Venue: NAACL 2022

# Generating Authentic Adversarial Examples beyond Meaning-preserving

with Doubly Round-trip Translation

Siyu Lai1, Zhen Yang2 , Fandong Meng2, Xue Zhang 1, Yufeng Chen1\({}^{\dagger}\), Jinan Xu1 and Jie Zhou2

Work was done when Siyu were interning at Pattern Recognition Center, WeChat AI, Tencent Inc, China.

Footnote 1: footnotemark:

###### Abstract

Generating adversarial examples for Neural Machine Translation (NMT) with single Round-Trip Translation (RTT) has achieved promising results by releasing the meaning-preserving restriction. However, a potential pitfall for this approach is that we cannot decide whether the generated examples are adversarial to the target NMT model or the auxiliary backward one, as the reconstruction error through the RTT can be related to either. To remedy this problem, we propose a new criterion for NMT adversarial examples based on the Doubly Round-Trip Translation (DRTT). Specifically, apart from the source-target-source RTT, we also consider the target-source-target one, which is utilized to pick out the authentic adversarial examples for the target NMT model. Additionally, to enhance the robustness of the NMT model, we introduce the masked language models to construct bilingual adversarial pairs based on DRTT, which are used to train the NMT model directly. Extensive experiments on both the clean and noisy test sets (including the artificial and natural noise) show that our approach substantially improves the robustness of NMT models.

+
Footnote †: Corresponding author.

Beijing Key Lab of Traffic Data Analysis and Mining,

Beijing Jiaotong University, Beijing, China

Pattern Recognition Center, WeChat AI, Tencent Inc, China

{siyulai,xue_zhang,chenyf,jaxu}@bjtu.edu.cn,

{zieenyang,fandongmeng,withoutzhou}@tencent.com

## 1 Introduction

In recent years, neural machine translation (NMT) Cho et al. (2014); Bahdanau et al. (2014); Vaswani et al. (2017) has achieved rapid advancement in the translation performance Yang et al. (2020); Lu et al. (2021). However, the NMT model is not always stable enough, as its performance can drop significantly when small perturbations are added into the input sentences Belinkov and Bisk (2017); Cheng et al. (2020). Such perturbed inputs are often referred to as adversarial examples in the literature, and how to effectively generate and utilize adversarial examples for NMT is still an open question.

Conventional approaches Ebrahimi et al. (2018); Cheng et al. (2019) for generating NMT adversarial examples always follow the meaning-preserving assumption, i.e., an NMT adversarial example should preserve the meaning of the source sentence but destroy the translation performance drastically Michel et al. (2019); Niu et al. (2020). With the meaning-preserving restriction, the researchers try to add perturbations on the source inputs as small as possible to ensure the meaning of the source sentence is unchanged, which severely limits the search space of the adversarial examples. Additionally, it is much problematic to craft a minor perturbation on discrete text data, since some random transformations (e.g., swap, deletion and replacement) may change, or even reverse semantics of the text data, breaking the aforementioned meaning-preserving assumption. To break this limitation, Zhang et al. (2021) introduce a new criterion for NMT adversarial examples: _an effective NMT adversarial example imposes minor shifting on the source and degrades the translation dramatically, would naturally lead to a semantic-destroyed round-trip translation result_. Take the case in Figure 1 as an example: \(\mathbf{x}_{\delta}\) reverses the semantics of input \(\mathbf{x}\) by replacing "\(\boxplus\!\!\!\!\!\boxplus\) (huge)" to "\(\boxplus\!\!\!\!\!\boxplus\) (light)". Since the semantics of \(\mathbf{x}\) and \(\mathbf{x}_{\delta}\) are com

pletely different, it is unreasonable to use the original target sentence of \({\bf x}\) to evaluate the attacks directly. Therefore, Zhang et al. (2021) propose to evaluate the BLEU score between \({\bf x}_{\delta}\) and its reconstructed sentence \(\hat{\bf x}_{\delta}\) from the source-target-source round-trip translation (RTT), as well as the BLEU score between the original sentence \({\bf x}\) and its reconstructed sentence \(\hat{\bf x}\). They take the decrease between the two BLEU scores mentioned above as the adversarial effect. Specifically, if the BLEU decrease exceeds a predefined threshold, \({\bf x}_{\delta}\) is concluded to be an adversarial example for the target NMT model.

While achieving promising results by breaking the meaning-preserving constraint, there are two potential pitfalls in the work of Zhang et al. (2021): (1) Since the source-target-source RTT involves two stages, i.e., the source-to-target translation (S2T) performed by the target NMT model and target-to-source translation (T2S) performed by an auxiliary backward NMT model, we cannot decide whether the BLEU decrease is really caused by the target NMT model. As we can see from the example in Figure 1, the translation from \({\bf x}_{\delta}\) to \({\bf y}^{\prime}_{\delta}\) is pretty good, but the translation from \({\bf y}^{\prime}_{\delta}\) to \(\hat{\bf x}_{\delta}\) is really poor. We can conclude that the BLEU decrease is actually caused by the auxiliary backward model and thus \({\bf x}_{\delta}\) is not the adversarial example for the target NMT model. Even if Zhang et al. (2021) try to mitigate this problem by fine-tuning the auxiliary backward model on the test sets, we find this problem still remains. (2) They only generate the monolingual adversarial examples on the source side to attack the NMT model, without proposing methods on how to defend these adversaries and improve the robustness of the NMT model.

To address the issues mentioned above, we first propose a new criterion for NMT adversarial examples based on Doubly Round-Trip Translation (DRTT), which can ensure the examples that meet our criterion are the authentic adversarial examples for the target NMT model. Specifically, apart from the source-target-source RTT (Zhang et al., 2021), we additionally consider a target-source-target RTT on the target side. The main intuition is that an effective adversarial example for the target NMT model shall cause a large BLEU decrease on the source-target-source RTT while maintaining a small BLEU decrease on target-source-target RTT. Based on this criterion, we craft the candidate adversarial examples with the source-target-source RTT as Zhang et al. (2021), and then pick out the authentic adversaries with the target-source-target RTT. Furthermore, to solve the second problem, we introduce the masked language models (MLMs) to construct the bilingual adversarial pairs by performing phrasal replacement on the generated monolingual adversarial examples and the original target sentences synchronously, which are then utilized to train the NMT model directly. Experiments on both clean and noisy test sets (including five types of artificial and nature noise) show that the proposed approach not only generates effective adversarial examples, but also improves the robustness of the NMT model over all kinds of noises. To conclude, our main contributions are summarized as follows:

* We propose a new criterion for NMT adversarial examples based on the doubly round-trip translation, which can pick out the authentic adversarial examples for the target NMT model.
* We introduce the masked language models to construct the bilingual adversarial pairs, which are then utilized to improve the robustness of the NMT model.
* Extensive experiments show that the proposed approach not only improves the robustness of the NMT model on both artificial and natural noise, but also performs well on the clean test sets1. Footnote 1: The code is publicly available at [https://github.com/lisasiyu/DRTT](https://github.com/lisasiyu/DRTT)

## 2 Related Work

### Adversarial Examples for NMT

The previous approaches for constructing NMT adversarial examples can be divided into two branches: white-box and black-box. The white-box approaches are based on the assumption that the architecture and parameters of the NMT model are accessible (Ebrahimi et al., 2018; Cheng et al., 2019; Chen et al., 2021). These methods usually achieve superior performance since they can construct and defend the adversaries tailored for the model. However, in the real application scenario, it is always impossible for us to access the inner architecture of the model. On the contrary, the black-box approaches never access to inner architecture and parameters of the model. In this line, Belinkov and Bisk (2017) rely on synthetic and naturally occurring language error to generate adversarial examples and Michel et al. (2019) propose a meaningful preserving method by swapping the word internal 

character. Recently, Zhang et al. (2021) craft adversarial examples beyond the meaning-preserving restriction with the round-trip translation and our work builds on top of it.

### Masked Language Model

Masked Language Model (MLM) Devlin et al. (2018); Conneau and Lample (2019) has achieved state-of-the-art results on many monolingual and cross-lingual language understanding tasks. MLM randomly masks some of the tokens in the input, and then predicts those masked tokens. Recently, some work adopt MLM to do word replacement as a data augmentation strategy. Jiao et al. (2019) leverage an encoder-based MLM to predict word replacements for single-piece words. Liu et al. (2021) construct augmented sentence pairs by sampling new source phrases and corresponding target phrases with transformer-based MLMs. Following Liu et al. (2021), we introduce the transformer-based MLMs to construct the bilingual adversarial pairs. The main difference between our work and Liu et al. (2021) is that we choose to mask the adversarial phrases or words at each step and Liu et al. (2021) mask the words randomly.

## 3 Method

In this section, we first describe our proposed criterion for NMT adversarial examples, and then present the way of constructing the bilingual adversarial pairs.

### Adversarial Examples for NMT

For clarity, we first introduce the traditional criteria for NMT adversarial examples, i.e., the criteria based on the meaning-preserving Michel et al. (2019); Karpukhin et al. (2019) and RTT Zhang et al. (2021), and then elaborate our new criterion based on DRTT. We will use the following notations: \({\bf x}\) and \({\bf y}\) denotes the source and target sentence, respectively. \({\bf x}_{\delta}\) and \({\bf y}_{\delta}\) denote the perturbed version of \({\bf x}\) and \({\bf y}\), respectively. \(f(\cdot)\) is the forward translation process performed by the target NMT model and \(g(\cdot)\) is the backward translation process performed by the auxiliary backward NMT model. \(\sin(\cdot,\cdot)\) is a function for evaluating the similarity of two sentences, and we use BLEU Papineni et al. (2002) as the similarity function.

Criterion based on meaning-preserving.Suppose \({\bf y^{\prime}}=f({\bf x})\) and \({\bf y^{\prime}_{\delta}}=f({\bf x}_{\delta})\) is the forward translation of the input \({\bf x}\) and its perturbed version \({\bf x}_{\delta}\), respectively. \({\bf x}_{\delta}\) is an adversarial examples when it meets:

\[\left\{\begin{array}{l}\mathop{sim}({\bf x},{\bf x}_{\delta})>\eta,\\ \mathop{sim}({\bf y},{\bf y^{\prime}})-\mathop{sim}({\bf y},{\bf y^{\prime}_ {\delta}})>\alpha,\end{array}\right. \tag{1}\]

where \(\eta\) is a threshold to ensure a high similarity between \({\bf x}_{\delta}\) and \({\bf x}\), so that they can meet the meaning-preserving restriction. A larger \(\alpha\) indicates a more strict criterion of the NMT adversarial example.

Criterion based on RTT.Zhang et al. (2021) point out that the perturbation \(\delta\) may change, even reverse the meaning of \({\bf x}\), so it is incorrect to use \({\bf y}\) as a target sentence to measure the semantic alteration on the target side. Therefore, they introduce the criterion based on RTT which gets rid of the meaning-preserving restriction. The percentage decrease of similarity between \({\bf x}\) and \({\bf x}_{\delta}\) through the

Figure 2: The overview of the bilingual adversarial pair generation under the criterion of DRTT. \(({\bf x},{\bf y})\) denote the source and target sentence. \(({\bf x}_{\delta},{\bf y}_{\delta})\) denote the generated bilingual adversarial pair.

 

source-target-source RTT is regarded as the adversarial effect \({\rm d}_{\rm src}({\bf x},{\bf x}_{\delta})\), is calculated as:

\[{\rm d}_{\rm src}({\bf x},{\bf x}_{\delta})=\frac{\sin({\bf x},\hat{\bf x})-\sin( {\bf x}_{\delta},\hat{\bf x}_{\delta})}{\sin({\bf x},\hat{\bf x})}, \tag{2}\]

where \(\hat{\bf x}\) and \(\hat{\bf x}_{\delta}\) are reconstructed sentences generated with source-target-source RTT: \(\hat{\bf x}=g(f({\bf x}))\), \(\hat{\bf x}_{\delta}=g(f({\bf x}_{\delta}))\). A large \({\rm d}_{\rmsrc}({\bf x},{\bf x}_{\delta})\) indicates that the perturbed sentence \({\bf x}_{\delta}\) can not be well reconstructed by RTT when compared to the reconstruction quality of the original source sentence \({\bf x}\), so \({\bf x}_{\delta}\) is likely to be an adversarial example.

Criterion based on DRTT.In Eq.(2), \(\sin({\bf x},\hat{\bf x})\) is a constant value given the input \({\bf x}\) and the NMT models. Therefore, the \({\rm d}_{\rm src}({\bf x},{\bf x}_{\delta})\) is actually determined by \(-\!\sin({\bf x}_{\delta},\hat{\bf x}_{\delta})\), which can be interpreted as the reconstruction error between \({\bf x}_{\delta}\) and \(\hat{\bf x}_{\delta}\). As we mentioned above, the reconstruction error can be caused by two independent translation processes: the forward translation process \(f(\cdot)\) performed by the target NMT model and the backward translation process \(g(\cdot)\) performed by the auxiliary backward model. Consequently, there may be three occasions when we get a large \({\rm d}_{\rm src}({\bf x},{\bf x}_{\delta})\): 1) A large semantic alteration in \(f({\bf x}_{\delta})\) and a small semantic alteration in \(g({\bf y^{\prime}_{\delta}})\); 2) A large semantic alteration in \(f({\bf x}_{\delta})\) and a large alteration in \(g({\bf y^{\prime}_{\delta}})\); 3) A small semantic alteration in \(f({\bf x}_{\delta})\) and a large alteration in \(g({\bf y^{\prime}_{\delta}})\). We can conclude \({\bf x}_{\delta}\) is an adversarial example for the target NMT model in occasion 1 and 2, but not in occasion 3. Therefore, the criterion based on RTT may contain many fake adversarial examples.

To address this problem, we add a target-source-target RTT starting from the target side. The percentage decrease of the similarity between \({\bf y}\) and \({\bf y^{\prime}_{\delta}}\) through the target-source-target RTT, denoted as \({\rm d}_{\rm tgt}({\bf y},{\bf y^{\prime}_{\delta}})\), is calculated as:

\[{\rm d}_{\rm tgt}({\bf y},{\bf y^{\prime}_{\delta}})=\frac{\sin({\bf y},\hat {\bf y})-\sin({\bf y^{\prime}_{\delta}},{\bf y^{\prime}_{\delta}})}{\sin({\bf y },\hat{\bf y})}, \tag{3}\]

where \(\hat{\bf y}=f(g({\bf y}))\) and \(\hat{\bf y^{\prime}_{\delta}}=f(g({\bf y^{\prime}_{\delta}}))\) are reconstructed sentences generated with the target-source-target RTT. We take both \({\rm d}_{\rm src}({\bf x},{\bf x}_{\delta})\) and \({\rm d}_{\rmtgt}({\bf y},{\bf y^{\prime}_{\delta}})\) into consideration and define \({\bf x}_{\delta}\) as an adversarial examples when it meets:

\[\left\{\begin{array}{l}{\rm d}_{\rm src}({\bf x},{\bf x}_{\delta})>\beta,\\ {\rm d}_{\rm tgt}({\bf y},{\bf y^{\prime}_{\delta}})<\gamma,\end{array}\right. \tag{4}\]

where \(\beta\) and \(\gamma\) are thresholds ranging in \([-\infty,1]\)2. The interpretation of this criterion is intuitive: if \({\rm d}_{\rm tgt}({\bf y},{\bf y^{\prime}_{\delta}})\) is lower than \(\gamma\), we can conclude that the reconstruction error between \({\bf y^{\prime}_{\delta}}\) and \({\bf y^{\prime}_{\delta}}\) is very low. Namely, we can ensure a small semantic alteration of \(g({\bf y^{\prime}_{\delta}})\). Therefore, if \({\rm d}_{\rm src}({\bf x},{\bf x}_{\delta})\) is larger than \(\beta\), we can conclude the BLEU decrease through the source-target-source RTT is caused by the target NMT model, so that we can conclude \({\bf x}_{\delta}\) is an authentic adversarial example.

Footnote 2: It is possible that the reconstruction quality of the perturbed sentence is higher than the original one.

### Bilingual Adversarial Pair Generation

Since the proposed criterion breaks the meaning-preserving restriction, the adversarial examples may be semantically distant from the original source sentence. Thus, we cannot directly pair the adversarial examples with the original target sentences. In this section, we propose our approach for generating bilingual adversarial pairs, which performs the following three steps: 1) Training Masked Language Models: using monolingual and parallel data to train masked language models; 2) Phrasal Alignment: obtaining alignment between the source and target phrases; 3) Phrasal Replacement: generating bilingual adversarial pairs by performing phrasal replacement on the source and target sentences synchronously with the trained masked language models. The whole procedure is illustrated in Figure 2.

Training Masked Language Models.We train two kinds of masked language models, namely monolingual masked language model (M-MLM) Devlin et al. (2018) and translation masked language model (T-MLM) Conneau and Lample (2019), for phrasal replacement on the source and target sentence, respectively. The M-MLM introduces a special [MASK] token which randomly masks some of the tokens from the input in a certain probability, and predict the original masked words. Following Liu et al. (2021), we train the M-MLM on monolingual datasets and use an encoder-decoder Transformer model Vaswani et al. (2017) to tackle the undetermined number of tokens during generation. The T-MLM takes the identical model structure and similar training process as the M-MLM. The main difference is T-MLM relies on the parallel corpus. T-MLM concatenates parallel sentences by a special token [SEP] and only masks words on the target side. The objective is to predict the original masked words on the target side.

 

Phrasal Alignment.Phrasal alignment projects each phrase in the source sentence \({\bf x}\) to its alignment phrase in the target sentence \({\bf y}\). We first generate the alignment between \({\bf x}\) and \({\bf y}\) using FastAlign Dyer et al. (2013). Then we extract the phrase-to-phrase alignment by the phrase extraction algorithm of NLTK3, and get a mapping function \(p\).

Footnote 3: [https://github.com/nltk/nltk/blob/develop/nltk/translate/phrase_based.py](https://github.com/nltk/nltk/blob/develop/nltk/translate/phrase_based.py)

Phrasal Replacement.Given the source sentence \({\bf x}=\{s_{1},s_{2},\ldots,s_{n}\}\) and the target sentence \({\bf y}=\{t_{1},t_{2},\ldots,t_{m}\}\), \(s_{i}\) is the \(i\)-th phrase in \({\bf x}\), \(t_{p(i)}\) is the \(p(i)\)-th phrase in \({\bf y}\) which is aligned to \(s_{i}\) by the mapping function \(p\). We construct the candidate bilingual adversarial pairs \(({\bf x}_{\delta},{\bf y}_{\delta})\) by performing the phrasal replacement on \(({\bf x},{\bf y})\) repeatedly until \(c\) percentage phrases in \({\bf x}\) have been replaced. For each step, we select the phrase that yields the most significant reconstruction quality degradation.

Here, we take the replacing process for \(s_{i}\) and \(t_{p(i)}\) as an example. Considering the not attacked yet phrase \(s_{i}\) in \({\bf x}\), we first build a candidate set \(\mathcal{R}_{i}=\{r^{1}_{i},r^{2}_{i},\dots,r^{k}_{i}\}\) for \(s_{i}\) with the prepared M-MLM. Specifically, we extract the \(k\) candidate phrases with top \(k\) highest predicted probabilities by feeding \({\bf x}^{\setminus i}\) into M-MLM, where \({\bf x}^{\setminus i}\) is the masked version of \({\bf x}\) by masking \(s_{i}\). We select the best candidate \(r^{*}_{i}\) for \(s_{i}\) as:

\[r^{*}_{i}=\operatorname*{arg\,max}_{j\in\{1,\cdots,k\}}\mathrm{d}_{\text{src }}({\bf x},{\bf x}^{\setminus i:j}), \tag{5}\]

where \({\bf x}^{\setminus i:j}\) is the noised version by replacing \(s_{i}\) with \(r^{j}_{i}\). With \(s_{i}\) being replaced, we need to replace \(t_{p(i)}\) to ensure they are still semantically aligned. To this end, we feed the concatenation of \({\bf x}^{\setminus i:*}\) and \({\bf y}^{\setminus p(i)}\) into T-MLM, and choose the output phrase with the highest predicted probability as the substitute phrase for \(t_{p(i)}\).

Finally, to decide whether \(({\bf x}_{\delta},{\bf y}_{\delta})\) is an authentic bilingual adversarial pair for the target NMT model, we perform a target-source-target RTT starting from the target side and calculate \(\mathrm{d}_{\text{tgt}}({\bf y},{\bf y}^{\prime}_{\delta})\) between \({\bf y}^{\prime}_{\delta}\) and its reconstruction sentence \({\hat{\bf y}}^{\prime}_{\delta}\) according to Eq.(4). We take \(({\bf x}_{\delta},{\bf y}_{\delta})\) as an authentic bilingual adversarial pair if \(\mathrm{d}_{\text{src}}({\bf x},{\bf x}_{\delta})\) is greater than \(\beta\) and \(\mathrm{d}_{\text{tgt}}({\bf y},{\bf y}^{\prime}_{\delta})\) is less than \(\gamma\). We formalize these steps in Algorithm 1 in Appendix A.

After generating adversarial data through the above steps, we combine it with original training data and use them to train the NMT model directly.

## 4 Experimental Settings

We evaluate our model under artificial noise in Zh\(\rightarrow\)En and En\(\rightarrow\)De translation tasks, and under natural noise in En\(\rightarrow\)Fr translation task. The details of the experiments are elaborated in this section.

### Dataset

For the Zh\(\rightarrow\)En task, we use the LDC corpus with 1.25M sentence pairs for training4, NIST66 for validation, and NIST 02, 03, 04, 05, 08 for testing. For the En\(\rightarrow\)De task, we use the publicly available dataset WMT'17 En-De (5.85M) for training, and take the _newstes116_ and _newstest17_ for validation and testing, respectively. In En\(\rightarrow\)Fr task, we follow Liu et al. (2021) to combine the WMT'19 En\(\rightarrow\)Fr (36k) robustness dataset with Europarl-v7 (2M) EnF-Fr pairs for training. We take the development set of the MTNT Michel and Neubig (2018) for validation and the released test set of the WMT'19 robustness task for testing. As for MLMs, we use the Chinese sentences of the parallel corpus to train the Chinese M-MLM, and use the whole parallel corpus to train Zh-En T-MLM. We train the English M-MLM with News Commentary and News Crawl 2010 (7.26M in total) monolingual corpus following Liu et al. (2021). T-MLM for En-De and En-Fr are trained with their original parallel corpus.

Footnote 4: It is extracted from LDC data, including LDC 2002E18, 2003E07, 2003E14, 2004T08 and 2005T06.

### Model Configuration and Pre-processing

The MLMs and NMT models in this paper take Transformer-base Vaswani et al. (2017) as the backbone architecture. We implement all models base on the open-source toolkit Fairseq Ott et al. (2019). As for hyper-parameters, \(\beta\) is set to 0.01 and \(\gamma\) is set to 0.5 for Zh\(\rightarrow\)En. For En\(\rightarrow\)De and En\(\rightarrow\)Fr, \(\beta\) and \(\gamma\) are set to 0.5. The replacement ratio \(c\) is set to 0.2 following Liu et al. (2021), and the candidate number \(k\) is set to 1. The details of model configuration and the number of the generated adversarial examples are shown in the Appendix B. Following previous work, the Zh\(\rightarrow\)En performance is evaluated with the BLEU Papineni et al. (2002) score calculated by _multi-bleu,perl_ script. For En\(\rightarrow\)De and En\(\rightarrow\)Fr, we use SacreBLEU Post (2018) for evaluation5.

 



### Comparison Methods

To test the effectiveness of our model, we take both meaning-preserving and meaning-changeable systems as comparison methods:

Baseline:The vanilla Transformer model for NMT (Vaswani et al., 2017). In our work, we use the baseline model to perform the forward and backward translation in the round-trip translation.

CharSwap:Michel et al. (2019) craft a minor perturbation on word by swapping the internal character. They claim that character swaps have been shown to not affect human readers greatly, hence making them likely to be meaning-preserving.

TCWR:Liu et al. (2021) propose the approach of translation-counterfactual word replacement which creates augmented parallel translation corpora by random sampling new source and target phrases from the masked language models.

Rtt:Zhang et al. (2021) propose to generate adversarial examples with the single round-trip translation. However, they do not provide any approach for generating the bilingual adversarial pairs. To make a fair comparison, we generate the bilingual adversarial pairs from their adversarial examples in the same way as ours.

## 5 Results and Analysis

### Main Results

Artificial Noise.To test robustness on noisy inputs, we follow Cheng et al. (2018) to construct five types of synthetic perturbations with different noise ratios on the standard test set6: 1) _Deletion:_ some words in the source sentence are randomly deleted; 2) _Swap:_ some words in the source sentence are randomly swapped with their right neighbors; 3) _Insertion:_ some words in the source sentence are randomly repeated; 4) _Rep src:_ short for 'replacement on src'. Some words in the source sentence are replaced with their relevant word according to the similarity of word embeddings7; 5) _Rep both:_ short for 'replacement on both'. Some words in the

\begin{table}
\begin{tabular}{c|l|r r r|r r|r r|r} \hline \multirow{2}{*}{**Noise**} & \multicolumn{3}{c|}{**Model**} & \multicolumn{3}{c|}{**Zh\(\rightarrow\)En**} & \multicolumn{3}{c|}{**En\(\rightarrow\)De**} \\ \cline{3-10}  & & 0.1 & 0.2 & 0.3 & **AVG** & 0.1 & 0.2 & 0.3 & **AVG** \\ \hline \multirow{6}{*}{**Deletion**} & baseline & 32.98 & 26.59 & 20.54 & 26.70 & 19.82 & 13.71 & 9.33 & 14.29 \\  & +CharSwap & 32.94 & 26.92 & 20.46 & 26.77 & **19.92** & 13.64 & 9.30 & 14.29 \\  & +TCRW & 34.47 & 27.76 & 21.38 & 27.87 & 19.61 & 13.77 & 9.08 & 14.15 \\  & +RTT & 33.84 & 27.43 & 20.74 & 27.33 & 19.61 & 13.48 & 9.27 & 14.12 \\  & +DRTT(ours) & **35.10\(\ast\)\(\ast\)** & **28.12\(\ast\)\(\ast\)** & **22.07\(\ast\)\(\ast\)** & **28.43** & 19.83 & **14.22** & **9.48** & **14.51** \\ \hline \multirow{6}{*}{**Swap**} & baseline & 36.14 & 32.88 & 30.21 & 21.47 & 16.97 & **13.21** & 17.22 \\  & +CharSwap & 36.71 & 33.38 & 30.58 & 33.55 & 20.49 & 16.31 & 11.93 & 16.24 \\  & +TCWR & 37.67 & 34.15 & 31.47 & 34.43 & 20.52 & 16.31 & 12.80 & 16.54 \\  & +RTT & 37.14 & 34.34 & 31.42 & 34.30 & 20.23 & 15.47 & 11.52 & 15.74 \\  & +DRTT(ours) & **37.90\(\ast\)** & **34.65** & **31.92\(\ast\)** & **34.82** & **21.51\(\ast\)\(\ast\)** & **17.36\(\ast\)** & 12.91\(\ast\)\(\ast\)** & **17.26** \\ \hline \multirow{6}{*}{**Insertion**} & baseline & 39.96 & 39.10 & 38.41 & 39.16 & 26.86 & **26.54** & 25.48 & 25.96 \\  & +CharSwap & 40.26 & 39.66 & 39.03 & 39.65 & 26.69 & 25.79 & 25.23 & 25.90 \\  & +TCWR & 41.32 & 40.07 & 39.60 & 40.33 & 26.27 & 25.55 & 24.33 & 25.38 \\  & +RTT & 41.75 & 40.82 & 39.90 & 40.82 & 26.18 & 25.06 & 23.68 & 24.97 \\  & +RDTT(ours) & **41.98** & **40.90** & **40.34\(\ast\)** & **41.07** & **27.32\(\ast\)** & 26.40\(\ast\)\(\ast\)** & **25.71\(\ast\)** & **26.48** \\ \hline \multirow{6}{*}{**Rep src**} & baseline & 35.25 & 29.69 & 24.64 & 29.86 & **21.65** & 17.40 & 14.45 & 17.83 \\  & +CharSwap & 35.01 & 30.25 & 25.27 & 30.18 & 21.56 & 17.67 & 14.60 & 17.94 \\  & +TCWR & 35.73 & **30.48** & 25.65 & **30.62** & 21.57 & **17.71** & **14.95** & **18.08** \\  & +RTT & 35.63 & 30.17 & **25.86** & 30.55 & 21.06 & 17.01 & 14.36 & 17.48 \\  & +DRTT(ours) & **35.81** & 30.18 & 25.70 & 30.56 & 21.51\(\ast\) & 17.22 & 14.33 & 17.69 \\ \hline \multirow{6}{*}{**Rep both**} & baseline & 22.33 & 18.77 & 15.98 & 19.03 & 25.52 & 22.68 & 20.07 & 22.76 \\  & +CharSwap & 21.99 & 18.08 & 15.77 & 18.61 & 25.18 & 22.39 & 19.98 & 22.52 \\ \cline{1-1}  & +TCWR & 22.98 & 19.69 & 17.14 & 19.94 & 25.44 & 22.64 & 20.43 & 22.84 \\ \cline{1-1}  & +RTT & 22.92 & 19.56 & 16.76 & 19.75 & 25.30 & 22.76 & 20.66 & 22.91 \\ \cline{1-1}  & +DRTT(ours) & **23.37\(\ast\)** & **20.23\(\ast\)** & **17.37\(\ast\)** & **20.32** & **26.19\(\ast\)** & **23.31\(\ast\)** & **20.98** & **23.49** \\ \hline \end{tabular}
\end{table}
Table 1: The BLEU scores (%) for forward-translation on noisy test sets with noise ratio 0.1, 0.2 and 0.3, and ‘AVG’ denotes the average BLEU (%) on all noise ratios. We re-implement all baselines to eliminate the discrepancy caused by MLMs and the auxiliary backward model. ‘\(\ast/\ast\)’’: significantly (Koehn, 2004) better than the RTT with \(p<0.05\) and \(p<0.01\), respectively.



source sentence and their aligned target words are replaced by masked language models 8.

Footnote 8: Each sentence has four references on NIST test sets, we only choose sb0 for replacement.

Table 1 shows the BLEU scores of forward translation results on Zh\(\rightarrow\)En and En\(\rightarrow\)De noisy test sets. For Zh\(\rightarrow\)En, our approach achieves the best performance on 4 out of 5 types of noisy test sets. Compared to RTT, DRTT achieves the improvement up to 1.1 BLEU points averagely on _deletion_. For En\(\rightarrow\)De, DRTT also performs best results on all types of noise except _Rep src_. We suppose the reason is _Rep src_ sometimes reverses the semantics of the original sentence as we claimed above.

Since the perturbations we introduced above may change the semantics of the source sentence, it may be problematic for us to calculate the BLEU score against the original reference sentence in Table 1. Therefore, following Zhang et al. (2021), we also report the BLEU score between the source sentence and its reconstructed version through the source-target-source RTT, which is named as RTT BLEU. The intuition behind it is that: a robust NMT model translates noisy inputs well and thus has minor shifting on the round-trip translation, resulting in a high BLEU between inputs and their round-trip translation results. Following Zhang et al. (2021), we fine-tune the backward model (vanilla Transformer model) with its test set to minimize the impact of the T2S process. As shown in Table 2, DRTT outperforms the meaning-preserving method and other methods on all types of noise on Zh\(\rightarrow\)En and En\(\rightarrow\)De tasks. Considering the results of Table 1 and Table 2 together, DRTT significantly improves the robustness of NMT models under various artificial noises.

Natural Noise.In addition to the artificial noise, we also test the performance of our model on WMT'19 En\(\rightarrow\)Fr robustness test set which contains

\begin{table}
\begin{tabular}{c|l|r r r|r|r r|r} \hline \multirow{3}{*}{**Noise**} & \multicolumn{6}{c|}{**Zh\(\rightarrow\)En**} & \multicolumn{6}{c|}{**En\(\rightarrow\)De**} \\ \cline{3-10}  & & 0.1 & 0.2 & 0.3 & **AVG** & 0.1 & 0.2 & 0.3 & **AVG** \\ \hline \multirow{7}{*}{**Deletion**} & baseline & 35.31 & 31.53 & 28.22 & 31.69 & 21.42 & 19.90 & 17.42 & 19.58 \\  & +CharSwap & 34.94 & 31.12 & 28.14 & 31.40 & 22.70 & 20.57 & 18.88 & 20.72 \\  & +TCWR & 35.02 & 31.74 & 28.45 & 31.74 & 22.45 & 20.48 & 18.66 & 20.53 \\  & +RTT & 35.23 & 32.12 & 28.03 & 31.79 & 23.34 & 22.30 & 20.36 & 22.00 \\  & +DRTT(ours) & **36.63\(\ast\ast\)** & **32.96\(\ast\ast\ast\)** & **33.18\(\ast\)** & **24.06\(\ast\ast\)** & **23.02\(\ast\ast\)** & **21.18\(\ast\ast\)** & **22.75** \\ \hline \multirow{7}{*}{**Swap**} & baseline & 28.63 & 22.82 & 18.21 & 23.22 & 19.01 & 15.92 & 14.25 & 16.39 \\  & +CharSwap & 29.55 & 24.46 & 20.97 & 24.99 & 19.80 & 16.51 & 14.54 & 16.95 \\  & +TCWR & 31.01 & 26.03 & 22.25 & 26.43 & 19.56 & 16.65 & 14.95 & 17.05 \\  & +RTT & 31.07 & 26.06 & 22.08 & 26.40 & 20.51 & 17.63 & 16.17 & 18.10 \\  & +DRTT(ours) & **32.03\(\ast\ast\)** & **26.95\(\ast\ast\)** & **23.71\(\ast\)** & **27.56** & **21.40\(\ast\ast\)** & **18.68\(\ast\ast\)** & **17.53\(\ast\ast\)** & **19.20** \\ \hline \multirow{7}{*}{**Insertion**} & baseline & 30.13 & 23.57 & 17.95 & 23.88 & 19.57 & 16.24 & 13.12 & 16.31 \\  & +CharSwap & 29.03 & 22.17 & 17.01 & 22.73 & 20.47 & 16.86 & 13.71 & 17.01 \\  & +TCRWR & 30.12 & 23.76 & 18.02 & 23.97 & 20.73 & 17.27 & **14.12** & 17.37 \\  & +RTT & 29.72 & 22.75 & 17.87 & 23.45 & 20.79 & 16.81 & 13.80 & 17.13 \\  & +RDTT(ours) & **31.84\(\ast\ast\)** & **24.24\(\ast\ast\)** & **19.43\(\ast\)** & **25.23** & **21.24\(\ast\)** & **17.53\(\ast\ast\)** & **14.12\(\ast\)** & **17.63** \\ \hline \multirow{7}{*}{**Rep src**} & baseline & 33.02 & 28.15 & 23.26 & 28.14 & 20.56 & 18.40 & 16.53 & 18.50 \\  & +CharSwap & 31.71 & 26.97 & 21.92 & 26.87 & 21.56 & 18.81 & 17.11 & 19.16 \\  & +TCWR & 32.83 & 28.11 & 23.38 & 28.11 & 21.43 & 19.22 & 17.10 & 19.25 \\  & +RTT & 32.65 & 27.23 & 23.05 & 27.65 & 22.25 & 20.14 & 18.45 & 20.28 \\  & +RDTT(ours) & **34.76\(\ast\ast\)** & **29.04\(\ast\ast\)** & **25.06\(\ast\)** & **29.62** & **22.74\(\ast\)** & **20.59\(\ast\)** & **18.87\(\ast\)** & **20.73** \\ \hline \multirow{7}{*}{**Rep both**} & baseline & 38.25 & 36.17 & 35.48 & 36.63 & 23.62 & 23.23 & 22.13 & 22.99 \\  & +CharSwap & 36.23 & 34.90 & 33.81 & 34.98 & 25.23 & 24.37 & 23.33 & 24.31 \\ \cline{1-1}  & +TCWR & 38.38 & 36.92 & 35.44 & 36.91 & 24.84 & 24.77 & 23.34 & 24.32 \\ \cline{1-1}  & +RTT & 39.13 & 36.92 & 35.23 & 37.09 & 25.51 & 24.77 & 24.12 & 24.80 \\ \cline{1-1}  & +DROTT(ours) & **40.07\(\ast\)** & **38.34\(\ast\ast\)** & **37.22\(\ast\)** & **38.54** & **26.28\(\ast\)** & **25.26\(\ast\)** & **24.87\(\ast\)** & **25.47** \\ \hline \end{tabular}
\end{table}
Table 2: The RTT BLEU scores (%) for round-trip translation on noisy test sets. ‘\(\ast/\ast\ast\)’: significantly better than RTT with \(p<0.05\) and \(p<0.01\), respectively.

\begin{table}
\begin{tabular}{l|c|c} \hline \hline
**Method** & **En\(\rightarrow\)Fr** & **BLEU\(\Delta\)** \\ \hline baseline & 35.02 & \\ +CharSwap & 35.59 & +0.57 \\ +TCWR & 35.64 & +0.62 \\ +RTT & 35.73 & +0.71 \\ \hline \hline \multirow{7}{*}{**Rep src**} & baseline & 36.17 & 35.48 & 36.63 \\ +CharSwap & 36.23 & 34.90 & 33.81 & 34.98 \\ \cline{1-1}  & +TcWR & 38.38 & 36.92 & 35.44 \\ \cline{1-1}  & +RTT & 39.13 & 36.92 & 35.23 \\ \cline{1-1}  & +DRTT(ours) & **36.36\(\ast\)** & **+1.34** \\ \hline \hline \end{tabular}
\end{table}
Table 3: The BLEU scores (%) on the WMT’19 En\(\rightarrow\)Fr robustness task. ‘BLEU\(\lambda\)’ denotes the gain of BLEU compared to baseline. ’\(\ast/\ast\ast\)’: significantly better than RTT with \(p<0.05\) and \(p<0.01\), respectively.

 

various noise in real-world text, e.g., exhibits typos, grammar errors, code-switching, etc. As shown in Table 3, DRTT yields improvements of 1.34 BLEU compared to the baseline, it proves that our approach also performs well in real noise scenario. Besides, DRTT achieves 0.63 BLEU improvement over RTT by filtering out 10% of fake adversarial examples (according to Table 6), which demonstrates that filtering out fake adversarial examples further improves the robustness of the model.

### Effectiveness of Adversarial Examples

In this sub-section, we evaluate the effectiveness of the generated adversarial examples on attacking the victim NMT model (i.e., the target NMT model without being trained on the generated adversarial pairs). In our approach, \(\gamma\) in Eq.(4) is a hyper-parameter to control the strictness of our criterion on generating adversarial examples. Thus, we evaluate the effectiveness of adversarial examples by studying the translation performance of the victim NMT model on the set of adversarial pairs generated with different \(\gamma\). That is to say, if a sample is an adversary, it should destroy the translation performance drastically, resulting in a low BLEU score between the translation result and its paired target sentence. The average BLEU scores of the victim model on the different adversarial pair sets (generated with \(\gamma\) from -10 to 1 on NIST 06) are shown in Figure 3. Specifically, the average BLEU on the adversarial sets generated with \(\gamma=-10\) is 8.0. When we remove the restriction of \(\gamma\), i.e., the DRTT is degenerated into RTT, the average BLEU for the constructed adversarial examples reaches up to 11.2. This shows that the adversarial examples generated with lower \(\gamma\) (more strict restriction) attack the model more successfully. Therefore, we can select more effective adversarial examples compared to Zhang et al. (2021) by lowering the threshold \(\gamma\) to create a more strict criterion.

### Clean Test set

Adding a large amount of noisy parallel data to clean training data may harm the NMT model performance on the clean test sets seriously Khayralilah and Koehn (2018). In this sub-section, we test the performance of the proposed model on the clean test sets and the results are presented in Table 4. The meaning-preserving method CharSwap has negative effect on clean test set while DRTT achieves the best translation performance on Zh\(\rightarrow\)En and En\(\rightarrow\)De clean test sets. It demonstrates that our approach not only improves the robustness of the NMT model, but also maintains its good performance on clean test sets.

## 6 Case Study and Limitations

In Table 5, we present some cases from Zh-En adversarial pairs generated by our approach. From the case 1, we can see "in the source sentence is replaced by its antionym ", which reverse the meaning of the original sentence, and DRTT makes a corresponding change in the target sentence by replacing "support" with "oppose". In the other case, DRTT replaces "by its synonym

Figure 3: Black spots represent the distribution of adversarial samples. The darker color indicates more effective adversarial examples generated with lower \(\gamma\).

 

"\(\mathcal{T}_{i}^{\text{effit*}}\), thus, "satisfactory" in the target sentence remains unchanged. From these cases, we find that DRTT can reasonably substitute phrases in source sequences based on the contexts and correctly modify the corresponding target phrases synchronously.

Although the proposed approach achieves promising results, it still has limitations. A small number of authentic adversarial examples may be filtered out when the large \(\mathrm{d}_{\mathrm{tgt}}(\mathbf{y},\mathbf{y}^{\prime}_{\delta})\) is caused by \(f(\hat{x}_{\delta})\), we will ameliorate this problem in the further.

## 7 Conclusion and Future Work

We propose a new criterion for NMT adversarial examples based on Doubly Round-trip Translation, which can ensure the examples that meet our criterion are the authentic adversarial examples. Additionally, based on this criterion, we introduce the masked language models to generate bilingual adversarial pairs, which can be used to improve the robustness of the NMT model substantially. Extensive experiments on both the clean and noisy test sets show that our approach not only improves the robustness of the NMT model but also performs well on the clean test sets. In future work, we will refine the limitations of this work and then explore to improve the robustness of forward and backward models simultaneously. We hope our work will provide a new perspective for future researches on adversarial examples.

## Acknowledgements

The research work descried in this paper has been supported by the National Key R&D Program of China (202AAA0108001) and the National Nature Science Foundation of China (No. 61976016, 61976015, and 61876198). The authors would like to thank the anonymous reviewers for their valuable comments and suggestions to improve this paper.

## References

* Bahdanau et al. (2014) Dzmitry Bahdanau, Kyunghyun Cho, and Yoshua Bengio. 2014. Neural machine translation by jointly learning to align and translate. _arXiv preprint arXiv:1409.0473_.
* Belinkov and Bisk (2017) Yonatan Belinkov and Yonatan Bisk. 2017. Synthetic and natural noise both break neural machine translation. _arXiv preprint arXiv:1711.02173_.
* Chen et al. (2021) Guandan Chen, Kai Fan, Kaibo Zhang, Boxing Chen, and Zhongqiang Huang. 2021. Manifold adversarial augmentation for neural machine translation. In _Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021_, pages 3184-3189.
* Cheng et al. (2019) Yong Cheng, Lu Jiang, and Wolfgang Macherey. 2019. Robust neural machine translation with doubly adversarial inputs. In _Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics_, pages 4324-4333.
* Cheng et al. (2020) Yong Cheng, Lu Jiang, Wolfgang Macherey, and Jacob Eisenstein. 2020. AdvAug: Robust adversarial augmentation for neural machine translation. In _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_, pages 5961-5970, Online. Association for Computational Linguistics.
* Cheng et al. (2018) Yong Cheng, Zhaopeng Tu, Fandong Meng, Junjie Zhai, and Yang Liu. 2018. Towards robust neural machine translation. _arXiv preprint arXiv:1805.06130_.
* Cho et al. (2014) Kyunghyun Cho, Bart van Merrienboer, Caglar Gulcehre, Dzmitry Bahdanau, Fethi Bougares, Holger Schwnek, and Yoshua Bengio. 2014. Learning phrase representations using rnn encoder-decoder for statistical machine translation. In _EMNLP_.
* Conneau and Lample (2019) Alexis Conneau and Guillaume Lample. 2019. Crosslingual language model pretraining. _Advances in Neural Information Processing Systems_, 32:7059-7069.
* Devlin et al. (2018) Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2018. BERT: pre-training of deep bidirectional transformers for language understanding. _CoRR_, abs/1810.04805.
* Chorrado et al. (2019)

\begin{table}
\begin{tabular}{l l} x : & \\ y : we resolutely support measures taken by our \\ government in handling this incident. \\ x : & \\ y \(s\) : we resolutely opposite measures taken by our \\ government in handling this case. \\ \end{tabular}
\end{table}
Table 5: Case study for the proposed approach. The words in red and blue color represents the augmented words on the source and target side, respectively.

 

Chris Dyer, Victor Chahuneau, and Noah A Smith. 2013. A simple, fast, and effective reparameterization of ibm model 2. In _Proceedings of the 2013 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies_, pages 644-648.
* Ebrahimi et al. (2018) Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018. Hotflip: White-box adversarial examples for text classification. In _Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers)_, pages 31-36.
* Jiao et al. (2019) Xiaoqi Jiao, Yichun Yin, Lifeng Shang, Xin Jiang, Xiao Chen, Linlin Li, Fang Wang, and Qun Liu. 2019. Tinybert: Distilling bert for natural language understanding. _arXiv preprint arXiv:1909.10351_.
* Karpukhin et al. (2019) Vladimir Karpukhin, Omer Levy, Jacob Eisenstein, and Marjan Ghazvininejad. 2019. Training on synthetic noise improves robustness to natural noise in machine translation. _arXiv preprint arXiv:1902.01509_.
* Khayrallah and Koehn (2018) Huda Khayrallah and Philipp Koehn. 2018. On the impact of various types of noise on neural machine translation. In _Proceedings of the 2nd Workshop on Neural Machine Translation and Generation_, pages 74-83.
* Kingma and Ba (2014) Diederik P Kingma and Jimmy Ba. 2014. Adam: A method for stochastic optimization. _arXiv preprint arXiv:1412.6980_.
* Koehn (2004) Philipp Koehn. 2004. Statistical significance tests for machine translation evaluation. In _Proceedings of the 2004 conference on empirical methods in natural language processing_, pages 388-395.
* Liu et al. (2021) Qi Liu, Matt Kusner, and Phil Blunsom. 2021. Counterfactual data augmentation for neural machine translation. In _Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies_, pages 187-197.
* Lu et al. (2021) Yu Lu, Jiail Zeng, Jiajun Zhang, Shuangzhi Wu, and Mu Li. 2021. Attention calibration for transformer in neural machine translation. In _Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers)_, pages 1288-1298, Online. Association for Computational Linguistics.
* Michel et al. (2019) Paul Michel, Xian Li, Graham Neubig, and Juan Pino. 2019. On evaluation of adversarial perturbations for sequence-to-sequence models. In _Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers)_, pages 3103-3114.
* Michel and Neubig (2018) Paul Michel and Graham Neubig. 2018. Mtnt: At testbed for machine translation of noisy text. In _Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing_, pages 543-553.
* Niu et al. (2020) Xing Niu, Prashant Mathur, Georgiana f Dinu, and Yaser Al-Onaizan. 2020. Evaluating robustness to input perturbations for neural machine translation. In _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_, pages 8538-8544, Online. Association for Computational Linguistics.
* Ott et al. (2019) Myle Ott, Sergey Edunov, Alexei Baevski, Angela Fan, Sam Gross, Nathan Ng, David Grangier, and Michael Auli. 2019. fairseq: A fast, extensible toolkit for sequence modeling. In _Proceedings of NAACL-HLT 2019: Demonstrations_.
* Papineni et al. (2002) Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. 2002. Bleu: a method for automatic evaluation of machine translation. In _Proceedings of the 40th annual meeting of the Association for Computational Linguistics_, pages 311-318.
* Post (2018) Matt Post. 2018. A call for clarity in reporting bleu scores. _arXiv preprint arXiv:1804.08771_.
* Sennrich et al. (2016) Rico Sennrich, Barry Haddow, and Alexandra Birch. 2016. Neural machine translation of rare words with subword units. In _Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)_, pages 1715-1725.
* Vaswani et al. (2017) Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. In _Advances in neural information processing systems_, pages 5998-6008.
* Yang et al. (2020) Zhen Yang, Bojie Hu, Ambyera Han, Shen Huang, and Qi Ju. 2020. Csp: Code-switching pre-training for neural machine translation. In _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)_, pages 2624-2636.
* Zhang et al. (2021) Xinze Zhang, Junzhe Zhang, Zhenhua Chen, and Kun He. 2021. Carfining adversarial examples for neural machine translation. In _Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers)_, pages 1967-1977, Online. Association for Computational Linguistics.

 

Bilingual Adversarial Pair Generation

```
Input: A sequence pair \((x,y)\), a sampling probability \(c\), an alignment mapping \(p\), candidate words \(k\), masked language models M-MLM and T-MLM, thresholds \(\beta\) and \(\gamma\). Output: A bilingual adversarial pair \((x_{\delta},y_{\delta})\)
1Function BilAdvGen\((x,y)\):
2while\(n\leq len(x)*c\)do
3\(r^{j}_{i}\leftarrow\text{M-MLM}~{}(x^{\setminus i})\);
4\(x^{\setminus ij}\leftarrow\text{Replace}(x,r^{j}_{i})\)
5\(r^{*}_{i}\leftarrow\arg\max\mathrm{d}_{\rm src}(x,x^{\setminus i:j})\) (2);
6\(x^{\setminus i*}\leftarrow\text{Replace}(x,r^{*}_{i})\)
7 Get aligned index \(p(i)\);
8\(w_{p(i)}\gets\text{T-MLM}~{}(x^{\setminus i*},y^{\setminus p(i)})\);
9\(y_{\delta}\leftarrow\text{Replace}(y,w_{p(i)})\)
10\(n\gets n+1\)
11 end while
12if\(\mathrm{d}_{\rm src}(x,x_{\delta})>\beta\) and \(\mathrm{d}_{\rm tgt}(y,y^{\prime}_{\delta})<\gamma\)then return\(x_{\delta},y_{\delta}\)
13 end if
```

**Algorithm 1**Bilingual Adversarial Pair Generation

## Appendix B Implementation Details

As for Zh\(\rightarrow\)En, we apply the separate byte-pair encoding (BPE) [Sennrich et al., 2016] encoding with 30K merge operations for Zh and En, respectively, the peak learning rate of 5e-4, and the training step is 100K. For En\(\rightarrow\)De and En\(\rightarrow\)Fr, we apply the joint BPE with 32K merge operations, the learning rate of 7e-4 and the training step is 200K. The dropout ratio is 0.1. We use Adam optimizer [Kingma and Ba, 2014] with 4k warm-up steps. All models are trained on 8 NVIDIA Tesla V100 (32GB) GPUs.