TextShield: Beyond Successfully Detecting Adversarial Sentences in text classification
Authors: Lingfeng Shen
Ze Zhang
Haiyun Jiang
Ying Chen
Venue: ICLR 2023 poster (2023)
Keywords: Natural language processing
Adversarial defense
Adversarial attack
Text Classification

Abstract: Adversarial attack serves as a major challenge for neural network models in NLP, which precludes the model's deployment in safety-critical applications. A recent line of work, detection-based defense, aims to distinguish adversarial sentences from benign ones. However, {the core limitation of previous detection methods is being incapable of giving correct predictions on adversarial sentences unlike defense methods from other paradigms.} To solve this issue, this paper proposes TextShield: (1) we discover a link between text attack and saliency information, and then we propose a saliency-based detector, which can effectively detect whether an input sentence is adversarial or not. (2) We design a saliency-based corrector, which converts the detected adversary sentences to benign ones. By combining the saliency-based detector and corrector, TextShield extends the detection-only paradigm to a detection-correction paradigm, thus filling the gap in the existing detection-based defense. Comprehensive experiments show that (a) TextShield consistently achieves higher or comparable performance than state-of-the-art defense methods across various attacks on different benchmarks. (b) our saliency-based detector outperforms existing detectors for detecting adversarial sentences.

Published as a conference paper at ICLR 2023
TEXTSHIELD: BEYOND SUCCESSFULLY DETECTING ADVERSARIAL SENTENCES IN TEXT CLASSIFICATION
Lingfeng Shen Ze Zhang² Haiyun Jiang" Ying Chen
JJhnn Hopkins University TTinnhua University
Tencent AI Lab
*College of Information and Electrical Engineering, China Agricultural University (starkshen33333 haiyunjiang1 httpriiinng@@eeeeeeeee ateceent. com
com
chenying@cau.ed
ABSTRACT
Adversarial attack serves major challenge for neural network models in NLP, which precludes the model's deployment in safety-critical applications. A recent line of work, setection-based defense, aims to distinguish adversarial sentences from benign ones. However, the core limitation of previous detection methods is being incapable of giving correct predictions on adversarial sentences unlike de- fense methods from other paradigms. To solve this issue, this paper proposes TextShield: (1) we discover a link between text attack and saliency informa- tion, and then we propose a saliency-based detector, which can effectively de- tect whether an input sentence is adversarial or not. (2) We design a saliency- based corrector, which converts the detected adversary sentences to benign ones. By combining the saliency-based detector and corrector, TextShield extends the detection-only paradigm a detection--oorrection paradigm, thus filling the gap in the existing detection-base based defense. Comprehensive experiments show that (a) TextShield consistently achieves higher or comparable performance than state-of- the-art defense methods across various attacks on different benchmarks. (b) our saliency- based detector outperforms existing detectors for detecting adversary.
INTRODUCTION
Deep Neural Networks (DNNs) have obtained great progress in the field of natural language pro- cessing (NLP) but are vulnerable to adversarial attacks, leading to security and safety concerns, and research on defense algorithms against such attacks is urgently needed. Specifically, the most com- mon attack for NLP is word-level attack (Wang et al., 2019b] Garg & Ramakrishnan 2020 Zang ct al. 2020 Li et al. 2021). which is usually implemented by adding, deleting or substituting words within sentence. Such attack often brings catastrophic performance degradation to DNN-based models. Therefore, we choose to study defending against word-level attacks] in this paper.
Although number of defense methods can be found in the literature of NLP (Jia et 2019 Ko ct al. 2019: Jones et al. 2020 Wang et al., 2020b Zhou et al. [022 Dong et al. 2021 Bao el al., 2021 there are remaining several unsolved research problems. One problem lies in the neffecttve application of the existing detection- based defense paradigm to the adversarial defense scenario, which consists of two steps: adversarial detection that detects whether an input sentence is adversar- ial or not, and model prediction that predicts a label for the input. Notice that the model prediction usually specific for a practical application, e.g., different text elassification tasks used this paper. However, the detection-basee defense paradigm only focuses make efforts to adversarial sentence prediction. That is, even if adversarial detection can successfully detect adversarial sentences, correctly predicting such adversaries remains incapable. Considering that an adversarial sentence is usually generated through adding an imperceptible perturbation into a benign sentence, we believe a practical defense paradigm should have another operation, correc- tion that transforms the adversarial sentence into the benign sentence as much as possible, and then
adversarial detection and does not
"This work is done during Lingfeng's 's internship at Tencent AI Lab, frefers to the corresponding authors. 'Through the rest of the paper, text attack specifically refers word-level text attacks.

---

Published as a conference paper at ICLR 2023
use the corrected adversarial sentence for the model prediction. Therefore, considering the paradigm problem, we propose a deteetion-coorectti defense method in this paper.
Another problem is that most existing defense methods rely either word frequency diction logits to detect adversarial sentences (Mozes et al., 202T, Mosca et al., 2022 One may wonder whether any other information discover that the mechanism of text attack is related to saliency, a measure used in the explainability of DNNs (Simonyan et al., 2013). Based on such discovery, we propose the saliency-based detector to enhance adversarial detection.
pre-
be leveraged for adversarial detection. In this paper,
Overall, to address the two issues, in this paper, build our TextShield, defense method consist- ing of a detector and corrector. Motivated by the link between ad sentence and saliency, we define a metric called adaptive word importance (AWI) based on saliency computation (Simonyan et al.. 2013), and then design the detector and corrector based on AWI. Specifically, the detector com- bines four saliency-base -based sub-detectors inform whether an input sentence adversarial, where the four sub-detector utilize four saliency computation methods (Simonyan et al. 2013 (Springenberg ct al. 2015 Bach et al., 2013; Sundararajan al., 2017) to calculate AWI, respectively. Then, if the detector recognizes the input as adversarial, the corrector rectifies the words with high adversarial probabilities in the sentence by their high-frequency synonyms, where the adversarial probability is determined by AWI. Finally, the corrected sentence is used for model prediction. Our extensive ex- periments demonstrate that TextShield can effectively defend against adversarial attacks on several text classification benchmarks.
Our main contribution are listed as follows:
We design a defense method, TextShield, which extends the existing detection-based de- fense paradigm to detection-correction paradigm. The incorporation of a corrector in TextShield resolves the model prediction incapability problem in detection- defense.
We discover another word-level information for detecting adversarial sentences, saliency, and then design detector based on adaptive word importance (AWT), novel metric based on saliency computation. Furthermore, AWI is also used to design the corrector.
Comprehensive experiments demonstrate that our TextShield performs comparably or bet- ter than SoTA defense methods under various victim classifiers on several text classification benchmarks.
RELATED WORK
In recent years, many adversarial attack methods have been proposed for NLP, different from back- door attacks Chen et al. (2017); Liu et al. (2017); Wang al. (2019a); Li et al. (200cc); Shen et al. (022a)). adversarial attacks try to modify the text data while making them less perceptible by hu- mans. Coarsely, these attacks modifies the text data character level (Belinkov & Bisk
2018 Eger et al. 2019 He et al. 2021), word level (Alzantot et al. 2018 Zhang et al. 2021 Wang et al. 2022) or sentence level (Jia & Liang 2017, Ribiiio Ribeiro et al. 2018 Zhang al. 2019b Lin al. (021) Since word-level text attack is the most common and effective attack for text classification, in this paper, we focus on defense methods against word-level text attacks, which can be categorized into three paradigms: (1) model--nhanneemen--eeee based, (2) prrtffidd-robustnes--bbee
and (3) detection-basee based.
Model enhancement is common way improve model's 's robustness against text attacks, and one popular way is adversarial training which re- te-trains victim model with extra adversarial examples to obtain an enhanced model. Alzznnoot et al. (2018); Ren et al. (2019) generated adversarial ex- amples by an attack method and re-trained models more robust against the attack. More successful defense based on model enhancement can be regarded as synonym encoding (L.e et al. [021] Dong al. 2021; Wang al., 2221a), series of methods defend text attacks through setting the same embedding for different synonyms. Unfortunately, the robustness of re-trained models is often deter- mined by the diversity of adversarial examples used in re-training (Shen et al. 2022b). As result, adversarial training is vulnerable to unknown attacks.
Besides. a stream of recent popular defense methods (Huang et al. 2019 Jia et al. 2019) concen- trates on certified robustness, which ensures models are robust to all potential word perturbations within the constraints. However, because of the extreme time cost in the training stage, certified
2

---

Published as a conference paper at ICLR 2023
bustness is more difficult to be applied to complex models compared to other paradigms of defenses. For example, IBP (Jia et al. 2019) performed catastrophically on large pre-trained language models.
Recently, some excellent works have designed detection- defense methods. For example, Mozes et al. (02I) used the word frequency difference to design detectors: Le et al. (02T) designed detector specific for the 'Universal trigger'; Mosca et al. (2022) proposed detection method by leveraging prediction logits. Despite their success, such detection-based defense methods own a key issue: the incapability of correctly classifying adversarial sentences. An intuitive and straight- forward idea is to design a corrector to convert adversarial sentences to their original benign ones, which has proved effective in the the field of computer vision (CV) (Liu et al.) 2019 Qin et al., 2019 Li et al. 2020bb Deng et al.) (021). However, the different essence between languages and pixels makes correctors used in CV not transferable in NL.. In this paper, based on the generation mechanism of adversarial sentences, we design proper detector and corrector for text attacks.
3 BACKGROUND
In this section, we present basic definitions used in adversarial text attack and saliency computation.
Ad Adversarial text attack In text classification scenario, X = (w....., w.) is sentence with d words, and Wi,-.., W. are the corresponding embeddings. Given a text classifier F, F(X) denotes the probability distribution over the class set y for input sentence X. Then, class yj with the largest probability in F(X) is selected as the prediction of X. Furthermore, in a word-level text attack for a text classification scenario, there a victim classifier F' and text attack G.
Victim Classifier: Given a set of benign sentences in a text classification benchmark, the victim classifier F can be trained with the benign sentences, where the sentence encoder is usually selected as TexICNN (Kim 2014), LSTM (Hochreiter & Schmidhuber] 1997) or BERT (Devlin et al. 2019).
Text Attack: For a benign sentence X with true label yj. the text attack G' generates an adversarial sentence X = (X)) by substituting words w; in X with wi, satisfying: (1) F(X*) and F(X) output different predicted labels; (2) Dist (W,, w?) < 8, where Dist(; :) is a distance metric and 8 is a threshold to limit the distance.
Saliency computation In the field of explainability of DNNs, saliency map is common technique to identify input features that are most salient. In other words, these input features cause a maximum influence on the model's output. Specifically, saliency is a measure that quantifies the sensitivity of an output class for an input feature in a DNN-based model, and a saliency map is a transparent colored heatmap overlaid on the input features.
Furthermore, back- propagation based methods, which have been widely used to compute saliency in the explainability of DNNs, treat saliency as the gradient of DNN-based model. There are different ways to calculate gradients based on gradient signals passed from output to input during model training, which leads to different saliency computation methods. For example, in the vanilla et al.) 2013), saliency is directly defined the partial derivative of the network output concerning each input feature scaled by its value. Formally, given a classifier F and a sentence X containing words w,, the saliency of w, to prediction y is defined as follows:
gradient (VG) method (Simonyan
OF ys (X)
Tij
(1)
Ow:
where Fyy (X) is the prediction confidence for yj when applying F on X.
4 MOTIVATION AND INTUITION
This section illustrates intuitions that motivate us design TextShield. Firstly, we present our basic derivations to show a cross-cutting connection between adversarial robustness and saliency. Then, define adaptive word importance (AWI), metric that helps to detect adversarial sentences.
3

---

Published as a conference paper at ICLR 2023
4.1 THE CONNECTION BETWEEN ADVERSARIAL ROBUSTNESS AND SALIENCY
In this part, we explain why saliency is highly related to adversarial robustness, indicating there is connection between adversarial robustness and saliency. Given victim classifier F and a benign sentence X with label y/ predicted by F, the objective of a text attack that generates an adversarial sentence X with wrong predicted label (namely yı) defined as follows:
arg min (Fy, (
where a loss function (e.g., cross-entropy loss). a vanilla gradient- based attack (Goodfellow et al. 2014), Eq optimized by gradient descent method. Specifically, in each iteration of the attack, word wy is substituted with a word whose embedding is closest to W,. In other words, word embedding wi is perturbed with step rate by the attack, which is defined follows:
wi O Ms (X),
Ow,
In ease of clarification, we regard the word embeddings continuous variables. Then, based dc(Fy, (x)..)) and rewrite it follows:
Eq we can further derive the term w, r1
Ow:
OC(F,, b3 (X),
W1 T1
|mag
(4)
OF, 8. (X)
As shown in Eq words with larger |nyy are perturbed more severely by the attack, indicating that saliency Irayl may serve key for adversary detection.
4.2 ADAPTIVE WORD IMPORTANCE
Inspired from previous analysis and finding, we design novel metric called adaptive word impor- tance (AWT) based on saliency.
Definition Given sentence X with label yj predicted by classifter F, the adaptive word imporiance (AWI) of word w in the sentence, Rej, is defined as follows:
Rij = [I w4, w4, 85)1
(5)
A is saliency computation method, e.g., VG.
Given sentence X, the (i. j)t element R,j reflects the importance of word w; towards prediction y in victim classifier F. Thus, AWI can reflect the importance of word, and larger AWI value indicates higher importance.
TEXTSHIELD
5.1 OVERVIEW
Based previous analysis, we present TextShield, which like shield in front of the victim classifier, as shown in Figure [ Generally, TextShield has two principal components: a detector and a corrector. The detector is a learning-basee binary classifier that takes sentence as input and outputs whether the input is adversarial or not. The corrector continues to correct adversarial sentences to benign ones, which makes up the blank of previous detection-basse defense methods.
Specifically, given an input sentence X. X is fed to the victim classifier F to get prediction V/- Then the detector is used to judge whether X is adversarial based on prediction yy- If X is benign, the final prediction for X will be yj (i.c., F(X)). Otherwise, a corrector is used to transform X to X', and the final prediction for X will F(X)..
5.2 DETECTOR
As shown in Figure the detector consists of four sub-detectors and one combiner. A sub-detector is a binary classifier that utilizes saliency computation method and a LSTM layer to predict whether input sentence X is adversarial or not. In this paper, four saliency computation methods, vanilla

---

Published as a conference paper at ICLR 2023
X
F F())
F F(X")
Benign
Victim Classifier F
Detector
Corrector
Adversarial
Figure 1: The overview of TextShield. During inference, sentence X firstly fed to the classifier F. Then the detector judges whether X is adversarial. If not, F(X) will be the final prediction. On the contrary, X will be transformed X' by corrector, and the final prediction for X is F(X)..
Salieney Computation
AWI Matrix
LSTM
Combiner
VG
2V6)
(VG)
IG
z06)
R(G)
F(x)
Z
LRP
(LRP)
(LRP))
GBP
ZGBBP)
GBP)
Figure 2: The overview of the detector. The detection can be summarized into three stages: (I): AWI matrices are generated by specific saliency computation methods based F(X) and the classifier F. (II): AWI matrices are fed LSTMs to obtain predictions, e.g., (VG)) (GBP), 2LLPP) and ((G)), (III): The predictions are fed to combiner (a linear layer) to produce final prediction
gradient (VG), guided backpropagation (GBP), layerwise relevance propagation (LRP), and integra- tion gradient (IG), are chosen, which correspond to the four sub-detectors, respectively. Then, the combiner uses linear layer combine four predictions from the four sub-detectors. respectively.
Specifically, for sub-detector based on a saliency computation method I, given an input sentence X, one AWI matrix is calculated for using I, and then the AWI matrix is fed LSTM to obtain a prediction. Takings VG as an example, the VG-based sub-detector is calculated as follows.
(VG) -LSTM, (R((G)
where R.j column of AWI matrix R, and (VG) is a binary prediction from VG-based sub- detector. Similarly, (GBP) (LRP) and (TG) are predictions from GBP-based, LRP-based, and IG-based sub-detectors, respectively. Finally, through a linear combiner, the four binary predictions are combined to give the prediction 2:
(L (GBP), (C)CE) (LRP)) (LRP)),(1G))))
where L is the linear layer and is the label reflecting whether X adversarial.
In the following section, we will present the four saliency computation methods and then give the details of the detector's training.
Vanilla Gradient (VG) For text classifier F, the AWI value of word in sentence X to prediction y is calculated by the vanilla gradient method (Simonyan et 2013) follows:
aF, (X)
R (VG)
Ow;

---

Published as a conference paper at ICLR 2023
(VC) where Ri the jit element of AWI matrix RVVG), is the AWI value of word w; prediction Uj. Py, is the prediction confidence for from F, and wi is the word embedding for word w;- In fact, when calculating R.y (V Fy, is a scalar and wi E R 1iik is a vector, where is the dimension 1ixk
of the word embedding. Thus, yFy,()) is vector with the form Ri*k, and an average operation is made obtain Ry For brevity, we omit the operation in the paper.
Guided Backpropagation (GBP) Following the idea of the vanilla gradient, GBP (Springenberg
at. 2015) chooses only 'positive' (> 0) gradients and discards 'negative' (< 0) gradients. Positive gradients indicate supporting the prediction, while negative ones mean the opposite. Such a choice enables to capture what text classifier F learns and yet discard anything that F does not learn. We take the final outputs of GBP as AWI matrix RGBP
Layerwise Relevance Propagation (LRP) GBP owns an obvious drawback called gradient satu- ration (Bach al., 2015 Binder et al. 2016) that gradients computed by GBP are always zeros un- der some cases. Therefore, Layerwise Relevance Propagation (LRP) (Bach et al. (2015) is proposed, which tackles the problem using a reference input besides the target input to calculate gradients. The LRP method calculates weight for each connection in the gradient chain and uses reference input instead of roughly setting the weights as or 1 like GBP. The reference input a 'neutral' input and will be difffrrnnt in different tasks (c.g., blank images in the CV field or zero embeddings in the NLP field). Finally, such gradients compose AWI matrix RLRP.
Integrated Gradient (IG) LRP is calculating discrete gradients. However, the chain rule does not hold for discrete gradients that LRP has essential drawbacks. Thus, the integrated gradient (IG) (Sundararajan et al. (2117) is proposed, which calculates the influence of word wy to prediction y/ by integrating vanilla gradient, which defined as follows:
R1C) (w; - wi') x So" DF (X, wi' + a (w: wi'))
do
[8]
Ow.
where w/ is zero embedding and Fy, (X, w:' a(w; ws') means that the embedding of word wi, Wi, is replaced with w;' <<w;; wi'). The final outputs of IG is AWI matrix R.G
Training of detector Generally, training the detector consists of the following three steps, where both the adversarial data setup and the balanced data setup prepare data for the model's 's training. More training details are deferred to Appendix A
Adversarial data setup: Given benign data, the victim classifier F is fine-tuned by the data. Then the adversarial attacks are used to generate adversarial sentences and 2,000 adversarial sentences per class that successfully attacks are selected. Moreover, the adver- sarial sentences are equally generated by attacks
Balanced data setup:
The adversarial data and the same-size benign data mixed bal- anced data. Then, the balanced data is split into train-dev-test sets with a 7:2:1 proportion.
Model training: The training data set is fed to train the detector, and the best-performance checkpoint is selected according to performance on the dev data set.
5.3 CORRECTOR
As mentioned in Sec 5.I if the detector recognizes the input sentence X as an adversarial one, then the prediction yy for X possibly inaccurate. Furthermore, as discussed in See 4.1, given an AWI matrix R, larger RAj means word w; is more important for classifying the sentence as yj- In other words, words with large AWI values are more likely be perturbed by attacks to fool the victim classifier. Therefore, the corrector corrects the words with large AWI values in the adversarial sentence. addition, the corrector chooses R.G. as Riz.
We do not train detector with the attack for evaluation. For example, if we evaluate the defense capacity against GA, then it trained with IGA, PWWS, and TextFooler.

---

Published as a conference paper at ICLR 2023
Specifically, for an adversarial sentence X with prediction yj. the corrector regards word Wy suspect when its Ray exceeds a threshold, which is defined as follows:
Ra B (Rmax Rmin) + Rmin
where Rmax and Rmin are the largest and smallest values in R. and 3 is hyper-parameter to control the ratio of suspects. For a suspect w,, the corrector substitutes wy with the most frequent word w' E S(w,), where S(w)) is wy's synonyms, extracted by NLTK (Loper & Bird 2002).
6 EXPERIMENTS ON ADVERSARIAL DEFENSE
In this section, we conduct comprehensive experiments to compare TextShield to baselines.
6.1 EXPERIMENTAL SETTINGS
Firstly, we use TextCNN (Kim 2014), LSTM (Hochreiter & Schmidhuber 1997) and BERT (De- vlin et 2019 as victim classifiers, and select four widely-used text attacks in the NLP field: TL (TextFooler, (Kuleshov et al. 2018)). PWWS (Probability Weighted Word Saliency, Ren et al.) 2019 GA (Genetic Algorithm, Alzantot et al. 2018) and IGA (Improved Genetic Algorithm, Wang et al. 2019c). Moreover, we choose three popular benchmarks in text classification: IMDB Potts 2010). AG's News (Zhang et al., 2015) and Yahoo! Answers (Zhang et al. 2015).
Then, given a victim classifier, an attack and benchmark, we generate test data consisting of benign dataset and an adversarial dataset, which are used to evaluate the generalization and robust- ness of defense methods. Specifically, the benign dataset includes 1,000 benign sentences sampled from the benchmark, and the adversarial dataset includes 1,000 adversarial sentences generated by the attack based on the benchmark. Please note that there is no overlap between the test data and the training data used for the detector's 's training. Finally, we evaluate the performance of the victim models with without defense methods.
Moreover, we compare TextShield with four state-of ofte-offthheart defense methods: (1) IBP (Jia et al, 2019): the most representative method in the certified robustness paradigm. (2) Adversarial Sparse Convex Combination (ASCC) (Dong et al.] 2021): a modellennhancement-baee defense method which leverages convex hull to defend against adversarial word substitutions. (3) Synonym En- coding Method (SEM) (Wang et al. 2021a): moodel-enhancemen--bee defense method based on synonym encoding. (4) Frequency-based Word Substitution (FGWS) (Mozes et al.. 202T): detection-based method which leverages word frequency. (5) Word-level Differential Reaction (WDR) (Mosca et al. 2022): a detection-based method which utilizes prediction logits. Specif- ically, considering that FGWS and WDR are detection-only methods and cannot correctly classify adversarial sentences, we combine our corrector them. The baselines' settings are kept the same with corresponding papers.
6.2 PERFORMANCE
Table T lists the performances of various defense models under different scenarios, which demon- strates both the generalization and the robustness of these defense models.
Effect on generalization When evaluated on benign sentences (see Column 'No' in Table nor- mal training (NT) achieves the best results, and our proposed method, TextShield, achieves accuracy performance close to normal training (NT), indicating a good trade-off between robustness and gen- eralization. By the way, such trade-off is common for attack/defense, which has been theoretically investigated in the CV field (Zhang et al.) 2019a). In addition, generalization can be seen as a proper upper bound for accuracy performance adversarial sentences.
Moreover, among baselines, ASCC performs best, and IBP has lowest accuracy due to its relatively loose bounds. Besides, combined with our corrector, PGWS and WDR obtain comparable per- formances towards ASCC, which indicates that our corrector is effective across different detectors concerning model's generalization.
7

---

Published as a conference paper at ICLR 2023
IMDB
AGNNww
Yahoo
Vietim
Defense
IGA
PWWS
T1.
No
IGA
PWWS
GA
TL
IGA
NI
88.7
13.3
4.4
7.1
2.3
92.3
45.5
37.5
36.0
30.0
68.4
19.6
10.3
13.7
IBP
78.6
72.5
72.5
71.5
65.0
89.4
80.0
80.5
80.5
80.0
64.2
49.4
52.6
59.2
61.0
Text
FGWS
84.7
70.4
68.0
70.2
64.0
84.7
82.0
83.5
82.2
83.4
65.0
57.0
58.0
57.5
60.8
CNN
WDR
85.4
72.5
70.5
71.0
66.5
85.5
84.2
84.4
83.4
83.5
66.0
60.0
60.0
61.5
61.5
ASCC
87.8
68.4
69.1
70.5
69.4
86.7
85.0
83.0
84.0
83.0
64.8
60.7
60.3
62.2
62.4
SEM
86.8
66.4
71.1
72.5
72.4
89.7
86.0
86.0
85.0
86.0
65.8
61.0
60.5
63.0
63.0
ISOOurs)
87.0
74.0
74.2
75.0
74.0
90.8
87.4
87.8
86.8
86.8
67.7
62.0
59.0
63.0
62.0
NT
87.3
8.3
2.2
5.0
3.0
92.6
35.0
30.0
29.0
26.5
71.6
27.6
21.1
15.8
5.5
IBP
79.5
70.0
70.0
69.0
64.5
86.3
79.5
79.5
76.5
79.5
60.2
35.0
33.5
30.0
31.5
LSTM
FGWS
80.9
70.4
71.1
72.9
70.0
87.5
82.5
82.0
82.0
82.0
68.0
58.0
58.2
58.5
58.5
WDR
80.3
70.5
75.0
75.0
71.0
88.0
83.5
84.0
82.0
83.4
66.5
60.0
58.0
60.0
59.5
ASCC
82.8
70.2
75.0
74.0
70.8
88.9
84.6
85.0
82.7
84.0
68.0
58.6
57.9
58.2
55.5
SEM
86.8
72.2
77.0
73.8
90.9
85.5
86.5
85.0
85.5
60.6
60.2
62.5
TS(Ours)
86.0
74.0
79.4
78.6
76.4
91.4
86.6
87.2
87.6
87.0
69.6
62.0
62.6
65.2
65.0
NT
92.3
24.5
40.7
40.0
28.0
94.6
66.5
68.0
58.5
45.5
77.7
31,3
34.3
15.7
10.0
IBP
FGWS
88.7
79.2
80.9
78.0
79.0
93.5
80.2
79.3
85.0
80.0
75.8
58.5
$7.6
59.5
58.0
BERT
WDR
88.5
82.0
82.0
81.5
93.0
82.5
84.0
86.5
83.5
76.5
61.8
62.4
ASCC
88.2
84.3
84.2
84.2
82.0
90.1
83.5
83.5
87.7
87.6
74.5
60.7
62.5
63.5
61.1
SEM
89.5
87.5
88.4
85.5
94.1
88.5
88.5
88.5
88.5
76.2
66.8
66.4
TS(Ours)
88.3
88.4
88.6
90.5
86.5
94.0
90.2
90.0
90.0
89.5
76.0
70.5
69.0
70.0
64.5
Table I: The accuracy (%) of various defense methods on benign and adversarial sentences. Rows (e.g.. NT) represent the defense methods; Columns (e.g., No) represent the attacks that generate adversarial test sentences; No: no attack, NT: Normal Training, TS: TextShield, TL: TextFooler; BLUE is the best performance. Moreover, for fair comparison, as the previous work (Shi et al.) 2019 reported that BERT is too difficult to be tightly verified by IBP, we do not use IBP on BERT.
Effeet on robustness When evaluated on adversarial sentences, TextShield performs best in most cases, demonstrating that TextShield can effectively improve the model's robustness. Furthermore, the enhancement of model's robustness is derived from the leveraging cross-cutting link between adversarial robustness and saliency, which complementary to the conventional opinion (Zhang et al. 2020 Goyal et al. 2022) that text attacks should be better defended using discrete information instead of continuous information.
Moreover, among the baselines, SEM, the state-of-the-art defense method against word-level at- tacks, achieves the best performance. IBP, which was first proposed in the CV domain, is more suitable for TexICNN and does not perform excellently on other vietim classifiers. FGWS focuses only on word frequencies, so it is not sufficient to detect adversarial sentences when word frequency distinct. Moreover, after combining with our corrector, WDR can yield a comparable perfor- mance towards ASCC, a competitive baseline using the indicates our corrector can combine well with existing detectors concerning model's 's robustness.
based paradigm, which
7 EXPERIMENTS ON ADVERSARIAL DETECTION
This section compares our saliency-baa bbased detector to current SoTA adversarial detectors in several configurations involving datasets and attacks.
7.1 EXPERIMENTAL SETTINGS
In the experiments, only BERT (Devlin et al. 2019) is used as victim classifier. Then, four widely used adversarial attacks are selected: GA (Alzantot et al. 2018), PWWS (Ren et al. 2019). IGA (Wang et al.) 2019c) and TextFooler (Jin et al.] 2020). Next, three popular benchmarks in text classification are selected: IMDB (Potts] 2010). AG's News (Zhang et al. 2015) and Yelp (Zhang et al. 2015). Similar to the experiments adversarial defense, given victim classifier, attack. and a benchmark, we generate test data which include 1,000 adversarial sentences generated by the attack based on the benchmark. Finally, evaluate the performance of the victim models the test data. Following previous works (Mosca et al. 2022). the performance of adversarial detection evaluated by F1-score and recall.
8

---

Published as a conference paper at ICLR 2023
Saliency
WDR
FGWS
Dataset
Attack
Fl-score
Recall
Fl-score
Recall
Fl-score
Recall
PWWS
92.2 1.1
93.4
90.1 1.1
89.1 1.4
88.4
80.1
IGA
90.4 0.9
85.7 = 1.3
86.6 = 1.8
68.6
58.3
AGNews
GA
92.9 1.0
91.4 1.3
0.9
87.2 1.1
70.3
60.1
TextFooler
95.1 0.4
96.6
94.0 0.8
97.0 0.9
86.0
77.6
PWWS
0.8
00.8110
0.7
87.5 + 1.8
80.8
76.7
IGA
9.2
9..2
0.9
90.5 1.3
79.5
70.1
IMDB
GA
91.8
1.5
89.6 8.1
79.0
74.2
TextFooler
96.6
9.6
95.0 0.8
96.0 0.9
86.0
77.6
PWWS
91.8
90.1
89.2 1.4
86.2
91.2
85.6
IGA
91.0
9..7
0.5
8.91
85.4
82.8
YELP
GA
91.2
9..0
8.4
8..7
85.9
83.3
TextFooler
0.3
9.5
9.3
9.9
90.5
84.2
The performances of adversarial detection under various attacks BERT-based victim classifier. The performances of WDR and FGWS are from the corresponding paper; BLUE the best performance. 'Salliecy'' represents our saliency- detector.
Table 2:
Moreover, in order to examine the performance of our detector, two state-of-the-arr detectors are chosen baselines, FGWS (Mozes et al., (02I]) and WDR (Mosca al.] 2022), where FGWS leverages word frequency to detect adversarial sentences, and WDR uses prediction logit informa- tion for adversarial detection.
7.2 PERFORMANCE
Table 2 shows the performance of the detectors in various configurations. In Table 2 our proposed detector consistently shows better results terms of F1-score and recall. Specifically, our detector outperforms the best baseline in 11 configurations out of 12, and on average achieves 3.74% gain on F1-score. Such results show that the saliency-base detector reacts well all selected attacks.
Moreover, we can also observe that TextFooler is easier to be detected than other attacks. Consid- cring that TextFooler much stronger than the attacks like GA and IGA, we can claim that there is no positive relation between attack's attack power and detection difficulty.
FURTHER RESULTS
We also illustrate the details or discussion towards critical designs of TextShield with additional experiments. We defer them Appendix due to limited space. The outline is as follows: the anal- yses of hyper-parameters are shown in Appendix B Performance against extra word-level attacks shown in Appendix C Also, human evaluation towards attack quality shown Appendix D Besides, computational cost and corrector design discussions shown in Appendix(]aaa versarial detection performance TextShield against other levels of attacks (c.g., sentence-level attack) is shown in Appendix G
Ad-
CONCLUSION
This paper proposes TextShield, a detect-correct pipelined defense method against word-level text attacks. Based on basic derivations, we find a cross-cutting connection between adversarial ro- bustness and saliency, and then we propose the adaptive word importance (AWI) metric based on saliency computation. Based on AWI, we design a saliency- detector, which achieves bet- ter performance than previous detectors. Then, design saliency-based corrector, which rects adversarial sentences to benign ones using AWI Comprehensive experiments demonstrate that Textthield is superior previous defense methods for generalization and robustness.

---

Published as a conference paper at ICLR 2023
10 ACKNOWLEDGEMENT
The research was financially supported by National Precision Agriculture Application Project (Grant/Contract number: IZNYYY001), and Beijing Municipal Science and Technology Project (Gran//Contract number: Z201 10000800000)))
REFERENCES
Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, and Kai-Wei Chang. Generating natural language adversarial examples. In Proceedings of the 2018 Conference on Empirical Methods Natural Language Processing, pp. 2890-2896, 2018.
Sebastian Bach, Alexander Binder, Grégoire Montavon, Frederick Klauschen, HobusRRobert Müller, and Wojeiech Samek. On pixel-wise explanations for non-linear classifier decisions by layer-wise relevance propagation. PloS one, (07)):0133014) 2015.
Rongzhou Bao, Jiayi Wang, and Hai Zhao. Defending pre-trained language models from adversarial word substitution without performance sacrifice. In Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021, pp. 3248-3258, 2021.
Yonatan Belinkov and Yonatan Bisk. Synthetic and natural noise both break neural machine trans- lation. In International Conference on Learning Representations, 2018.
Alexander Binder, Grégoire Montavon, Sebastian Lapuschkin. Klaus RobsrRobbrt Müller, and Wojeiech Samek. Layer-wise relevance propagation for neural networks with local renormalization layers. In International Conference on Artificial Neural Networks, pp. 63-71. Springer, 2016.
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint 17X15:17/ 2017.
Zhijie Deng, Xiao Yang, Shizhen Xu, Hang Su, and Jun Zhu. Libre: A practical bayesian approach to adversarial detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 972-982, 2021.
Jacob Devlin, Ming- Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In NAACL, pp. 4171-4186, 2019.
Xinshuai Dong, Anh Tuan Luu, Rongrong Ji, and Hong Liu. Towards robustness against natural language word substitutions. ICLR, 2021.
Steffen Eger, Gözde Gül Şahin, Andreas Rücklé, Ji-Ung Lee, Claudia Schulz, Mohsen Mesgar, Krishnkant Swarnkar, Edwin Simpson, and Iryna Gurevych. Text processing like humans do: Visually attacking and shielding nlp systems. In Proceedings of NAACL-HLT, pp. 1634-1647, 2019.
Siddhant Garg and Goutham Ramakrishnan, Bae: Bert-based adversarial examples for text classifi- cation. In EMNLP, pp. 6174-6181, 2020.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint 1rXiv:1412.6572. 2014.
Shreya Goyal, Sumanth Doddapaneni, Mitesh M Khapra, and Balaraman Ravindran. A survey in adversarial defences and robustness in nlp. arXiv preprini arXiv:2203.066 04441, 2022.
Xuanli He, Lingjuan Lyu, Lichao Sun, and Qiongkai Xu. Model extraction and adversarial trans- ferability, your bert is vulnerable! In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pp- 2006-2012, 2021.
Sepp Hochreiter and Jürgen Schmidhuber. Long short-term memory. Neural computation, 9(8): 1735-1780, 1997.
10

---

Published as a conference paper at ICLR 2023
Po-Sen Huang, Robert Stanforth, Johannes Welbl, Chris Dyer, Dani Yogatama, Sven Gowal, Krish- namurthy Dvijotham, and Pushmeet Kohli. Achieving verified robustness to symbol substitutions via interval bound propagation. In EMNLP. pp. 2019.
Robin Jia and Percy Liang. Adversarial examples for evaluating reading comprehension systems. In EMNLP, pp. 2021-2031, 2017.
Robin Jia, Aditi Raghunathan, Kerem Göksel, and Percy Liang, Certified robustness to adversarial word substitutions. In EMNLP, pp. 4129-4144 2019.
Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. Is bert really robust? a strong baseline for natural language attack on text classification and entailment. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pp. 8018-8025, 2020.
Erik Jones, Robin Jia, Aditi Raghunathan, and Percy Liang. Robust encodings: framework for combating adversarial typos. In ACL, pp. 2752-2765, 2020.
Yoon Kim. Convolutional neural networks for sentence classification. In EMNLP, pp. 1746-1751, 2014.
Ching- Yun Ko, Zhaoyang Lyu, Lily Weng, Luca Daniel, Ngai Wong, and Dahua Lin. Popgor:: Quantifying robustness of recurrent neural networks. In ICML, pp. 3468-3477. PMLR, 2019.
Volodymyr Kuleshov, Shantanu Thakoor, Tingfung Lau, and Stefano Ermon. Adversarial examples for natural language classification problems. 2018.
Thai Le, Noseong Park, and Dongwon Lee. A sweet rabbit hole by darcy: Using honeypots to de- tect universal trigger's adversarial attacks. In Joint Conference of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Nat- ural Language Processing, ACI.IICNLP 2021, pp. 3831-3844. Association for Computational Linguisties (ACL), 2021.
Thai Le, Jooyoung Lee, Kevin Yen, Yifan Hu, and Dongwon Lee. Perturbations in the wild: Lever- aging human- -uitte- text perturbations for realistic adversarial attack and defense. In Findings of the Association for Computational Linguistics: ACL 2022, pp. 2953-2965, 2022a.
Thai Le, Noseong Park, and Dongwon Lee. Shield: Defending textual neural networks against multiple black-box adversarial attacks with stochastic multi-expert patcher. In Proceedings of the 60th Anmual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 6661-6674, 2022b.
Dianqi Li, Yizhe Zhang, Hao Peng. Liqun Chen, Chris Brockett, Ming-Ting Sun, and Bill Dolan. Contextualized perturbation for textual adversarial attack. In NAACI, pp. 5053-5069, 2021.
Linyang Li, Ruotian Ma. Qipeng Guo, Xiangyang Xue, and Xipeng Qiu. Bert-attack: Adversarial attack against bert using bert. In Proceedings of the 2020 Conference Empirical Methods in Natural Language Processing (EMNLP), pp. 6193-6202, 2020a.
Shasha Li, Shitong Zhu, Sudipta Paul, Amit Roy-Chowdhury, Chengyu Song, Srikanth Krishna- murthy, Ananthram Swami, and Kevin S Chan. Connecting the dots: Detecting adversarial pertur- bations using context inconsistency. In European Conference on Computer Vision, pp. 396-413. Springer, 2020b.
Yiming Li, Baoyuan Wu, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey. arXiv preprint arvi 008005, 2020c.
Jieyu Lin, Jiajie Zou, and Nai Ding. Using adversarial attacks to reveal the statistical bias in machine reading comprehension models. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference Natural Language Processing (Volume 2: Short Papers), pp. 333-342, 2021.
Jaayang Liu, Weiming Zhang, Yiwei Zhang, Dongdong Hou, Yujia Liu, Hongyue Zha, and Nenghai Yu. Detection based defense against adversarial examples from the steganalysis point of view. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp-
4834, 2019.
11

---

Published as a conference paper at ICLR 2023
Qin Liu, Rui Zheng, Bao Rong, Jingyi Liu, Zhihua Liu, Zhanzhan Cheng, Liang Qiao, Tao Gui, Qi Zhang, and Suan-Jing Huang. Flooding-x: Improving bert's 's resistance to adversarial attacks via loss-restricted fine-tuning. In Proceedings the 60th Annual Meeting of the Association for Computational Linguisties ( (Volume I: Long Papers), pp. 5634-5644, 2022.
Yuntao Liu, Yang Xie, and Ankur Srivastava. Neural trojans. In 2017 IEEE International Conference Computer Design (ICCD), pp. 48. IEEE, 2017.
Edward Loper and Steven Bird. Nitk: the natural language toolkit. In Proceedings of the ACL.02 Workshop on Effective tools and methodologies for teaching natural language processing and computational linguistics-Volle
I, pp. 63-70, 2002.
Edoardo Mosca, Shreyash Agarwal, Javier Rando Ramírez, and Georg Groh. "that is suspicious reaction!": Interpreting logits variation to detect nip adversarial attacks. Proceedings of the 60th Annual Meeting of the Association for Computational Linguisties (Volume 1: Long Papers), pp. 7806-7816, 2022.
Maximilian Mozes, Pontus Stenetorp, Bennett Kleinberg, and Lewis Griffin. Frequency-guice word substitutions for detecting textual adversarial examples. In EACL. pp. 171-186, 2021.
Christopher Potts. On the negativity of negation. In Semantics and Linguistic Theory, volume 20, pp. 636-659, 2010.
Yao Qin, Nicholas Frosst, Sara Sabour, Colin Raffel, Garrison Cottrell, and Geoffrey Hinton. De- tecting and diagnosing adversarial images with class-conditional capsule reconstructions. In In- ternational Conference on Learning Representations, 2019.
Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. Generating natural language adversarial examples through probability weighted word saliency. In Proceedings of the 57th annual meeting of the association for computational linguistics, pp. 1085-1097, 2019.
Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. Semantically equivalent adversarial rules for debugging nip models. In Annual Meeting of the Association for Computational Linguistics (ACL), 2018
Lingfeng Shen, Haiyun Jiang, Lemao Liu, and Shuming Shi. Rethink stealthy backdoor attacks in natural language processing. arXiv preprint orXiv:2201.02993 2022a.
Lingfeng Shen, Shoushan Li, and Ying Chen. Katg: Keyword-bias-wwe aware adversarial text gener- ation for text classification. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pp. 11 11294-11 1302, 2022b.
Zhouxing Shi, Huan Zhang, Kai-Wei Chang, Minlie Huang, and Cho-Jui Hsieh. Robustness verifi- cation for transformers. In International Conference Learning Representations, 2019.
Karen Simonyan, Andrea Vedaldi, and Andrew Zisserman. Deep inside convolutional networks: Vi- sualising image classification models and saliency maps. arXiv preprint arXiv:1312.6053 2013.
J Springenberg, Alexey Dosovitskiy, Thomas Brox, and M Riedmiller. Striving for simplicity: The all convolutional net. In ICLR (workshop track), 2015.
Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Axiomatic attribution for deep networks. In International Conference on Machine Learning, pp. 3328. PMLR, 2017.
Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium on Security and Privacy (SP), pp. 707-723, IEEE, 2019a.
Boxin Wang, Hengzhi Pei, Boyuan Pan, Qian Chen, Shuohang Wang, and Bo Li. T3: Tree- autoencoder regularized adversarial text generation for targeted attack. In EMNLP, pp. 6134 6150, 2020a.
Boxin Wang, Shuohang Wang, Yu Cheng, Zhe Gan, Ruoxi Jia, Bo Li, and Jingjing Liu. Infobert Improving robustness of language models from an information theoretic perspective. In Interna- fional Conference on Learning Representations, 2020b.
12

---

Published as a conference paper at ICLR 2023
Boxin Wang, Chejian Xu, Xiangyu Liu, Yu Cheng, and Bo Li. Semattack: Natural textual attacks via different semantic spaces. arXiv preprint arXiv:2205.01287 2022.
Wenqi Wang, Run Wang. Lina Wang, Zhibo Wang, and Aoshuang Ye. Towards robust deep neural network in texts: A survey, arXiv preprint arXiv:1902.07285 2019b.
Xiaosen Wang, Hao Jin, and Kun He. Natural language adversarial attack and defense in word level. 2019c.
Xiaosen Wang, Jin Hao, Yichen Yang, and Kun He. Natural language adversarial defense through synonym encoding. In Conference Uncertainty in Artificial Intelligence, 2021a.
Xiaosen Wang, Yichen Yang, Yihe Deng, and Kun He. Adversarial training with fast gradient projection method against synonym substitution based text attacks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pp. 13997-14005, 2021b.
Yuan Zang, Fanchao Qi, Chenghao Yang, Zhiyuan Liu, Meng Zhang, Qun Liu, and Maosong Sun. Word-level textual adversarial attacking combinatorial optimization. In ACL, pp. 6080, 2020.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy, In International Conference on Machine Learning, pp. 7472-7482. PMLR, 2019a.
Wei Emma Zhang, Quan Z Sheng, Ahoud Alhazmi, and Chenliang Li. Adversarial attacks on deep-learning models in natural language processing: A survey. ACM Transactions on Intelligent Systems and Technology (TIST), 11(3):1 (1, 2020.
Xiang Zhang, Junbo Zhao, and Yann LeCun. Character-level convolutional networks for text clas- sification. NeurlPs, 28:649-657, 2015.
Xinze Zhang, Junzhe Zhang, Zhenhua Chen, and Kun He. Crafting adversarial examples for neural machine translation. In Proceedings of the 59th Annual Meeting of the Association for Compula- tional Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), pp. 1967-1977, 2021.
Yuan Zhang, Jason Baldridge, and Luheng He. Paws: Paraphrase adversaries from word scrambling. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume I (Long and Short Papers), pp.
2019b.
Yi Zhou, Xiaoqing Zheng, Cho-Jui Hsich, Kai-wei Chang, and Xuanjing Huang. Defense against adversarial attacks in nlp via dirichlet neighborhood ensemble. ACL, 2021.
A DETAILS OF DETECTOR'S SS TRAINING
The learnable parameters in our saliency- -based detectors are the ones in the four LSTMs of the detector and the two-layer MLP of the combiner. After tokenization, we either conduct padding with 'max_ lengthh=21 or do truncation for each input sentence. Then after saliency computation, we obtain the AWI matrix with form (128, [)]). where | the size of the label set used in the focused text classification. Thus, the four LSTMs take the four AWI matrices as input correspondingly and output their hidden states (hidden.siee size 128). Finally, the hidden states are concatenated feed to the combiner, which is two-layer MLP + softmax function, with input dim = 128, intermediate layer dim 64 and out dim In addition, the LSTMs and the two-layer MLP are simultaneously trained through the Adam optimizer with a 5 learning rate.
B ABLATION STUDY
This section conducts ablation studies of TextShield to answer the following three questions: Q1) What is the impact of B, the dyper-parametees of the corrector? Q2) What is the impact of multiple lub-detectors? Q3) What is the impact of the number of adversarial sentences used to train detectors? The experimental settings similar to the ones used in Sec 6
13

---

Published as a conference paper at ICLR 2023
B.1 ANALYSIS HYPER- PARAMETER B
We study the impact of 3, the hyper- apper-parameters of our corrector. As shown in Figure 3 the best performance achieves when 8 is 0.4, and either small large will cause significant perfor- mance drop, especially when 8 is large. This is because 3 serves to control the ratio of suspects in sentence: when inadequate; on the contrary. when 8 is 1.0, every word is viewed as suspect, which is inappropriate.
only the most important word is considered as suspect, which may be
(a) TexICNN
(b) LSTM
(c) BERT
Figure 3: The accuracy (%) of TextSiield towards different text attacks when 3 varies from 0.1 to 1.0. Specifically, the performance of the three victim classifiers AGNews is presented.
Performence CSA
Performance PWWS
70
Bdbust
ONN
OWN
LSTM
LSTH
BTAT
40
Number sumples Sraffhherdd
Number kamplie Trettheeld
(a) TL
(b) PWWS
Performance
Performance
90
Accursce
60
Icthurt
LSTM BERT
LSTH
30
(c) GA
(d) IGA
Figure 4: Accuracy (%) of TextShield on adversarial sentences generated by four attacks (TL,
PWWS, GA and IGA) as K changes.
B.2 ANALYSIS OF THE COMBINING OF MULTIPLE BUB-DETECTORS
Since crucial design of TextShield is the ensembling of the four sub-detectors with combiner, investigate the impact of such an ensembling strategy. Specifically, we verify the performance after removing some sub-detectors, and the evaluation is launched using TextCNN AGNews.
As shown in Table 3 removing any sub-detector will cause performance drop, demonstrating the effectiveness of each sub-detector. Based on the results, the importance of sub-detectors
14

---

Published as a conference paper at ICLR 2023
be ranked follows: VG>LRP>IG> Furthermore, removing all the sub-detectors shows catastrophic performance drop, which confirms our arguments that different sub-detectors can com- plement well with each other and also shows the importance of integrating the four sub-detectors.
Please note that neither the saliency computation methods nor the ensembling strategy of various sub-detectors paper's focus. There more sophisticated methods for saliency computation and sub-detector combination, and such methods can also be applied to TextShield
Removed sub-detector
TL
PWWS
GA
IGA
VG sub-detector
-8.9
-6.4
-IG sub-detector
-6.8
-45
-3.0
-4.5
LRP sub-dctector
-6,6
-5.0
-2.8
-4.0
-GBP detector
-7.4
-2.5
-4.1
-5.1
All sub-detectors
-34.8
-29.6
-40.3
-36.9
Table 3: Accuracy (%) drop adversarial sentences generated by different attacks after removing some sub-detectors from TextShield. E.g. '-VG' means removing the VG-based sub-detector in TextShield.
B.3 ANALYSIS OF THE NUMBER OF ADVERSARIAL SENTENCES USED IN TRAINING DETECTORS
During the training process, we use the same number K of adversarial sentences per class, where K 2000. This experiment illustrates the relation between the performance of TextShield and K. Notice that, except for K, we keep the same training settings as the experimental setting used in 6 The performance of TextShield under different K is shown in Figure
As illustrated in Figure 4 the defense capacity of TextShield is enhanced as K continuously in- creases since more samples used the training data help the detector better recognize adversarial sentences. Specifically, when K is larger than 2000, the improvement becomes extremely subtle, indicating that we have arrived at the upper-bound of TextShield performance under such configu- rations.
BERT
Dataset
NT
IBP
FGWS
WDR
ASCC
SEM
TS
IMDb
10.8
50.2
59.0
61.4
61.4
64.5
AGNews
9.6
46.7
52.4
60.2
59.6
63.0
Yahoo
6.0
40.2
50.1
58.9
60.3
64.2
Table The accuracy (%) of various defense methods towards BERT-Autack (BA).
C PERFORMANCE ON OTHER WORD-LEVEL ATTACKS
Additionally, we add BERT-attack (BA) al. (220a) our attack methods. The settings of BA are the same from its paper Li et al. (2020a). Specifically, please note that we also train our detectors with adversarial samples generated by BA (same sample size as the experiments in Sec 6). Then, measure the defense capacity for each baseline, and the results are shown in Table
D HUMAN EVALUATION FOR THE TEXT ATTACK QUALITY
The quality of text attacks remains a challenge since it is difficult to ensure that text attacks will keep sentences' ground truth towards the original label. This a problem that many SoTA adversarial defense methods have omitted. Therefore, conduct human evaluation by examining the qual- ity of four attacks selected in Sec 6 Considering there are over one thousand adversarial samples, which lead the tremendous manual effort, thus choose sample 200 adversarial sentences for
15

---

Published as a conference paper at ICLR 2023
GA
IGA
PWWS
TextFooler
Quality
96.4
94.3
95.0
93.0
Table 5: The quality of five text attacks selected in paper. Quality represents the proportion of adversarial sentences whose ground-truth remain unchanged. We can see, in most cases, text attacks do not affect the ground-truth.
our selected attacks. Then, we evaluate whether such attacks modify their ground-truth labels, and the results are illustrated Table 5 Then, we also present the Fi-score on these samples (conducted human evaluation by us) in Table We can observe that the overall quality of adversarial sentences good.
IMDB
AGNews
Victim
Defense
No
IGA
PWWS
GA
TL
No
IGA
PWWS
GA
T1.
No
IGA
PWWS
GA
TL.
NT
88.7
12.3
4.5
7.7
3.3
92.0
43.5
35.5
34.5
30.0
67.5
19.0
10.9
14.8
9.5
IBP
76.6
71.2
71.2
70.0
62.5
89.0
79.2
80.2
80.3
79.6
62.4
49.0
51.4
58.2
60.2
Text CNN
FGWS
83.8
70.0
67.2
68.8
63.0
83.5
81.8
83.0
81.2
82.2
64.1
56.1
57.2
56.5
58.7
WDR
85.0
71.4
69.2
70.0
64.4
83.8
82.3
83.1
82.0
82.4
65.0
59.1
58.5
60.0
60.2
ASCC
66.9
69.4
84.0
SEM
87.0
66.8
72.0
71.0
71.6
89.6
85.2
85.0
84.4
85.2
63.9
60.0
60.5
61.0
61.7
TS
74.2
92.4
27.2
TBP
78.2
69.0
68.0
65.8
61.5
85.6
78.4
78.6
75.5
78.8
60.0
34.1
32.8
29.1
30.3
LSTM
57.0
WDR
80.1
70.1
74,1
73.8
69.7
86.4
82.6
83.5
81.1
82.6
65.2
59.0
$7.5
58.9
58.6
ASCC
81.7
69.5
73.1
70.1
86.9
83.7
84.0
67.0
57.8
56.9
57.4
SEM
85.9
71.4
76.0
75.8
72.9
90.1
84.3
85.8
84.1
84.3
68.2
60.0
58.7
59.4
61.2
TS
85.8
73.2
78.8
78.0
75.8
90.6
85.8
87.2
87.1
86.3
69.2
62.0
61.9
64.7
63.9
NT
92.0
25.4
36.9
39.1
26.8
94.0
65.7
67.1
57.6
44.8
76.9
30.7
33.6
16.5
11.6
IBP
FGWS
$8.8
79.7
80.3
78.7
79.3
93.2
79.6
79.0
84.3
80.5
76.0
56.9
58.0
58.4
58.3
BERT
WDR
89.2
81.2
81.6
92.7
82.4
86.
76.0
60.3
ASCC
88.0
83.6
83.8
83.5
81.0
90.0
82.7
82.8
87.0
86.3
73.3
60.0
61.6
62.3
60.3
SEM
89.9
86.4
86.0
85.0
88.0
88.5
89.2
75.8
66.2
65.9
TS
88.4
87.9
88.0
90.5
85.8
92.0
89.8
89.6
89.3
89.0
75.2
67.6
67.2
69.1
63.7
Table 6: Under human-evaluated adversarial sentences, F1-score (%) of various defense methods on adversarial sentences.
E COMPUTATIONAL COST
Concerning the computational cost of our method, present study here. On RTX3090 GPU, the victim model is selected as BERT-base-uncased. Setting the batch size as 8, each inference of BERT takes around 20-30ms, TextShield (only detector part) takes around 60ms, and the cost is acceptable. The corrector + BERT inference takes around 20-30ms, nearly equal to BERT inference time since the information corrector needed has already been computed in the VG detector. Overall, takes around 80-90ms per inference time under the configuration. Considering the training cost of detectors, since detectors only consist of L.STM and MLP, training them until convergence takes around 60min (On RTX3090).
F OTHER BASELINES FOR CORRECTOR DESIGN
Since the baselines for our corrector remain blank, we define some intuitive strategies for the correc- tor as follows: (1) replace words based on their part of speech (POS), (2) we replace words based on their word frequency in the benchmark (Freq). The only thing that varied in this set of experiments is: how we select words to be replaced by high-frequent selection methods have different optimal B, tune B for these two baselines and report the best performance. The remaining settings the corrector are the same to ensure fair comparisons. The results are shown in Table We can that all of the methods perform significantly worse than
synonyms. Specifically, since different
16

---

Published as a conference paper at ICLR 2023
original design leverage saliency for correction. Specifically, and nouns outperform merely either of them, which is reasonable. Also, we find that replacing low- frequency words achieves not bad performance, which matches the empirical findings in Mozes et al. 2021). Overall, the results demonstrate the effectiveness of our corrector design.
that combining verbs
Detection
TL
PWWS
GA
IGA
POS(Verb)
-14.9
-13.2
-16.4
-14.7
POS(Noun)
-12.8
-10.4
-9.0
-10.3
POS(Noun+Verb)
-6.7
-7.0
-5.8
-6.0
Freq(Low) -8.9
-10.6
-7.3
-9.9
Table 7: Accuracy (%) drop adversarial sentences by setting different replacement strategies the corrector. POS(Verb), POS(Noun), POS(Noun+Verbh mean only replace the verbs, nouns, verb+noun with their high-freug sighfreeuency synonyms. Freq(Low) represent replace low-frequency word with their freuueryy synonyms.
G LIMITATION AND FUTURE WORKS
TextShield mainly focuses defending against word-level text attacks, the main limitation in TextShield lies the specificity of word-level attacks. Moreover, this limitation also exists in most adversarial defenses. To validate the practical application of TextShield. in this section, conduct similar experiments as the ones in Sec 7 yet on detecting sentence-level and character-level attacks
[Wang et al., 2021a Dong al., 2021
Mozes et al. 2021 Mosca al., (022).. Specifically,
select one character- level attack, Visual
Eger et al. 2019). and two sentence-level attacks, PAWS
Zhang al. 2019b) and T3 (Wang al. 2020a). and show the results in Table
Saliency
WDR
FGWS
Datasct
Attack
F1-score
recall
F1-scom
recall
Fi-score
recall
PAWS
80.9 1.0
80.5 + 0.6
73.4 # 1.0
74.3 + 1.1
68.7
67.0
AGNews
T3
76.9 + 1.2
76.8 + 0.9
73.0 # 1.3
71.5 + 1.2
60.4
60.3
Visual
84.9 + 1.0
83.8 + 0.8
80.0 + 1.1
78.4 + 0.8
70.1
68.5
PAWS
80.3 + 0.6
80.4 1.1
75.3 + 0.8
72.3 + 1.0
65.4
63.8
IMDB
T3
81.4 + 1.1
80.3 1.4
74.7 + 0.8
74.4 + 1.8
68.4
66.0
Visual
84.9 1.0
85.3
80.6 + 0.6
79.0 + 1.1
74.5
71.1
PAWS
80.4 1.0
0.6
77.2 1.2
74.2 + 2.1
70.2
71.6
YELP
T3
80. 0.6
81.7 0.6
75.0 0.6
72.5 + 1.6
70.0
69.7
Visual
85.1 0.4
85.0 0.8
81.7 0.8
80.2 + 1.1
78.0
74.7
Table 8: The adversarial detection performance of different detectors against sentence-level and character-level attacks. Generally, all the detectors become less effective when facing sentence-level attacks, but our saliency-based detector still outperforms the baselines.
First, we can observe that all the detectors have a significant performance drop (about 10%) in both Fl-score and recall when facing sentence-level attacks, compared the performance on de- tecting word-level attacks in Table I The reason might be that the perturbation in sentence-level attacks is more complicated and is more likely to influence sentence' semantics at level higher than word-level attacks, which makes sentence-level attacks more difficult to detect. Moreover, the detec- tion difficulty character-level attacks lies between word-level attacks and sentence-level attacks. Therefore, due to its stealthiness, sentence-level attack is more challenging issue for adversarial defense in NLP. Yet, most of existing adversarial defenses (Jia et al. 2019 Dong et al.) 2021 Wang
et al. 202 Mozes et al. 2021: Wang et al. 2021b] Mosca al. 2022 Le et al. 2022a focus
defending word-level attacks, and they will also counter significant performance drop when facing other text attacks (e.g., sentence-level).
17

---

Published as a conference paper at ICLR 2023
Second, there seems to be contradiction between the generality and performance of defense method. There are some general defenses (Le et al. 2022b] Liu et al., 2022) that can defend sentence-level. word-level and character-level attacks. However, their performance is not compa- rable to state-of-the-arr defense methods designed for a specific attack (e.g., word-level attacks). Meanwhile, the success of state-of-the-an defense against one kind of attacks (e.g.. word-level) can not transfer to another kind of attacks (c.g., sentence-level) (Zhang et al.) 2020) /ooya et al.) 2022). Thus, how tackle such trade-off between generality and performance remains a valuable question. We believe that designing more suitable detectors and correctors is plausible direction since our salieney-based defense performs properly and shows strong potential to detect each kind of attacks. Specifically, there are two lines of future work to continue: (1) designing stronger de- tectors that perform well on three kinds of attacks, and (2) designing better correctors with general correction schemes.
18


Reviews:
[{"review_id": "e8eOSe348G-", "reviewer": "Reviewer_xPPy", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors propose a method called TextShield to handle a problem setup within the field of adversarial attacks, where the goal is to first detect an adversarial sentence and then correctly classify it. The system detects adversarial sentences using a saliency-based methodology and subsequently corrects them to benign ones. TextShield surpasses existing approaches on multiple metrics in experiments on standard NLP datasets.", "summary_of_the_review": "please see the Strength And Weaknesses section. While the method is not entirely novel, the method TextShield is an easy, efficient way to detect and correct adversarial attacks while achieving competitive results for NLP type of datasets.", "strength_and_weaknesses": "Strengths\n\n- The authors present strong motivation in Section 4 about the connection between saliency and robustness \n- The authors present a concise, clear description of adversarial text attacks and saliency computation.\n- I like that TextShield has both a detector and a corrector for adversarial sentences which seems to be novel\n- The proposed adaptive word importance (AWI) is interesting in that it is a simple, efficient method for identifying which words are the most important\n-TextShield outperforms existing methods in adversarial detection metrics on popular datasets\n\nWeaknesses\n- Table 1 could be better presented if TS had (ours) in front of it to make it easy to distinguish between the proposed method and the rest. For the rest of the methods, it would be nice to have citations in front of them to make it easy to identify where they come from. \n- Multiple runs of the experiments in Table 1 are missing as the variance based on the random seed would give us a good idea about whether the reported results are significant. It is not clear whether TS significantly outperforms others.\n- No code is provided to reproduce the results and get a deeper understanding of the control flow.\n- While this work doesn't seem entirely novel as the methods are based on popular computer vision algorithms related to saliency: the authors used saliency at the word level compared to the pixel level used in computer vision, which is very similar. However,  I like this work as it provides a simple yet efficient way of achieving strong performance compared to existing methods for adversarial detection and correction.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "RSO4FPx0gC", "reviewer": "Reviewer_iR5J", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposed a detection-correction paradigm to defend against word-level attacks on the text classification task.\nTheir adversarial sentence detector leverages adaptive word importance (AWI) based on saliency computation. If a sentence is detected as an adversarial one, the corrector will act on the sentence by refining the word with the highest saliency score. Then, the victim model takes the corrected sentence as input to make the final prediction. Thus, their model is like a shield in front of the victim classifiers.", "summary_of_the_review": "This paper proposed an interesting way of defense by adding a \"shield\" of the victim model. But there are some concerns like the inference speed, the generalization of the detector and the corrector. I will reconsider this paper if the authors can give some explanation and evidence of these problems.", "strength_and_weaknesses": "Strengths:\n1. This paper is well written, with a clear description and exact formula.\n2. This paper aims to not only successfully detect adversarial sentences but also correctly classify adversarial sentences that previous attacking work rarely pays attention to. In order to enhance the robustness of victim models, previous work generally mixes the detected adversarial sentences and original training data to retrain the victim model. This work provides a new way to explore how to get correct predictions of those adversarial samples.\n3. The experimental results on adversarial sentences produced by four widely-used text attacks in the NLP field achieve comparable performance to previous defense methods.\n\nWeakness:\n1. Some attackers get adversarial sentences by adding an imperceptible perturbation into benign sentences. Ideally, the adversarial sentence's target remains the same as the benign one. But the perturbation process can not promise the unchangeable targets of the adversarial sentences. The automatic evaluation can only take the targets of the benign sentences as the true targets of the adversarial sentences, but maybe they are not. So it is better to add a human evaluation on the part of samples to reflect the precision of Table 1.\n2. This method is somewhat opportunistic. By adding a \"shield\", the victim model could be more likely to make correct predictions of adversarial samples, but there still have been some concerns. The first one is the speed of inference. Calculating saliency should go through a forward and a backward process of the victim model. So, I wonder about the speed of the detector and the corrector. Another is that the detector is trained on the adversarial sentences generated by the GA, IGA, PWWS, and TextFooler. The reported final experiment results are also on the adversarial sentences generated by the GA, IGA, PWWS, and TextFooler. So I wonder if the adversarial sample is \"out of domain\" (for example, train detector and test the \"shield\" using two different \"styles\" attacker), the performance of the detector. Such a situation is more realistic because an attacker may generate adversarial samples with the same \"style\", which can not cover all potential adversarial sentences.\n3. The experiments have compared the saliency detector with previous detectors by adding the designed corrector to previous detector-based methods, with the results demonstrating the corrector's efficiency. I'd like to know how much of a role the saliency played in the corrector. Specifically, how will the model behave if I do not choose the replaced word according to the saliency but something else, like some entities? It is better to have some case studies to explicitly show the saliency scores and their importance.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "M_uE36hBEG", "reviewer": "Reviewer_V9s1", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposed a detection-based defence strategy called TextShield against word-level text attacks, incorporating a detector and a corrector. Four saliency computation methods, vanilla gradient (VG), guided backpropagation (GBP), layerwise relevance propagation (LRP), and integration gradient (IG), are selected as sub-detectors. Adaptive word importance (AWI) is designed using the vanilla gradient method. Then a saliency-based corrector aims to correct adversarial sentences to benign ones based on AWI. Comprehensive experiments demonstrate that TextShield is superior to previous defence methods on both generalization and robustness.", "summary_of_the_review": "Pls see Sec. Strength And Weaknesses\n", "strength_and_weaknesses": "Strengths:\n\n(1)\tThe illustration structure for intuitions and explanations for TextShield is stated clearly with the help of Figure 1-2. \n\n(2)\tThe experimental part has conducted comprehensive ablation study on considering the impacts of the hyperparameter, multiple sub-detectors and the number of adversarial examples.\n\n\n\nWeaknesses:\n\n(1)\tOverclaim in Section 2 (Related Work): \"However, because of the extreme time cost in the training stage, certified robustness is difficult to be applied to complex models. For example, IBP performed catastrophically on large pre-trained language models (e.g., BERT)\". Certified robustness of recent work can be applied to complex models like BERT [1]. \n\n(2)\tIn Subsection 5.3 (Corrector): \"For a suspect w_{i}, the corrector substitutes w_{i} with the most frequent word w^{'} ∈ S(w_{i}), where S(w_{i}) is w_{i} 's synonyms [4]\". Here the synonym candidate set is selected from NLTK toolkit. However, the adoption of synonym sets is different in research on adversarial attacks, and the defence method assumes that the defenders are aware of the strategy for adversaries to create synonyms. Because we cannot limit a malicious attacker's use of synonym tables, this scenario is not realistic.\n\n(3)\tIn the experimental part, TL, PWWS, GA and IGA are selected as word-level attacks for generating adversarial examples. However, some SoTA attacks like TextFooler [2], and Bert-Attack [3] are not considered as baselines to test the effectiveness of the proposed defence method.\n\n(4)\tThe computation runtime and efficiency of the proposed defence strategy are not discussed in the experimental part.\n\n\nTypos:\n\n(1)\t\"Given sentence X with label y_{j} predicted by text classifier F, the adaptive word importance (AWI) of word w_{i} in the sentence, R_{ij}, …\" in Subsection 4.2 lacks articles. Such a problem also appears in several places in this paper.\n\n(2)\t\"Takings VG as an example\" in Subsection 5.2 (Detector).\n\n\nReference:\n\n[1] Ye, Mao, Chengyue Gong, and Qiang Liu. \"SAFER: A Structure-free Approach for Certified Robustness to Adversarial Word Substitutions.\" Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics. 2020.\n\n[2] Jin, Di, et al. \"Is bert really robust? a strong baseline for natural language attack on text classification and entailment.\" Proceedings of the AAAI conference on artificial intelligence. Vol. 34. No. 05. 2020.\n\n[3] Li, Linyang, et al. \"BERT-ATTACK: Adversarial Attack Against BERT Using BERT.\" Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP). 2020.\n\n[4] Loper, Edward, and Steven Bird. \"Nltk: The natural language toolkit.\" arXiv preprint cs/0205028 (2002).\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "4mCaBy6wXEz", "reviewer": "Reviewer_Yn8V", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors propose a saliency based detector TextShield to identify adversarial samples in NLP. They use existing methods (vanilla gradient, guided backpropagation, layerwise relevance propagation, and integration gradient) to obtain saliency maps and then combine the outputs of all the methods to produce a final prediction of whether a sample is adversarial. The authors also introduce a corrector that corrects that modifies adversarial samples such that they are correctly classified. ", "summary_of_the_review": "I'm not entirely convinced about the empirical evaluation because there are a few missing baselines. ", "strength_and_weaknesses": "Strengths:\n* The authors present a new method based on saliency maps. \n* On a few datasets and attacks, the authors show that they can successfully detect and defend against adversarial samples. \n\n\nWeaknesses:\n* Some baseline comparisons are missing, for instance \"Defense against Synonym Substitution-based Adversarial Attacks\nvia Dirichlet Neighborhood Ensemble\" (Zhou et al., 2021) present DNE. From looking at the numbers in the DNE paper, it also seems like some cases performance of DNE is better. \n* The authors mention that one of the weaknesses for adversarial training is that the robustness of the model is determined by the diversity of adversarial examples used in adversarial training and that you cannot defend against unknown attacks. Isn't the same thing true for TextShield as well because the detector needs to be trained with adversarial examples? Does TextShield generalize well to unknown attacks or to attacks that haven't been used during the training of the TextShield detector?\n* The authors state that \"there remains a significant gap between successfully detecting adversarial sentences and correctly classifying adversarial sentences for a specific application.\" This claim is confusing because defense methods are specifically designed for this. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Accept: poster