Towards Robustness Against Natural Language Word Substitutions
Authors: Xinshuai Dong
Anh Tuan Luu
Rongrong Ji
Hong Liu
Venue: ICLR 2021 Spotlight (2021)
Keywords: Natural Language Processing
Adversarial Defense

Abstract: Robustness against word substitutions has a well-defined and widely acceptable form, i.e., using semantically similar words as substitutions, and thus it is considered as a fundamental stepping-stone towards broader robustness in natural language processing. Previous defense methods capture word substitutions in vector space by using either l_2-ball or hyper-rectangle, which results in perturbation sets that are not inclusive enough or unnecessarily large, and thus impedes mimicry of worst cases for robust training. In this paper, we introduce a novel Adversarial Sparse Convex Combination (ASCC) method. We model the word substitution attack space as a convex hull and leverages a regularization term to enforce perturbation towards an actual substitution, thus aligning our modeling better with the discrete textual space. Based on  ASCC method, we further propose ASCC-defense, which leverages ASCC to generate worst-case perturbations and incorporates adversarial training towards robustness. Experiments show that ASCC-defense outperforms the current state-of-the-arts in terms of robustness on two prevailing NLP tasks, i.e., sentiment analysis and natural language inference, concerning several attacks across multiple model architectures. Besides, we also envision a new class of defense towards robustness in NLP, where our robustly trained word vectors can be plugged into a normally trained model and enforce its robustness without applying any other defense techniques.

Published as a conference paper at ICLR 2021
TOWARDS ROBUSTNESS AGAINST NATURAL LANGUAGE WORD SUBSTITUTIONS
Xinshuai Dong
Anh Tuan Luu
Nanyang Technological University, Singapore dongxi nshuat @outlook. com
Nanyang Technological University, Singapore VinAl Research, Vietnam anhtuan. luu uuuntu.. souuntu.ddu.sg
Rongrong Ji
Hong Liu
Xiamen University, China rrji 8xmu. cn
National Institute of Informatics, Japan h1 fiuuniii inniii.. wwc.ii.a........................
ABSTRACT
Robustness against word substitutions has a well-defined and widely acceptable form, i.e., using semantically similar words as substitutions, and thus it is con- sidered as fundamental stepping-stone towards broader robustness in natural language processing. Previous defense methods capture word substitutions in vector space by using either 12-ball or hyper-rectangle, which results in pertur- bation sets that are not inclusive enough or unnecessarily large, and thus impedes mimicry worst cases for robust training. In this paper, we introduce a novel Adversarial Sparse Conver Combination (ASCC) method. We model the word substitution attack space as a convex hull and leverages a regularization term to enforce perturbation towards better with the discrete textual space. Based on the ASCC method, we further pro- pose ASCC-defense, which leverages ASCC generate worst-case perturbations and incorporates adversarial training towards robustness. Experiments show that ASCC-defense outperforms the current state-of-the-an in terms of robustness on two prevailing NLP tasks, i.e., sentiment analysis and natural language inference, concerning several attacks across multiple model architectures. Besides, we also envision new class of defense towards robustness in NLP, where our robustly trained word vectors can be plugged into normally trained model and enforce its robustness without applying any other defense techniques,
actual substitution. thus aligning modeling
INTRODUCTION
Recent extensive studies have shown that deep neural networks (DNNs) are vulnerable adversarial attacks (Szegedy et al.] 2013) Goodfellow et al. 2013 Paaperno et al.) 2016a Kurakin et al.) [017]] Alzantot et al. 20188; e.g., minor phrase modification can easily deceive Google's 's toxic comment detection systems Hosseini al. 2017). This raises grand security challenges to advanced natural language processing (NLP) systems, such as malware detection and spam filtering, where DNNs have been broadly deployed (Stringhini et al., [010 Kolter & Maloof 2006). As a consequence, the research on defending against natural language adversarial attacks has attracted increasing attention.
Existing adversarial attacks in NLP can be categorized into three folds: (i) character-level modifica- tions (Belinkov & Bisk 2018 Gao et al. 2018 Eger et al. 2019), (ii) deleting, adding, or swapping words (Liang et al.) 20177 Via & Liang 2017: Lyyer al. 2018). and (ii) word substitutions using
semantically similar words (Alzantot et al. 2018 Ren et al. 2019 Zang et al. (020)). The first two attack types usually break the grammaticality and naturality of the original input sentences. and thus can be detected by spell or grammar checker (Pruthi et al. 2019). In contrast, the third attack type only substitutes words with semantically similar words, thus preserves the syntactic and semantics
"Corresponding author.
'Our code will be available at hunss//ghhha.ccmmooggiissaaaAA

---

Published as a conference paper at ICLR 2021
Our approach
Other approaches not inclusive enough or umneecssarity large
Border
Vister of word
Convex hull
1z ball with fixed radius
Axis aligned hyper-rectangle
of anisttttiio
Figure 1: Visualization of how different methods capture the word substimtionss in the vector space.
of the original input to the most considerable extent and are very hard to discern, even from hu- man's perspective. Therefore, building robustness against such word substitutions is fundamental stepping stone towards robustness in NLP, which is the focus of this paper.
Adversarial attack by word substitution is combinatorial optimization problem. Solving this prob- lem the discrete textual space is considered NP-hard as the searching space increases exponen- tially with the length of the input. As such, many methods have been proposed to model word substitutions in the continuous word vector space (Sato et al., 2018: Gong et al., 2018 Jia et al.] 2019 Huang et al., 2019), so that they can leverage the gradients generated by a victim model either for attack or robust training. However, previous methods capture word substitutions in the vector space by using either 12-ball hyper-rectangle, which results perturbation sets that are not inclu- sive enough or unnecessarily large, and thus impedes precise mimicry of the worst cases for robust training (see Fig. ffor an illustration).
In this paper, we introduce novel Adversarial Sparse Convex Combination (ASCC) method, whose key idea is to model the solution space as a convex hull of word vectors. Using a convex hull brings two ad advantages: (i) continuous convex space is beneficial for mundient-based adversary generation, and (ii) the convex hull is, by definition, the smallest convex set that contains all substitutions, thus inclusive enough to cover all possible substitutions while ruling out unnecessary cases. In particular, we leverage a regularization term to encourage adversary towards an actual substitution, which aligns our modeling better with the discrete textual space. We further propose ASCC-defense, which employs the ASCC to generate adversaries and incorporates adversarial training to gain robustness.
We evaluate ASCC-defense two prevailing NLP tasks, i.e., sentiment analysis IMDB and natural language inference on SNLI, across four model architectures, concerning two common attack methods. Experimental results show that method consistently yields models that more robust than the state-of-the-arts with significant margins; e.g., we achieve 79.0% accuracy under Genetic attacks IMDB while the trat-of--the-an art performance is 75.0%. Besides, our robustly trained word vectors can be easily plugged into standard NLP models and enforce robustness without applying any other defense techniques, which envisions new class of approach towards NLP robustness. For instance, using our pre-trained word vectors as initialization enhances normal LSTM model to achieve 73.4% robust accuracy, while the state- state-of-the -fe----ttthhtteee art defense and the undefended model achieve 72.5% and 7.9%, respectively.
2 PRELIMINARIES
2.1 NOTATIONS AND PROBLEM SETTING
In this paper, we focus on text classification problem to introduce our method, while it can also be extended to other NLP tasks. We assume we are interested in training classifier X' -> y that predicts label E y given input x E X. The input x is textual sequence L words {x,) ) We consider the most common practice for NLP tasks where the first step is to map into sequence of vectors in oiw-dimensional embedding space, which is denoted as v(z). The classifier is then formulated pz)))(2)) where p can be parameterized by using a neural network, e.g., CNN LSTM model.
2

---

Published as a conference paper at ICLR 2021
We examine the robustness of model against adversarial word substitutions (Alzantot al. 2018 Ren et al. 2019). Specifically, any word z, in z can be substituted with any word 2; in ( (S(z)) j-11 where S(z;) represents a predefined substitution set for (including itself) and T denotes the number of elements in S(z.).. To ensure that è is likely to be grammatical and has the same label as x, S(x;) is often comprised of semantically similar words of 44, egg., its synonyms. Attack algorithms such Genetic attack (Alzantot al. (208)) and PWWS attack (Ren et al. (019) aim to find the worst-case & to fool a victim model, whereas our defense methods aim to build robustness against such substitutions.
2.2 PERTURBATION SET AT VECTOR LEVEL
Gradients provide crucial information about a victim model for adversary generation (Szegedy et al, 2013 Goodfellow et al.) 2015). However, in NLP, the textual input space is neither continuous nor convex, which impedes effective use of gradients. Therefore, previous methods capture perturba- tions in the vector space instead, by using the following simplexes (see Fig for an illustration):
L2-ball with a fixed radius. Miyato et al. (2017) first introduced adversarial training to NLP tasks. They use l2-ball with radius e to constrain the perturbation, which is formulated as:
((x) = o(x) + r, s.t. |||||2 S
where r denotes sequence-level perturbation in the word vector space and è denotes the adversar- ial sequence of word vectors. While such modeling initially considers (2-ball the sentence- can also be extended to word-level to capture substitutions. Following that, [Sato et al. (2018) and Barham Feizi (2019) propose to additionally consider the directions towards each substitu- tion. However, they still use the l2-ball, which often fails to capture the geometry of substitutions precisely.
Axis aligned bounds. Dia et al. (2019) and Huang et al. (2019) use axis-aligned bound to capture perturbations at the vector level. They consider the smallest axis-aligned hyper-rectangular that contains all possible substitutions. Such perturbation set provides useful properties for bound prop- agation towards robustness. However, the volume of the unnecessary space captures can grow with the depth of the model and grow exponentially with the dimension of the word vector space. Thus fits shallow architectures but often fails to utilize the capacity of neural networks fully.
Besides, instead of fully defining the vector-level geometry of substitutions, Ebrahimi et al. (2018) propose to find substitutions by first-order approximation using directional gradients. is effective in bridging the gap between continuous embedding space and discrete textual space. However, is based on local approximation, which often fails to find global worst cases for robust training.
METHODOLOGY
In this section, we first introduce the intuition of using a convex hull capture substitutions. Then, we propose how Adversarial Sparse Convex Combination (ASCC) generates adversaries. Finally, we introduce ASCC-defense that incorporates adversarial training towards robustness.
3.1 OPTIMALITY OF USING CONVEX HULL
From the perspective of adversarial defense, it is crucial to well capture the attack space of word substitutions. There are three aspects we need to consider: (i) Inclusiveness: the space should in- clude all vectors of allowed substitutions to cover all possible cases. (ii) Exclusiveness: on the basis of satisfying inclusiveness, the space should be as small as possible since a loose set can generate unnecessarily intricate perturbations, which impede model from learning useful information. (iii) Optimization: the space should convex and continuous to facilitate effective gradient- baaed op- timization, whether the objective function is convex not (Bertsekas) 1997. Jain & Kar 2017] Inspired by archetypal analysis (Cutler Breiman 1994), we propose to use a convex hull to build the attack space: the convex hull is continuous space and, by definition, the minimal convex set containing all vectors of substitutions. We argue that using a convex hull can satisfy all the above aspects (as illustrated in Fig T) and thus it is considered theoretical optimum.
3

---

Published as a conference paper at ICLR 2021
Step 1
Step Robust training
Adversary generation
II
awesome
awresome
0.03
awesome
0.01
great
lerriffc
Medel
generation
terrific
0.33
Iurcific
0.01
Model
Loss fincction
Bantasii
0.00
Fantasdic
0.00
amiziing
amazing
0.00
amazing
0.00
Original Weed
Subuiiiativn
Figure 2: An illustration of the training process the ASCC-defense. Step Generate adversaries by ASCC with regularization. Step 2: Take adversaries as input to perform adversarial training.
3.2 ADVERSARIAL SPARSE CONVEX COMBINATION
convex hull. A classical workaround in liter- ature for optimization over a constraint set is the projected gradient descent (Cauchy 1847 Frank & Wolfe 1956 Bubeck 2014 Madry et 2018). As for optimization over convex hull, necessi- tates characterizing the convex hull, e.g., by vertexes, to perform projections. However, computing vertexes is computationally unfavorable because need to recalculate the vertexes whenever word embeddings change, which frequently occurs during the training process.
Efficient representation of and optimization
In this paper, we propose more efficient fashion for optimization over the concerning convex hull, based on the following proposition (the proof of which lies in the definition of convex hull);
Proposition 1. Let S(u) = (S(u),, S(u)T} be the set of all substitutions of word u, convS(u) be the convex hull of word vectors of all elements in S(u), and v(-) be the word vector function. Then, we have convS(u)
1 (.(()( Σ
Wi w. z 0}.
According to Proposition can formulate 6(x;), which denotes any vector in the convex hull around v(xe), as:
6(x,) = Σ Wi (i s.t. Σ
j=1 Wij 1, wij 2 0.
As such, we use Eq to transform the original optimization on o(x;) to the optimization wis the coefficient of convex combination. Considering that wi still belongs to set with constraint [1] II 1, Wa 2 0}, to achieve better flexibilities of optimization, we introduce variable i E IR to relax the constraint on w by the following equation:
Way exp(wij) exp(
Bhs R.
we are able to optimize the objective function over the convex hull by optimizing E provides a projection- way to generate any adversaries inside the convex hull using gradients.
After such relaxation in Eqs 2 and 3,
Gradient-based adversary generation. Let L be a loss function concerning classifier. We can generate the worst-case convex combinations ((x) by finding the worst-case w:
max ((v(x))) ((x),v)
where L is classification-related e.g., the cross-entropy loss over ((x):
(5) However, since we relax the discrete textual space to convex hull in the vector space, any wi that |ww]lo > is highly possible give rise to ((x.) that does not correspond to a real substitution.
[(v(x), 6(x), y) log p(y)o(=))

---

Published as a conference paper at ICLR 2021
Algorithm 1 ASCC-defense
Input: dataset D, parameters of Adam optimizer. Output: parameters / and Φ.
1: repeat
2: for random mini-batch D do
3: for every 2, y in the mini-batch (in parallel) do
4: Solve the inner maximization Eq Io find the optimal 1 by Adam;
5: Compute ((x) by 10 using vú and then compute the imner-maximum in Eq
6: end for
7: Update 0 and by Adam to minimize the calculated manermmaximmm;
8: end for
9:
until the training converges.
To align better with the discrete nature of textual input, propose impose regularizer the coefficient of convex combination, wi. To be specific, we take wy as a probability distribution and minimize the entropy function of w; softly encourage the lo sparsity of w;. We formulate this word-level satropy-based regularization term as:
H(w;) = Σ Wey log(wi)).
Combining loss function L. and the entropy-hased regularizer H. here formulate Adversarial Sparse Convex Combination (ASCC) for adversary generation as:
max ((v(x),, (())) E L H(ws),
where a > is the weight controlling the regularization term (the effectiveness of which is validated
in Sec 4.3
3.3 ASCC-DEFENSE TOWARDS ROBUSTNESS
We here introduce ASCC-defense, which uses ASCC for adversaries and employs adversarial train- ing towards robustness. We denote 0 and ø as the parameters of p(u)v(z)) and v(z), respectively.
Adversarial training paradigm for NLP. Adversarial training (Szegedy et al.) 2013 Goodfellow et al., 2015] Madry et al. 2018) is currently one of the most effective ways to build robustness. Miyato et al. (2017) are the first use adversarial training for text classification. They use 12-ball with radius to restrict perturbations and the training objective can be defined as:
min 0.6
E
[max [(v(x), ((x), 0, +)]], s.t. ((x) = u(r) + r. |rlle 6
(8)
where r denotes the perturbations in the vector space and L denotes a classification-relaaa loss. Therefore, maximizing can generate adversarial perturbations r to fool victim model, whereas minimizing L can let the model learn predict under perturbations.
ASCC-Defense Instead of using lalball E we leverage ASCC to capture perturbations inside
the convex hull to perform adversarial training. This is to re-define ((x: in Eq 8 Jusinn ASCC, and the resulting training objective formulated as:
min 8,0
[max L(v(x), (,
(2,8)~
i6
((x,) = Σ
Way ( Wij = expl (w:))) j=1
(10)
Σ exp(1)))
To specify in Eq for ASCC-defense, we consider the KL-divergence between the prediction by vanilla input and the prediction under perturbations (Miyato et al. 2018 Zhang et al. 2019a). In the meantime, we also encourage the sparsity of w; by the proposed regularizer for adversary generation. Taking these together, we formulate the training objective of ASCC-defense as follows:
min
max lerk-logplllle logg()/((z)) 0.0 (a.0)~D
H(ws) + (<L()( ]]. L
(11)
5

---

Published as a conference paper at ICLR 2021
Table Accuracy(%) of different defense methods under attacks on IMDB (al and SNLI (b order aprx" denotes Ebrahimi et al.] (2018). "Adv 12-ball" denotes Miyato et al. 2017
"First-
"Axis-
aligned" denotes Jia ) "ASCC-defense" denotes the proposed method.
Method
Model
Genetic
PWWS
Method
Model
Genetic
PWWS
Standard
LSTM
1.0
0.2
Standard
BOW
28.8
15.4
CNN
7.0
11.3
DCOM
30.2
9.0
First-order aprx
LSTM
72.5
66.7
First-order aprx
BOW
65.6
57.2
CNN
51.2
74.1
DCOM
66.7
58.6
Adv 12-ball
LSTM
20.1
11.7
Adv 12-ball
BOW
35.0
16.7
CNN
36.7
46.2
DCOM
33.1
15.4
Axis-aligned
LSTM
64.7
59.6
Axis-aligned
BOW
75.0
72.1
CNN
75.0
69.5
DCOM
73.7
67.9
ASCC-defense
LSTM
79.0
77.1
ASCC-defense
BOW
76.3
75.1
CNN
78.2
76.2
DCOM
74.5
72.8
(a) Accuracy (%) under attacks on IMDB.
(h) Accuracy (%) under attacks on SNLL
JACC SNER S0
74
42
66
(a) Accuracy (%) under Genetic attacks.
(b) Accuracy (%) under PWWS attacks.
Figure 3: Tradeoff between robustness and accuracy IMDB under Genetic and PWWS attacks.
where a, control the weight of regularization and KL term, respectively. Noted that term H.(-) has no gradient with respect to and é, so it only works during inner-max adversary generation.
Robust word vectors. We here explain why ASCC-defense can yield more robust word vectors. Previous defenses such as Miyato et al. (017) fail to train word vectors in robust way, they update & by only using the clean data flow. Specifically, Miyato et al. (2017) obtains d(2;) through [ where perturbation r has no gradient with respect to Φ, and thus V Vot; V.v(I;) On the contrary, (xx;) modeled by ASCC-defense has gradient w.rl. & concerning substitutions, as:
(=((z))=)
T Wiy Vou(S(z)))).
(12)
Therefore, ASCC-defense updates the word vector considering all potential adversarial substitutions simultaneously, which gives rise to more robust word vectors (we validate our claim in 4.4).
Optimization. We employ Adam (Kinmma & Ba 2014) to solve both inner-max and outer-min problems Eq Our training process is illustrated in Fig. and presented in Algorithm
4 EXPERIMENTS
4.1 EXPERIMENTAL SETTING
Tasks and datasets. We focus two prevailing NLP tasks evaluate the robustness and compare our method to the ofate-of-the-arts (i) Sentiment analysis on the IMDB dataset (Maas et al. 2011). (ii) Natural language inference the SNLI dataset (Bowman et al. (015)).
Model architectures. We examine robustness on the following four architectures to show the scala- bility of method: (i) BOW, the bag-of-worde words model which sums up the word vectors and predicts

---

Published as a conference paper at ICLR 2021
Table Ablation study on the sparsity regularization term.
Regul weight
Vanilla
Genetic
PWWS
Regul weight
Vanilla
Genetic
PWWS
a=0
80.6
75.1
61.6
x=0
76.7
73.4
73.7
a=5
81.9
76.8
71.7
a=5
77.4
75.1
74.0
a=10
82.2
78.2
75.7
a=10
77.8
76.3
75.1
a=15
81.2
76.1
78.3
a=15
76.7
73.7
73.3
(a) Ace (%) of CNN-based ASCC-defense on IMDB.
(b) Acc (%) of BOW-based ASCC-defense on SNLI
genuinely
genuinely
really
really
indeed
actuallly
indeed
actually
choud
Vedar wad
truly
truly
(a) ê generated without the regularization term.
(b) ē generated with the regularization when a = 10.
Figure 4: An illustration show the effectiveness of the proposed sparsity regularization, We randomly choose 300 adversaries of word "actually" from the test set of IMDB. Vectors are projected into a 2-dimensional space by SVD. Best view in color with zooming in.
by a multilayer perceptron (MLP), (ii) CNN model, (iii) Bi-LSTM model, (iv) DCOM, decompos- able attention model (Parikh et al. 2016), which generates context-aware vectors and predicts by MLP. We align our implementation details with Jia et al. (2019) for fair comparisons.
Comparative methods. (i) Standard training. It uses the cross-entropy loss the main loss func- tion. (ii) First-order approximation (Ebrahimi et al.) 2018). While it is initially proposed to model char flip, it can also be applied to word substitutions. We implement its word-level version for comparison. (iii) Ady 12-ball (Miyato et al.] (017). It first normalizes the word vectors and then generates perturbations inside a 12-ball for adversarial training. We implement it with word level ba-ball and radius e varying from 0.1 to 1. We only plot the best performance among different e. (iv) Axis aligned bound (Jia et al. 2019). It models perturbations by an axis-aligned box and uses bound propagation for robust training. (v) ASCC-defense, We set the aaper-parameters a 10 and 3 For fair comparisons, KL term employed for all compared adversarial training based methods. More implementation details well as runtime analysis can be found in the Appendix A.
Attack algorithms. We employ the following two powerful attack methods to examine the ro- bustness: (i) Genetic attack (Alzantot et al.) 2018) maintains population to generate attacks in an evolving way. Aligned with Jia et al. (2019), we set the population size as 60 to run for 40 itera- tions. (ii) PWWS attack (Ren al. 2019) calculates the saliency of each word and then substitutes greedily. Aligned with Alzantot et al. (2018) and Jia et al. (2019), ) we do not attack premise on SNLI.
Substitution set. For fair comparisons with state-of-ther of thethe-attaae-- art defense Jia et al. (2019), we follow their setting to use substitution set from Alzantot et al.) (2018). We apply the same language model constraint Genetic in Jia al. (2019), while do not apply it on PWWS attacks. As aim using prevailing setting to compare with the state-of-the thete--rsss we do not focus on how to construct the substitution set in this work and leave for future exploration.
4.2 MAIN RESULT
Aligned with Jia et al. 2019). we evaluate robustness on 1000 randomly selected examples from the test set of IMDB, and all 9824 test examples from SNLI. As shown in Tab our method achieves leading robustness across all architectures with significant margins. For example, on IMDB, we surpass LSTM-based runner-up method by 6.5% under Genetic and 10.4% under PWWS attacks.
7

---

Published as a conference paper at ICLR 2021
Table 3: Accuracy (%) of models initialized with different word vectors without any other defense technique. GloVe denotes the word vectors from Pennington et al. (2014). "First order V denotes word vectors trained by Ebrahimi al. (2018). "ASCC-V" denotes word vectors trained by ASCC- defense. We freeze the pre-trained word vectors during normal training.
Word vector
Model
Vanilla
Genetic
Word vector
Model
Vanilla
Genetic
GloVe
LSTM
88.5
7.9
GloVe
BOW
80.1
35.8
First order V
LSTM
85.3
65.6
First order V
BOW
79.3
62.1
ASCC-V
LSTM
84.1
73.4
ASCC-V
BOW
77.9
69.6
GloVe
CNN
86.4
8.6
GloVe
DCOMP
82.6
41.8
First order V
CNN
83.1
44.7
First order V
DCOMP
78.7
62.8
ASCC-V
CNN
84.2
72.0
ASCC-V
DCOMP
77.8
72.1
(a) Accuracy (%) under attacks on IMDB.
(b) Accuracy (%)
under attacks on SNLI.
Plus, the robust performance of ASCC-defense is consistent against different attacks: e.g., IMDB, LSTM-based ASCC-defense achieves 79.0% under Genetic attacks and 77.1% under PWWS at- tacks, which shows ASCC-defense does not rely on over-fitting addition to robust accuracy, we also plot the tradeoff between robustness and accuracy in F which shows method trade off some accuracy for more robustness compared to the state- of-the-art. More detailed vanilla accuracy and our performance on BERT (Devlin et al. 2019) are shown in Appendix B.
specific attack algorithm. In
4.3
ON THE REGULARIZATION AND OTHER DISCUSSIONS
Fig[4] qualitatively shows how the proposed regularizer encourages sparsity. After applying the regularization, the resulting is close to a substitution, corresponding better with the discrete nature of textual input. Tab quantitatively shows the influence of the regularization term on robustness. Specifically, when a 10 our method performs the best. As a keeps increasing, ASSC focus too much on the sparsity and thus fail to find strong enough perturbations for robust training.
We now discuss some other intuitive defense methods. The thought of enumerating all combi- nations during training is natural and yet impractical on benchmark datasets; e.g., on IMDB the average number of combinations per input is 6108, Augmenting training with random combinations is also ineffective, since it fails to find hard cases in the exponentially large attack space; e.g., under Genetic ASCC-defense surpasses random augmentation by 46.0% on IMDB and by 7.8% SNLI (more significant margin owes to larger attack space on IMDB). Besides, though simply grouping all substitutions can achieve ensured robustness, it sacrifices discriminative powerness: two words that are not semantically similar will be mapped together just because they are indirectly related by one or more mediators. For instance, grouping defense achieves 71.3% robust accuracy and 71.3% vanilla accuracy on IMDB while ASCC-defense achieves 79.0% and 82.5% respectively.
4.4 ROBUST WORD VECTORS
As mentioned in Sec 3.3 ASCC-defense updates the vector of a word by considering all its substi- tutions, and thus the obtained word vectors are robust in nature. To validate, use the standard training process to train models but with different pre-trained word vectors as initialization. We compare word vectors pre-trained by ASCC-defense with Glove and word vectors pre-trained by Ebrahimi et al. (018) (the best performing setting Miyato et al. (207)) and et al. (211)) is to freeze the word vectors as Glove, which laterally validates our claim about robust word vectors in Scc(.33.. As shown in Tab[] the models initialized by robustly trained word vectors (and fixed during normal training) are robust to attacks without applying any other defense techniques. For example, armed with our robust word vectors, normally trained LSTM-based model can achieve 73.4% under Genetic attacks, whereas using GloVe achieves 7. 7.9%.
In addition, this result also implies of NLP models relate to word vectors significantly. and transferring pre-trained robust word vectors can be more scalable way towards NL.P robustness. For more result, please refer to Appendix B.
perspective towards robustness in NLP: the vulnerabilities
8

---

Published as a conference paper at ICLR 2021
5
RELATED WORK
Though achieved success in many fields, DNNs appear to be susceptible to adversarial examples (Szegedy al. 2013). Initially introduced attack CV models, attack algorithms vary from Lp bounded Goodfellow et al. 2211));CC Carlini & Wagner 2017); Madry et al. (2018), universal pertur- bations Sesoosavi-Dezfoooe et al. 2017 L al, 2019). to wasserstein distance- attack (Wong et al. 2019), while defense techniques for CV models include adversarial
MadniingGoodffllov et al.
2015 Kurakin et al. 2017] Madry et al. 2018), preprocessing (Chen et al.
2018
Yang al. 2019).
and generative classifiers (Li al. 2019 Schott al. 2019 Dong al.
2020
Recently, various classes NLP adversarial attacks have been proposed. Typical methods consider
char-level manipulations (Hosseini al.) 2017 Ebrahimi et al. 2018 Belinkov & Bisk 2018 Gao
itt al. 2018 Eger et al. [219]] Pruthi et al. 2019). Another line of thought focus on deleting, adding,
swapping words (lyyer al. 2018 Ribeiro et al.,
val.,,200) 2018: Jia & Liang 2017 Zhao al. 2018
In contrast to char-level and sequence-level manipulations, word substitutions consider prior knowl- edge to preserve semantics and syntactics, such synonyms from WordNet (Miller, [998). Se-
memes (Bloomfield) Dong et al.] 2006). and neighborhood relationships (Alzantot et al. 2018)
Some focus on heuristic searching the textual space (Alzantot al.) 2018 Liang [al.[[201 Ren
et al. 2019 Jin et al. 2020; Zhang et al., 2019b Zang et al. (020). while (Papernot et al. 2016bb
Gong al. 2018) propose leverage gradients for adversary generation the vector space.
As for defense against adversarial word substitutions, Ebrahimi
E et al. (2018) find substitutions by
first-order approximation. MMyato et al. (2017). Barham & Feizi (2019) and Sato al. (2018) use l2-ball to model perturbations, while Jia et al. (2019) and Huang et al. (2019) use axis-aligned bound. Zhou al. (2020) sample from Dirichlet distribution to initialize a convex combination of substitutions, but the sparsity might be lost during adversary generation. Our work differs as we model the convex hull with sparsity by entropy function, and the sparsity is enforced during the whole process, which makes our captured geometry of substitutions more precise.
CONCLUSION
In this paper, we proposed novel method use the convex hull capture and defense against adversarial word substitutions. Our method yields models that consistently surpass the state-of-the- arts across datasets and architectures. The experimental results further demonstrated that the word vectors themselves can be vulnerable and our method gives rise to robust word vectors that can enforce robustness without applying any other defense techniques. As such, we hope this work can be a stepping stone towards even broader robustness in NLP.
ACKNOWLEDGEMENTS
This work is supported by the National Science Fund for Distinguished Young Scholars (No. 62025603), and the National Natural Science Foundation of China (No. U1705262, No. 62072386, No. 62072387, No. 62072389, No. 62002305, No. 61772443, No. 61802324, and No. 61702136).
REFERENCES
Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, and Kai-Wei Chang. Generating natural language adversarial examples. EMNLP, 2018.
Samuel Barham and Soheil Feizi. Interpretable adversarial training for text. arXiv preprint arXiv: /2044 2019.
Yonatan Belinkov and Yonatan Bisk. Synthetic and natural noise both break neural machine trans- lation. In ICLR, 2018
Dimitri P Bertsekas. Nonlinear programming. Journal of the Operational Research Society, 48(3): 334-334, 1997.

---

Published as a conference paper at ICLR 2021
Leonard Bloomfield. A set of postulates for the science of language. Language, 2(3).
Samuel Bowman, Gabor Angeli, Christopher Potts, and Christopher Manning. A large anno- tated corpus for learning natural language inference. In EMNLP, 2015.
Sébastien Bubeck. Convex optimization: Algorithms and complexity. arXiv preprint
arXiv:1405.4988) 2014.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In SP. IEEE, 2017.
Augustin Cauchy, Méthode générale pour la résolution des systemes d' d'équations simultanées. Comp. Rend. Sci. Paris, 25(1847):536-338, 1847.
Jiefeng Chen, Xi Wu, Yingyu Liang, and Somesh Jha. Improving adversarial robustness by data- specific discretization. CoRR, obs//805.07816, 2018.
Adele Cutler and Leo Breiman. Archetypal analysis. Technometries, 36(4):338-347, 1994.
Jacob Devlin, Ming- Beig Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In NAACL, 2019.
Xinshuai Dong, Hong Liu, Rongrong Ji, Liujuan Cao, Qixiang Ye, Jianzhuang Liu, and Qi Tian. Api-net: Robust generative classifier via a single discriminator. In ECCV, 2020.
Zhendong Dong, Qiang Dong, and Changling Hao. Hownet and the computation of meaning. 2006.
Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. Hotflip: White-box adversarial examples for text classification. In ACL. 2018.
Steffen Eger, Gözde Gül Sahin, Andreas Rücklé, Ji-Ung Lee, Claudia Schulz, Mohsen Mesgar, Krishnkant Swarnkar, Edwin Simpson, and Iryna Gurevych. Text processing like humans do: Visually attacking and shielding nlp systems. arXiv preprint arXiv: 1508, 2019.
Marguerite Frank and Philip Wolfe. An algorithm for quadratic programming. Naval research logistics quarterly, 3(1-2)995-10, 1956.
Gao, Jack Lanchantin, Mary Lou Soffa, and Yanjun Qi. Black-box generation adversarial text sequences to evade deep learning classifiers. In SPW. IEEE, 2018.
Zhitao Gong, Wenlu Wang, Bo Li, Dawn Song, and Wei-Shinn Ku. Adversarial texts with gradient methods. urXiv preprini 1rXivv/801.07111 2018
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy, Explaining and harnessing adversarial examples. In /CLR, 2015.
Hossein Hosseini, Sreeram Kannan, Baosen Zhang, and Radha Poovendran. Deceiving google's perspective api built for detecting toxic comments. arXiv preprint arXiv: 2017.
Po-Sen Huang, Robert Stanforth, Johannes Welbl, Chris Dyer, Dani Yogatama, Sven Gowal, Krish- namurthy Dvijotham, and Pushmeet Kohli. Achieving verified robustness to symbol substitutions via interval bound propagation. In EMNLP. 2019.
Mohit lyyer, John Wieting, Kevin Gimpel, and Luke Zettlemoyer. Adversarial example generation with syntactically controlled paraphrase networks. In NAACL, 2018.
Prateek Jain and Purushottam Kar. Non-convex optimization for machine learning. arXiv preprint arXiv:1712.07897, 2017.
Robin Jia and Percy Liang. Adversarial examples for evaluating reading comprehension systems. In EMNLP, 2017.
Robin Jia, Aditi Raghunathan. Kerem Göksel, and Percy Liang. Certified robustness to adversarial word substitutions. In EMNLP, 2019.
10

---

Published as a conference paper at ICLR 2021
Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. Is bert really robust? natural language attack on text classification and entailment. AAAI, 2020.
Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint Drxiiv:141.. 6980, 2014.
J Zico Kolter and Marcus A Maloof. Learning to detect and classify malicious executables in the wild. Journal of Machine Learning Research, 7(Dec):2721-2744 2006.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In ICLR, 2017.
Yingzhen Li, John Bradshaw, and Yash Sharma. Are generative classifiers more robust to adversarial attacks? In ICMM., 2019.
Bin Liang Hongcheng Li, Miaoqiang Su, Pan Bian, Xirong Li, and Wenchang Shi. Deep text classification can be fooled. arXiv preprint 0rXiv:1704.08000 2017.
Hong Liu, Rongrong Ji, Jie Li, Baochang Zhang, Yue Gao, Yongjian Wu, and Feiyue Huang. Uni- versal adversarial perturbation via prior driven uncertainty approximation. ICCV, 2019.
Andrew L. Maas, Raymond E. Daly, Peter Pham, Dan Huang, Andrew Y. Ng. and Christopher Potts. Learning word vectors for sentiment analysis. In ACL,, 2011.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018.
George A Miller. WordNet: An electronic lexical database. MIT press, 1998.
Takeru Miyato, Andrew M Dai, and Ian Goodfellow. Adversarial training methods for semi- supervised text classification. In ICLR, 2017.
Takeru Miyato, Shin-ichi Maeda, Masanori Koyama, and Shin Ishii. Virtual adversarial training: a regularization method for supervised and remii-upervised learning. IEEE transactions on pattern analysis and machine intelligence, 11(8):197--199 2018.
Seyed-Mohsen Moosavi-Dezfooli
Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In CVPR, 2017.
Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Berkay Celik, and Ananthram Swami. The limitations of deep learning in adversarial settings. In EuroS&P. IEEE, 2016a.
Nicolas Papernot, Patrick McDaniel, Ananthram Swami, and Richard Harang. Crafting adversarial input sequences for recurrent neural networks. In MILCOM, 2016b.
Ankur Parikh, Oscar Täckström, Dipanjan Das, and Jakob Uszkoreit. A decomposable attention model for natural language inference. EMNLP, 2016.
Jeffrey Pennington, Richard Socher, and Christopher Manning. Glove: Global vectors for word representation. In EMNLP, pp. 1532-1543, 1543, 2014.
Danish Pruthi, Bhuwan Dhingra, and Zachary C Lipton. Combating adversarial misspellings with robust word recognition. In ACL, 2019.
Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. Generating natural language adversarial examples through probability weighted word saliency. In ACL, 2019.
Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. Semantically equivalent adversarial rules for debugging nlp models. In ACL, 2018.
Motoki Sato, Jun Suzuki, Hiroyuki Shindo, and Yuji Matsumoto. Interpretable adversarial pertur- bation in input embedding space for text. In IJCAI, 2018.
Lukas Schott, Jonas Rauber, Matthias Bethge, and Wieland Brendel. Towards the first adversarially robust neural network model on mnist. In ICLR, 2019.

---

Published as a conference paper at ICLR 2021
Gianluca Stringhini, Christopher Kruegel, and Giovanni Vigna. Detecting spammers social net- works. In ACSAC, pp. 1-9, 2010.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2013.
Eric Wong, Frank R Schmidt, and Zico Kolter. Wasserstein adversarial examples via projected sinkhorn iterations. In ICML, 2019.
Yuzhe Yang, Guo Zhang, Dina Katabi, and Zhi Xu. Me-net: Towards effective adversarial robustness with matrix estimation. In ICML, 2019.
Yuan Zang, Fanchao Qi, Chenghao Yang, Zhiyuan Liu, Meng Zhang, Qun Liu, and Maosong Sun. Word-level textual adversarial attacking as combinatorial optimization. ACL, 2020.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML, 2019a.
Huangzhao Zhang, Hao Zhou, Ning Miao, and Lei Li. Generating fluent adversarial examples for natural languages. In ACL, 2019b.
Zhengli Zhao, Dheeru Dua, and Sameer Singh. Generating natural adversarial examples. In ICLR, 2018.
Yi Zhou, Xiaoqing Zheng, Cho-Jui Hsieh, Kai-wei Chang, and Xuanjing Huang. Defense against adversarial attacks in nlp via dirichlet neighborhood ensemble. arXiv preprint arXiv: 2tt::2000.11622. 2020.
A APPENDIX
A.1 IMPLEMENTATION DETAILS
Text processing. We employ the tokenizer from NLTK and ignore all punctuation marks when tokenizing the textual input. We set the maximum length of input as 300 for IMDB and S0 for SNLI. For unknown words, we set them as "NULL" token.
Hyper-parameters and optimization. We a as 10 and 3 as 4 for the training procedure defined in 12. To generate adversaries for robust training, we employ Adam optimizer with a learning rate of 10 and weight decay of 0.00002 to run for 10 iterations To update & and 6, we also employ Adam optimizer, the parameters of which differ between architectures and will be discussed as follows.
We use 1-d convolutional layer with kernal size of 3 to extract features and then make predictions. We set the batch-size as 64 and use Adam optimizer with a learning rate of 0.005 and weight decay of 0.0002. (ii) Bi-LSTM for IMDB: We use bi-directional LSTM layer to process the input sequence, and then use the last hidden state to make predictions. We set the batch-size 64 and use Adam optimizer with learning rate of 0.005 and a weight decay of 0.0002. (iii) BOW for SNLI: We first sum up the word vectors at the dimension of sequence and concat the encoding of the premise and the hypothesis. Then we employ MLP of 3 layers to predict the label. We set the batch-size as 512 and use Adam optimizer with a learning rate of 0.0005 and weight decay of 0.0002. (iv) DECOMPATTN for SNLI: We first generates context-aware vectors and then employ MLP of layers to make predictions given the context- aware vectors. We set the batch-size as 256 and use Adam with a learning rate of 0.0005 and weight decay of O.
Architecture parameters (i) CNN for IMDB:
A.2 RUNTIME ANALYSIS
All models are trained using the GeForce GTX1080 GPU. (i) As for IMDB, it takes about 1.5 GPU hours to train CNN-based model and 2 GPU hours for a LSTM-based model. (ii) As for SNLI, it takes about 12 GPU hours to train a BOW-based model and 15 GPU hours for DECOMPATTN- based model.
12

---

Published as a conference paper at ICLR 2021
Table 4: Vanilla accuracy(%) of different defense methods on IMDB
and SNLI (
Method
Model
Vanilla accuracy
Method
Model
Vanilla accuracy
Standard
LSTM
88.5
Standard
BOW
80.1
CNN
87.2
DECOMP
82.6
First-order aprx
LSTM
83.2
First-order aprx
BOW
78.2
CNN
80.3
DECOMP
77.6
Adv 12-ball
LSTM
84.6
Adv 12-ball
BOW
74.8
CNN
84.5
DECOMP
73.5
Axis-aligned
LSTM
76.8
Axis-aligned
BOW
79.4
CNN
81.0
DECOMP
77.1
ASCC-delense
LSTM
82.5
ASCC-defense
BOW
77.2
CNN
81.7
DECOMP
76.3
(a) Vanilla accuracy (%) on IMDB.
(h) Vanilla accuracy (%) on SNLI
Table 5: Vanilla and robust accuracy (%) of the proposed method on BERT
Method Standard
Dataset
Model
Vanilla accuracy Under Genetic attack
IMDB
BERT
92.2
16.4
ASCC-defense
IMDB
BERT
77.5
70.2
B ADDITIONAL EXPERIMENTAL RESULT
B.1 VANILLA ACCURACY AND ROBUST ACCURACY UNDER GENETIC ATTACKS WITHOUT CONSTRAINT
In Tab we have plotted the robust accuracy under attacks to compare with state-of-the-arts. Here we plot the vanilla accuracy of all compared methods in Tab as an addition. Aligned with Tab the parameters of each compared method here are chosen to have the best robust accuracy instead of vanilla accuracy.
In our main result in T for fair comparisons we align our setting with SOTA defense Jia et al., where genetic attacks are constrained by a language model. Here we plot our performance under genetic attacks without any language model constraint addition: ASCC-defense achieves 76.7% robust accuracy under Genetic without constraint on IMDB based on LSTM, and 72.8% on SNLI based on BOW.
B.2 PERFORMANCE ON BERT
ASCC-defense models perturbations at word-vecotr level, and thus it can be applied to architec- tures like Transformers, as long as it uses word embeding as its first layer. To validate, we conduct experiments BERT (bert-base-uncaat As shown in T ASCC-defense enhances the robustness of BERT model significantly. Specifi- cally, BERT finetuned by standard method IMDB achieves 16.4% robust accuracy under Genetic attacks, while using the proposed defe-ee achieves 70.2%.
using standard training and ASCC-defense respectively.
Table 6: Accuracy (%) of normally trained models initialized with and freezed by the proposed robust word vectors. For example, pre-trained on LSTM means the word vectors are pre-trained by bSsd- ASCC-defense and applied CNN means the pre-trained word vectors are used to initialize CNN model to perform normal training.
Pre-trained Applied to
Vanilla
Genetic
Pre- Fre-trained Applied to Vanilla
Genetic
L.STM
LSTM
84.1
73.4
DECOMP DECOMP
DECOMP
77.8
72.1
LSTM
CNN
78.5
71.9
BOW
77.2
70.5
(a) Accuracy (%) under attacks on IMDB.
(b) Accuracy (%) under attacks on SNL.
13

---

Published as a conference paper at ICLR 2021
B.3 REDUCED PERTURBATION REGION
In this section, we show the reduced perturbation region by using convex hull compared to 12-ball and hyper-rectangle. To make the result more intuitive, we first project word vectors into 2D space by SVD, and than calculate the average area of each modeling (to rule out irrelevant factors, we use word vectors from GloVe and consider words whose substitution We choose the smallest 12-ball and hyper-rectangle that contain all substitutions to compare with convex hull. The result shows that using convex hull reduce the perturbation region significantly. Specificaly, the average ratio of the area modeled by convex hull to the area modeled by hyper- rectangle is 29.2%, and the average ratio of the area modeled by convex hull to area modeled by 12-ball area is 8.4%.
are of the same size).
B.4 CROSS PROSS-ARCHITECTURES PERFORMANCE ROBUST WORD VECTORS
As discussed in Sec.4.4, our robustly trained word vectors can enforce the robustness of a normally trained model without applying any other defense techniques. In this section, aim examine whether such a gain of robustness over-fits to specific architecture. To this end, we first employ ASCC-defense obtain robust word vectors and then fix the word vectors as the initialization of an- other model based on different architecture to perform normal training. We examine the accuracy under attacks. As shown in Tab our robustly trained word vectors consistently enhance the robust- ness of a normally trained model based on different architectures. For example, though trained by LSTM-based model, the robust word vectors can still enforce CNN-based model to achieve robust accuracy of 71.9% under Genetic attacks (whereas initializing by GloVe achieves 8.6%), demon- strating the across-aree architecture transferability of the robustness of our pre- me-trained word vectors.
14


Reviews:
[{"review_id": "LtXtj5MrBrS", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The authors answered my questions so I am increasing my score to 7. \n\n-----\n\nThe paper presents a new defense for being robust to adversarial examples in NLP. This is a very exciting topic and I am glad to see more work in this space.\n\nThe paper presents a technique to make the model robust to word substitutions coming from a set S(u). The authors propose to use a convex hull which the authors claim is a better bound than using l2-ball or axis-aligned rectangles. \n\nThe authors derive a optimization objective for their problem and show experimental results that shows their model achieves higher performance under two types of attacks (Genetic and PWWS) on the IMDB and SNLI datasets for various standard neural architectures. \n\n\nI have a couple of questions:\n\n(1) Is this setting different than the one explored in Jia et al. 2019 (Certified Robustness to Adversarial Word Substitutions)?\n\nIt seems Jia et al. 2019 explores the case where multiple positions in the sentence can be perturbed whereas here only one word can be perturbed? I think clarifying this and discussing its implications would be useful for the reader.\n\n(2) In training does the model have access to the set of all possible substitutions S(u) or not? \n\n\n\n\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "E3JfPDtEHRg", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary:\nIn this paper, the authors aim to build a robust model against word substitution attacks. Unlike previous work, they consider a convex hull as the perturbation region instead of a norm-ball or a hyper-rectangle. From their derivation, perturbed words can be viewed as the linear combinations of substitutions and perturbations can be viewed as the corresponding normalized weights. Therefore, they can adversarially train the perturbations and model to obtain a robust model and robust word embeddings. The authors also design a regularizer to encourage the sparsity on perturbation weights. The experimental results show that the proposed model is indeed more robust than other baselines. In addition, they show that the learned word embedding can be a good initialization for training robust models.\n\nI very like the idea to convert the perturbations into the linear combination weights. I only have some minor questions:\n- Can the proposed method be applied to more complex models, such as Transformer?\n-Can the proposed technique be extended to optimize the certification bound (the lower bound of robust accuracy)?\n- Maybe it is interesting to report the percentage of reduced perturbation region by using the convex hull rather than norm-ball or hyper-rectangle.", "extra_scores": {}, "extra_text": {}}, {"review_id": "1vS_ZLl5dfg", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "*Summary of the paper*: This paper studies the problem of robustness against word substitutions. The authors propose a novel Adversarial Sparse Convex Combination (ASCC) method in which they model the word substitution attack space as a convex hull and leverages a regularization term to enforce perturbation towards an actual substitution. Based on the ASCC, they also propose ASCC-defense, which leverages ASCC to generate worst-case perturbations and incorporates adversarial training towards robustness. Experimental results show that their method outperforms the existing SOTA on two tasks -- sentiment analysis and natural language inference.\n\n*Strength of the paper*:  \n1. The idea proposed in the paper is quite straightforward yet effective. Using a convex hull could satisfy the three aspects as stated by the authors -- Inclusiveness, Exclusiveness, and Optimization. The experimental results do show the advantage of using the proposed convex hull.\n\n2. Besides the robustness of the model, it also achieves robustness over word vectors.\n\n3. The experiments are well designed including both qualitative analysis, quantitative results, and reasonable ablation to show the effectiveness of their method. In general, the paper is well-structured and easy to follow.\n\n*Question for the authors*: \n\n1. I am curious about how much headroom there still exists for this task? Let's say if we have a perfect way to defend against such kind of attacks, how good are the current approaches?\n\n2. What is the computational cost of the proposed method compared to others? In equation (3), the authors compute $w_{ij}$ through a softmax parameterized by $\\hat{w_{ij}}$. If the substitution set of a word is infinite or too large, how are you going to deal with such kind of situations?\n\n3. Seen from Table 1, the proposed method is much better than other models at PWWS attacks than the genetic attacks. Can you give an intuitive explanation of why? \n\n*Reason for score*: Overall, I vote for accepting this paper. I like the idea of using a convex hull and the way they regularize the model to achieve sparsity. It would be helpful if the authors could address the questions raised above.", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: All three reviewers are positive, and the authors have addressed essentially all the questions raised by the reviewers. The main insight of the paper is clear, and the empirical results are good, so a spotlight is deserved.
Decision: Accept (Spotlight)