SlowGuess/NAACL_2022_OCR huggingface dataset:
Out-of-Domain: We use different datasets for contrastive learning and finetuning.
H4: By optimizing eq. (1), our method pulls the representations of the clean samples and their corresponding hard positive examples closer in the vector space while pushing other different examples further. In this way, the representations of clean examples and their adversarial examples are also closer in the vector space.
We validate this hypothesis by conducting a vector space study. See section 4.4 for details.
Note that to avoid confusing adversarial examples generated during contrastive learning and adversarial examples generated during finetuning, we refer to the former as hard positive examples (see section 3.3).
Table 1 shows the experimental results for validating H1 and H2. For each dataset, when evaluating the model robustness, we use the same perturbation budget across different settings. Note that although the replacement rates vary across different settings of the same dataset, the perturbation budget for the same attack is the same in these settings. By using the same perturbation budget, we ensure that the success rates of the attacks provide us with a fair evaluation of the robustness of the model (Wang et al., 2021c; Ren et al., 2019).
H1: To validate H1, we focus on rows with the FTC setting during finetuning. We can observe that models without any contrastive pretraining (NP) are the most vulnerable to adversarial attacks. For example, the success rate of the Geometry Attack for AG's News dataset is  $86.2\%$  for the NP model. In contrast, for BTCL and ADCL, the success rate of the Geometry Attack is at least  $5.6\%$  lower than this setting. This shows that self-supervised contrastive learning does improve model robustness.
Additionally, we can also see from table 1 that ADCL improves the model robustness more than BTCL. For example, in the IMDB dataset, the model pretrained with ADCL is  $9.1\%$  more robust than the model pretrained with BTCL  $(93.3\% \rightarrow 84.2\%)$ , showing that using adversarial perturbations during contrastive learning further improves model robustness against adversarial at
Dataset	Pretrain	Finetune	Acc. (%)	Success Rate (%) ↓	Replaced (%) ↑
Geometry	TextFollower	PWWS	BAE-R	Geometry	TextFollower	PWWS	BAE-R
AG	NP	FTC	94.2	86.2	87.6	63.6	17.9	18.6	25.7	20.9	7.4
ADV	94.4	20.7	25.1	26.1	10.7	20.5	29.3	22.3	7.7
BTCL	FTC	94.4	80.6	84.6	63.1	17.7	18.1	24.6	20.9	7.5
ADCL	FTC	94.3	76.5	80.7	55.9	14.1	19.1	26.7	22.6	7.5
ADV	94.4	18.7	23.5	24.7	9.7	20.6	29.3	22.2	7.2
Yelp	NP	FTC	97.1	94.6	94.3	97.0	42.1	10.6	10.4	7.1	6.7
ADV	96.2	38.8	52.4	62.7	22.2	12.8	17.3	11.3	8.8
BTCL	FTC	97.1	92.3	91.6	94.8	39.2	11.0	10.1	7.7	6.9
ADCL	FTC	97.0	88.6	88.2	91.1	37.8	10.4	10.5	7.4	6.9
ADV	96.1	35.6	50.1	61.0	21.0	13.4	17.1	11.2	8.3
IMDB	NP	FTC	92.3	98.7	99.0	99.2	54.0	3.5	6.5	4.3	3.0
ADV	92.0	51.4	75.3	79.1	35.1	7.4	12.7	9.3	3.6
BTCL	FTC	92.5	93.3	96.6	95.1	52.0	4.5	7.4	4.4	3.3
ADCL	FTC	92.4	84.2	87.8	87.8	48.0	3.7	8.7	5.1	2.3
ADV	91.9	48.7	74.4	77.6	31.8	8.1	12.4	9.1	3.5
DBpedia	NP	FTC	99.2	79.6	79.3	46.7	14.3	17.8	23.2	16.2	13.3
ADV	99.0	13.9	16.5	17.7	10.9	21.6	28.2	18.9	14.1
BTCL	FTC	99.2	77.4	76.8	45.1	13.0	18.9	22.8	18.1	13.1
ADCL	FTC	99.1	73.6	74.5	42.6	11.6	18.2	22.9	17.6	12.8
ADV	99.0	12.4	14.8	16.2	10.1	20.1	28.6	18.2	13.8
Table 1: Experimental results for H1 and H2. In-Domain setting is used. We bold the best results, while the second best is in italic.
tacks. Hence, we do not combine BTCL with ADV in later experiments for simplicity.
To further understand how contrastive learning improves the model robustness, we study the transferability of the adversarial examples between models without any contrastive pretraining (NP) and the models pretrained with ADCL. To be specific, the models are first pretrained using either NP or ADCL, and then finetuned on clean examples (FTC). Then, we use a NP model to generate adversarial examples on the test set of each dataset, and then test the corresponding model pretrained with ADCL on these adversarial examples. And vice versa.
Table 3 shows the results. We can see that adversarial examples generated by models pretrained with ADCL have much higher success rates on models without any contrastive pretraining (NP). For example, for the AG's News dataset, the success rates increase by  $32.1\%$ ,  $35.3\%$ ,  $33.8\%$ , and  $22.1\%$  for Geometry Attack, TextFooer, BAE-R, and PWWS, respectively. This demonstrates that by self-supervised contrastive learning with adversarial perturbations, the models become more robust against attacks.
H2: To validate H2, we compare two settings of NP + ADV and ADCL + ADV. We note that when compared with conducting adversarial training
alone (NP + ADV), combining our self-supervised contrastive learning method with adversarial training (ADCL + ADV) constantly results in higher robustness. In other words, the adversarial attacks have lower success rates and higher replacement rate in ADCL + ADV models than in NP + ADV models. For instance, for the IMDB dataset, the ADCL + ADV model is  $2.7\%$  more robust than the NP + ADV model, when both models are tested against the Geometry Attack (Success rates of Geometry attack: ADCL + ADV:  $48.7\%$ , NP + ADV:  $51.4\%$ ; Replacement rates: ADCL + ADV:  $8.1\%$ , NP + ADV:  $7.4\%$ ).
Note that when test NP + ADV models and ADCL + ADV models against the other three adversarial attacks, ADCL + ADV models do not show an advantage over NP + ADV models in terms of replacement rates, despite that ADCL + ADV models still constantly make lower success rates against the adversarial attacks. We argue that this is because we use the Geometry Attack for adversarial training during finetuning, and the adversarial examples from the Geometry Attack might not fully match the distribution from the other attacks. Nevertheless, we can still conclude that ADCL + ADV models are more robust than NP + ADV models.
Our experiments also show that during con
Dataset	Domain	Pretrain	Acc. (%)	Success Rate (%) ↓	Replaced (%)↑
Geometry	TextFollower	PWWS	BAE-R	Geometry	TextFollower	PWWS	BAE-R
AG	-	NP	94.2	86.2	87.6	63.6	17.9	18.6	25.7	20.9	7.4
In-Domain	BTCL	94.4	80.6	84.6	63.1	17.7	18.1	24.6	20.9	7.5
ADCL	94.3	76.9	80.7	55.9	14.1	19.1	26.7	22.6	7.5
Out-of-Domain	ADCL	94.1	79.2	84.0	60.4	16.3	18.7	25.9	21.9	7.5
IMDB	-	NP	92.3	98.7	99.0	99.2	54.0	3.5	6.5	4.3	3.0
In-Domain	BTCL	92.5	93.3	96.6	95.1	52.0	4.5	7.4	4.4	3.3
ADCL	92.4	84.2	87.8	87.8	48.0	3.7	8.7	5.1	2.3
Out-of-Domain	ADCL	92.5	92.3	95.7	94.5	50.1	4.4	8.6	5.3	3.1
Table 2: Comparison of Out-of-Domain with In-Domain. We use the DBpedia dataset as the out-of-domain dataset for AG's News and IMDB. Models are finetuned on clean examples after pretraining (FTC). Best results are bolded, while the second best are in italic.
Dataset	Attack	Success Rate (%)
NP → ADCL	ADCL → NP
AG	Geometry	30.2	62.3
TextFooler	19.7	55.0
BAE-R	26.4	60.2
PWWS	28.3	50.4
Yelp	Geometry	30.1	36.4
TextFooler	22.4	28.0
BAE-R	37.4	41.5
PWWS	34.8	36.3
IMDB	Geometry	38.2	41.4
TextFooler	22.1	25.2
BAE-R	28.9	30.8
PWWS	24.7	26.0
DBpedia	Geometry	34.6	52.2
TextFooler	27.5	42.8
BAE-R	32.5	55.8
PWWS	55.3	58.8
Table 3: Transferability of adversarial examples. The models are pretrained under either NP or ADCL, and then finetuned on clean examples. NP  $\rightarrow$  ADCL: Generate adversarial examples with the model pretrained with NP, then test the model pretrained with ADCL on these adversarial examples. Same applies to ADCL  $\rightarrow$  NP.
trastive learning, the queue size (see section 3.2) has an impact on the final performance. We give the detailed analysis in appendix C.
H3: For the Out-of-Domain setting, we use the DBpedia dataset as the out-of-domain dataset for the AG's News and IMDB datasets, mainly because (1) Computational limits: While using larger datasets such as BookCorpus or Wikipedia might be more useful, conducting self-supervised contrastive learning on these datasets exceeds the limits of our computational infrastructure; (2) The DBpedia dataset is several times larger than AG's News and IMDB. This should give us a glimpse of what it looks like when we scale self-supervised contrastive learning with adversarial perturbations to
even larger out-of-domain datasets; (3) The DBpedia dataset (topic classification on Wikipedia) has a different task and domain compared to the AG's News dataset (news classification from a newspaper) and IMDB dataset (sentiment classification on movie reviews). This discrepancy allows us to understand how out-of-domain datasets could help.
Table 2 shows our results. We can see that models pretrained with ADCL under the Out-of-Domain setting are more robust than models without any pretraining at all (NP). This shows that our method can improve model robustness using out-of-domain data. For instance, for the IMDB dataset, the success rate of TextFooler decreases from  $98.7\%$  for FT models to  $92.3\%$  for Out-of-Domain ADCL models. This shows that our method can improve the model robustness even if the dataset used for contrastive learning is from a completely different domain. Note that in table 2, after pretraining, we finetune the model on clean examples (FTC).
We also notice that models pretrained with ADCL under the Out-of-Domain setting are not as robust as models pretrained with ADCL under the In-Domain setting. This indicates we might need to use much larger unlabeled raw datasets to obtain more improvements.
H4: To validate this hypothesis, we study the vector representations of  $M = 1000$  clean examples of the AG's News dataset and their corresponding adversarial examples. We obtain the adversarial examples by attacking a NP + FTC model.
Let  $v_{1}, v_{2} \ldots v_{M}$  and  $v_{1}', v_{2}' \ldots v_{M}'$  be the vector representations of the clean examples and corresponding adversarial samples, respectively. For each setting, we evaluate three metrics:
- Average distance  $d_{pos}$  between each of the posi
(a) NP + FTC
Figure 3: t-SNE plot of the vector representations of clean examples and adversarial examples from the AG's News dataset. Markers of the same color indicate a pair of clean example  $(\circ)$  and adversarial example  $(\triangle)$ . Check section 4.4 for the evaluation settings. The ranges of x-axis and y-axis are normalized to [0, 1]. We connect each clean example by a dotted line to its corresponding adversarial example.
(b) ADCL + FTC
(c) NP + ADV
(d) ADCL + ADV
Dataset	Distance (dpos/dneg/δ)
NP + FTC	ADCL + FTC	NP + ADV	ADCL + ADV
AG	2.4/3.9/1.5	1.8/4.0/2.2	0.7/4.1/3.4	0.7/4.4/3.7
Yelp	3.5/3.7/0.2	2.9/4.0/1.1	0.7/3.2/2.5	0.5/3.4/2.9
IMDB	3.0/3.7/0.7	2.3/3.8/1.5	0.6/3.4/2.8	0.6/3.8/3.2
DBpedia	2.8/4.8/2.0	2.3/5.1/2.8	0.4/4.9/4.5	0.4/5.2/4.8
Table 4: Vector space study. For each setting, we evaluate three metrics: (a) Average distance between positive pairs; (b) Average distance between negative pairs; (c) Difference between (a) and (b).
tive pairs  $v_{i}$  and  $v_{i}^{\prime}$ , where  $1 \leq i \leq M$ . Then we have:
$$
d _ {p o s} = \frac {1}{M} \sum_ {i = 1} ^ {M} d (\pmb {v} _ {i}, \pmb {v} _ {i} ^ {\prime})
$$
where  $d(\cdot ,\cdot)$  denotes the distance between two vectors.
- Average distance  $d_{\text{neg}}$  between negative pairs:
$$
d _ {n e g} = \sum_ {i = 1} ^ {M} \sum_ {j = 1} ^ {M} \frac {\mathbb {1} _ {i \neq j} (d (\boldsymbol {v} _ {i} , \boldsymbol {v} _ {j}) + d (\boldsymbol {v} _ {i} , \boldsymbol {v} _ {j} ^ {\prime})}{2 (M - 1)}
$$
- Difference  $\delta = d_{\text{neg}} - d_{\text{pos}}$  between (a) and (b). Furthermore, we evaluate the above metrics under the following settings:
- NP + FTC: Finetune on clean examples.
- ADCL + FTC: First do ADCL pretraining, and then finetune on clean examples.
- NP + ADV: Finetune with adversarial training.
- ADCL + ADV: First do ADCL pretraining. Then finetune with adversarial training.
Table 4 shows the results. We can see that our method (1) increases the distance between negative pairs in all settings; (2) decreases the distance between positive pairs in NP + FTC and ADCL + FTC
models, while the distances between positive pairs barely change in  $\mathrm{NP} + \mathrm{ADV}$  and ADCL + ADV models; (3) increases  $\delta$  in all settings. The above observations validate H4 in section 4.3, and further explain that our method achieves higher robustness by pushing vector representations of clean examples and adversarial examples closer.
In fig. 3, we further give qualitative analysis on the distances between clean examples and adversarial examples of the AG's News dataset by showing the t-SNE plot. We can see from the plot that the distances between the clean examples and the corresponding adversarial examples are closer when we apply ADCL pretraining, and that combining ADCL with ADV gives the smallest distance between supervised adversarial examples. Additional plots of other datasets are available in appendix H.
In this paper, we improve the robustness of pretrained language models against word substitution-based adversarial attacks by using self-supervised contrastive learning with adversarial perturbations. Our method is different from previous works as we can improve model robustness without accessing annotated labels. Furthermore, we also conduct word-level adversarial training on BERT with on-the-fly generated adversarial examples. Our adversarial training is different from previous works in that (1) it is on the word level; (2) we generate adversarial examples on the fly, instead of generating a fixed adversarial set beforehand. Experiments show that our method improves model robustness. We find that combining our method with adversarial training results in better robustness than conducting adversarial training alone. In the future, we plan to scale our method to even larger out-of-domain datasets.
To the best of our knowledge, the data used in our work does not contain sensitive information. Although our models are evaluated on academic datasets in this paper, they could also be used in sensitive contexts, e.g. healthcare or legal scenarios. It is essential that necessary anonymization and robustness evaluation is undertaken before using our models in these settings.
Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, and Kai-Wei Chang. 2018. Generating natural language adversarial examples. In EMNLP.
Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey E. Hinton. 2020. A simple framework for contrastive learning of visual representations. In ICML.
Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-training of deep bidirectional transformers for language understanding. In *NAACL*.
Xinshuai Dong, Anh Tuan Liu, Rongrong Ji, and Hong Liu. 2021. Towards robustness against natural language word substitutions. In ICLR.
Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018. HotFlip: White-box adversarial examples for text classification. In ACL.
Tianyu Gao, Xingcheng Yao, and Danqi Chen. 2021. Simcse: Simple contrastive learning of sentence embeddings. In EMNLP.
John Giorgi, Osvald Nitski, Bo Wang, and Gary Bader. 2021. DeCLUTR: Deep contrastive learning for unsupervised textual representations. In ACL.
Beliz Gunel, Jingfei Du, Alexis Conneau, and Ves Stoyanov. 2021. Supervised contrastive learning for pretrained language model fine-tuning. In ICLR.
Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross B. Girshick. 2020. Momentum contrast for unsupervised visual representation learning. In CVPR.
Robin Jia and Percy Liang. 2017. Adversarial examples for evaluating reading comprehension systems. In EMNLP.
Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2020. Is bert really robust? a strong baseline for natural language attack on text classification and entailment. In AAAI.
Minseon Kim, Jihoon Tack, and Sung Ju Hwang. 2020. Adversarial self-supervised contrastive learning. In NeurIPS.
Taeuk Kim, Kang Min Yoo, and Sang-goo Lee. 2021. Self-guided contrastive learning for BERT sentence representations. In ACL.
Seanie Lee, Dong Bok Lee, and Sung Ju Hwang. 2021. Contrastive learning with adversarial perturbations for conditional text generation. In ICLR.
Linyang Li and Xipeng Qiu. 2020. Tavat: Token-aware virtual adversarial training for language understanding. arXiv preprint arXiv:2004.14543.
Xiaodong Liu, Hao Cheng, Pengcheng He, Weizhu Chen, Yu Wang, Hoifung Poon, and Jianfeng Gao. 2020. Adversarial training for large neural language models. arXiv preprint arXiv:2004.08994.
Andrew L. Maas, Raymond E. Daly, Peter T. Pham, Dan Huang, Andrew Y. Ng, and Christopher Potts. 2011. Learning word vectors for sentiment analysis. In ACL.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards deep learning models resistant to adversarial attacks. In ICLR.
Zhao Meng and Roger Wattenhofer. 2020. A geometry-inspired attack for generating natural language adversarial examples. In COLING.
John Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, Di Jin, and Yanjun Qi. 2020. TextAttack: A framework for adversarial attacks, data augmentation, and adversarial training in NLP. In EMNLP: System Demonstrations.
Nikola Mrkšić, Diarmuid Řeaghdha, Blaise Thomson, Milica Gašić, Lina M. Rojas-Barahona, Pei-Hao Su, David Vandyke, Tsung-Hsien Wen, and Steve Young. 2016. Counter-fitting word vectors to linguistic constraints. In NAACL.
Xiao Pan, Mingxuan Wang, Liwei Wu, and Lei Li. 2021. Contrastive learning for many-to-many multilingual neural machine translation. In ACL.
Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. 2019. Generating natural language adversarial examples through probability weighted word saliency. In ACL.
Boxin Wang, Shuohang Wang, Yu Cheng, Zhe Gan, Ruoxi Jia, Bo Li, and Jingjing Liu. 2021a. Infobert: Improving robustness of language models from an information theoretic perspective. In ICLR.
Dong Wang, Ning Ding, Piji Li, and Haitao Zheng. 2021b. CLINE: Contrastive learning with semantic negative examples for natural language understanding. In ACL.
Xiaosen Wang, Yichen Yang, Yihe Deng, and Kun He. 2021c. Adversarial training with fast gradient projection method against synonym substitution based text attacks. In AAAI.
Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015. Character-level convolutional networks for text classification. arXiv preprint arXiv:1509.01626.
Yi Zhou, Xiaqing Zheng, Cho-Jui Hsieh, Kai-Wei Chang, and Xuanjing Huang. 2021. Defense against synonym substitution-based adversarial attacks via Dirichlet neighborhood ensemble. In ACL.
Chen Zhu, Yu Cheng, Zhe Gan, Siqi Sun, Tom Goldstein, and Jingjing Liu. 2020. Freelb: Enhanced adversarial training for natural language understanding. In ICLR.
Yukun Zhu, Ryan Kiros, Rich Zemel, Ruslan Salakhutdinov, Raquel Urtasun, Antonio Torralba, and Sanja Fidler. 2015. Aligning books and movies: Towards story-like visual explanations by watching movies and reading books. In ICCV.
A Geometry Attack for Contrastive Loss
Algorithm 1 is the pseudocode of our Geometry Attack for contrastive loss. Refer to Section 3.3 for more details.
Dataset	Labels	Avg Len	Train	Test
AG's News	4	44	120K	7.6K
IMDB	2	292	25K	25K
DBPedia	14	67	560K	70K
Yelp	2	177	560K	38K
The statistics of each dataset are shown in Table 5. In our work, the maximum sequence length is set to 128 for AG's News and DBpedia, 256 for Yelp, and 512 for IMDB. To save time during evaluating the model robustness against attacks, we randomly select a part of the test examples in each dataset for evaluation. Specifically, we select 1,000 samples from IMDB, 2,000 samples from Yelp, and 5,000 samples from DBpedia. We use all 7,600 samples from the AG's News test set for evaluation.
AG's News<sup>3</sup> Topic classification dataset with four types of news articles: World, Sports, Business and Science/Technology.
IMDB (Maas et al., 2011) Binary sentiment classification dataset on positive and negative movie reviews.
Yelp Yelp review dataset for binary sentiment classification. Following Zhang et al. (2015), reviews with star 1 and 2 are considered negative, and reviews with star 3 and 4 are considered positive.
DBpedia (Zhang et al., 2015) Topic classification dataset with 14 non-overlapping classes. Both content and title fields are used in our work.
C Effect of Queue Size
We conduct additional experiments to study the effect of queue size. We use a queue size of 8192, 16384, 32768, and 65536 under the setting of ADCL+FT for the AG's News dataset. As is shown in Table 6, a larger queue size generally helps improve the model robustness. However, we also notice that when the queue size is too large
Table 5: Statistics of the datasets.
Queue Size	Original Acc. (%)	Success (%)	Replaced (%)
Vanilla	94.2	86.2	18.6
8192	94.4	77.8	18.9
16384	94.3	76.9	18.7
32768	94.3	76.5	19.1
65536	94.4	76.7	19.3
(65536), the model robustness starts to decrease. We argue that this is because a too large queue size results in less frequent queue updates, which makes the vectors in the queue stale.
D Speed of Different Attacks
We show in Table 7 the average number of seconds each attack needs for one example. We obtain the average time by attacking 1000 examples and then taking the average. We can observe that the Geometry attack is at least four times faster than TextFooler, and 4 to 10 times faster than PWWS and BAE-R.
Table 6: Effect of queue size. We use the Geometry Attack to evaluate the robustness of each model. The FT model is finetuned without contrastive learning.
Attack	AG's News	IMDB	DBpedia	Yelp
Geometry	0.44	2.02	0.69	1.16
Text,Fooler	2.48	8.69	2.89	4.86
PWWS	6.29	21.86	2.52	10.27
BAE-R	5.37	24.10	7.74	16.03
Table 7: Average number of seconds each attack needs for an example.
E Adversarial Training with Pre-generated Examples
We compare two different methods for adversarial training:
- Pre-generated We pre-generate for each example in the training set an adversarial example. We then augment the original training set with the adversarial examples. Finally, the model is finetuned on the augmented dataset.
- On-the-fly This setting is the same as ADV in Table 1, where we generate adversarial examples on the fly for each mini-batch during training.
Table 8 shows the results on the AG's News dataset. We can see that on all four attacks, adversarial training with on-the-fly generated adversarial
<sup>3</sup>http://groups.di.unipi.it/~gulli/AG corpus_of_news_articles.html
Dataset	Success Rate / Replaced (%)
Geometry	TextFollower	PWWS	BAE-R
Pre-generated	55.3/17.1	59.4/22.6	42.0/17.4	16.5/7.3
On-the-fly	20.7/20.5	25.1/29.3	26.1/22.3	10.7/7.7
Table 8: Comparison between adversarial training with pre-generated adversarial examples and on-the-fly generated adversarial examples.
examples gives higher robustness than adversarial training with pre-generated adversarial examples.
In our paper, we use PyTorch Lightning $^4$  and HuggingFace Transformers $^5$  in our implementation. We use BERT as the encoder  $f(\cdot)$ , and the representation of the [CLS] symbol in the last layer is used for  $h$ .  $g(\cdot)$  is a two-layer MLP, of which the output size  $c$  is 128.  $g(\cdot)$  uses Tanh as activation function in the output layer. We use FP16 in training step to reduce GPU memory usage, and
use FusedAdam from DeepSpeed as the optimizer. We enable DeepSpeed ZeRO Stage 2 to further speed up training. We conduct all our experiments on 8 RTX TITAN GPUs.
Contrastive learning For Geometry Attack for contrastive loss, to reach a balance between attack success rate and efficiency, the maximum number of iterations  $K$  is set to 10 for AG's News, DBpedia, and Yelp, and 15 for IMDB dataset. We do not perturb words that were already perturbed in previous iterations. For an example  $X_{i} = \{w_{1}, w_{2}, \ldots, w_{L}\}$ , at most  $\min \{K, 0.2 \cdot L\}$  words can be perturbed. For each word  $w_{t}$ ,  $1 \leq t \leq L$ , the upper limit of the candidate set size  $T$  is set to 25. Due to the various maximum lengths in downstream datasets and GPU memory limits, we use different batch sizes for different datasets. During contrastive learning, the batch size is set to 1024 for AG's News and DBpedia, 448 for Yelp, and 192 for IMDB.
Fine-tuning During finetuning, we train the model for two epochs for AG's News and DBpedia, 3 for
<sup>4</sup>https://www.pytorchlightning.ai/
<sup>5</sup>https://huggingface.co/transformers/
$^{6}$ https://www.deepspeed.ai/