End-to-end Adversarial Sample Generation for Data Augmentation
Authors: Tianyuan Liu
YUQING SUN
Venue: EMNLP 2023 Findings (2023)
Keywords: adversarial sample
data augmentation

Abstract: Adversarial samples pose a significant challenge to neural inference models.
In this paper, we propose a novel enhancing approach A3 for the robustness of the neural NLP models, which combines the adversarial training and data augmentation.
We propose an adversarial sample generator that consists of a conditioned paraphrasing model and a condition generator.
The latter aims to generate conditions which guides the paraphrasing model to generate adversarial samples.
A pretrained discriminator is introduced to help the adversarial sample generator adapt to the data characteristics for different tasks. 
We adopt a weighted loss to incorporate the generated adversarial samples with the original samples for augmented training.
Compared to existing methods, our approach is much efficient since the generation process is independent to the target model and the generated samples are reusable for different models.
Experimental results on several tasks show that our approach improves the overall performance of the trained model. Specially, the enhanced model is robust for various attacking techniques.

End-to-end Adversarial Sample Generation for Data Augmentation
Tianyuan Liu and Yuqing Sun"
Shandong University
zodiacgefoxmail. com sun_yugingêsdu edu. cn
Abstract
adversarial training approach uses the the adversar- ial samples together with the original samples for training model (Goodfellow et al., 2014b). Miy- ato et al. (Miyato et al., 2016) proposed the first NLP oriented adversarial training method by ap- plying noise on the word representations, But the perturbed result is in the latent space and does not map meaningful sentence. Then many works turned to generating adversarial samples means of adversarial training. The often adopted method the lexical substitution that formulated as a combinatorial optimization problem and solved by heuristic search algorithms (Yoo and Qi, 2021). Since it requires much interaction with the target model for identifying the important words and se- lecting the appropriate replacement words, it is time-consuming. Due to the lack of supervised training data, far there is not applicable end-to- end mode for adversarial generation.
Adversarial samples pose significant chal- lenge to neural inference models. In this paper, we propose novel enhancing approach A for the robustness of the neural NLP models, which combines the adversarial training and data augmentation. We propose an adversarial sample generator that consists of a conditioned paraphrasing model and a condition generator. The latter aims generate conditions which guides the paraphrasing model to generate ad- versarial samples. pretrained discriminator is introduced to help the adversarial sample generator adapt to the data characteristics for different tasks. We adopt a weighted loss to incorporate the generated adversarial samples with the original samples for augmented train- ing. Compared to existing methods, proach is much efficient since the generation process is independent to the target model and the generated samples reusable for different models. Experimental results on several tasks show that our approach improves the overall performance of the trained model. Specially, the enhanced model robust for various attack- ing techniques.
ap-
Another kind of approaches to improve model robustness is data augmentation, which aims to gen- erate the similar samples to the original data for increasing the amount of training data. The tradi- tional methods on data augmentation include back- translation (Sennrich et al., 2015), rule-based mod- ification (Wei and Zou, 2019), paraphrasing (Ku- mar al., 2019) and other techniques (Li et al., 2022). These methods are based on the distribution of training data, which are model agnostic. How- ever, with these data, the models are still vulnerable to adversarial samples as the attacking techniques are designed for finding the weakness of the target model (Yoo and Qi, 2021).
1 Introduction
Adversarial samples refer to the inputs that in- tentionally designed to fool deep learning mod- els (Morris al., 2020a), which are also called the attack samples (Szegedy al., 2013). The methods for generating attack samples have deceived many natural language processing (NLP) models, such as text classification (Ebrahimi et al., 2017; 77; Ren et al., 2019), machine translation (Cheng et al., 2020) and etc (Goyal et al., 2022). Along with the application of neural models in various areas, the adversarial samples have drawn much attention.
To solve the above challenges, in this paper, we designed an adversarial sample generation method for data augmentation 3 We propose end-to- end adversarial sample generation model. Given original sample, condition generator is designed to output condition which guides conditioned paraphrasing model to generate a potential adver- sarial sample. By pretraining an adversarial dis-
Generally, the adversarial samples are generated by perturbations on the original sample. To en- hance the robustness of NLP neural methods, the
Corresponding Author

---

criminator be utilized the training signal, it can learn the lask-specific data characteristics for finding the potential vulnerabilities. Since the gen- eration process doesn't require interaction with the target model, it is much efficient compared with the current search based generation methods. Besides, the generated samples can be reused for different models rather than for specific model as the tradi- tional way. Then we propose a weighted loss for in- corporating the generated adversarial samples with the original data for the target task. We evaluate our method on several NLP tasks and compare it to both the data augmentation and adversarial training methods. Experimental results demonstrate that our approach not only improves the overall perfor- mance of the trained model but also enhances its robustness against multiple attacking techniques. Moreover, the computational time is significantly reduced compared existing adversarial sample generation methods.
and effectiveness of trained models by introduc- ing disturbances to the original training samples, commonly known as adversarial training (Good- fellow et al., 20) Miyato et al. (Miyato et al., 2016) first proposed a NLP-oriented method that adds noise to the word embeddings of the input sample for adversarial training in text classifica- tion task. Similar approaches have been applied to adversarial training for pretrained language mod- els (Liu et al., 2020) and other NLP tasks (Li and Qiu, 2021), showing improvements in model per- formance. Despite their effectiveness, disturbance in the continuous spaces lack clear meaning in ac- tual language, making them less interpretable.
Recent works in adversarial training for NLP tasks consider modifications the lexical level to make the perturbed samples more consistent with real samples. Early works use synonym substitu- tion to explore proximate samples in the sample space. Huang et al. (Huang et al., 2019) and Dong et al. (Dong et al., 2021) used different sample space exploration methods to find samples that ef- fectively enhance model robustness in adversarial training. The SSMBA method proposed by Ng et al. (Ng al., 2020) generates perturbed samples by using pretrained language models complete corrupted texts. Recently, researchers consider us- ing adversarial sample generation methods for ad- versarial training. Previous work (Carlini et al., 2019) has shown that using samples generated by specific adversarial sample generation method for augmented training generally only improves the robustness against that method. Yoo et al. de- signed the A2T method (Yoo and Qi. 2021), which introduced a fast lexical substitution adversarial sample generation method into the model train- ing process, achieving improved robustness against multiple model attacking methods. Current adver- sarial training methods for NLP models are mostly based on constrained searching in the sample space, and lack the ability to self learn and adapt to mod- els datasets. Moreover, the lexical substitution based generation methods have potential problems regarding semantic soundness and syntactic cor- rectness. (Chiang and Lee, 2022)
2 Related works
2.1 Adversarial Sample Generation
In the NLP area, the disturbance on the original sample is often adopted in adversarial sample gen- eration due to the discrete character of text, such as word replacement. For example, TextBugger (Li et al., 2019) generates the adversarial samples by randomly replacing the words in a sample text for gathering the candidate samples that may flip the model prediction. Then it chooses the reasonable adversarial samples with the similar semantics with the original text. PWWS (Ren et al., 2019) uses synonym for word substitution with the help of WordNet. With the development of pretrained lan- guage models (PLM), it help various NLP tasks to gain improvement on the performance. Jin et al. proposed the TextFooler (Jin et al., 2020) method for evaluating the robustness of BERT. Meanwhile, several works utilizes PLM to generate the can- didate adversarial texts with similar semanties to original ones (Li et al., 2020, 2021). Recently, survey on word substitution based adversarial sam- plc generation (Chiang and Lee, 2022) shows that despite the effectiveness of such attacks, the gener- ated samples have flaws on fluency and syntactical correctness and can be identified easily.
3
The End-to-end Adversarial Sample Based Data Augmentation
2.2 Adversarial Training
3.1 Framework
Based on the proximity assumption, researchers have explored methods to enhance the robustness
In this paper, we design the end-to-end adversarial sample generation method for data augmentation.

---

Fou
In this paper we adopt multi-layer bidirectional recurrent neural network as the basic network. The output hidden vector at each step projected a scalar. The output of the condition generator is fed into the conditioned paraphrasing model. Since the condition с is defined as a sequence of binary value, while conventional activation function such as sigmoid outputs contiguous value between O and 1. To maintain reasonable form of and achieve a stable training, we adopt the straight- through estimator (Bengio et al., 2013) method the activation function, such that the output of the condition generator will be binary.
Generator
Condition
Model
Paraphrasing
Conditionnd
Dioctininnte
Advernariall
y
Fusto
y
Figure 1: The framework for the end-to-end adversarial sample based data augmentation
For a given sample x, the condition generator gives the condition c, based on which the paraphrasing model generates x' that is a potential adversarial sample. The whole architecture consists of three parts, shown in Fig.1. The first condition gen- erator is designed to generate the appropriate con- ditions for guiding the generated paraphrase being an adversarial sample. The second the pretrained conditioned paraphrasing model that generates the paraphrases satisfying the given condition.
==STE(G(X))
(2)
3.3 Pretraining the Conditioned Paraphrasing Model
The general purpose of paraphrasing is gener- a sample with the same meaning but different expression with the given text. Here we introduce the conditioned paraphrasing model for guiding the paraphrase. For a given text x and a condi- tion c, it generates a paraphrase x' with the similar semantics to x and satisfying formally:
Since there the condition generator, propose adversarial discriminator to provide the proper training signals, similar the structure of generative adversarial network (GAN) (Goodfellow et al., 2014a). The third part the adversarial discriminator that can be a classifier or regression model for the target task, which checks the flip of predication.
supervised data for training
x' F(=F(xxc)
We adopt multi-layer bidirectional recurrent neural network for the conditioned paraphrasing model. The pretraining data are automatically gen- erated, where the input is a pair of text x and the randomly selected positions as the condition c. As the paraphrase x', there are many candidate methods for choosing the replacement words, such as the synonym vocabulary or the masked language model. To ensure the semantic similarity and the syntactical correctness, we adopt the word com- posable knowledge (Liu et al., 2023) for choosing the words to form text x' the supervised target.
Then for the target task, the generated adversar- ial samples are incorporated with the original data for data augmentation, which are used to train a model for this task.
3.2 Condition Generator
The condition generator takes an original sample as input and aims to generate condition for guiding the paraphrasing model generate adversarial sample. Let G denote the condition generator.
c= c=G(x)
Since only a small proportion of the text are changed, the simple negative log-likelihood loss would lead the model to just copy the input. Thus, we apply larger weight wp > 0 for the replace- ment positions G; =
There are many candidate forms of condition c, such as the ratio of changed words, the sentence structure or the sentiment. Following the normal
way of generating adversarial samples, we adopt the lexical substitution indicator as the condition, which is in the form of binary sequence correspond- ing to the words in x, denoted by e {0, 1} |x] 4 = indicates Ij should be changed in the para- phrase x', C = 0 for otherwise.
x
ep Σ (1 qwy) logpld = ,/|x, c)
(4)
where &/ is the output of the model and af is the supervised paraphrase.

---

3.4 Adversarial Discriminator
advanced distances between probabilities such KL-distance can be an alternative.
To train the end-to-end adversarial sample gener- ation model, we pretrain an adversarial discrimi- nator to provide training signals, denote by D. It is a trained classifier or regression model for the target task.
fado = -1111(x -(x)
(7)
Perturbation ratio loss To maintain the similar semantics between the perturbed sample and the original sample, the ratio of perturbed words in text are constrained, namely the number of cj 1 cases in the generated condition Let p denote the expected ratio, L is the length of sample, the perturbation ratio loss calculated as follows.
y D(x)
Theoretically the paraphrasing model should gen- erate the semantically similar text with the original one. If the prediction j' by D for the generated sample r' is flipped compared the ground truth y. x' is a potentially adversarial sample.
Lo 1p ||c||/ /
(8)
3.5 End-to-End Adversarial Sample
Generation Training
Conditioned paraphrasing losses The condi- tioned paraphrasing model is fine-tuned for dif- ferent expectation by a few loss functions. The first is the reconstruction loss for the words not per- turbed in c, i.c. the positions C 0, denoted by c(0). It is negative likelihood loss for the original words such that the paraphrasing model is trained to reconstruct the original input.
The core of the adversarial sample generation model is to generate the appropriate condition for paraphrasing. Since the discriminator can be seen white-box victim model, we can pass the gra- dient through the neural network structure by uti- lizing the tricks like Gumbel softmax (Jang al., 2017). This allows an end-to-end training mode for the whole adversarial sample generation method. During the training, the condition generator, the conditioned paraphrasing model and the adversar- ial discriminator are connected in pipeline way. For given sample the pipeline outputs pre- diction ÿ for perturbed sample. The conditioned paraphrasing model F(x, c) outputs sequence of word probabilities. We adopt Gumbel softmax to convert the probabilities word embeddings that can be directly used by D.
froc =
Σ iEc(O)
logp(x; =x,xxxxx(xx,)c) xx
(9)
For the perturbed positions, the probability of the original word should be lower than any other words. Inspired by the loss function for the negative sam- ples in the noise contrastive estimation (Gutmann and Hyvärinen, 2010), design the loss of pun- ishing repeating the original word. Let c(1) denote the positions of the 1s the condition c.
G(x)
epan
Σ a-- = xx(x,)) (10) iEc(1)
x c)
D(x')
During training, the parameters of the condition generator and the conditioned paraphrasing model are tuned while the adversarial discriminator re- mains frozen. Training the condition paraphrasing model allow the model be trained adaptively to gen- erate words more suitable for the target task. To train the adversarial sample generation model, we used the following losses.
Semantics similarity and syntactic correctness losses To maintain the semantics of the generated paraphrase similar with the original sample, we adopt word-level similarity loss based on cosine similarities for the word embeddings between the generated word and the original word.
fsom = - sim(xx x')
Adversarial loss is the main goal of the model, namely generate sample that can make the target model flip its prediction. Since previous works on model distilling show the effectiveness and simplicity of the MSE loss function (Hinton et al., 2015), thus it is adopted in our work. More
I
(1I)
sim x')
(1 (x.
The word embeddings similarity cannot guar- antee a proper syntactical role of the replacement word. Thus, we also adopt the word composable

---

Algorithm 1 The Training Process for End-to-End Adversarial Sample Generator
Dataset
#Class
#Train
#Test
Ave.Len.
IMDB
2
25000
25000
270.7
Input: Training set Dr
Quora
2
363660
40404
25.33
Output: Condition generator G, conditioned para- phrasing model
SNLI
3
550152
10000
22.4
Table 1: Dataset statistics
1: //Priiain conditioned paraphrasing model
2: Generate paraphrasing training data Dp base
on Dt
The overall training process of the end-to-end adversarial sample generation is listed in Alg.
3: Pretrain F with Dp according to Eq.4
4: retrrn adversarial discriminator
3.6 Data Augmentation
5: Pretrain D with Dj
6: //Train the end-to-end adversarial sample gen- eration model
Having the above end-to-end adversarial sample generator, we can apply data augmentation on the training data for the target task. For the given origi- nal training set Dt, the corresponding generated ad- versarial samples is denoted by Dj. Then the model for the target task can be trained on Dr D' for improving the model robustness. Since the adver- sarial samples are more likely introduce noises, their training loss is assigned a lower weight. Let L, denotes the loss of the target task, X; denotes the loss weight for sample 8;. X 1 for an original sample while X; < 1 for generated sample.
7: Freeze the parameters of D
8: for sample x, y in D; do
9: Let G(x)
10: Calculate Loon according to Eq.8
11: Letx' = =F(x,c)
12:
Calculate Erecs punnn leens Leyn according
to
Eq.9-12
Let 1 D(x')
Calculate kadu according Eq.7
15:
Calculate Lade according to Eq.13
16:
Update G, F according to Ladd
Ltask
Σ
XeLo((:)
(14)
17:
end for
18:
return Condition generator G, conditioned paraphrasing model F
scEDi
The previous work has shown the adversarial sam- ples generated based model are potentially adversarial to other models (Szegedy et al., 2013).
knowledge based loss (Liu et al., 2023) to pro- vide syntactical correctness guidance for the gen- erated sample. Given dependency relationship between words < u, r, 2, the word compos- able knowledge estimates the syntactical soundness of this combination, denoted by pa (u, r, v). It relies on the pretrained word embeddings and thus is easy to integrate with other neural network structures. Let 8y = (i, rjj) denote the dependency parsing tree of x, where (i, r, represents the dependency relation between Xj and its head word is r. The syntactic correctness loss is calculated as follows:
Experiments
To evaluate the effectiveness of the proposed method, four aspects should be considered and eval- uated in the subsections 4.2-4.5.
A1: To check the attacking effectiveness of gen- erated adversarial sample.
A2: To check whether the model performance is improved after augmented training.
A3: To check whether the robustness of the target model is improved.
Layn
Σ
log,o(X4,r,, (X,,7,)), x()
(12)
A4: To check the efficiency of our method.
(ird)ess
4.1
Experiment Setups
The complete loss function for training the adap- tive adversarial sample generation model is the weighted sum of the above losses.
4.1.1 Tasks
Three tasks are considered evaluation tasks cover wider range of NLP tasks such that the ef- fectiveness of data augmentation can thoroughly evaluated in different scenarios. The first is a senti- ment analysis task on the dataset IMDB, The IMDB
Ladv -Wakare + Welcom + wyfrec + Wylpus + Wsem ssem + Waynkogn
(13)

---

Base
BERT
DistilBERT
Perturbed
Bert Score
Model
%
Dataset
Ori.Acc.
Att.Acc.
A
Ori.Acc.
Att.Acc.
A
IMDB
93.9%
66.58%
-27.32%
92.96%
61.76%
-31.2%
9.95%
95.98
Quora
84.84%
75.95%
-8.89%
84.32%
76.44%
-7.88%
16.6%
95.96
SNLI
88.95%
55.64%
-33.31%
88.04%
55.20%
-32.84%
14.73%
95.62
Table 2: Accuracy comparison between accuracies on the original testing set and adversarial testing set.
dataset consists of long movie reviews which classified as positive of negative sentiment polar- ity. The second is a text classification task on the dataset Quora Question Pairs(QQP), which consists of question pairs from the Quora site classified as duplicate or not. The last is natural language in- ference task on the dataset SNLI. Each sample in SNLI consists a hypothesis sentence and premise sentence, the logical relationship between them is determined as entailment, neutral contradiction. The statistics of the datasets are listed in 1.
Base Model
Dataset
Method
IMDB
Quora
SNLI
Baseline
93.9
84.84
88.95
SSMBA
-0.41
+3.03
-2.88
BERT
A2T
-0.03
+1.4
-0.5
A3
+1
+4
+0.1
Baseline
91.87
84.33
88.04
Distil- BERT
SSMBA
+1.09
+3.79
-0.12
A2T
+1.27
+4.39
+1.38
A3
+1.93
+4.89
+0.22
Table Accuracy comparison on the original testing set. The values for the augmentation methods are the differences the accuracy of the base model.
4.1.2 Base Models
Recently, pretrained language models widely used fundamental part for NLP methods. In the following experiments, BERT (Kenton and Toutanova, 2019) and DistiBBERT (Sanh et al., 2019) are chosen as the base model the tasks. BERT is a widely used pretrained language model, and achieves improvements on various NLP tasks. DistilBERT is compressed version of BERT model based on model distilling technique, making it easier to be used on devices with lower compu- tation power. Both models will be finetuned the original train set or the augmented train for the target task and evaluated afterwards. Their results will be listed as Baseline in the following experiments.
15% when generating training data. For training the complete model, the weights in the final loss function set Wa = 5.0, wc 3.0, w. = 2.0, Up 5.0, Wsem 2.0, Wsyn 0.1 in most cases. The ratio of perturbed words p for the condition generator set as 0.15 for SNLI and 0.1 for IMDB and Quora unless stated otherwise.
4.1.4 Compared methods
For the comparison methods, we consider the fol- lowing methods. SSMBA (Ng et al., 2020) is a data augmentation method that uses the corrup- tion function similar to the masked language model training and reconstructs the samples with BERT. A2T (Yoo and Qi, 2021) is an adversarial training method, where a fast adversarial sample generation method uses the gradients for identifying important words in a sample and replaces them based on word embeddings or MLM models. It iteratively trains the task model and augment the training data set with the generated adversarial samples.
4.1.3 Implementation
All the experiments conducted on a single NVIDIA Geforee RTX 2080Ti. Our method is implemented with PyTorch 1.12.0. The code for our proposed method is shared at sdu. edu. cn/ htc//scg//St xscg/sjjydmmm htm. The compared methods and adversarial sample generation are im- plemented by TextAttack (Morris et al., 2020b). The size of hidden vectors in model is 300. We adopt Glo Ve (Pennington al., 2014) as the word embeddings and reused the pretrained param- eters of word composable knowledge released in SynPara (Liu et al., 2023). For pretraining the para- phrasing model, the ratio of replaced words is set
4.2 Attack Effectiveness
To evaluate the effectiveness of the generated ad- versarial samples, we compared the performances of the baseline models on the original testing data and on the adversarial data. The results are shown in Table.2, where the ratio of perturbed words

---

Base Model
BERT
DistiBERT
Datasets
IMDB
Quora
SNLI
IMDB
Quora
SNLI
Attack Method
Augment Method
%
%
A
%
A
%
%
A
Bascline
69.3
77.3
58.3
64.1
80.1
59.8
A
SSMBA
71.6
+2.3
77.7
+0,4
58.7
+0.4
61.6
-2.5
78.8
-1.3
62.9
+3.1
A2T
73.7
+4.4
76.9
-0.4
59.7
+1.4
66.1
+2
78.6
-1.5
600.
+0.5
A
92.2
+22.9
89.3
+12
86.2
+27.9
93.8
+29.7
90.9
+10.8
86.5
+26.7
Bascline
38.8
40.1
44.1
30.6
50.3
41.1
SSMBA
38.9
+1
48.1
49.3
+5.2
27.9
-2.7
50.7
+0,4
45.1
A2T
A2T
44
+5.2
76.2
+36.1
79.4
+35.3
54.5
+23.9
76.1
+25.8
75.6
+34.5
A
+6.5
60.7
+20.6
48
+3.9
+5.5
60.2
+9.9
43.3
+2.2
Baseline
1.7
23.6
0.9
0.1
10.3
0.47
Text-
SSMBA
5.3
+3.6
12.5
-11.1
0.4
-0.5
-0.1
12.1
+1.8
0.73
+0.26
Fooler
A2T
0.8
-0.9
14.3
-9.3
5.1
+4.2
1.3
+1.2
8
-2.3
3,93
+3,46
A
12
+10.3
27.1
+3,5
1,9
+1
1.6
+1.5
15.2
+4,9
0,67
+0,2
Baseline
31
39.3
22.1
24.9
39.3
23.87
SSMBA
30.6
-0.4
39
-0.3
25
+2.9
21
-3.9
39.7
+0.4
23.93
+0.06
BAR
A2T
29.1
-1.9
43,4
+4.1
23.5
+1.4
26.3
+1.4
44.2
+4.9
25.5
+1.63
A
37.9
+6.9
+1.5
27.6
+5.5
45.7
+6.4
24.27
Baseline
25.1
1.2
22.1
1.07
SSMBA
+1.2
23.1
-2
2.3
+1.1
-0.7
22.9
+0.8
1.2
+0.13
PWWS
A2T
0.3
-0.7
26.3
+1.2
0.7
-0.5
-0.2
23
+0.9
0.87
-0.2
A
7,3
+6.3
27.7
+2.6
2.4
+1,2
0.9
+0.1
24.1
+2
2.4
+1.33
Table Comparison of attacking methods against augmentation methods. Column denotes the model accuracy under attacking. Column A denotes the difference between augmented model with the original model.
the adversarial samples is listed in column Per- turbed%. A lower ratio indicates more structure in- formation of the text preserved. BertScore (Zhang et al., 2020) is used for quantifying the semantics similarity between the original sample and the ad- versarial sample. The higher the BertScore, the closer their semantics. We performances of both baseline models drop signifi- cantly on the adversarial samples, which show that the generated adversarial samples are effective on attacking the baseline models.
sideration the task specific characteristics, such as the logical connections between the hypothesis and premise in SNLI. It should also noted that while the original performance of DistilBERT is slightly lower than BERT, it improves a lot after data aug- mentation, which confirmed previous studies re- garding the effectiveness of data augmentation for distilled models (Das et al., 2020).
that the model
4.4 Robustness Improvement
To evaluate the robustness of base model against different attacking methods, we choose three repre- sentative attacking methods: TextFooler (Jin et al.. 2020), BAE (Garg and Ramakrishnan, 2020) and PWWS (Ren et al., 2019). We adopt the notion m1 mm2 denoting the attacking method m1 against augmentation method m2. For example, BAE-A2T means using BAE to attack model trained using A2T. Similar to the settings of previous works (Yoo and Qi, 2021), 1), 1000 samples are selected from the original testing set of each dataset (1500 samples from SNLI for three labels). where the label distri- butions are balanced. To better show the impact of be
4.3 Performance Improvement
We then evaluated the model performance on the target tasks before and after training with aug- mented data. By using method and SSMBA, the data is augmented doubled size of the original training set, respectively. The augmented dataset used for training the base models. For A2T, itera- tively trains the model and then augments the train- ing set by generating adversarial samples. The re- sults in Table.3 show that our method improves the performance on all settings and are better than the compared methods in most cases. The compared methods unstable on performances, namely in some cases performances are the improved while some are not. For example, SSMBA has negative impact on SNLI dataset for both base models. This is probably because SSMBA doesn't take into con-
attacking method, the selected samples predicted correctly by the base models before data augmentation. The attack methods generate the adversarial samples based on the selected samples and the accuracy on these adversarial samples the trained model would compared. A2T and

---

Dataset
son. First reason is that the attacking process is conducted multiple times. Secondly, the method is based on attacking the target model which not only com-cconsuming, but the time taken will also increase over time since the model is trained bet- ter after each epoch. Comparably, our proposed method generates model-agnostic adversarial sam- ples, such that the time for augmented training is significantly shortened.
Methods
IMDB
Quora
SNLI
SSMBA
10m
38m
1h2m
A2T
36h(3)
11)h(2)
70h(2)
A
4m
27m
21m
Table 5: Time for augmenting the dataset. It should be noted that the time for A2T is the cumulated time for multiple training epochs (number of epochs is listed in the brackets).
4.6
Parameter Analysis
20%
40%
35%
We analyze the effect parameter p. the targeted perturbed ratio. In our method for a p setting, the actual perturbed ratio in the generated adversar- ial samples may be different with the initial value. Thus, we analyze the actual perturbed ratio and its impact on the attacking effectiveness, shown in Fig.2. The blue and orange lines represent the set p and the actual perturbed ratio respectively, corresponding to the left Y-axis. The AAcc is the accuracy difference after the attack, corresponding to the right Y-axis. Higher value of A Acc means more effective attack. We can see that the actual perturbed ratio approaches the p setting. A higher may cause the predicated label flipped but may lead to larger semantics difference. Thus, the parameter p should be set properly achieve a balanced performance.
15%
30%
25%
10%
20%
15%
P
5%
Perturbed Ratio
10%
AAcc
5%
0%
5%
10%
15%
Parameter
Figure 2: The influence of p on the perturbed ratio and the attack effectiveness (denoted by AAcc)
our proposed method are tested as they are also adversarial sample generation methods.
The results are listed in Table.4, where the col- umn % denotes the model accuracy under attacking and column A shows the difference between the performance of the augmented model with the base- line. As explored in a previous research (Carlini et al., 2019), the robustness against a certain attack method will be improved if trained with the corre- sponding adversarial samples. From the row A-3 and A2T-A2T, we can that both methods sig- nificantly improve the model robustness. For other representative attacking methods, the augmented models with our generated data show better robust- ness than the compared methods in most settings.
Conclusion
In this paper, we present a method named A that combines the advantages of adversarial training and data augmentation to enhance the robustness of NLP models. We introduce an end-to-end adver- sarial sample generation model which consists of a condition generator and conditioned paraphrasing model. A pretrained adversarial discriminator is proposed train the adversarial sample generation model for capturing the task-specific data charac- teristics. This method is much efficient without the need for extensive model interactions. The gen- erated adversarial samples are incorporated with the original training samples by a weighted loss for augmented training downstream models. Ex- periments are conducted on multiple NLP tasks and demonstrate the effectiveness and efficiency of our proposed method. Compared existing meth- ods, the performances of the base models have im- proved more after our data augmentation, as well as their robustness enhanced against multiple at- tacking techniques.
4.5 Efficiency Comparison
Another vital aspect of adversarial training is the ef- ficiency. Most adversarial sample generation meth- ods involves constantly interaction with the target model. Such process is both computational heavy and time-consuming. We recorded the time used for augmenting the training set of different methods. Both SSMBA and our proposed method are one- time augmentation thus the time taken is similar. Our method is slightly faster than SSMBA since SSMBA uses BERT as the reconstruction model. The A2T method, on the other hand, is significantly slower than our method due to two possible rea-

---

Limitations
Javid Ebrahimi. Anyi Rao. Daniel Lowd, and De- jing Dou. 2017. Hotflip: White-box adversarial examples for text classification. arXiv preprint arXiv:1712.06751.
Firstly, the current form of condition limits the di- versity and fine-grained control the generation process. For example, condition can be sub- tree from the dependency syntax structure, which allows paraphrases with potential structure reform and correct syntax (Liu et al., 2023). Secondly, a condition may also contain the direction of replace- ment word for the paraphrasing model. This would allow reusing the same conditioned paraphrasing model across different tasks, thereby reducing the training overhead for adversarial sample genera- tion. Lastly, in future research, we aim explore the feasibility of directly using the gradient from the target model for training the adversarial sample generation model.
Siddhant Garg and Goutham Ramakrishnan. 2020. Bae: Bert-based adversarial examples for text classifica- tion. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLIP), pages 6174-6181.
Jan J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron C. Courville, and Yoshua Bengio. 2014a. Generative adversarial networks. CoRR, abs/1 206.2661.
lan Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014b. Explaining and harnessing adver- sarial examples. arXiv preprint arXiv: 1412.6422
Shreya Goyal, Sumanth Doddapaneni, Mitesh
Khapra, and Balaraman Ravindran. 2022. A survey of adversarial defences and robustness in nlp. ACM Computing Surveys.
Acknowledgments
This work was supported by the National Natural Science Foundation of China (62376138) and the Innovative Development Joint Fund Key Projects of Shandong NSF (2R2022LZH007).
Michael Gutmann and Aapo Hyvärinen. 2010. Noise- contrastive estimation: A new estimation principle for unnormalized statistical models. In Proceedings of the thirteenth international conference artificial intelligence and statistics, pages 297-304. JMLR Workshop and Conference Proceedings.
References
Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. 2015. Distilling the knowledge in neural network. arXiv preprint arXiv: 1503.0233..
Yoshua Bengio, Nicholas Léonard, and Aaron Courville. 2013. Estimating or propagating gradients through stochastic neurons for conditional computation. arXiv preprint urXiv:1308.381
Po-Sen Huang, Robert Stanforth, Johannes Welbl, Chris Dyer, Dani Yogatama, Sven Gowal, Krishnamurthy Dvijotham, and Pushmeet Kohli. 2019. Achieving verified robustness to symbol substitutions via in- terval bound propagation. In Proceedings of the 2019 Conference on Empirical Methods in Natu- ral Language Processing and the 9th International Joint Conference Natural Language Processing (EMNLP-IJCNLP)) pages 4083-4093.
Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Ku- rakin. 2019. On evaluating adversarial robustness. arXiv preprint arXiv:190.006705
Minhao Cheng, Jinfeng Yi, Pin-Yu Chen. Huan Zhang, and Cho-Jui Hsieh. 2020. SeqZsick: Evaluating models with ad-
Eric Jang, Shixiang Gu, and Ben Poole. 2017. Cate- gorical reparametrization with gumble-softmax. In International Conference on Learning Representa- rions (ICLR 2017). OpenReview. net.
robustness of versarial examples. In Proceedings of the AAAI con- ference on artificial intelligence, volume 34, pages 3601-3608.
Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2020. Is bert really robust? strong base- line for natural language attack on text classification and entailment. In Proceedings of the AAAI ference on artificial intelligence, volume 34, pages 8018-8025.
Cheng-Han Chiang and Hung-yi Lec, 2022. How far are we from real synonym substitution attacks? arXiv preprint 2rx:::220000884
Deepan Das, Haley Massa, Abhimanyu Kulkarni, and Theodoros Rekatsinas. 2020. An empirical analysis of the impact data augmentation on knowledge distillation. CoRR, abs/2006.03810.
Jacob Devlin Ming-Wo Chang Kenton and Lee Kristina Toutanova. 2019. Bert: Pre-training deep bidirec- tional transformers for language understanding. In Proceedings of NAACL-HLT, pages 4171-4188
Xinshuai Dong, Anh Tuan Luu, Rongrong Ji, and Hong Liu. 2021. Towards robustness against nat- ural language word substitutions. arXiv preprint arXiv:2107.13544 13541.
Ashutosh Kumar, Satwik Bhattamishra, Manik Bhan- dari, and Partha Talukdar. 2019.
Submodular

---

optimization- basse diverse paraphrasing and its ef- fectiveness in data augmentation. In Proceedings of the 2019 Conference of the North American Chap- ter of the Association for Computational Linguisties: Human Language Technologies, Volume (Long and Short Pupers), pages 3609-3619.
Nathan Ng, Kyunghyun Cho, and Marzyeh Ghassemi. 2020. Ssmba: Supe-supe manifold based data augmentation for improving out-of-domain robust- ness. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 1268-1283.
Bohan Li, Yutai Hou, and Wanxiang Che. 2022. Data augmentation approaches in natural language pro- cessing: A survey. AI Open, 3:71-90.
Jeffrey Pennington, Richard Socher, and Christopher Manning. 2014. GloVe: Global vectors for word representation. In Proceedings of the 2014 Confer- ence Empirical Methods in Natural Language Pro- cessing (EMNLP), pages 1532-1543, Doha, Qatar. Association for Computational Linguisties.
Dianqi Li, Yizhe Zhang, Hao Peng, Liqun Chen, Chris Brockett, Ming-Ting Sun, and William B Dolan. 2021. Contextualized perturbation for textual adver- sarial attack. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computarional Linguisticx: Human Language Technologies, pages 5053-5069.
Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. 2019. Generating natural language adversarial ex- amples through probability weighted word saliency. In Proceedings of the 57th annual meeting of the as- sociation for computational linguistics, pages 1085- 1097.
JL,, S Ji, Du, Li, and Wang. 2019. Texthugger: Generating adversarial text against real-world appli- cations. In 26th Annual Network and Distributed System Security Symposium.
Victor Sanh, Lysandre Debut, Julien Chaumond, and Thomas Wolf. 2019. Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter. arXiv preprint arXiv:1910.01
Linyang Li. Ruotian Ma, Qipeng Guo. Xiangyang Xue, and Xipeng Qiu. 2020. Bert- Sttt-attack: Adversarial at- tack against using bert. In Proceedings of the 2020
Rico Sennrich, Barry Haddow, and Alexandra Birch. 2015. Improving neural machine translation models with monolingual data. arXiv preprint 1rXiv:1511.06700
Conference on Empirical Methods in Natural Lan- guage Processing (EMNLP), pages 6193-6202.
Linyang Li and Xipeng Qiu. 2021. Token-aware vir- tual adversarial training in natural language under- standing. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 8410-8418.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan. Ian Goodfellow, and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199
Tianyuan Liu, Yuqing Sun, Jiaqi Wu, Xu Xi, Yuchen Han, Cheng Li, and Bin Gong. 2023. Unsupervised paraphrasing under syntax knowledge. In Proceed- ings of the AAAI conference on artificial intelligence, volume 37.
Jason Wei and Kai Zou. 2019. Fda: Easy data augmenta- tion techniques for boosting performance on text clas- sification tasks. arXiv preprint arXiv:1901.1 1116..
Jin Yong Yoo and Yanjun Qi. 2021. Towards improving adversarial training of nlp models. In Findings of the Association for Computational Linguistics: EMNIP 2021, pages 945-956.
Xiaodong Liu, Hao Cheng, Pengcheng He, Weizhu Chen, Yu Wang, Hoifung Poon, and Jianfeng Gao. 2020. Adversarial training for large neural language models. arxiv preprint arXiv:2004.0800
Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q- Weinberger, and Yoav Artzi. 2020. Bertscore: Evalu- ating text generation with BERT. In 8th International Conference on Learning Representations. ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenRe- view.net.
Takeru Miyato, Andrew M Dai, and Ian Goodfel- low. 2016. Adversarial training methods for semi-supervised text classification. arXiv preprint wrXiv:660..07225.
John Morris, Eli Lifland, Jack Lanchantin, Yangfeng Ji, and Yanjun Qi. 2020a. Reevaluating adversarial examples natural language. In Findings of the Association for Computational Linguisties: EMNLP 2020, pages 3829-388208 3839.
John Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, Di Jin, and Yanjun Qi 2020b. Textattack: A frame- work for adversarial attacks, data augmentation, and adversarial training in nip. In Proceedings of the 2020 Conference Empirical Methods in Natu- ral Language Processing: System Demonstrations, pages 119-126.


Reviews:
[{"review_id": "mW8IbzQaPT", "reviewer": "Reviewer_m7F9", "summary": "", "questions": "A. Can you clarify the discriminator in your approach? Is it based on pre-trained model or trained from scratch?\nB. Why did you consider the bidirectional RNN, instead of transformer in condition generator and conditioned paraphrasing model?\nC. Why did you only consider paraphrasing model for adversarial generation? How about other text generation methods like generating the Out-of-domain words?\nD. In my perspective, paraphrasing is affected by sentence-level, not only word-level. Why did you generate the condition or rephrased sentence based on word? For word-level, I guess rule-based approach is better one.\nE. In line 485, how does the size of train set in A2T?\nF. Why A2T in SNLI+DistillBERT is better than your approach in Table 3?", "limitations": "", "rating": 3, "confidence": 4, "soundness": 3, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for the comments and feedback. Here are our responses regarding the issues and questions in the reviews.\n\nR1. Firstly, there is the distinct difference with GAN. The goal of GAN discriminators is to distinguish samples being real or fake, or belonging to different categories. Differently, the discriminator in our work is task-dependent and the purpose is making the task model predict incorrectly. \nSecondly, comparing with the mostly related works like GAN-BERT, our model generates the fine-grained controllable and understandable sentences, namely samples, which they do not. \n\nR2. The term of “pre-training” in our method refers to process of training the discriminator on the target task before the complete model training. \n\nR3. (The reason about A2T having better performance on the specific SNLI task) \nSNLI has higher requirements on the logical relationships between the hypothesis and premise. A2T constantly interact with the target model during the generation of the adversarial sample. But it is time consuming and not transferable across different models compared to our method. \n\nR4. The generated samples are not included in this version due to the space limitation. We would present some illustrative samples in the appendices later.\n\nR5. About the ablation experiments on the hyper-parameter settings, since there are 6 loss functions, the space of their combination is enormous for exploration and thorough validation.\nCurrently, we try different combinations and set them based on both the experimental results and the cognitive perspectives.\n\nR6. The source code and datasets will be openly available on the web.\n\nR7. About the problem of labeling and jumping for table/figure/algorithm in the downloaded pdf version of our paper, they work well on our side. We use Acrobat DC.\n\nQ.A: Please refer to the above point R2.\n\nQ.B: The BiRNN is selected as the model due to its simplicity and cost-effectiveness with a small number of parameters. Since the target of our method is to provide task-dependent data augmentation, in practice there is not much labelled data. Thus, it requires the model to be light-weight for training rather than the transformer based large models. \n\nQ.C/D: Previous works in data augmentation and adversarial sample generation prove the effectiveness of word substitution-based paraphrasing. It’s easier to maintain the semantic similarity and reduce the complexity of generating plausible samples than sentence level generation. In this paper, we combine the word-level paraphrasing with the complete sentence-level generation.\nConsidering the rule-based approaches, they cannot be trained in an end-to-end style like our proposed method.\n\nQ.E: A2T does not require a training process.\n\nQ.F: Please refer to the above point R3.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "- Generate the conditions for paraphrasing model to make a suitable adversarial sample.\n- Test on three different tasks to reveal the novelty of works.\n- Simple but powerful performances regarding the experiments done by authors.", "reasons_to_reject": "- Idea is very similar to Generative Adversarial Network. The author needs to point out the difference to show the novelty of work in the Related work sections better. Please see \"Missing References\" part. \n- The algorithm is not clear, especially for discriminator since author sometimes argues that it is pre-trained model (line 82-85) but sometimes not (line 5 in Algorithm 1). Please develop the algorithm part better to make it more understandable.\n- The insights of authors choices (e.g. model selection) and the investigation of experimental results are missing. For example, why A2T in SNLI+DistillBERT is better than your approach (Table 3)? \n- Please include the example of adversarial examples in each approach to understand better. \n- Lack of ablation study regarding the selection of hyperparameters (e.g. Section 4.1.3).\n- Hard to reproduce the results since there is no offered source code.\n- Please double-check whether authors follow the ACL format since the labelling of Table/Figure/Algorithm does not work.", "questions_to_authors": "A. Can you clarify the discriminator in your approach? Is it based on pre-trained model or trained from scratch?\nB. Why did you consider the bidirectional RNN, instead of transformer in condition generator and conditioned paraphrasing model?\nC. Why did you only consider paraphrasing model for adversarial generation? How about other text generation methods like generating the Out-of-domain words?\nD. In my perspective, paraphrasing is affected by sentence-level, not only word-level. Why did you generate the condition or rephrased sentence based on word? For word-level, I guess rule-based approach is better one.\nE. In line 485, how does the size of train set in A2T?\nF. Why A2T in SNLI+DistillBERT is better than your approach in Table 3?", "paper_topic_and_main_contributions": "The paper proposes a novel approach based on adversarial training and data augmentation. This approach consists of conditioned paraphrasing model and condition generator to generate adversarial sample. Pre-trained discriminator is applied together to adapt to the different downstream tasks. The goal of this approach is to generate the robust model against to the diverse adversarial attacks.", "excitement": 3, "reproducibility": 2, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"Typos_Grammar_Style_and_Presentation_Improvements": "- In Figure 1, \"dot (.)\" is missing. \n- Add space in data augmentationA^3 (line 77)\n- Authors sometimes use pretrained (line 82) but sometimes use pre-trained (line 157). Please use it consistently."}, "extra_text": {"Missing_References": "- Lantao Yu, Weinan Zhang, Jun Wang, and Yong Yu. 2017. Seqgan: Sequence generative adversarial nets with policy gradient. In Proceedings of the AAAI conference on artificial intelligence, volume 31.\n- Danilo Croce, Giuseppe Castellucci, and Roberto Basili. 2020. GAN-BERT: Generative adversarial learning for robust text classification with a bunch of labeled examples. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 2114–2119, Online. Association for Computational Linguistics.\n- BERTScore: https://arxiv.org/abs/1904.09675"}}, {"review_id": "IrEWaGcAup", "reviewer": "Reviewer_ue2L", "summary": "", "questions": "A: Why did TextFooler and PWWS results perform so much worse in Table 4?\n\nB: In Table 3, DistilBERT seems to enjoy a performance increase regardless of the method used in contrast to BERT.  Is this consistent with prior literature on data augmentation with DistilBERT?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for the comments and feedbacks. Here are our responses regarding the issues and questions in the review.\n\nR1. The reported results come from the average results of multiple runs.\n\nR2. The source code and datasets will be openly available on the web.  \nCurrently the BiRNN adopts 2-layer GRU structure with the hidden dimension of 300. More details will be added in later revisions.\n\nQ.A: Both TextFooler and PWWS models replace words in an aggressive try-check way. We generate the adversarial samples in a contextual style since the contextual word replacement is more human-understandable in adversarial sample generation.\n\nQ.B: (About the distilled models benefit more from data augmentation techniques than the original models). \nYes, it has been studied in previous work:  \nDas, Deepan, et al. \"An empirical analysis of the impact of data augmentation on knowledge distillation.\" arXiv preprint arXiv:2006.03810 (2020).", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "Outside of some rough grammar in places I found this paper to be very easy to follow and the motivations to create the end-to-end system well founded.\n\nThe adversarial + augmentation approach appears to greatly outperform the comparison methods in Table 4, of which only one other was also an adversarial + augmentation method (and it performed significantly slower).\n\nThe efficiency of the proposed method was significantly improved over the comparison methods, allowing for time and cost reduction over prior approaches in generating large datasets.", "reasons_to_reject": "In the reported results tables there is no mention if the data is from a single run or best of many.  There is no given standard deviation or CI to frame the variation of quality in the generation between the compared methods.\n\nReproducibility would be hard if the authors will not release code, incomplete specifics on the BiRNNs used were given in the paper (were the RNNs identical for all stages? optimizer? learning rate? etc).  If no code is to be released, an appendix would be welcome with further details on complete model construction.", "questions_to_authors": "A: Why did TextFooler and PWWS results perform so much worse in Table 4?\n\nB: In Table 3, DistilBERT seems to enjoy a performance increase regardless of the method used in contrast to BERT.  Is this consistent with prior literature on data augmentation with DistilBERT?", "paper_topic_and_main_contributions": "This paper presents an adversarial data generation model for training data augmentation that does not require interaction with the target model.  The authors introduce a three stage model consisting of a BiRNN condition generator, a BiRNN conditioned paraphrasing model, and an adversarial discriminator.   The model is trained end-to-end with a weighted composite loss function to produce adversarial examples that are syntactically correct.  The resulting model can then be used for data augmentation to train a downstream model.\n\nThe authors describe the architecture and loss functions in detail, then perform a series of experiments to test the following assumptions: 1) the attacking effectiveness, 2) whether the target model performance is improved after augmented training, 3) whether the robustness of the target model is improved, and 4) the efficiency compared to prior art.  They perform various experiments on three datasets (IMDB, Quora, SNLI) to test the assumptions.  They conclude their methods are superior in quality and efficiency over four comparison adversarial methods and two comparison data augmentation methods.", "excitement": 4, "reproducibility": 3, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"Missing_References": "Cite GLoVe on line 437"}, "extra_text": {"Typos_Grammar_Style_and_Presentation_Improvements": "There are many minor grammar issues that can affect clarity, particularly in sections 1, 2.1, 4.5, 4.6, 5.  I would highly recommend running the source through a grammar checker.\n\nIt is explained in the text body, but it would help if the y axes were labeled on figure 2."}}, {"review_id": "c7x2v9RTL4", "reviewer": "Reviewer_CHih", "summary": "", "questions": "Eqn 12: Is the loss normalized based on the length of the syntax tree of x? Will the length of x’ always be the same to x? \nLine 379: how do you choose \\lambda_i for the generated sample?\nLine 441: Why fix the pretrain ratio as 15%? Wouldn’t this affect the fine-tuning stage with different /rho (which is set 0.1 in IMDB and Quora)\nLine 443-445: Sensitivity of all six parameters is not evaluated. Ablation study is required.\nLine 468: Is perturbed% a metric or statistics of all perturbed words used in adversarial samples? Why is the perturbed ratio in Quora higher but the performance drop is lower?\nHow do you generate the test set? How do you validate the test set is good enough to present the distribution of adversarial samples? \n\nIs the test set generated using the model after pre-training or after fine-tuning? Do you have confidence intervals for multiple experiments for the results? \n\n\nLine 558 (Table 5): Does the time calculation consider the pre-training stage? Is the pre-training stage agnostic to datasets/tasks?", "limitations": "", "rating": 2, "confidence": 5, "soundness": 3, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for the comments and feedbacks. Here are our responses regarding the issues and questions in the review.\n\nR1. There are 6 loss functions during the training process of our model, which makes the space of hyper-parameter combinations enormous for thorough exploration. The current setting is based on the cognitive perspective and validated by experimental results.\n\nR2/3. Thanks for pointing out. The representation will be refined in the later version.\n\nR4. About the training time of our model, the pretraining process takes around 1-2 hours for the conditioned paraphrasing model and 1-2 hours for the adversarial discriminator.  In the end-to-end training process, it takes around 3-4 hours for the complete model on the stated hardware specifications in Sec.4.1.3. \nCurrently, the BiRNN adopts 2-layer GRU structure with the hidden dimension of 300. More details will be added in later revisions.\n\nR5. The structure of experimental evaluation is similar with the previous works like A2T. \n\n(About the results of a larger perturbed ratio not bringing a larger performance downgrade on the Quora dataset):\nThe current results are based on the multiple experiments, which are related to the characteristics of the dataset.\n\nSince the main purpose of our method is for data augmentation, it is not necessary to compare with other attacking methods. \n\nWe have presented the details on how to generate the adversarial test set in paper Lines 514-517, which are similar as the previous works.\nThe test set is generated with samples that can be correctly predicted by the fine-tuned base model on the target tasks. Such that the attacked accuracy isn’t affected by the model’s original performance. \n\nR6. Our method outperforms A2T on the A2T-A^3 setting against A2T attacking method and on most settings against BAE/PWWS/Textfooler attacking techniques.\nMeanwhile, A2T appears better than ours mostly on the cases by itself as the attacking technique.\n\nR7. The pretraining stage is not considered since A2T does not have one. \nIf the computation time for pre-training stage is taken into account, our method still outperforms baselines, as stated in the above point R4.\n\nR8. Please refer to the above point R1.\n\nR9. Thanks for the suggestion. The representation will be further refined.\n\nQ.1: Yes, the loss is normalized based on the length. The length of x’ is the same as x since the paraphrasing is on word-level.\n\nQ.2: The choice of lambda is based on empirical experiments, 0.2-0.6 for different datasets.\n\nQ.3: The \\rho is set 0.15 to balance the preservation of original semantics and variance of expression. We found the \\rho setting in the pre-training process doesn’t affect fine-tuning results since the paraphrasing model is also trained during the end-to-end training. \n\nQ.4: Please refer to the above point R1.\n\nQ.5: The perturbed ratio metric refers to the average ratio on all samples, not all perturbed words against all samples.\n\nQ.6-10: Please refer to the above points R5 and R7.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "The results show some improvements. The motivation of adding each loss and module is clear.", "reasons_to_reject": "TL;DR I appreciate the efforts and observations / merits found by the authors. However, this paper poorly presents the methodology (both details and its key advantage), and it’s hard to validate the conclusion with such little hyperparameter analysis. I would love to see more detailed results, but I could not accept this version to be accepted as an EMNLP paper.\n\n1 There are too many missing details when presenting the methodology: e.g., what will be the effect if I remove one or two losses presented by the authors? Though their motivations are clear, they do not validate the hypothesis clearly.\n\n2 A lot of equations look like placeholders, such as equations (1, 2, 3, 5, 6). \n\n3 Some of the pieces are simply using existing methods, such as  equation (12), the presentation of these methods are also vague (can only be understood after checking the original paper). \n\n4 The pipeline misses a lot of details. For example, how long does it take to pre-train each module? How adding pre-training will benefit the performance? How to schedule the training of the discriminator and the main module? Not mentioning the detail design of the RNN network used.\n\n5 Why do we need to focus on the four aspects? They are just listed there. Also, some of the results presentation does not seem to be thorough and valid. For example, in table 2, the Quora datasets have the highest perturbation ratio, but the downgraded performance is the least among the three. Is it really because the adversarial samples are effective instead of the task variance or dataset variance?  Also, we didn’t see the attack performance of other comparison methods. And how is the test set generated? What is the size of the adversarial test set and why is that a good benchmark?\n\n6 In table 4, it’s actually hard to say which is better, A^3 or A^2T, if you count the number of winners for each row and column.\n\n7 In table 5, is the computation time also considered the pre-training stage? If not, why? Does the pre-training stage can serve as a unified step which is agnostic to the dataset and tasks?\n\n8 I don’t quite understand the point of section 4.6, and its relationship to the effectiveness of A^3. This influence of /rho seems to be really obvious. I would rather be more interested in changing the six hyperparameters mentioned in line 444 and test their effectiveness.\n\n9 The related work section is also not very well-written. I couldn’t understand what is the key difference and key advantage of A^3 compared to the other methods.", "questions_to_authors": "Eqn 12: Is the loss normalized based on the length of the syntax tree of x? Will the length of x’ always be the same to x? \nLine 379: how do you choose \\lambda_i for the generated sample?\nLine 441: Why fix the pretrain ratio as 15%? Wouldn’t this affect the fine-tuning stage with different /rho (which is set 0.1 in IMDB and Quora)\nLine 443-445: Sensitivity of all six parameters is not evaluated. Ablation study is required.\nLine 468: Is perturbed% a metric or statistics of all perturbed words used in adversarial samples? Why is the perturbed ratio in Quora higher but the performance drop is lower?\nHow do you generate the test set? How do you validate the test set is good enough to present the distribution of adversarial samples? \n\nIs the test set generated using the model after pre-training or after fine-tuning? Do you have confidence intervals for multiple experiments for the results? \n\n\nLine 558 (Table 5): Does the time calculation consider the pre-training stage? Is the pre-training stage agnostic to datasets/tasks?", "paper_topic_and_main_contributions": "The author proposes A^3, a framework to generate adversarial data samples. The framework contains a context generator to select which words are going to be replaced, a paraphrasing model to change the words, and a discriminator to justify if the data is adversarial. The above modules require pre-training. The author then uses the framework to perform end-to-end training. In this stage, the author provides six losses for different purposes with almost no ablation studies to the choice of hyperparameter. The author shows that the generated adversarial samples are harmful to the model, and training the model with them will augment the robustness.    However, the efficiency comparison remains questionable, and the parameter analysis of /rho is confusing. \n\nIn general, there remains a lot of question unanswered / not well explained in this paper.", "excitement": 2, "reproducibility": 2, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {"Missing_References": "Eqn 12: Is the loss normalized based on the length of the syntax tree of x? Will the length of x’ always be the same to x? \nLine 379: how do you choose \\lambda_i for the generated sample?\nLine 441: Why fix the pretrain ratio as 15%? Wouldn’t this affect the fine-tuning stage with different /rho (which is set 0.1 in IMDB and Quora)\nLine 443-445: Sensitivity of all six parameters is not evaluated. Ablation study is required.\nLine 468: Is perturbed% a metric or statistics of all perturbed words used in adversarial samples? Why is the perturbed ratio in Quora higher but the performance drop is lower?\nHow do you generate the test set? How do you validate the test set is good enough to present the distribution of adversarial samples? \n\nIs the test set generated using the model after pre-training or after fine-tuning? Do you have confidence intervals for multiple experiments for the results? \n\n\nLine 558 (Table 5): Does the time calculation consider the pre-training stage? Is the pre-training stage agnostic to datasets/tasks?", "Typos_Grammar_Style_and_Presentation_Improvements": "77: missing space.\n\n173-174: ability to self learn and adapt to models / datasets. (Is it related to non-neural method?l)\n\n192: not -> no\n\nFigure 1: Adding parameters such as /rho with explanation might be helpful.\n\nEqn 10: pun is not an intuitive abbreviation for ‘punish’"}}]

Author rebuttal:

Meta-review: This paper proposed a GAN-like approach to generate adversarial samples. These augmented samples are used during training to enhance robustness of the target model in front of various attacking techniques. The reviewers find this work overall sound but with some issues on details, clarify, and ablations, as summarized below.

### Pros
1. "Simple but powerful performances regarding the experiments done by authors."
2. "The efficiency of the proposed method was significantly improved over the comparison methods, allowing for time and cost reduction over prior approaches in generating large datasets."
3. "Test on three different tasks to reveal the novelty of works."


### Cons 
1. There are many clarity issues such as missing details, missing ablations and writing problems raised by Reviewer m7F9 and Reviewer CHih, as reflected by relatively low reproducibility scores as well.

2. Ablation analysis is not comprehensive enough to justify authors' choices.

Overall, I think this paper sound but not exciting enough.
Decision: Accept-Findings