Abstract: Despite the success of deep models for paraphrase identification on benchmark datasets, these models are still vulnerable to adversarial examples. In this paper, we propose a novel algorithm to generate a new type of adversarial examples to study the robustness of deep paraphrase identification models. We first sample an original sentence pair from the corpus and then adversarially replace some word pairs with difficult common words. We take multiple steps and use beam search to find a modification solution that makes the target model fail, and thereby obtain an adversarial example. The word replacement is also constrained by heuristic rules and a language model, to preserve the label and grammaticality of the example during modification. Experiments show that our algorithm can generate adversarial examples on which the performance of the target model drops dramatically. Meanwhile, human annotators are much less affected, and the generated sentences retain a good grammaticality. We also show that adversarial training with generated adversarial examples can improve model robustness.

Introduction: Paraphrase identification is to determine whether a pair of sentences are paraphrases of each other BIBREF0. It is important for applications such as duplicate post matching on social media BIBREF1, plagiarism detection BIBREF2, and automatic evaluation for machine translation BIBREF3 or text summarization BIBREF4. Paraphrase identification can be viewed as a sentence matching problem. Many deep models have recently been proposed and their performance has been greatly advanced on benchmark datasets BIBREF5, BIBREF6, BIBREF7. However, previous research shows that deep models are vulnerable to adversarial examples BIBREF8, BIBREF9 which are particularly constructed to make models fail. Adversarial examples are of high value for revealing the weakness and robustness issues of models, and can thereby be utilized to improve the model performance for challenging cases, robustness, and also security. In this paper, we propose a novel algorithm to generate a new type of adversarial examples for paraphrase identification. To generate an adversarial example that consists of a sentence pair, we first sample an original sentence pair from the dataset, and then adversarially replace some word pairs with difficult common words respectively. Here each pair of words consists of two words from the two sentences respectively. And difficult common words are words that we adversarially select to appear in both sentences such that the example becomes harder for the target model. The target model is likely to be distracted by difficult common words and fail to judge the similarity or difference in the context, thereby making a wrong prediction. Our adversarial examples are motivated by two observations. Firstly, for a sentence pair with a label matched, when some common word pairs are replaced with difficult common words respectively, models can be fooled to predict an incorrect label unmatched. As the first example in Figure FIGREF1 shows, we can replace two pairs of common words, “purpose” and “life”, with another common words “measure” and “value” respectively. The modified sentence pair remains matched but fools the target model. It is mainly due to the bias between different words and some words are more difficult for the model. When such words appear in the example, the model fails to combine them with the unmodified context and judge the overall similarity of the sentence pair. Secondly, for an unmatched sentence pair, when some word pairs, not necessarily common words, are replaced with difficult common words, models can be fooled to predict an incorrect label matched. As the second example in Figure FIGREF1 shows, we can replace words “Gmail” and “school” with a common word “credit”, and replace words “account” and “management” with ”score”. The modified sentences remain unmatched, but the target model can be fooled to predict matched for being distracted by the common words while ignoring the difference in the unmodified context. Following these observations, we focus on robustness issues regarding capturing semantic similarity or difference in the unmodified part when distracted by difficult common words in the modified part. We try to modify an original example into an adversarial one with multiple steps. In each step, for a matched example, we replace some pair of common words together, with another word adversarially selected from the vocabulary; and for an unmatched example, we replace some word pair, not necessarily a common word pair, with a common word. In this way, we replace a pair of words together from two sentences respectively with an adversarially selected word in each step. To preserve the original label and grammaticality, we impose a few heuristic constraints on replaceable positions, and apply a language model to generate substitution words that are compatible with the context. We aim to adversarially find a word replacement solution that maximizes the target model loss and makes the model fail, using beam search. We generate valid adversarial examples that are substantially different from those in previous work for paraphrase identification. Our adversarial examples are not limited to be semantically equivalent to original sentences and the unmodified parts of the two sentences are of low lexical similarity. To the best of our knowledge, none of previous work is able to generate such kind of adversarial examples. We further discuss our difference with previous work in Section 2.2. In summary, we mainly make the following contributions: We propose an algorithm to generate new adversarial examples for paraphrase identification. Our adversarial examples focus on robustness issues that are substantially different from those in previous work. We reveal a new type of robustness issues in deep paraphrase identification models regarding difficult common words. Experiments show that the target models have a severe performance drop on the adversarial examples, while human annotators are much less affected and most modified sentences retain a good grammaticality. Using our adversarial examples in adversarial training can mitigate the robustness issues, and these examples can foster future research.

Question: How much in experiments is performance improved for models trained with generated adversarial examples?
Answer: Answer with content missing: (Table 1) The performance of all the target models raises significantly, while that on the original
examples remain comparable (e.g. the overall accuracy of BERT on modified examples raises from 24.1% to 66.0% on Quora)