Towards Robustness Against Natural Language Word Substitutions

1 INTRODUCTION . Recent extensive studies have shown that deep neural networks ( DNNs ) are vulnerable to adversarial attacks ( Szegedy et al. , 2013 ; Goodfellow et al. , 2015 ; Papernot et al. , 2016a ; Kurakin et al. , 2017 ; Alzantot et al. , 2018 ) ; e.g. , minor phrase modification can easily deceive Google ’ s toxic comment detection systems ( Hosseini et al. , 2017 ) . This raises grand security challenges to advanced natural language processing ( NLP ) systems , such as malware detection and spam filtering , where DNNs have been broadly deployed ( Stringhini et al. , 2010 ; Kolter & Maloof , 2006 ) . As a consequence , the research on defending against natural language adversarial attacks has attracted increasing attention . Existing adversarial attacks in NLP can be categorized into three folds : ( i ) character-level modifications ( Belinkov & Bisk , 2018 ; Gao et al. , 2018 ; Eger et al. , 2019 ) , ( ii ) deleting , adding , or swapping words ( Liang et al. , 2017 ; Jia & Liang , 2017 ; Iyyer et al. , 2018 ) , and ( iii ) word substitutions using semantically similar words ( Alzantot et al. , 2018 ; Ren et al. , 2019 ; Zang et al. , 2020 ) . The first two attack types usually break the grammaticality and naturality of the original input sentences , and thus can be detected by spell or grammar checker ( Pruthi et al. , 2019 ) . In contrast , the third attack type only substitutes words with semantically similar words , thus preserves the syntactic and semantics ∗Corresponding author . 1Our code will be available at https : //github.com/dongxinshuai/ASCC . of the original input to the most considerable extent and are very hard to discern , even from a human ’ s perspective . Therefore , building robustness against such word substitutions is a fundamental stepping stone towards robustness in NLP , which is the focus of this paper . Adversarial attack by word substitution is a combinatorial optimization problem . Solving this problem in the discrete textual space is considered NP-hard as the searching space increases exponentially with the length of the input . As such , many methods have been proposed to model word substitutions in the continuous word vector space ( Sato et al. , 2018 ; Gong et al. , 2018 ; Jia et al. , 2019 ; Huang et al. , 2019 ) , so that they can leverage the gradients generated by a victim model either for attack or robust training . However , previous methods capture word substitutions in the vector space by using either l2-ball or hyper-rectangle , which results in perturbation sets that are not inclusive enough or unnecessarily large , and thus impedes precise mimicry of the worst cases for robust training ( see Fig . 1 for an illustration ) . In this paper , we introduce a novel Adversarial Sparse Convex Combination ( ASCC ) method , whose key idea is to model the solution space as a convex hull of word vectors . Using a convex hull brings two advantages : ( i ) a continuous convex space is beneficial for gradient-based adversary generation , and ( ii ) the convex hull is , by definition , the smallest convex set that contains all substitutions , thus is inclusive enough to cover all possible substitutions while ruling out unnecessary cases . In particular , we leverage a regularization term to encourage adversary towards an actual substitution , which aligns our modeling better with the discrete textual space . We further propose ASCC-defense , which employs the ASCC to generate adversaries and incorporates adversarial training to gain robustness . We evaluate ASCC-defense on two prevailing NLP tasks , i.e. , sentiment analysis on IMDB and natural language inference on SNLI , across four model architectures , concerning two common attack methods . Experimental results show that our method consistently yields models that are more robust than the state-of-the-arts with significant margins ; e.g. , we achieve 79.0 % accuracy under Genetic attacks on IMDB while the state-of-the-art performance is 75.0 % . Besides , our robustly trained word vectors can be easily plugged into standard NLP models and enforce robustness without applying any other defense techniques , which envisions a new class of approach towards NLP robustness . For instance , using our pre-trained word vectors as initialization enhances a normal LSTM model to achieve 73.4 % robust accuracy , while the state-of-the-art defense and the undefended model achieve 72.5 % and 7.9 % , respectively . 2 PRELIMINARIES . 2.1 NOTATIONS AND PROBLEM SETTING . In this paper , we focus on text classification problem to introduce our method , while it can also be extended to other NLP tasks . We assume we are interested in training classifier X → Y that predicts label y ∈ Y given input x ∈ X . The input x is a textual sequence of L words { xi } Li=1 . We consider the most common practice for NLP tasks where the first step is to map x into a sequence of vectors in a low-dimensional embedding space , which is denoted as v ( x ) . The classifier is then formulated as p ( y|v ( x ) ) , where p can be parameterized by using a neural network , e.g. , CNN or LSTM model . We examine the robustness of a model against adversarial word substitutions ( Alzantot et al. , 2018 ; Ren et al. , 2019 ) . Specifically , any word xi in x can be substituted with any word x̂i in S ( xi ) = { S ( xi ) j } Tj=1 , where S ( xi ) represents a predefined substitution set for xi ( including itself ) and T denotes the number of elements in S ( xi ) . To ensure that x̂ is likely to be grammatical and has the same label as x , S ( xi ) is often comprised of semantically similar words of xi , e.g. , its synonyms . Attack algorithms such as Genetic attack ( Alzantot et al. , 2018 ) and PWWS attack ( Ren et al. , 2019 ) aim to find the worst-case x̂ to fool a victim model , whereas our defense methods aim to build robustness against such substitutions . 2.2 PERTURBATION SET AT VECTOR LEVEL . Gradients provide crucial information about a victim model for adversary generation ( Szegedy et al. , 2013 ; Goodfellow et al. , 2015 ) . However , in NLP , the textual input space is neither continuous nor convex , which impedes effective use of gradients . Therefore , previous methods capture perturbations in the vector space instead , by using the following simplexes ( see Fig.1 for an illustration ) : L2-ball with a fixed radius . Miyato et al . ( 2017 ) first introduced adversarial training to NLP tasks . They use a l2-ball with radius to constrain the perturbation , which is formulated as : v̂ ( x ) = v ( x ) + r , s.t . ‖r‖2 ≤ , ( 1 ) where r denotes sequence-level perturbation in the word vector space and v̂ denotes the adversarial sequence of word vectors . While such modeling initially considers l2-ball at the sentence-level , it can also be extended to word-level to capture substitutions . Following that , Sato et al . ( 2018 ) and Barham & Feizi ( 2019 ) propose to additionally consider the directions towards each substitution . However , they still use the l2-ball , which often fails to capture the geometry of substitutions precisely . Axis aligned bounds . Jia et al . ( 2019 ) and Huang et al . ( 2019 ) use axis-aligned bound to capture perturbations at the vector level . They consider the smallest axis-aligned hyper-rectangular that contains all possible substitutions . Such perturbation set provides useful properties for bound propagation towards robustness . However , the volume of the unnecessary space it captures can grow with the depth of the model and grow exponentially with the dimension of the word vector space . Thus it fits shallow architectures but often fails to utilize the capacity of neural networks fully . Besides , instead of fully defining the vector-level geometry of substitutions , Ebrahimi et al . ( 2018 ) propose to find substitutions by first-order approximation using directional gradients . It is effective in bridging the gap between continuous embedding space and discrete textual space . However , it is based on local approximation , which often fails to find global worst cases for robust training . 3 METHODOLOGY . In this section , we first introduce the intuition of using a convex hull to capture substitutions . Then , we propose how Adversarial Sparse Convex Combination ( ASCC ) generates adversaries . Finally , we introduce ASCC-defense that incorporates adversarial training towards robustness . 3.1 OPTIMALITY OF USING CONVEX HULL . From the perspective of adversarial defense , it is crucial to well capture the attack space of word substitutions . There are three aspects we need to consider : ( i ) Inclusiveness : the space should include all vectors of allowed substitutions to cover all possible cases . ( ii ) Exclusiveness : on the basis of satisfying inclusiveness , the space should be as small as possible since a loose set can generate unnecessarily intricate perturbations , which impede a model from learning useful information . ( iii ) Optimization : the space should be convex and continuous to facilitate effective gradient-based optimization , whether the objective function is convex or not ( Bertsekas , 1997 ; Jain & Kar , 2017 ) . Inspired by archetypal analysis ( Cutler & Breiman , 1994 ) , we propose to use a convex hull to build the attack space : the convex hull is a continuous space and , by definition , the minimal convex set containing all vectors of substitutions . We argue that using a convex hull can satisfy all the above aspects ( as illustrated in Fig.1 ) , and thus it is considered as theoretical optimum . 3.2 ADVERSARIAL SPARSE CONVEX COMBINATION . Efficient representation of and optimization over a convex hull . A classical workaround in literature for optimization over a constraint set is the projected gradient descent ( Cauchy , 1847 ; Frank & Wolfe , 1956 ; Bubeck , 2014 ; Madry et al. , 2018 ) . As for optimization over a convex hull , it necessitates characterizing the convex hull , e.g. , by vertexes , to perform projections . However , computing vertexes is computationally unfavorable because we need to recalculate the vertexes whenever word embeddings change , which frequently occurs during the training process . In this paper , we propose a more efficient fashion for optimization over the concerning convex hull , based on the following proposition ( the proof of which lies in the definition of convex hull ) : Proposition 1 . Let S ( u ) = { S ( u ) 1 , ... , S ( u ) T } be the set of all substitutions of word u , convS ( u ) be the convex hull of word vectors of all elements in S ( u ) , and v ( · ) be the word vector function . Then , we have convS ( u ) = { ∑T i=1 wiv ( S ( u ) i ) | ∑T i=1 wi = 1 , wi ≥ 0 } . According to Proposition 1 , we can formulate v̂ ( xi ) , which denotes any vector in the convex hull around v ( xi ) , as : v̂ ( xi ) = ∑T j=1 wijv ( S ( xi ) j ) , s.t . ∑T j=1 wij = 1 , wij ≥ 0 . ( 2 ) As such , we use Eq.2 to transform the original optimization on v̂ ( xi ) to the optimization on wi , the coefficient of convex combination . Considering that wi still belongs to a set with constraint { ‖wi‖1 = 1 , wij ≥ 0 } , to achieve better flexibilities of optimization , we introduce a variable ŵ ∈ R to relax the constraint on w by the following equation : wij = exp ( ŵij ) ∑T j=1 exp ( ŵij ) , ŵij ∈ R. ( 3 ) After such relaxation in Eqs.2 and 3 , we are able to optimize the objective function over the convex hull by optimizing ŵ ∈ R. It provides a projection-free way to generate any adversaries inside the convex hull using gradients. . Gradient-based adversary generation . Let L be a loss function concerning a classifier . We can generate the worst-case convex combinations v̂ ( x ) by finding the worst-case ŵ : max ŵ L ( v ( x ) , v̂ ( x ) , y ) ( 4 ) where L is classification-related , e.g. , the cross-entropy loss over v̂ ( x ) : L ( v ( x ) , v̂ ( x ) , y ) = − log p ( y|v̂ ( x ) ) . ( 5 ) However , since we relax the discrete textual space to a convex hull in the vector space , any wi that ‖wi‖0 > 1 is highly possible to give rise to v̂ ( xi ) that does not correspond to a real substitution . Algorithm 1 ASCC-defense Input : dataset D , parameters of Adam optimizer . Output : parameters θ and φ . 1 : repeat 2 : for random mini-batch ∼ D do 3 : for every x , y in the mini-batch ( in parallel ) do 4 : Solve the inner maximization in Eq.11 to find the optimal ŵ by Adam ; 5 : Compute v̂ ( x ) by Eq.10 using ŵ and then compute the inner-maximum in Eq.11 ; 6 : end for 7 : Update θ and φ by Adam to minimize the calculated inner-maximum ; 8 : end for 9 : until the training converges . To align better with the discrete nature of textual input , we propose to impose a regularizer on the coefficient of convex combination , wi . To be specific , we take wi as a probability distribution and minimize the entropy function of wi to softly encourage the l0 sparsity of wi . We formulate this word-level entropy-based regularization term as : H ( wi ) = ∑T j=1 −wij log ( wij ) . ( 6 ) Combining loss function L and the entropy-based regularizer H , we here formulate Adversarial Sparse Convex Combination ( ASCC ) for adversary generation as : max ŵ L ( v ( x ) , v̂ ( x ) , y ) − α ∑L i=1 1 L H ( wi ) , ( 7 ) where α ≥ 0 is the weight controlling the regularization term ( the effectiveness of which is validated in Sec.4.3 ) .

Summary: In this paper, the authors aim to build a robust model against word substitution attacks. Unlike previous work, they consider a convex hull as the perturbation region instead of a norm-ball or a hyper-rectangle. From their derivation, perturbed words can be viewed as the linear combinations of substitutions and perturbations can be viewed as the corresponding normalized weights. Therefore, they can adversarially train the perturbations and model to obtain a robust model and robust word embeddings. The authors also design a regularizer to encourage the sparsity on perturbation weights. The experimental results show that the proposed model is indeed more robust than other baselines. In addition, they show that the learned word embedding can be a good initialization for training robust models.