SlowGuess/NAACL_2022_OCR huggingface dataset:
Blank filling with language model. In our default setting, we directly apply the original  $\mathrm{BART}_{\mathrm{base}}$  model<sup>10</sup> with 6 encoder and decoder layers and 140M parameters. During infilling, the target phrase  $a$  will be replaced with a special symbol “<mask>”, then the model will fill this blank with variable-length context. The Top-K sampling strategy is used during generation, where we set  $k = 50$  and repeat this procedure several times to collect enough phrase substitution candidates. Since  $\mathrm{BART}_{\mathrm{base}}$  implement blank filling via reconstructing the whole sentence, where the text
excluding the blank part after filling may not be the same as the original one, we simply only reserve the reconstructed sentences which keep the text excluding the blank part unchanged.
In the variations with other blank-infilling models, we use GPT-2<sub>small</sub> model<sup>11</sup> with 124M parameters or T5<sub>base</sub> model<sup>12</sup> with 220M parameters, both have 12 layers. Since the original GPT-2<sub>small</sub> model is not suitable for blank infilling, we enable GPT-2 model to implement this task by finetuing on Yelp training corpus using method proposed by Donahue et al., running the code provide by the authors<sup>13</sup>.
Table 9: Syntactic tags that will be selected as the root of a phrase.
Dataset	PPL before	PPL after
Yelp	11.44	6.29
AG News	9.33	3.64
MNLI	6.16	3.74
QNLI	5.14	5.00
Table 10: Perplexities of our fine-tuned masked language models for likelihood estimation, before and after fine-tuning on the validation set of each dataset (prepending our predefined special label token).
Models for calculating likelihood. We apply RoBERTa $_{\text{base}}$  model fine-tuned on the corresponding training set of each attack dataset in this stage, which has 12 layers and 125M parameter. Then we fine-tune the label-conditioned masked language models on different datasets as follows to make them better fit the specific domain.
- Classification datasets (Yelp, AG News): Since each sample is usually long, we split a sample into several short sentences as the input for fine-tuning. To avoid the conditions that some short sentences may be irrelevant or contradict the overall label  $y$ , we employ a classifier to make predictions on these sentences and only remain sentences with the confidence value of  $y$  higher than 0.99. Such a sentence along with the special label token "<Label>" corresponding to the overall label  $y$  will form a new sample for fine-tuning, whose input format is "<Label> Sentence".
- NLI datasets (MNLI, QNLI): samples in these datasets are usually a pair of short sentences, so we will not split them. The input format for these datasets is "<Label> SentenceA 
 
 SentenceB", where "

" is the separation symbol in RoBERTa.
https://github.com/huggingface/ transformers
$^{9}$ https://stanfordnlp.github.io/CoreNLP/
10https://dl.fbaipublicfiles.com/ fairseq/models/bart.base.tar.gz
<sup>11</sup>https://huggingface.co/gpt2
12https://huggingface.co/t5-base
<sup>13</sup>https://github.com/chrisdonahue/ilm
$^{14}$ https://huggingface.co/roberta-base
Then we will randomly mask some tokens in these samples to fine-tune a masked language model conditioned on labels, the batch size is 8, and the learning rate is  $5e^{-5}$  with AdamW optimizer. The PPL before and after fine-tuning is shown in Table 10, demonstrating the effectiveness of this procedure.
When predicting the likelihood of a perturbation, we will concatenate the label of the original sample with the masked perturbed sequence as the input, similar to samples in fine-tuning. When attacking Yelp and AG News datasets, we also only use the sub-sentence containing the perturbation, rather than the whole text.
Metrics. To obtain the edit distance (DIS) metric, we utilize the open-source tool<sup>15</sup> to calculate it in token-level, i.e. how many words need to be edited to transform a text into another one and then normalized by the text length. In addition, we employ Toolkit in NLTK<sup>16</sup> to calculate BLEU metrics between adversarial samples and the corresponding original samples.
A.2 Details of Victim Models
BERT models. All BERT victim models are based on  $\mathrm{BERT}_{\mathrm{base}}^{17}$ , which contains 110M parameters with 12 layers. A linear layer is added for classification, which takes the representation of “[CLS)” token in the head of a sequence as the input. We then fine-tune victim models on each dataset using batch size 32 and the learning rate  $2e^{-5}$  for 3 epochs. The final model after 3 epochs will be saved and used as the victim model  $F$  on each dataset.
Train robust models using TAVAT. The robust models are also based on  $\mathrm{BERT}_{\mathrm{base}}$  with a linear layer added for classification. We fine-tune the model using an adversarial training method TAVAT proposed by Li and Qiu which is a token-level gradient accumulation of perturbations, by running code provided by the authors<sup>18</sup> with all default hyper-parameters. During finetuning, perturbations guided by gradient are applied to the embedding space and models are trained using these perturbed data.
A.3 Details of baseline MAYA
MAYA has three variants: MAYA, MAYA $_{\pi}$  and MAYA $_{\mathrm{bt}}$ . We select MAYA as our baseline since overall it obtains the best attack success rate and perplexity performance.
A.4 Possible Limitations of Our Model
The label-preservation filter in our PLAT model utilizes label-conditioned masked language models, which need to be fine-tuned on a labeled corpus with sufficient data. Therefore, the performance of PLAT may drop on datasets that have limited number of labeled samples. In addition, it takes about 1 minute for our model to generate one adversarial sample using BERT as the victim model, so PLAT is not applicable for conditions with low computational resources.
B Additional Qualitative Samples
We introduce some additional adversarial samples generated by our PLAT model, along with three baselines, TextFooler, CLARE, MAYA, on four datasets, Yelp, AG News, MNLI, QNLI, in Table 11, Table 12, and Table 13.
Table 11: Adversarial examples generated by different models on Yelp and AG News dataset, perturbations are colored.
MNLI
(Neutral)	Premise The last politician to propose making driving more expensive was Al Gore, who fought to include a small energy tax—which would have included gasoline—in the Clinton administration's 1993 economic plan.
Hypothesis Al Gore is still making proposals for making driving more expensive.
TextFooler
(Contradiction)	Premise The last policies to propose making driving more expensive was Al Gore, who fought to include a small energy tax—which would have included gasoline—in the Clinton administration's 1993 economic plan.
Hypothesis Al Gore is still making proposals for making driving more expensive.
CLARE
(Contradiction)	Premise The last politician to propose making driving more expensive was Al Gore, who moved to include a small energy tax—which would have included gasoline—in the Clinton administration's 1993 economic plan.
Hypothesis Al Gore is still making proposals for making driving more expensive.
MAYA
(Contradiction)	Premise The last politician propose to make driving more expensive was Al Gore, who fought to include a small energy tax—which would have included gasoline—in the Clinton administration's 1993 economic plan.
Hypothesis Al Gore is still making proposals for making driving more expensive.
PLAT
(Contradiction)	Premise The last politician to propose making driving more expensive was his predecessor Senator Al Gore, who fought to include a small energy tax—which would have included gasoline—in the Clinton administration's 1993 economic plan.
Hypothesis Al Gore is still making proposals for making driving more expensive.
MNLI
(Entailment)	Premise So uh but but uh it runs fine all you have it's just very thirsty if I just keep the oil in it seems to be okay but you know that's a sign that I'm going to have to do something sooner or later
Hypothesis It runs well, but I think I might have to do some work on it.
TextFooler
(Neutral)	Premise So uh but but uh it runs fine all you have it's just very thirsty if I just keep the petroleum in it seems to be okay but you know that's a sign that I'm going to have to do nothing shortly or later
Hypothesis It runs well, but I think I might have to do some work on it.
CLARE
(Neutral)	Premise So uh but but uh it runs fine all you have it's just very thirsty if I just drink the oil in it seems to be okay but you know that's a sign that I'm going to have to do nothing sooner or later
Hypothesis It runs well, but I think I might have to do some work on it.
MAYA
(Neutral)	Premise So uh but but uh it runs fine all you have it's just very thirsty if it seems to be okay, but i'm going to have to do something soon or later.
Hypothesis It runs well, but I think I might have to do some work on it.
PLAT
(Neutral)	Premise So uh but but uh it runs fine all you have it's just very thirsty if I just keep it that's all I got in it seems to be okay but you know that's a sign that I'm going to have to do something sooner or later
Hypothesis It runs well, but I think I might have to do some work on it.
Table 12: Adversarial examples generated by different models on MNLI dataset, perturbations are colored.
QNLI
(Entailment)	Premise What are some of the sets or ideals most school systems follow?
Hypothesis Such choices include curriculum, organizational models, design of the physical learning spaces (e.g. classrooms), student-teacher interactions, methods of assessment, class size, educational activities, and more.
TextFooler
(Not Entailment)	Premise What are some of the sets or ideals most school systems follow?
Hypothesis Such choices include curriculum, organizes storyboards, design of the tangible learning spaces (e.g. classrooms), student-teacher interactions, methods of assessment, class size, educational activities, and more.
CLARE
(Not Entailment)	Premise What are some of the sets or ideals most school systems follow?
Hypothesis Such choices affect curriculum, organizational models, design of the physical learning spaces (e.g. classrooms), student-teacher interactions, methods of assessment, class size, educational activities, and more.
MAYA
(Not Entailment)	Premise What are some of the sets or ideals most school systems follow?
Hypothesis Such choices the design of the physical learning spaces should include curriculum, organizational models, and methods of assessment.., and class size.., and educational activities..
PLAT
(Not Entailment)	Premise What are some of the sets or ideals most school systems follow?
Hypothesis Such choices include curriculum, use of a teacher's manual, design of the physical learning spaces (e.g. classrooms), student-teacher interactions, methods of assessment, class size, educational activities, and more.
QNLI
(Entailment)	Premise What to the migrating birds usually follow?
Hypothesis These routes typically follow mountain ranges or coastlines, sometimes rivers, and may take advantage of updrafts and other wind patterns or avoid geographical barriers such as large stretches of open water.
Textfooler
(Not Entailment)	Premise What to the migrating birds usually follow?
Hypothesis These routes seldom follow colina telemetry or coastlines, sometimes rivers, and may take advantage of updrafts and other wind diagrams or avoid spatial separating such as large stretches of commencement water.
CLARE
(Not Entailment)	Premise What to the migrating birds usually follow?
Hypothesis These routes cannot follow continental ranges or coastlines, connect rivers, and may take advantage of updrafts and other wind patterns or avoid geographical barriers such as large stretches of open water.
MAYA
(Not Entailment)	Premise What to the migrating birds usually follow?
Hypothesis These lines typically connect mountain ranges or coastlines, sometimes rivers, and may take advantage of updrafts and other wind patterns or avoid geographical barriers such as large stretches of open water.
PLAT
(Not Entailment)	Premise What to the migrating birds usually follow?
Hypothesis These routes typically take advantages from larger mountain ranges or coastlines, sometimes rivers, and may take advantage of updrafts and other wind patterns or avoid geographical barriers such as large stretches of open water.
Table 13: Adversarial examples generated by different models on QNLI dataset, perturbations are colored.
C.1 Effectiveness of Label-Preservation Filter
Since human evaluation on ablation study of the label-preservation filter is costly, to verify its effect, we turn to use adversarial samples derived from the attack on the Yelp dataset. Here, we train models with either only adversarial examples or a combination of original and adversarial examples to evaluate the label correctness of adversarial samples. Since the labels of the Yelp test set are carefully annotated, the accuracy on the Yelp test set of each trained classifier can be regarded as a metric to reflect the label-preservation capability of the crafted adversarial examples. A better label-preservation of adversarial samples will introduce less noise during training and thus results in preferable performance on the test set. According to the results shown in Table 14, models trained using samples from our complete PLAT model with the label preservation filter shows higher accuracy than ones trained on samples derived from ablated PLAT without such a filter, especially when only training the classifiers based on adversarial samples. Therefore, it demonstrates that using the label-preservation filter can obtain adversarial examples with better label consistency.
Module	Only Adv	Combined
PLAT	88.8%	89.2%
w/o label-preservation	87.3%	88.6%
Table 14: Accuracy on the Yelp test set of models that are trained on barely adversarial examples (Only Adv) or a combination of original and adversarial examples (Combined). The adversarial samples come from our complete PLAT model, or its ablation without label-preservation filter.
C.2 Additional Results on Controllable Ability
We list the full results of §4.2 about controllable ability on Yelp dataset in Table 15, Table 16, and Table 17, for the effects of candidate number  $N$  during infilling, syntactic tree depth restriction for phrase candidates  $d$  and length incremental restriction for substitution  $l$  on our PLAT model, respectively. It can be found that all  $N$ ,  $d$ , and  $l$  can control the performance of PLAT in different aspects. Surprisingly, the grammar error decreases while  $d$  is increasing. We attribute this to the fact that the
modification range of the phrase is extended as  $d$  increases, such that the infilling text is less likely to be essentially conditioned on the surrounding context and fewer grammar errors occur at the boards between blanks and rest texts.
We also test the effects of different likelihood ratio threshold  $\delta$  on Yelp dataset, which is illustrated in Figure 4. A larger threshold  $\delta$  may result in a lower attack success rate, more modifications, and a worse textual quality.
N	ASR↑	DIS↓	BLEU↑	PPL↓	GER↓
10	38.8	0.28	0.66	55.7	0.23
30	71.2	0.30	0.63	54.2	0.28
50	83.7	0.30	0.63	53.6	0.33
100	92.2	0.28	0.66	54.0	0.37
500	97.6	0.22	0.73	56.0	0.33
1,000	98.1	0.20	0.75	56.2	0.33
2,500	98.3	0.18	0.77	56.6	0.32
5,000	98.4	0.17	0.78	56.8	0.33
10,000	98.5	0.16	0.79	57.3	0.29
Table 15: The performance of PLAT with varying candidate number  $N$  during infilling.
d	ASR↑	DIS↓	BLEU↑	PPL↓	GER↓
2	27.4	0.16	0.79	60.6	0.33
4	98.4	0.17	0.78	56.8	0.33
6	98.8	0.18	0.78	55.7	0.25
10	98.5	0.20	0.76	55.9	0.23
25	98.7	0.22	0.74	55.8	0.19
Table 16: The performance of PLAT with varying depth restriction  $d$  when selecting phrase candidates.
l	ASR↑	DIS↓	BLEU↑	PPL↓	GER↓
2	98.4	0.17	0.78	58.5	0.32
3	98.4	0.17	0.78	56.8	0.33
6	98.6	0.19	0.77	54.2	0.37
10	99.2	0.21	0.76	55.4	0.45
15	99.0	0.22	0.75	52.0	0.42
Table 17: The performance of PLAT with varying substitution length incremental restriction  $l$  when selecting phrase candidates.
D Details of Human Evaluation
We conducted our human evaluation via Google Forms on a total 60 non-expert volunteer anno
Figure 4: The performance of PLAT on Yelp dataset using different likelihood ratio threshold in label-preservation filter, in terms of all 5 metrics.
Figure 5: The instruction and an example of meaning preservation task in human evaluation.
Figure 6: The instruction and an example of label preservation task in human evaluation.
Figure 7: The instruction and an example of fluency and grammaticality comparison task in human evaluation.
tators. Each annotator was asked to rate for 10 sets of examples, where each set contains one original sample and three corresponding adversarial samples generated by PLAT, CLARE, and MAYA respectively. We show the screenshot of our instructions and examples in Figure 5, Figure 6, and Figure 7, where the perturbed parts are in bold font. We described how we would use these collected data in the invitations for annotators, and they must agree on this usage before evaluation. All collected data go without personal information in our experiments.
Task 1: Meaning Preservation
In this task, for each question, you will be given a REFERENCE TEXT and one modified TEXT. Given the modifications, please determine whether the meaning of the REFERENCE TEXT has been preserved. Specifically, please determine whether the modified words "mean the same thing" as the words in the reference text. All modifications are shown in BOLD.
REFERENCE TEXT: I love this place so much . It is by far the best all - you-can - eat sushi that I have found . Everytime I am in Vegas I make sure I hit this place up at least once . They always have very fresh fish and since it is a full menu made to order all - you-can - eat you can be happy ordering the nicer stuff and not worry about breaking the wallet .
TEXT 1: i have found a place that is best - to place to eat sushi. i make sure visit this place at least once a year . . . . they always have very fresh fish and since it is a full menu made to order all - you - can - eat you can be happy ordering the nicer stuff and just talk about breaking the wallet.
Do these modifications preserve the meaning of the REFERENCE TEXT? *
Task 2: Sentiment Preservation
In this task, for each question, you will be given a REFERENCE TEXT with a specific sentiment and another TEXT modified from the REFERENCE TEXT. Please determine whether there exist any modifications that have the opposite sentiment in another TEXT. All modifications are shown in BOLD.
REFERENCE TEXT: I love this place so much. It is by far the best all - you-can - eat sushi that I have found. Everytime I am in Vegas I make sure I hit this place up at least once. They always have very fresh fish and since it is a full menu made to order all - you-can - eat you can be happy ordering the nicer stuff and not worry about breaking the wallet.
REFERENCE TEXT SENTIMENT: POSITIVE
TEXT 1: i have found a place that is best - to place to eat sushi. i make sure visit this place at least once a year.... they always have very fresh fish and since it is a full menu made to order all - you - can - eat you can be happy ordering the nicer stuff and just talk about breaking the wallet.
Are there any modifications that FLIP the original sentiment of the modified part in the REFERENCE TEXT? (positive -> negative)? *
Task 3: Fluency & Grammaticality
In this task, for each question, you will be given a REFERENCE TEXT and modified TEXTs. Please determine which of the two modified TEXTs is better in terms of fluency and grammaticality. All modifications are shown in BOLD.
TEXT 2: I can't recommend Tacos too much. It is by far the best all - you - can - eat sushi that I have found. Every time I am in Vegas I make sure I hit this place up at least once. They always have very fresh fish and since it is a full menu made to order all - you - can - eat you can be happy ordering the nicer stuff and not worry about breaking the wallet.
Which TEXT is more fluent and grammatical? *
TEXT1
TEXT2
Both are equally good/bad