SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Muchao Ye<sup>1</sup> Ziyi Yin<sup>1</sup> Tianrong Zhang<sup>1</sup> Tianyu Du<sup>2</sup> Jinghui Chen<sup>1</sup> Ting Wang<sup>3</sup> Fenglong Ma<sup>1*</sup>
<sup>1</sup>The Pennsylvania State University, <sup>2</sup>Zhejiang University, <sup>3</sup-Stony Brook University {muchao, zmy5171, tbz5156, jzc5917, fenglong}@psu.edu, zjradty@zju.edu.cn, twang@cs.stonybrook.edu
Recent years have witnessed a surge of certified robust training pipelines against text adversarial perturbation constructed by synonym substitutions. Given a base model, existing pipelines provide prediction certificates either in the discrete word space or the continuous latent space. However, they are isolated from each other with a structural gap. We observe that existing training frameworks need unification to provide stronger certified robustness. Additionally, they mainly focus on building the certification process but neglect to improve the robustness of the base model. To mitigate the aforementioned limitations, we propose a unified framework named UniT that enables us to train flexibly in either fashion by working in the word embedding space. It can provide a stronger robustness guarantee obtained directly from the word embedding space without extra modules. In addition, we introduce the decoupled regularization (DR) loss to improve the robustness of the base model, which includes two separate robustness regularization terms for the feature extraction and classifier modules. Experimental results on widely used text classification datasets further demonstrate the effectiveness of the designed unified framework and the proposed DR loss for improving the certified robust accuracy. $^{\dagger}$
Despite the tremendous performance of deep neural networks (DNNs) in natural language processing (NLP) tasks, their robustness has been doubted due to their vulnerability against adversarial attacks [15]. Particularly, a type of word-level adversarial perturbation named synonym substitution can generate adversarial examples with high semantic similarity even in the hard-label setting with limited information [14, 26]. Accordingly, recent years have seen an urge for robust NLP models that can provide certified robust predictions [23, 25, 31] for this type of attack. A prediction for a text sample is certified if the hard-label prediction is correct and remains unchanged when the input is changed to any text sample constructed from the synonym substitution. The key to producing certified predictions is certified robust training, which introduces perturbation during training to ask the model to adapt to it and enables it to still perform well in the inference stage under perturbation.
Due to the large scale of NLP models nowadays, certification methods adopted for text data are usually probabilistic ones. In this context, given a base model that outputs a single prediction, a smoothed model is built on it in the inference stage with randomized mechanisms, whose outputs are used to decide whether predictions are certified. Thus, two aspects are essential for generating certified predictions: the robustness of the base model and the certification of the smoothed model.
The implementation code is available at https://github.com/machinelearning4health/UniT.
Existing studies have established the foundation for designing smoothing techniques and their corresponding certification conditions. As Figure 1(a) manifests, a base model usually consists of three modules: (1) an embedding module that converts discrete words into continuous embeddings,
(2) a feature extraction module that obtains its deep representation, and (3) a classifier constructed by the fully connected (FC) layer that converts the deep representation to logits. Given that, randomized mechanisms can either build in the discrete word space (Type I) or the continuous latent space (Type II). Figure 1(b) shows that Type I pipelines, including SAFER [25] and WordDP [23], use perturbed text samples generated by replacing original words with their corresponding synonyms to train the base model and construct a smoothed model for certification. Another type of training, the Type II one, is shown in Figure 1(c), which are recently proposed by CISS [31]. They add Gaussian
Figure 1: Given the (a) base model, (b) Type I frameworks construct the smoothed model in the discrete word space while (c) Type II frameworks construct it in the latent space with IBP. There is a need for unifying these training frameworks and improving the robustness of the base model.
noise to latent features of original text samples to train the base model and certify the prediction in the latent space in a randomized smoothing [1] fashion with the help of the interval bound propagation (IBP) [5] module.
Given these profound pioneering works, the observation motivating our work is that existing pipelines ignore the unification of training frameworks and robustness of the base model. For one thing, structure-wise speaking, Type II frameworks like CISS need to include an extra IBP module compared to Type I frameworks, which affects the certification because of the loose bound problem [30] of IBP. This is validated by our finding that IBP can cause the failure to strike a balance between natural accuracy and certification ratio. For another, both types of frameworks mainly use the cross-entropy (CE) loss calculated from the perturbed inputs for training to improve the discriminative ability of the base model, which is the same as normal training. However, this strategy lacks fine-grained robustness regularization for individual modules and consideration of the final certification target.
To develop a new method that mitigates the aforementioned limitations, we will face two research questions: (RQ1) how to build a unified framework for these two types of pipelines to provide stronger certified robustness and (RQ2) how to design robustness regularization terms for individual modules to further improve the base model robustness. Our solution to them is as follows:
For RQ1, we propose a new framework named UniT to unify Type I and Type II training. UniT resorts to the embedding space as an intermediate for unification. In the Type I scenario, it uses embeddings of perturbed words to train the base model directly. For the Type II scenario, it does not need the IBP module and adds Gaussian noise directly to the concatenated word embeddings of the text sample. We accordingly provide a novel certification condition in the embedding space.
For RQ2, we design a novel loss for certified robust training named decoupled regularization (DR) loss that compensates the CE loss with the modular regularization (MR) term. It consists of two parts. Part I is the  $l_{2}$  norm between the representations of the original sample and the perturbed input, which concentrates on the feature extraction module. Part II includes a novel term calculating the prediction margin from the logits when the original sample representation is slightly perturbed (modeled by Gaussian noise), which takes the certification target into consideration and aims to regularize the classifier module. They are linearly combined to provide supportive regularization for different modules based on their responsibilities and refine the robustness. To sum up, our contributions are:
- To the best of our knowledge, we are the first to provide a comprehensive viewpoint on certified robust training in text. We design a unified structure named UniT built in the embedding space that enables Type II frameworks to be conducted without using IBP during training and certification.
- We propose the DR loss to improve the robustness of the base model. It provides modular regularization directly to aid the CE loss. That is, the feature extraction module is regularized by
the representational  $l_{2}$  norm, while the classifier module is regularized based on the prediction margin calculated from the perturbed representations obtained by adding noise to the original ones.
- Experimental results show that the design of the UniT with DR loss is effective in improving the certified robust accuracy of both types of certification scenarios.
2.1 Certified Robust Training in Image
The development of certified robust training dates back to certifying multi-layer perceptions (MLPs) for image data. Early work tries to formulate certification as an optimization problem with the techniques of mixed integer linear programming [21] and semidefinite relaxation [18]. A practical solution to this problem is using the IBP [3] method and its variants [8], whose key idea is to regard the upper and lower bounds of activated output in each layer as parameters and they are trained by backpropagation. Later development on deterministic certification methods also includes developing Lipschitz networks [10]. However, they can only certify the robustness of shallow neural networks. Another line of certified robust training is conducted by randomized smoothing [1]. It helps provide a certificate in a probabilistic manner, which is more scalable and can certify larger DNNs.
2.2 Certified Robust Training in Text
Problem Formulation. Suppose that we are given a text classification dataset  $\mathcal{D}$ . Let  $\mathcal{V} = \{y_1, \dots, y_c\}$  denote the set of  $c$  classes of  $\mathcal{D}$ . We have  $(X, y)$  as a sample drawn from  $\mathcal{D}$ . For the text sample  $X = [w_1, \dots, w_n]$  with  $n$  words,  $w_i$  is the  $i$ -th word, and its ground truth is  $y \in \mathcal{V}$ . We denote  $f$  as the base model for the text classification task, which outputs the prediction logits  $[f_{y_1}(X), \dots, f_{y_c}(X)]$  for each class in  $\mathcal{V}$ . Suppose that  $f$  can make the correct prediction, i.e.,  $\arg \max_{y_i \in \mathcal{Y}} f_{y_i}(X) = y$ . In the context of certified robustness, we are interested in getting a certified prediction result such that  $\arg \max_{y_i \in \mathcal{Y}} f_{y_i}(X') = y$  holds for any allowed perturbed sample  $X'$  of  $X$ . In this paper, we center on certifying perturbed samples that are constructed by a powerful adversarial attack named synonym substitutions [9] (an example is shown in Table 10 in the Appendix). Note that this setting is different from the one in [27] which certifies the prediction under unconstrained word perturbation for a limited amount of words, and adversarial examples generated from synonym substitution have lower perturbation rates compared to the ones from rephrasing [17] and prompting. In this setting, for each word  $w_i \in X$ , suppose it has  $m_i$  synonyms, its allowable adversarial substitution set is denoted by  $S(w_i) = \{w_i^{(1)}, \dots, w_i^{(m_i)}\}$  (Note that  $S(w_i)$  includes  $w_i$ ). All perturbed samples  $X'$  obtained by replacing original words with their synonyms construct the allowed perturbed sample set  $A(X) = \{X'|X' = [w_1', \dots, w_n'], w_i' \in S(w_i), i = 1, \dots, n\}$ .
Training and Certification. Since  $A(X)$  is a large set of perturbed samples  $(|A(X)| = \prod_{i=1}^{n} m_i)$ , it is impractical to certify the prediction by asking  $f$  to make a prediction on every  $X' \in A(X)$ . Therefore, existing techniques usually certify prediction results by the upper bound condition. If such a certification condition satisfies, the prediction is certified robust. Certified robust training is needed to attain a certified prediction result for  $X$  such that the certification condition can be satisfied in testing. For example, [4] and [5] introduce the IBP-based methods and use the upper bound of text representation in the final layer to certify the result. However, due to the costly bound propagation, IBP-based methods can only be used in shallow MLPs and cannot be applied to large language models like BERT [2]. Besides, IBP has a loose bound problem [30], i.e., upper bounds get loose in the last several layers during propagation, which obstructs the certification of some samples.
Thus, recent studies mainly use probabilistic certified defense methods to obtain certified predictions for more powerful but intricate networks. As demonstrated in Figure 1, existing certified robust training methods for probabilistic certification are categorized into two types. Their common treatment is to introduce perturbation during training. They ask the whole network to get used to the perturbed samples, which are either perturbed input texts  $X'$  (Type I) [23, 25] or perturbed latent features injected into Gaussian noise (Type II) [31]. They usually use the CE loss to improve the discriminative ability of the base model. In certification, they construct a smoothed model  $F$  for  $f$ . A prediction is certified when the logit score of the ground truth class output by  $F$  is larger than that of the runner-up class by a large enough margin, which we refer to as the certification condition. Denote  $F_{y_i}$  as the soft-label prediction score of  $F$  on class  $y_i$ . The runner-up class is defined as
$y_{B} = \arg \max_{y_{i}\in \mathcal{Y},y_{i}\neq y}F_{y_{i}}(X)$  with the largest logit except for  $F_{y}$ . We now briefly mention their certification and kindly ask readers to review their works for a more complete picture if needed.
(1) For the Type I scenario,  $F$  is constructed by averaging the results attained from inputting several perturbed text samples to  $f$ . The certification depends explicitly on the prediction margin  $F_{y}(X) - F_{y_{B}}(X)$ . For example, the certification condition of SAFER (Proposition 1 in [25]) is  $F_{y}(X) - F_{y_{B}}(X) > 2q_{X}$ , where  $q_{X}$  is a constant calculated from the synonym set of the input  $X$ .
(2) In the Type II scenario,  $F$  is constructed by repeatedly adding Gaussian noise  $\delta \sim \mathcal{N}(0,\sigma^2 I)$  to the text representation in the latent space, where  $\sigma$  is the standard deviation and  $I$  is the identity matrix. To illustrate, under the randomized smoothing framework, CISS [31] repeatedly draws Gaussian noise perturbations and adds them to the latent feature of the original sample. It counts the top-1 prediction distribution of  $\mathcal{V}$  given all perturbed inputs. After that, the prediction is certified if  $\underline{p_y} > 0.5$  and  $R = \sigma \Phi^{-1}(\underline{p_y}) > \hat{R}$  (Algorithm 2 in [31]), where  $\underline{p_y}$  is the lower bound of the expected value of the event that the hard-label prediction output by  $f$  of the given perturbed input is class  $y$ ,  $R$  is the certified radius,  $\Phi^{-1}$  is the inverse of the standard Gaussian cumulative distribution function (CDF), and  $\hat{R}$  is the maximum  $l_2$  norm between  $X$  and any  $X' \in A(X)$  in the latent space obtained from IBP. The certification implicitly depends on the prediction margin. If the prediction margin is large, the calculated  $p_y$  and  $R$  will get greater, which helps the certification.
There are also some interesting discussions extended from certified robustness such as whether certified robustness helps fairness [16]. We mainly focus on the certification performance herein and kindly ask readers to review related works for further information about those discussions.
3 UniT: Unified Certified Robust Training
To provide stronger certified robustness for those important but independent frameworks, we design a unified one named UniT that can unify these two types of training without introducing extra modules such as the IBP module used in CISS. In this paper, we utilize BERT as the base model because it yields the best performance for state-of-the-art training frameworks such as SAFER and CISS in two settings. The basic processing procedure of the base model is shown in Figure 2, indicated by the black solid lines. It first transforms the input sample with
Figure 2: Given the base model, UniT unifies two frameworks by working in the embedding space. Type I training replaces original embeddings with embeddings of perturbed samples. Type II training adds Gaussian noise to original word embeddings.
$n$  words to a concatenated BERT word embedding  $x \in \mathbf{R}^{n \times d}$  where  $d = 768$  is the dimension of word embedding. Then the word embeddings will be processed by the BERT feature extraction module (Transformer [22, 24] blocks) which outputs the [CLS] token embedding  $z \in \mathbf{R}^d$  as the representation of the whole text. Finally, the classifier module (FC layer) outputs logits from  $z$ , and the loss is calculated for training. We shall notice that the structural decomposition analysis above is general among different models, e.g., RoBERTa [11] and ALBERT [7], so we can also adopt DR loss for other structures when needed. We now detail our motivation and design of UniT.
3.1 Motivation: Why Do We Need Unification and Better Supervision?
The supervision for improving the discriminative ability of the model during certified robust training generally builds on the CE loss. Since the calculation of the loss function is only related to the last FC layer in the classifier, we denote the last FC layer as  $g$  for illustration. We denote  $z' \in \mathbf{R}^d$  as the representation obtained from the feature extraction module given a perturbed input.
The CE loss is calculated from  $z'$ , i.e.,  $\ell_{ce} = -\log \left( \frac{\exp(g_y(z'))}{\sum_i \exp(g_{y_i}(z'))} \right)$ , where  $[g_{y_1}, \dots, g_{y_c}]$  is the logit distribution given the perturbed input for each class in  $y_i \in \mathcal{Y}$ . As depicted in Figure 1, Type I training builds a smoothed model in the discrete word space, and its training is almost the same as normal training except for perturbed inputs. Meanwhile, the loss for Type II training is  $\ell_{tr} = \ell_{ce} + \gamma \cdot \ell_{\hat{R}}$  where  $\gamma$  is the weight hyperparameter. It contains not only the CE loss but also a certified radius regularizer  $\ell_{\hat{R}} = \max(\hat{R} - R + \mu, 0)$ , where  $\mu$  is the relaxation hyperparameter,  $R$  is the certified
radius, and  $\hat{R}$  is the maximum deviation caused by synonym substitution in the latent space that we introduce in Sec. 2.2. We notice that there is a trade-off between the certification ratio and the natural accuracy for  $\ell_{tr}$  in Type II training: a relaxed regularization on the certified radius can make the base model have higher natural accuracy but a lower certification ratio, and vice versa.
We verify this observation by taking CISS for instance. We can obtain a relaxed regularization on certified radius by replacing  $\hat{R}$  with its lower bound  $\hat{R}_{lb}$  and a strict one by its upper bound  $\hat{R}_{ub}$ . Suppose the minimum and the maximum deviation in any dimension is  $\underline{\rho}$  and  $\bar{\rho}$ , respectively, and the number of dimensions in the latent space is  $d_I$ . We then have  $\hat{R}_{lb} = \sqrt{d_I} \cdot \underline{\rho}$  and  $\hat{R}_{ub} = \sqrt{d_I} \cdot \bar{\rho}$ . We denote the corresponding regularizers as  $\ell_{\hat{R}_{lb}} = \max (\hat{R}_{lb} - R + \mu, 0)$  and  $\ell_{\hat{R}_{ub}} = \max (\hat{R}_{ub} - R + \mu, 0)$ .
Regularization	\( \ell_{\hat{R}} \)	\( \ell_{\hat{R}_{ub}} \)	\( \ell_{\hat{R}_{lb}} \)
Natural Acc. (%)	93.88	89.57	96.34
Cert. Ratio (%)	94.38	99.56	0.81
CRA (%)	88.60	89.18	0.78
Table 1: Trade-off between natural accuracy and certification ratio. Experiments are conducted in Yelp [19] with CISS.
We show the results of how this trade-off affects certified robust accuracy in Table 1. Compared to the original  $\ell_{\hat{R}}$ , if we impose a relaxed regularization  $\ell_{\hat{R}_{lb}}$ , the natural accuracy will increase but the certification condition is hard to satisfy, and consequently, the certified robust accuracy is near  $0\%$ . On the contrary, a stricter regularization  $\ell_{\hat{R}_{ub}}$  makes the smoothed model satisfy the certification condition easily (almost  $100\%$ ), but it hurts the natural accuracy. An interesting finding in Table 1 is that strict regularization  $\ell_{\hat{R}_{ub}}$  helps obtain a higher certified robust accuracy (CRA) than the original regularization  $\ell_{\hat{R}}$  used in CISS. This is because  $\hat{R}$  in CISS is obtained from IBP, and it has a loose bound problem. The certified radius regularization  $\ell_{\hat{R}}$  from IBP is a somewhat strict one, so CISS cannot strike a balance for this trade-off with IBP. Therefore, we shall remove IBP and avoid this calculation. In addition, since the CE loss is deployed to improve discriminative ability, another direction for mitigation is to adopt better supervision other than the CE loss for ameliorating the model robustness, which motivates us to provide individual supervision for each module.
3.2 Training Input
Recall that in the Type I scenario, the original input  $X = [w_{1}, \dots, w_{n}]$  is replaced by the perturbed sample  $X' = [w_{1}', \dots, w_{n}'] \in A(X)$ . Correspondingly, in this scenario, UniT uses the embedding  $x' = [u(w_{1}')', \dots, u(w_{n}')]$  as the input to train the base model, where  $u$  is the BERT embedding function. For the Type II scenario, to facilitate randomized smoothing, UniT needs to inject Gaussian noise into the BERT embeddings for training. Thus, given a sample of zero-mean Gaussian noise  $\delta \sim \mathcal{N}(0, \sigma^2 I) \in \mathbf{R}^{n \times d}$ , UniT uses the embedding  $x + \delta$  as the input. In this sense, we unify two types of certified robust training in one framework by utilizing the embedding space as the intermediate. Thus, all modules can remain the same for either type of certified robust training.
3.3 Certification
For the Type I scenario, we can obtain the certified robustness guarantee from Proposition 1 of SAFER [25] by constructing the smoothed model based on synonym substitutions. We thereby intend to detail our proposed certification for the Type II scenario without IBP. Note that the key calculation for certification in this scenario is  $\hat{R}$ , which is the maximum  $l_{2}$  norm caused by allowed perturbed synonyms in the embedding space. This calculation by UniT is different from CISS because UniT does not need IBP module, and it is directly obtained in the BERT embedding space  $\mathbf{R}^{n\times d}$  as follows.
Given the text sample  $X = [w_{1}, \dots, w_{n}]$ , its BERT embedding is  $x = [u(w_{1}), \dots, u(w_{n})]$ . Similarly, for any perturbed sample  $X' = [w_{1}', \dots, w_{n}'] \in A(X)$ , its embedding  $x' = [u(w_{1}'), \dots, u(w_{n}')]$ . Since each word is independent of the others in the embedding space, the  $l_{2}$  norm between  $x$  and any  $x'$  is  $||x' - x|| = \sqrt{\sum_{i=1}^{n} ||u(w_{i}) - u(w_{i}')||^{2}}$ . For each word  $w_{i} \in X$ , because its synonym embedding set is  $U_{i} = \{u(w_{i}^{(1)}), \dots, u(w_{i}^{(m_{i})})\}$ , the maximum deviation between  $w_{i}$  and any word in  $S(w_{i})$  measured by  $u$  is  $||v_{i}|| = \max_{e \in U_{i}} ||u(w_{i}) - e||$ . Due to the independence of embedding of each word, the maximum deviation caused by all synonyms is
$$
\hat {R} = \sqrt {\left| \left| v _ {1} \right| \right| ^ {2} + \cdots + \left| \left| v _ {n} \right| \right| ^ {2}}. \tag {1}
$$
By adopting Eq. (1) to calculate  $\hat{R}$ , we can train and certify in the Type II scenario without IBP and avoid bound propagation. We can conduct the certification in the embedding space with Theorem 1.
Theorem 1 Given  $(X, y)$  from  $\mathcal{D}$ , suppose that the text embedding of  $X$  is  $x$ . Let  $h: s \to \mathcal{Y}$  be the hard-label prediction function of UniT in the Type II scenario that takes as the input a vector  $s \in \mathbf{R}^{n \times d}$  in the text embedding space and outputs the class with the largest logit. Let  $\delta \sim \mathcal{N}(0, \sigma^2 I)$ , where  $\sigma$  is the standard deviation of the added Gaussian noise. If
$$
\mathbb {E} _ {\delta} [ h (x + \delta) = y ] \geq \max  _ {y _ {i} \in \mathcal {Y}, y _ {i} \neq y} \mathbb {E} _ {\delta} [ h (x + \delta) = y _ {i} ], \tag {2}
$$
then  $\forall x', h(x') = y$  is robust where  $x'$  is the text embedding of any  $X' \in A(X)$  if  $\hat{R} \leq R$ , and