Towards Robustness Against Natural Language Word Substitutions

1 INTRODUCTION . Recent extensive studies have shown that deep neural networks ( DNNs ) are vulnerable to adversarial attacks ( Szegedy et al. , 2013 ; Goodfellow et al. , 2015 ; Papernot et al. , 2016a ; Kurakin et al. , 2017 ; Alzantot et al. , 2018 ) ; e.g. , minor phrase modification can easily deceive Google ’ s toxic comment detection systems ( Hosseini et al. , 2017 ) . This raises grand security challenges to advanced natural language processing ( NLP ) systems , such as malware detection and spam filtering , where DNNs have been broadly deployed ( Stringhini et al. , 2010 ; Kolter & Maloof , 2006 ) . As a consequence , the research on defending against natural language adversarial attacks has attracted increasing attention . Existing adversarial attacks in NLP can be categorized into three folds : ( i ) character-level modifications ( Belinkov & Bisk , 2018 ; Gao et al. , 2018 ; Eger et al. , 2019 ) , ( ii ) deleting , adding , or swapping words ( Liang et al. , 2017 ; Jia & Liang , 2017 ; Iyyer et al. , 2018 ) , and ( iii ) word substitutions using semantically similar words ( Alzantot et al. , 2018 ; Ren et al. , 2019 ; Zang et al. , 2020 ) . The first two attack types usually break the grammaticality and naturality of the original input sentences , and thus can be detected by spell or grammar checker ( Pruthi et al. , 2019 ) . In contrast , the third attack type only substitutes words with semantically similar words , thus preserves the syntactic and semantics ∗Corresponding author . 1Our code will be available at https : //github.com/dongxinshuai/ASCC . of the original input to the most considerable extent and are very hard to discern , even from a human ’ s perspective . Therefore , building robustness against such word substitutions is a fundamental stepping stone towards robustness in NLP , which is the focus of this paper . Adversarial attack by word substitution is a combinatorial optimization problem . Solving this problem in the discrete textual space is considered NP-hard as the searching space increases exponentially with the length of the input . As such , many methods have been proposed to model word substitutions in the continuous word vector space ( Sato et al. , 2018 ; Gong et al. , 2018 ; Jia et al. , 2019 ; Huang et al. , 2019 ) , so that they can leverage the gradients generated by a victim model either for attack or robust training . However , previous methods capture word substitutions in the vector space by using either l2-ball or hyper-rectangle , which results in perturbation sets that are not inclusive enough or unnecessarily large , and thus impedes precise mimicry of the worst cases for robust training ( see Fig . 1 for an illustration ) . In this paper , we introduce a novel Adversarial Sparse Convex Combination ( ASCC ) method , whose key idea is to model the solution space as a convex hull of word vectors . Using a convex hull brings two advantages : ( i ) a continuous convex space is beneficial for gradient-based adversary generation , and ( ii ) the convex hull is , by definition , the smallest convex set that contains all substitutions , thus is inclusive enough to cover all possible substitutions while ruling out unnecessary cases . In particular , we leverage a regularization term to encourage adversary towards an actual substitution , which aligns our modeling better with the discrete textual space . We further propose ASCC-defense , which employs the ASCC to generate adversaries and incorporates adversarial training to gain robustness . We evaluate ASCC-defense on two prevailing NLP tasks , i.e. , sentiment analysis on IMDB and natural language inference on SNLI , across four model architectures , concerning two common attack methods . Experimental results show that our method consistently yields models that are more robust than the state-of-the-arts with significant margins ; e.g. , we achieve 79.0 % accuracy under Genetic attacks on IMDB while the state-of-the-art performance is 75.0 % . Besides , our robustly trained word vectors can be easily plugged into standard NLP models and enforce robustness without applying any other defense techniques , which envisions a new class of approach towards NLP robustness . For instance , using our pre-trained word vectors as initialization enhances a normal LSTM model to achieve 73.4 % robust accuracy , while the state-of-the-art defense and the undefended model achieve 72.5 % and 7.9 % , respectively . 2 PRELIMINARIES . 2.1 NOTATIONS AND PROBLEM SETTING . In this paper , we focus on text classification problem to introduce our method , while it can also be extended to other NLP tasks . We assume we are interested in training classifier X → Y that predicts label y ∈ Y given input x ∈ X . The input x is a textual sequence of L words { xi } Li=1 . We consider the most common practice for NLP tasks where the first step is to map x into a sequence of vectors in a low-dimensional embedding space , which is denoted as v ( x ) . The classifier is then formulated as p ( y|v ( x ) ) , where p can be parameterized by using a neural network , e.g. , CNN or LSTM model . We examine the robustness of a model against adversarial word substitutions ( Alzantot et al. , 2018 ; Ren et al. , 2019 ) . Specifically , any word xi in x can be substituted with any word x̂i in S ( xi ) = { S ( xi ) j } Tj=1 , where S ( xi ) represents a predefined substitution set for xi ( including itself ) and T denotes the number of elements in S ( xi ) . To ensure that x̂ is likely to be grammatical and has the same label as x , S ( xi ) is often comprised of semantically similar words of xi , e.g. , its synonyms . Attack algorithms such as Genetic attack ( Alzantot et al. , 2018 ) and PWWS attack ( Ren et al. , 2019 ) aim to find the worst-case x̂ to fool a victim model , whereas our defense methods aim to build robustness against such substitutions . 2.2 PERTURBATION SET AT VECTOR LEVEL . Gradients provide crucial information about a victim model for adversary generation ( Szegedy et al. , 2013 ; Goodfellow et al. , 2015 ) . However , in NLP , the textual input space is neither continuous nor convex , which impedes effective use of gradients . Therefore , previous methods capture perturbations in the vector space instead , by using the following simplexes ( see Fig.1 for an illustration ) : L2-ball with a fixed radius . Miyato et al . ( 2017 ) first introduced adversarial training to NLP tasks . They use a l2-ball with radius to constrain the perturbation , which is formulated as : v̂ ( x ) = v ( x ) + r , s.t . ‖r‖2 ≤ , ( 1 ) where r denotes sequence-level perturbation in the word vector space and v̂ denotes the adversarial sequence of word vectors . While such modeling initially considers l2-ball at the sentence-level , it can also be extended to word-level to capture substitutions . Following that , Sato et al . ( 2018 ) and Barham & Feizi ( 2019 ) propose to additionally consider the directions towards each substitution . However , they still use the l2-ball , which often fails to capture the geometry of substitutions precisely . Axis aligned bounds . Jia et al . ( 2019 ) and Huang et al . ( 2019 ) use axis-aligned bound to capture perturbations at the vector level . They consider the smallest axis-aligned hyper-rectangular that contains all possible substitutions . Such perturbation set provides useful properties for bound propagation towards robustness . However , the volume of the unnecessary space it captures can grow with the depth of the model and grow exponentially with the dimension of the word vector space . Thus it fits shallow architectures but often fails to utilize the capacity of neural networks fully . Besides , instead of fully defining the vector-level geometry of substitutions , Ebrahimi et al . ( 2018 ) propose to find substitutions by first-order approximation using directional gradients . It is effective in bridging the gap between continuous embedding space and discrete textual space . However , it is based on local approximation , which often fails to find global worst cases for robust training . 3 METHODOLOGY . In this section , we first introduce the intuition of using a convex hull to capture substitutions . Then , we propose how Adversarial Sparse Convex Combination ( ASCC ) generates adversaries . Finally , we introduce ASCC-defense that incorporates adversarial training towards robustness . 3.1 OPTIMALITY OF USING CONVEX HULL . From the perspective of adversarial defense , it is crucial to well capture the attack space of word substitutions . There are three aspects we need to consider : ( i ) Inclusiveness : the space should include all vectors of allowed substitutions to cover all possible cases . ( ii ) Exclusiveness : on the basis of satisfying inclusiveness , the space should be as small as possible since a loose set can generate unnecessarily intricate perturbations , which impede a model from learning useful information . ( iii ) Optimization : the space should be convex and continuous to facilitate effective gradient-based optimization , whether the objective function is convex or not ( Bertsekas , 1997 ; Jain & Kar , 2017 ) . Inspired by archetypal analysis ( Cutler & Breiman , 1994 ) , we propose to use a convex hull to build the attack space : the convex hull is a continuous space and , by definition , the minimal convex set containing all vectors of substitutions . We argue that using a convex hull can satisfy all the above aspects ( as illustrated in Fig.1 ) , and thus it is considered as theoretical optimum . 3.2 ADVERSARIAL SPARSE CONVEX COMBINATION . Efficient representation of and optimization over a convex hull . A classical workaround in literature for optimization over a constraint set is the projected gradient descent ( Cauchy , 1847 ; Frank & Wolfe , 1956 ; Bubeck , 2014 ; Madry et al. , 2018 ) . As for optimization over a convex hull , it necessitates characterizing the convex hull , e.g. , by vertexes , to perform projections . However , computing vertexes is computationally unfavorable because we need to recalculate the vertexes whenever word embeddings change , which frequently occurs during the training process . In this paper , we propose a more efficient fashion for optimization over the concerning convex hull , based on the following proposition ( the proof of which lies in the definition of convex hull ) : Proposition 1 . Let S ( u ) = { S ( u ) 1 , ... , S ( u ) T } be the set of all substitutions of word u , convS ( u ) be the convex hull of word vectors of all elements in S ( u ) , and v ( · ) be the word vector function . Then , we have convS ( u ) = { ∑T i=1 wiv ( S ( u ) i ) | ∑T i=1 wi = 1 , wi ≥ 0 } . According to Proposition 1 , we can formulate v̂ ( xi ) , which denotes any vector in the convex hull around v ( xi ) , as : v̂ ( xi ) = ∑T j=1 wijv ( S ( xi ) j ) , s.t . ∑T j=1 wij = 1 , wij ≥ 0 . ( 2 ) As such , we use Eq.2 to transform the original optimization on v̂ ( xi ) to the optimization on wi , the coefficient of convex combination . Considering that wi still belongs to a set with constraint { ‖wi‖1 = 1 , wij ≥ 0 } , to achieve better flexibilities of optimization , we introduce a variable ŵ ∈ R to relax the constraint on w by the following equation : wij = exp ( ŵij ) ∑T j=1 exp ( ŵij ) , ŵij ∈ R. ( 3 ) After such relaxation in Eqs.2 and 3 , we are able to optimize the objective function over the convex hull by optimizing ŵ ∈ R. It provides a projection-free way to generate any adversaries inside the convex hull using gradients. . Gradient-based adversary generation . Let L be a loss function concerning a classifier . We can generate the worst-case convex combinations v̂ ( x ) by finding the worst-case ŵ : max ŵ L ( v ( x ) , v̂ ( x ) , y ) ( 4 ) where L is classification-related , e.g. , the cross-entropy loss over v̂ ( x ) : L ( v ( x ) , v̂ ( x ) , y ) = − log p ( y|v̂ ( x ) ) . ( 5 ) However , since we relax the discrete textual space to a convex hull in the vector space , any wi that ‖wi‖0 > 1 is highly possible to give rise to v̂ ( xi ) that does not correspond to a real substitution . Algorithm 1 ASCC-defense Input : dataset D , parameters of Adam optimizer . Output : parameters θ and φ . 1 : repeat 2 : for random mini-batch ∼ D do 3 : for every x , y in the mini-batch ( in parallel ) do 4 : Solve the inner maximization in Eq.11 to find the optimal ŵ by Adam ; 5 : Compute v̂ ( x ) by Eq.10 using ŵ and then compute the inner-maximum in Eq.11 ; 6 : end for 7 : Update θ and φ by Adam to minimize the calculated inner-maximum ; 8 : end for 9 : until the training converges . To align better with the discrete nature of textual input , we propose to impose a regularizer on the coefficient of convex combination , wi . To be specific , we take wi as a probability distribution and minimize the entropy function of wi to softly encourage the l0 sparsity of wi . We formulate this word-level entropy-based regularization term as : H ( wi ) = ∑T j=1 −wij log ( wij ) . ( 6 ) Combining loss function L and the entropy-based regularizer H , we here formulate Adversarial Sparse Convex Combination ( ASCC ) for adversary generation as : max ŵ L ( v ( x ) , v̂ ( x ) , y ) − α ∑L i=1 1 L H ( wi ) , ( 7 ) where α ≥ 0 is the weight controlling the regularization term ( the effectiveness of which is validated in Sec.4.3 ) .

Summary: of the paper*: This paper studies the problem of robustness against word substitutions. The authors propose a novel Adversarial Sparse Convex Combination (ASCC) method in which they model the word substitution attack space as a convex hull and leverages a regularization term to enforce perturbation towards an actual substitution. Based on the ASCC, they also propose ASCC-defense, which leverages ASCC to generate worst-case perturbations and incorporates adversarial training towards robustness. Experimental results show that their method outperforms the existing SOTA on two tasks -- sentiment analysis and natural language inference.