process  $f(\cdot)$  performed by the target NMT model and the backward translation process  $g(\cdot)$  performed by the auxiliary backward model. Consequently, there may be three occasions when we get a large  $\mathrm{d_{src}}(\mathbf{x},\mathbf{x}_{\delta})$ : 1) A large semantic alteration in  $f(\mathbf{x}_{\delta})$  and a small semantic alteration in  $g(\mathbf{y}_{\delta}^{\prime})$ ; 2) A large semantic alteration in  $f(\mathbf{x}_{\delta})$  and a large alteration in  $g(\mathbf{y}_{\delta}^{\prime})$ ; 3) A small semantic alteration in  $f(\mathbf{x}_{\delta})$  and a large alteration in  $g(\mathbf{y}_{\delta}^{\prime})$ . We can conclude  $\mathbf{x}_{\delta}$  is an adversarial example for the target NMT model in occasion 1 and 2, but not in occasion 3. Therefore, the criterion based on RTT may contain many fake adversarial examples.
To address this problem, we add a target-source-target RTT starting from the target side. The percentage decrease of the similarity between  $\mathbf{y}$  and  $\mathbf{y}_{\delta}^{\prime}$  through the target-source-target RTT, denoted as  $\mathrm{d_{tgt}}(\mathbf{y},\mathbf{y}_{\delta}^{\prime})$ , is calculated as:
$$
\mathrm {d} _ {\mathrm {t g t}} (\mathbf {y}, \mathbf {y} _ {\delta} ^ {\prime}) = \frac {\operatorname {s i m} (\mathbf {y} , \hat {\mathbf {y}}) - \operatorname {s i m} (\mathbf {y} _ {\delta} ^ {\prime} , \hat {\mathbf {y}} _ {\delta} ^ {\prime})}{\operatorname {s i m} (\mathbf {y} , \hat {\mathbf {y}})}, \quad (3)
$$
where  $\hat{\mathbf{y}} = f(g(\mathbf{y}))$  and  $\hat{\mathbf{y}}_{\delta}^{\prime} = f(g(\mathbf{y}_{\delta}^{\prime}))$  are reconstructed sentences generated with the target-source-target RTT. We take both  $\mathrm{d_{src}(x,x_{\delta})}$  and  $\mathrm{d_{tgt}(y,y_{\delta}'')}$  into consideration and define  $\mathbf{x}_{\delta}$  as an adversarial examples when it meets:
$$
\left\{ \begin{array}{l} \mathrm {d} _ {\mathrm {s r c}} (\mathbf {x}, \mathbf {x} _ {\delta}) > \beta , \\ \mathrm {d} _ {\mathrm {t g t}} (\mathbf {y}, \mathbf {y} _ {\delta} ^ {\prime}) <   \gamma , \end{array} \right. \tag {4}
$$
where  $\beta$  and  $\gamma$  are thresholds ranging in  $[- \infty, 1]$
2. The interpretation of this criterion is intuitive: if  $\mathrm{dtgt}(\mathbf{y},\mathbf{y}_{\delta}^{\prime})$  is lower than  $\gamma$ , we can conclude that the reconstruction error between  $\mathbf{y}_{\delta}^{\prime}$  and  $\hat{\mathbf{y}}_{\delta}^{\prime}$  is very low. Namely, we can ensure a small semantic alteration of  $g(\mathbf{y}_{\delta}^{\prime})$ . Therefore, if  $\mathrm{d_{src}}(\mathbf{x},\mathbf{x}_{\delta})$  is larger than  $\beta$ , we can conclude the BLEU decrease through the source-target-source RTT is caused by the target NMT model, so that we can conclude  $\mathbf{x}_{\delta}$  is an authentic adversarial example.
3.2 Bilingual Adversarial Pair Generation
Since the proposed criterion breaks the meaning-preserving restriction, the adversarial examples may be semantically distant from the original source sentence. Thus, we cannot directly pair the adversarial examples with the original target sentences. In this section, we propose our approach for generating bilingual adversarial pairs, which performs the following three steps: 1) Training Masked Language Models: using monolingual and parallel data to train masked language models; 2) Phrasal Alignment: obtaining alignment between the source and target phrases; 3) Phrasal Replacement: generating bilingual adversarial pairs by performing phrasal replacement on the source and target sentences synchronously with the trained masked language models. The whole procedure is illustrated in Figure 2.
Training Masked Language Models. We train two kinds of masked language models, namely monolingual masked language model (M-MLM) (Devlin et al., 2018) and translation masked language model (T-MLM) (Conneau and Lample, 2019), for phrasal replacement on the source and target sentence, respectively. The M-MLM introduces a special [MASK] token which randomly masks some of the tokens from the input in a certain probability, and predict the original masked words. Following Liu et al. (2021), we train the M-MLM on monolingual datasets and use an encoder-decoder Transformer model (Vaswani et al., 2017) to tackle the undetermined number of tokens during generation. The T-MLM takes the identical model structure and similar training process as the M-MLM. The main difference is T-MLM relies on the parallel corpus. T-MLM concatenates parallel sentences by a special token [SEP] and only masks words on the target side. The objective is to predict the original masked words on the target side.
It is possible that the reconstruction quality of the perturbed sentence is higher than the original one.
Phrasal Alignment. Phrasal alignment projects each phrase in the source sentence  $\mathbf{x}$  to its alignment phrase in the target sentence  $\mathbf{y}$ . We first generate the alignment between  $\mathbf{x}$  and  $\mathbf{y}$  using FastAlign (Dyer et al., 2013). Then we extract the phrase-to-phrase alignment by the phrase extraction algorithm of NLTK<sup>3</sup>, and get a mapping function  $p$ .
Phrasal Replacement. Given the source sentence  $\mathbf{x} = \{s_1, s_2, \ldots, s_n\}$  and the target sentence  $\mathbf{y} = \{t_1, t_2, \ldots, t_m\}$ ,  $s_i$  is the  $i$ -th phrase in  $\mathbf{x}$ ,  $t_{p(i)}$  is the  $p(i)$ -th phrase in  $\mathbf{y}$  which is aligned to  $s_i$  by the mapping function  $p$ . We construct the candidate bilingual adversarial pairs  $(\mathbf{x}_\delta, \mathbf{y}_\delta)$  by performing the phrasal replacement on  $(\mathbf{x}, \mathbf{y})$  repeatedly until  $c$  percentage phrases in  $\mathbf{x}$  have been replaced. For each step, we select the phrase that yields the most significant reconstruction quality degradation.
Here, we take the replacing process for  $s_i$  and  $t_{p(i)}$  as an example. Considering the not attacked yet phrase  $s_i$  in  $\mathbf{x}$ , we first build a candidate set  $\mathcal{R}_i = \{r_i^1, r_i^2, \ldots, r_i^k\}$  for  $s_i$  with the prepared M-MLM. Specifically, we extract the  $k$  candidate phrases with top  $k$  highest predicted probabilities by feeding  $\mathbf{x}^{\backslash i}$  into M-MLM, where  $\mathbf{x}^{\backslash i}$  is the masked version of  $\mathbf{x}$  by masking  $s_i$ . We select the best candidate  $r_i^*$  for  $s_i$  as:
$$
r _ {i} ^ {*} = \underset {j \in \{1, \dots , k \}} {\arg \max } \mathrm {d} _ {\operatorname {s r c}} (\mathbf {x}, \mathbf {x} ^ {\backslash i: j}), \tag {5}
$$
where  $\mathbf{x}^{\backslash i:j}$  is the noised version by replacing  $s_i$  with  $r_i^j$ . With  $s_i$  being replaced, we need to replace  $t_{p(i)}$  to ensure they are still semantically aligned. To this end, we feed the concatenation of  $\mathbf{x}^{\backslash i:*}$  and  $\mathbf{y}^{\backslash p(i)}$  into T-MLM, and choose the output phrase with the highest predicted probability as the substitute phrase for  $t_{p(i)}$ .
Finally, to decide whether  $(\mathbf{x}_{\delta},\mathbf{y}_{\delta})$  is an authentic bilingual adversarial pair for the target NMT model, we perform a target-source-target RTT starting from the target side and calculate  $\mathrm{d_{tgt}}(\mathbf{y},\mathbf{y}_{\delta}^{\prime})$  between  $\mathbf{y}_{\delta}^{\prime}$  and its reconstruction sentence  $\hat{\mathbf{y}}_{\delta}^{\prime}$  according to Eq.(4). We take  $(\mathbf{x}_{\delta},\mathbf{y}_{\delta})$  as an authentic bilingual adversarial pair if  $\mathrm{d_{src}}(\mathbf{x},\mathbf{x}_{\delta})$  is greater than  $\beta$  and  $\mathrm{d_{tgt}}(\mathbf{y},\mathbf{y}_{\delta}^{\prime})$  is less than  $\gamma$ . We formalize these steps in Algorithm 1 in Appendix A.
After generating adversarial data through the above steps, we combine it with original training data and use them to train the NMT model directly.
We evaluate our model under artificial noise in  $\mathrm{Zh}\rightarrow \mathrm{En}$  and  $\mathrm{En}\rightarrow \mathrm{De}$  translation tasks, and under natural noise in  $\mathrm{En}\rightarrow \mathrm{Fr}$  translation task. The details of the experiments are elaborated in this section.
For the  $\mathrm{Zh}\rightarrow \mathrm{En}$  task, we use the LDC corpus with 1.25M sentence pairs for training $^4$ , NIST06 for validation, and NIST 02, 03, 04, 05, 08 for testing. For the  $\mathrm{En}\rightarrow \mathrm{De}$  task, we use the publicly available dataset WMT'17 En-De (5.85M) for training, and take the newstest16 and newstest17 for validation and testing, respectively. In  $\mathrm{En}\rightarrow \mathrm{Fr}$  task, we follow Liu et al. (2021) to combine the WMT'19  $\mathrm{En}\rightarrow \mathrm{Fr}$  (36k) robustness dataset with Europarl-v7 (2M) En-Fr pairs for training. We take the development set of the MTNT (Michel and Neubig, 2018) for validation and the released test set of the WMT'19 robustness task for testing. As for MLMs, we use the Chinese sentences of the parallel corpus to train the Chinese M-MLM, and use the whole parallel corpus to train Zh-En T-MLM. We train the English M-MLM with News Commentary and News Crawl 2010 (7.26M in total) monolingual corpus following Liu et al. (2021). T-MLM for En-De and En-Fr are trained with their original parallel corpus.
4.2 Model Configuration and Pre-processing
The MLMs and NMT models in this paper take Transformer-base (Vaswani et al., 2017) as the backbone architecture. We implement all models base on the open-source toolkit Fairseq (Ott et al., 2019). As for hyper-parameters,  $\beta$  is set to 0.01 and  $\gamma$  is set to 0.5 for  $\mathrm{Zh}\rightarrow \mathrm{En}$ . For  $\mathrm{En}\rightarrow \mathrm{De}$  and  $\mathrm{En}\rightarrow \mathrm{Fr}$ ,  $\beta$  and  $\gamma$  are set to 0.5. The replacement ratio  $c$  is set to 0.2 following Liu et al. (2021), and the candidate number  $k$  is set to 1. The details of model configuration and the number of the generated adversarial examples are shown in the Appendix B. Following previous work, the  $\mathrm{Zh}\rightarrow \mathrm{En}$  performance is evaluated with the BLEU (Papineni et al., 2002) score calculated by multi-bleu.perl script. For  $\mathrm{En}\rightarrow \mathrm{De}$  and  $\mathrm{En}\rightarrow \mathrm{Fr}$ , we use SacreBLEU (Post, 2018) for evaluation<sup>5</sup>.