Perturbation Defocusing for Adversarial Defense
Authors: HENG YANG
Ke Li
Venue: Submitted to ICLR 2023 (2023)
Keywords: text adversarial defense
perturbation defocusing

Abstract: Recent research indicates adversarial attacks are likely to deceive neural systems, including large-scale, pre-trained language models. Given a natural sentence, an attacker replaces a subset of words to fool objective models. To defend against adversarial attacks, existing works aim to reconstruct the adversarial examples. However, these methods show limited defense performance on the adversarial examples whilst also damaging the clean performance on natural examples. To achieve better defense performance, our finding indicates that the reconstruction of adversarial examples is not necessary. More specifically, we inject non-toxic perturbations into adversarial examples, which can disable almost all malicious perturbations. In order to minimize performance sacrifice, we employ an adversarial example detector to distinguish and repair detected adversarial examples, which alleviates the mis-defense on natural examples. Our experimental results on three datasets, two objective models and a variety of adversarial attacks show that the proposed method successfully repairs up to ∼ 97% correctly identified adversarial examples with ≤∼ 2% performance sacrifice. We provide an anony-mus demonstration of adversarial detection and repair based on our work.

Under review as a conference paper at ICLR 2023
PERTURBATION DEFOCUSING FOR ADVERSARIAL DE- FENSE
Anonymous authors Paper under double-blind review
ABSTRACT
Recent research indicates adversarial attacks are likely deceive neural systems, including large-scale, pre-trained language models. Given a natural sentence, an attacker replaces subset of words fool objective models. To defend against adversarial attacks, existing works aim to reconstruct the adversarial examples. However, these methods show limited defense performance on the adversarial examples whilst also damaging the clean performance on natural examples. To achieve better defense performance, our finding indicates that the reconstruction of adversarial examples is not necessary. More specifically, we inject non-toxic perturbations into adversarial examples, which can disable almost all malicious perturbations. In order to minimize performance sacrifice, employ adver- sarial example detector to distinguish and repair detected adversarial examples, which alleviates the mis-defense natural examples. Our experimental results on three datasets, two objective models and a variety of adversarial attacks show that the proposed method successfully repairs up to 97% correctly identified adversarial examples with W~ 2% performance sacrifice. We provide an anony- mous demonstration' of adversarial detection and repair based on our work.
INTRODUCTION
Neural networks have been employed achieved state-of-the-art performance on various tasks. How- ever, recent research has shown their vulnerability to adversarial attacks (Szegedy et al., 2014; Good- fellow et al., 2015). In particular, language models have shown to be vulnerable to adversarial ex- amples (a.k.a., adversary) (Garg & Ramakrishnan, 2020; Li et al., 2020; Jin et al., 2020; Li et al., 2021a) generated by replaced specific words in a sentence. Compared to adversarial robustness on computer vision tasks (Alzantot al., 2018; Ren et al., 2019; Zang et al., 2020: Zhang al., 2021; Jin et al., 2020; Garg & Ramakrishnan, 2020; Li et al., 2021a; Wang et al., 2022), text adversarial defense (a.k.a. adversarial repair) has attracted less attention resulting in limited progress in adver- sary defense. Moreover, the crux of adversarial defense, i.e., performance sacrifice, has not been settled by existing studies.
While the prominent works tend to solve adversarial defense via adversarial training or feature re- construction, we propose perturbation defocusing to address adversarial defense in natural language processing. More specifically, perturbation defocusing attempts to apply non-toxic perturbations to adversaries to repair them. Although doesn't seem to be an intuitive thought, by empirical observations that malicious perturbations rarely destroy the fundamental semantics of a natural example. In other words, these adversaries can be easily repaired by distracting the objective model from malicious perturbations. We validate simple implementation of perturba- tion defocusing with preliminary experiments: simply masking the malicious perturbations, as in Figure 1. The experimental results in Table 1 show that masking malicious perturbations repairs a considerable number of adversaries (achieves up to 91 91.05% restored accuracy on the Ama zon Polarity ty dataset). Unfortunately, the positions of malicious perturbations are unknown in real adversarial defense. We employ adversarial attackers to perform perturbation defocusing as an al- ternative. If an adversary is identified, we obtain its perturbed prediction and keep attacking this adversary until the new prediction differs from the former. In this way, the malicious perturbations
motivated
hhttps://huggiiggaaas co/ spaces

---

Under review as a conference paper at ICLR 2023
Original:
This is among the year's most intriguing explorations of alientation.
Adversary:
This is among the year's most intriguing scrutinize of alientation.
Defocusing:
This is among the year's most intriguing [MASK] of alientation.
Figure 1: A real example of perturbation defocusing, which masks the perturbed words to re- pair adversary. "[MASK]" denotes the mask token. This virtual adversary is generated by TEXIFOOLER.
defocused without knowing the positions of malicious perturbations. Because ad adversarial at- tackers have large search spaces of non-toxic perturbations, almost all malicious perturbations in adversaries can be defocused in experiments. However, there is prerequisite that the adver- saries must be precisely identified to prevent oriented attackers from attacking natural examples (Bao et al., 2021) in perturbation defocusing. Hopefully, although existing adversarial attackers emphasize the naturalness of adversaries (Zang et al., 2020; Li et al., 2021b; Le et al., 2022), our study suggests that PLM-based models can efficiently distinguish the adversaries (refer Figure 4), provided that the adversarial detection objective is involved in fine-tuning processing. Thereafter, we propose reactive perturbation defocusing (RPD) based on perturbation defocusing and adversary detection that alleviates performance sacrifice by only repairing detected adversaries.
We deploy RPD on PLM--asedd model, and it can be extended to other NLP models. We evaluate RPD on three text classification datasets under challenging adversarial attackers. The experimental results demonstrated that RPD capable of repairing 97%+ of identified adversaries without observable performance sacrifice (under 2%) on clean data (please refer to Table 6). In summary, our contributions are mainly as follows:
We propose perturbation defocusing to supersede feature reconstruction-based methods for ad- versarial defense, which almost repairs all correctly identified adversaries.
b) We integrate adversarial detector with PLM-based classification model. Based multi- attack adversary sampling, the adversarial detector can efficiently detect most of the adversaries. We evaluate RPD on multiple datasets, PLMs and adversarial attackers. The experimental results indicate that RPD has an impressive capacity to detect and repair adversaries without sacrificing clean performance.
2 RELATED WORKS
Existing adversarial defense studies can be coarsely classified into three types: adversar- ial training-based approaches (Miyato al., 2017; Zhu et al., 2020; Ivgi & Berant, 2021); context reconstruction based methods (Pruthi et al., 2019; Liu et al., 2020b; Mozes et al., 2021; Keller et al., 2021; Chen et al., 2021; Xu al., 2022; Li al., 2022; Swenor & Kalita, 2022); and feature reconstruction-basel meth- ods(Zhou et al., 2019; Jones et al., 2020; Wang et al., 2021a). In the meantime, some re- search(Wang et al., 2021b) explores hybrid de- fenses against adversarial attacks. Neverthe-
Table 1: The experimental performance of masking- perturbation defocusing adver- saries.
Dataset
Clean Aco. (5)
Attacker
AEtacked
Acc (5)
Restored
Ace (5)
20,50
3912
PANS
21.92
74.37
LENIEGOLER
22.12
12.27
BAL:
1605
78.66
volarity
96.36
2688
10.30
$1.25
20.80
91,07
RAF
81.80
71.85
55.55
32.05
60.33
less, there are some problems that remain with the existing methods. For example, due to the issue of catastrophic forgetting (Dong et al., 2021), adversarial training has been shown to be inadequate for improving the robustness of PLMs in fine-tuning. On the contrary. it significantly increases the cost of objective model training. For context reconstruction (e.g., word substitution and translation- based reconstruction), these methods sometimes fail to identify semantically repaired adversaries malicious perturbations (Swenor & Kalita, 2022). In recent
or have tendency to introduce studies, it has been recognised that feature (c.g., embedding) space reconstruction. based approaches successful than context reconstruction methods like word substitution (Mozes al., 2021;
2

---

Under review as a conference paper at ICLR 2023
Bao al., 2021). However, these feature reconstruction methods may have difficulty repairing typo attacks (Liu et al., 2020a; Tan et al., 2020; Jones et al., 2020), sentence-level attacks(Zhao et al., 2018: Cheng et al., 2019), and other unknown attacks. These studies usually limit the experiments to word substitution-hasee trast prior efforts, we argue that reconstruction is necessary for adversarial repair. Because the fundamental semantics of an adversary generally remains in the adversary, we just need to dis- tract objective models' attention from malicious perturbations. Another problem with the existing methods is that they neglect the importance of adversary detection and assume that all instances are adversaries, resulting in numerous unsuccessful defenses. Compared to existing works, our study focuses reactive adversarial defense and addresses the crux of performance sacrifice brought on by adversarial defense.
attacks (typically Genetic Algorithm (Alzantot et al., 2018)). In con-
3 METHOD
Chessifier
w V Leta
Example
Su Lade
Surogaate Clsstlirr
Attarker
...
Advensury
Desector
I...tt LLde
Quer
RPD
Phase 1: Multi-objective Fine-tuning
Normal
Cheerifiation
Repaired Outpot
Feammle
Classier
Chesrifiation distcibution
adversary?
Pertorlation Defocusing
Advemoury
Dotection distribationn
RPD
Phase #2: Adversary Detection Repair
The framework of RPD. The dotted lines with solid arrow means the steps depends on the existence of adversary, while the dotted lines with triangles denotes the objectives for multitask training. In addition to standard classification objective, RPD contains an adversary detection objec- tive and a detached adversarial training objective.
Figure 2:
We illustrate the framework of RPD in Figure 2, which consists two phases: multi objti-objecctiee fine- tuning and adversarial repair. In Phase #1, fine-tune RPD based three training objectives, including the original classification objective. Next, we introduce each objective following sec- tions.
3.1 ADVERSARY DETECTOR TRAINING
Since we train the adversary detector using supervise learning, will introduce how sample adversaries by adversarial attackers.
3.1.1 TEXT ADVERSARIAL ATTACK
We focus word-level adversarial attacks in this work. Let (w1, W2, w), be natural sentence, where W,, < < n, denotes a word; is the ground truth label. The word-level attackers replace the original words with their words (c.g., synonyms) to fool the objective model. For example, substituting w; with ú; will generate an adversary: à = (w1, ú2,, ... wx), where w; alternative of w;. The objective model F predict å follows:
argmax F (-)²),

---

Under review as a conference paper at ICLR 2023
where 0 # y if & is successful adversaries. The perturbations in è expected to be human- imperceptible. However, most of existing attackers tend to introduce grammatical, syntactical errors to certain extent, while the features of these errors in & can be easily modeled by PLM.
3.1.2 MULTI-ATTACK ADVERSARY SAMPLING
Based on the open-source ad adversarial attack methods (i.c., attacker), we perform multi-attack sam- pling (line 12 in Algorithm 1) to train the adversary detector. Let Daat be the natural examples. Vrr E Daatt we try to find a successful adversary as follows:
Σ A.
where <- indicates the adversary search process; R, 1 are the perturbed sentence and label. Note that if the attack failed, y = y but I * x. A. 1 S S k. is a attacker for adversary sampling; k the number of sampling attackers. F, is the surrogate classifier trained on natural examples (line 6 in Algorithm 1). The label of example in RED contains 3 sub-labels (for the objectives of classification (Lete), detached adversarial training(Cudd). adversarial detection(Laet) respectively). In the sampling process, ý is conditioned the attack result (lines 6 in Algorithm 1):
{
(0. 0).,
i = 0
(g. 1).
where e indicates the sub-label neglected in cross-entropy loss calculation. All adversaries and natural examples are fused to train an adversary detector. We also conduct experiments on single- attack sampling-based RPD (denoted S S-RPD) to evaluate the significance of multi-attack sam- pling (please refer to Table 5).
3.1.3 ADVERSARY DETECTOR OBJECTIVE
After adversary sampling, we fit the adversary detector on natural examples and sampled adver- saries. Let H be the representation of an example encoded by a PLM, RPD calculate the adversarial distribution as follows:
exp (pool (H))
4
(4)
ΣE= exp (H)))
where E, 1 < < 2, indicates whether sentence has been perturbed; pool is the head pooling of PLM. The adversarial detection objective can be formulated as:
Ldet
Σ 1=1
& log 4,
(5)
where 4 denotes the true adversarial label. Because the adversary detector is a binary text classifier, we adopt widely used cross-entropy to minimize L
3.2 DETACHED ADVERSARIAL TRAINING
We employ adversarial training in RPD it has been recognized to be able to improve robust- ness (Miyato et al., 2017; Zhu et al., 2020; Ivgi & Berant, 2021). However, we find that traditional natural examples. Hence, propose the de-
adversarial training may degenerate performance tached adversarial training objective to simultaneously mitigate performance sacrifice and improve objective model's robustness. The detached adversarial training objective Lado can be formulated as:
min ((2.))~DDnat
max A.
Ladv (i, v)
More specifically, the standard classifier only learns classify natural examples, while the adversar- ial training objective only involves the adversaries. To clarify each step, we describe the training of RPD in Algorithm 1. The efficacy analysis of the detached adversarial training objective is available in Table 9.
?Generally, an independent adversarial detection method also works in RPD, but the M---hased adversary detector simple and efficient.
4

---

Under review as a conference paper at ICLR 2023
3.3 STANDARD CLASSIFICATION TRAINING
The last objective Lats aims at standard classification. We employ cross-entropy to optimize the standard classifier following:
C U1 log
Cdts = =-=
Lend== Lat + ahLiet BL + 0|1
(8)
where 0t. 1 i C, is the prediction of classífication; C' indicaats the classes number. Crpd is the overall objective of RPD. a and 3 are the objective weights. In this work, a and 3 are set to by grid searching. À 10-3 is the L2 regularization parameter; θ denotes the parameter set of RPD.
Algorithm 1: Adversarial sampling and training of RPD
Algorithm 2: Adversarial detection and
defense based on RPD
Require: Pnats attackers {A]
Input Input examples D,; attacker
Output RPD model Fn for adversary detection
ApD for perturbation
defocusing
Train surrogate classifier F, on Drat for adversaries sampling;
Output: The Repaired Outputs R
R <- 0:
0:
2 forall Te E De do
for i +-+1 1 to k do
3
D, FR((x.): if i = then
forall (z.y) y) E Paat do
4
i. 0 4- A:
y);
5
J, (x 9):
Ú + y then
Dr. ir = FR(
B = B Uft (0.0, 1))}:
7
R = R )
end
8
end
:= B ULZ (v, o, 0))}:
else
10
end
R = R U(1):
11 end
end
12 Train FR on B using Cipdi
12 end
13 return Fn
13 return R
3.4 REACTIVE PERTURBATION DEFOCUSING
In the Phase #2, RPD tries to repair the identified adversaries via perturbation defocusing (Al- gorithm 2). Assuming that the á, +- FR(ū) denote the classification distribution and adversarial detection distribution from RPD. i (i.e., 8 1) indicates an adversary, the repaired example x, is derived by:
Ir + ApD(2, @2, 9).
where APD is an adversarial attacker performing perturbation defocusing. Finally, the repaired adversaries's output C, + FR(x,) (lines 6 - 7 in Algorithm 2). Note that the adversaries repaired by perturbation defocusing are still perturbed examples, no more perturbation defocusing needed for repaired adversaries.
4 EXPERIMENTS
4.1 DATASETS AND EVALUTAION METRICS
To validate the efficacy of RPD, we conduct experiments on three classification datasets 3; SST2*, Amazon Polarity and A datasets, respectively. SST2 and Amazon
'Note that attacking the PLM-hased models is very expensive. In this case, we use the subsets of Ama Polari bolarttyand yand AGNews datasets in our experiments, the numbers examples in the these subsets are 10K. We submit the datasets as supplementary materials for reproducible evaluation.
co wtt.://////aae.... datasets/sst2
'https:/ hettps://hugginggacce. htt.gginnnaaee.ccctatttttttttee watasstts/aaazon.ppp...
"https: "https:://oggiingffacc.oo wttp:///aaaattaaaaoooooo.o news
5

---

Under review as a conference paper at ICLR 2023
Number of Examples
Dataset
Categories
Training
Validation
Testing
Sum
S922
6920
872
1821
9613
Amazon Polarity AGNaNs
5000
2000
10000
2000
10000
The details of experimental datasets used for evaluating RPD. We further split the original training set into training and validation subsets for the AGNews dataset.
Table 2:
Polarity datasets are binary sentiment classification datasets, while AGNews is a news classi- fication dataset containing 4 classes. Table 2 shows the dataset details. For detailed evaluation metric clarification, please refer to Appendix A.1.3.
4.2 EXPERIMENTS SETTING
The adversarial defense experiments involve attack methods and PLM2-based -based classifiers. We adopt the open-source implementations of the adversarial attack methods from TextAttack candidate attackers, following the original attack settings. We use BERT and DEBERTA as objective classifiers evaluate the adversarial repair performance, while DFBERTA the base objective model used in all ablation experiments. In Table 3, we evaluate adversarial detection and defense performance across the whole testing set. However, we only evaluate 500 examples the research questions due to resource limitation. For detailed
settings, please refer to A.1.1.
4.3 ADVERSARIAL ATTACKERS
The attacker for perturbation defocusing is PWWS in this work, because it hardly corrupts the se- mantics the repaired adversaries compared to BAE and is slightly faster than TeXTFOoLER. The attackers used for adversarial sampling are BAE, PWWS and TEXTFOOLER We briefly introduce these attackers as follows:
PWWS (Ren et al., 2019) is synonym-substitution based adversarial attack method. PWWS combines both the word saliency and the classification probability to perform word replacement.
BAE (Garg& & Ramakrishnan, 2020) replaces and inserts tokens according to alternatives generated by masked language model (MLM). To identify the essential words, BAE employs a deletion- based measure of word significance.
TEXTFOOLER (Jin et al., 2020) takes more constraints (e.g., prediction consistency, semantic sim- ilarity and fluency) into consideration in generating adversaries. Tex TEXTFCCLER adopts a gradient- based word importance measure to locate and perturb the important words.
The other attackers used in ablation experiments
PSO (Zang al., 2020), IGA (Wang al., 2021a), Norpooo (Gao et al., 2018), CLARE (Li et al., 2021a).
4.4 COMPARED METHODS
RPD: The baseline of RPD that adopts multi-attack sampling based on BAE, PWWS and TEXTFOOLER. The main experimental results of RPD listed in Table 3.
S-RPD: The variant of RPD that samples adversaries from a targeted single attack. We evaluate the transferability of RPDPD and show the results in Table 4 and Table 8.
RAT: RAT has an adversarial classifier based on reactive adversarial training. RAT predicts adver- saries using an adversarial classifier and predicts natural examples using standard classifier. The number of adversaries used in training RAT is the same as the number of RPD's 's training examples.
We also compare the adversarial defense performance of RPD with other state-of-the-art methods, such as ASCC and RIFT. Please refer to Appendix A.3 for more details.
We use transformers to implement RPD: https: http://ttt....oogggggg///////eea hhtpps://gi thub. wttpph/cco/ogaaaaaaeeeeeeeeoeeee

---

Under review as a conference paper at ICLR 2023
4.5
MAIN RESULTS
Table 3: The adversarial detection and defense performance of RPD on different objective models; "Acc." is abbreviation for Accuracy. The results are the medians in five runs.
Dataset
Model
Target
Clean Acc(5))
Attarker
Attacked Acc
Defender
Deterrion Aec.(%)
Acci()
Defense
Restored Acco%)
25.35
U5.02
BERT
91.78
GOLER
8:21
BAE
<1.38
R3D
02000
77.70
5812
1EATPGOLEA
PMWS
22.12
20.82
96.00
91.00
04. 56
02.74
01.21
DEBERTA
94.73
BAR
45.36
07.05
12.00
35.06
FMRS
20.82
RAT
91.83
15:50
23.85
TEXTPBOLER
12
91.70
19:01
25:17
BAB
44.00
79:15
19:15
85
3ERT
18400
PMAS
4.10
50565
05:04
11.25
TRXYFoo1 KM
1.25
91.04
01:91
01.00
BAE
M6.05
R2D
00:22
50.22
01.35
Amwxon Polarity
TEX7FO01EX
PMWS
20.30
19.00
19:25
95.06
05: 66
18:225
050.05
02.05
DEBERTA
96.20
BAE
56.85
23.
76.90
RAT
207
55:43
03.20
BAB
74.90
43.82
43.07
85.95
SERT
PMARS
25.55
00.67
80.34
87.05
TEXTFGOLER
10.50
57:01
53.10
R210
85.15
10:15
AGH
TEXTEGOLER
50.27
01.27
DEBERTA
BAE
PMWS
56.55
RAT
97.20
18.75
58.25
LEATEGOLER
42.30
500.0
31.30
00.30
The experimental findings in Table show how well RPD is able to identify and defend against adversaries. We provide both the standard classification performance and the accuracy under adver- sarial attack the objective models in order to intuitively demonstrate the efficacy of adversarial detection and repair. As demonstrated in existing studies (Jin et al., 2020; Garg & Ramakrish- nan, 2020), the objective models' performance is generally significantly decreased by adversarial attackers, particularly on the SST2 and Amazon Polarity datasets. For example, BERT'S per- formance can be decreased by up to 90%+, and its accuracy on the Amazon Polarity dataset only 1.25% its wors((TEx1FoouES) the majority of circumstances; its worst accuracy on Ama zon Polarity dataset is (under nutshell, adversarial attacks continue to a threat to existing PL.Ms. Despite having more classes, AGNews only sacrifices 11.32% and 16.7% accuracy when attacked by BAE, which means the PLM's robustness varies depending on the dataset domain.
In general, DEBERTA is more robust than BERT in
PWWS attack).
Overall, RPD's ability in terms of adversarial detection and repair is encouraging. Among all the datasets, RPD based on multi-attack sampling performs impressively, demonstrating that PLMs (es- pecially DEBERTA) are capable of recognising adversaries. Meanwhile, compared to previous ad- versarial defense studies, the regression of standard classification and adversarial detection error rate on natural examples are low 1% and 10%, respectively (please refer Appendix A.2 for details). This reduces mis-repairs on natural examples. The adversarial defense performance based on perturbation defocusing depends on the accuracy of adversarial detection, which means detection accuracy 2 defense accuracy. However, because the accuracy on natural examples suffers no sig- nificant loss, in the case of the worst detection accuracy (43.82% on AGNews dataset) of BERT, the restored accuracy (83.95% is still better than BERT without defense (74.8%). On the one hand, our experimental results show reactive perturbation defocusing able to repair 97%+ of correctly identified adversaries without clean performance sacrifice. On the other hand, RPD can be adapted to other models provided that the adversary detectors are deployed.
To our best knowledge, there is no reactive defense counterpart that can be directly compared with RPD. Hence, we implement RAT based on reactive adversarial training. It can be observed that reactive adversarial training has worse performance of adversarial repair comapred to RPD, with ~ 30% defense accuracy and ~م 60% restored accuracy in most situations. This means that RAT hardly handle challenging adversarial attacks, especially while the number of adversaries is limited. Due to resource limitations, we show a part of the experimental results compared with other popular proactive adversarial defense methods in Appendix A.3.
7

---

Under review as a conference paper at ICLR 2023
4.6 RESEARCH QUESTIONS
We discuss more findings about RPD by answering the following research questions.
RQI: DOES PERTURBATION DEFOCUSING REALLY REPAIR ADVERSARIES?
Our main experimental results show that perturbation defocusing is able repair 97%++ of correctly discriminated adversaries. To explain why PD works, we investigate the similarity between adver- saries and repaired adversaries. We randomly select 500 natural examples from SST2 12, Amazon Polarity and AGNews datasets and obtain the adversaries and repaired adversaries. We encode these examples and calculate the output cosine similarity between adversary-natural example pairs and repaired adversary-nature example pairs. We plot the cumulative distributions of similarity scores on the SST2 dataset in Figure (the visualizations ure 5). The cumulative distributions the SSI2 dataset show the repaired adversaries resemble natural examples from the perspective of predictions (Drep 2 0.92), while the adversaries generally have Arep I 0.85.. This indicates the adversaries repaired by perturbation defocusing contain similar semantics to natural examples.
other datasets are available Fig-
5373
0.5-
0.0
0.1
0:1
Na.
Adesaary
0.-
Netzzal
Advrssrry
0-2
Tatroal
Adhersux
Bepeirt Mivcoery
Pepiieal Adverwey
Hepabeed
Ausi (888)) Aew! 1997
Auci 0.88% Ansi 0.00
Duci 4,505 D.... 0.505
Figure 3: The cumulative distribution of output's cosine similarity scores towards natural examples. Andv and Arep indicate the average similarity scores of adversaries and repaired adversaries.
We also visualize the similarity of the feature space. We encode the above examples and visualize the representations via t-SNE in Figure 4(the visualizations of other datasets are available Figure 6). It can be observed that the repaired adversaries are still discriminateable by PLMs because their feature space is similar the adversaries. However, we note that more repaired adversaries lie in the natural example space compared to adversaries, which means repaired adversaries are more similar natural examples the feature space to some extent.
Natuná
Natumi
Natural
hivenary
Advenrry
Toooo LICTON
Miverryy
Repaiee Adberses
Repained Movesses
Bogaitod Adresary
SSWiAael cl.s%
Figure 4: The cluster visualizations of natural examples, adversaries and repaired adversaries via I-SNE.
RQ2: CAN RPD WORKS ON UNKNOWN ADVERSARIAL ATTACKS?
The most challenging obstacle for adversarial detection and repair methods is working on unknown attacks. Because RPD relies simple PLM-based adversarial detector to identify adversaries, need to know whether it can distinguish adversaries generated by unknown adversarial attackers. In this case, evaluate the RPD's performance unknown attacks. The results available in Table 4(we also evaluate the transfcrability of S-RPD Table 8). The experimental results in Ta- ble 4 show that even though trained BAE, PWWS and TEXTFOOLER, RPD is able to distinguish
8

---

Under review as a conference paper at ICLR 2023
unknown adversaries, especially for PSO and DIEFWoRDBUs, For example, the accuracy of re- paired adversaries is promising (97.5% and 90.48% on SST2 and Amazon Polarity datasets). However, there is significant defense performance drop in the adversaries generated by CLARE. In conclusion, RPD can identify and repair unknown adversaries.
Table 4: The adversarial detection and defense performance of RPD on unknown attacks.
Clean Acc/
Attacked
Detection
Delenee
Restored
Dataset
Attacker
Acc((%)
Aec4%)
Acc(%)
Accu. (%
IGA
1.52
33.31
13.33
De BeWoRDdus
22
08.44
87.50
50.00
1.39
62.30
59.37
57.00
IGA
14:91
92.31
92.31
94.85
Amazon Polarity
96.20
Dr PP Buuu
43.43
S7.04
85.19
86.87
FBO
12007
03:46
50.62
85:15
IGA
27.51
00.71
00.71
90.95
AGNewa 92.12
DezeMocnoBus
45.00
02.75
89.00
85,00
RQ3: DOES MUL.TI-TTAAC SAMPLING OUTPERFORM SINGLE-ATTACK SAMPLING?
We find that multi-attack sampling may assist adversarial detectors differentiating between hostile cases. In order to verify our idea, perform ablation experiments based on single-attack sampling (i.e., S-RPD) and provide the results Table 5. In the majority of instances, the detection accuracy of S-RPD suffers large decreases (up 12.6%). Consequently, the repair performance demon- strates up to 18.21% regression. We attribute the degraded performance of adversarial detection to two factors: single-attack sampling leads fewer training data for the adversarial detector; b) multi-attack sampling may generate more diverse adversarial patterns than single-attack sampling. In summary, defense accuracy and restored accuracy show that single-attack sampling limits RPD's performance.
Table 5: The adversarial detection and defense performance of S-RPD under different attackers and PLMs. The "Diff" measures the performance change compared RPD.
Attacked
Defene
Medel
Aoc/%)
Acci
DSEL [5]
ACGIST
DIEE. (5)
ACC
DIFF (3)
SAS
20
40.00
11.70
$3.43
11:40
01.91
5.00
BERT
91.66
1995
14.44
70105
$2:42
75.16
11.00
24.82
4.21
8.21
30.23
28.30
+1.00
22322
-6774
-2.50
-3.46
1370
10:00
-13.0
00:10
-12.70
13.30
-2.00
BERZ
94.55
7795
4.20
02.35
3.10
72.00
3.31
25.30
2:55
81.25
2A5
0.90
05:30
20.00
16:30
95:10
01.95
1.30
203
1320
20m1
1531
24:39
18.70
73.00
1110
91.50
7994
26.05
51.20
-0.0
80.00
-5.58
29.66
-1.00
7EX1P0OLE1
10.00
2010
113.0
15:20
-11.00
71:40
-1900
-660
-361
37.01
-1.36
-130
5 CONCLUSION
Existing approaches for adversarial defense generally result in performance sacrifices on natural examples. In this study, we propose the RPD based on perturbation defocusing that alleviates per- formance sacrifice by only repairing identified adversaries. Perturbation defocusing exploits ad- versarial attacks to distract objective models from malicious perturbation and has been shown to repair up to 97% of correctly identified adversaries among several challenging attackers. Pertur- bation defocusing is new perspective for future adversary repair research, which may supersede the reconstruction- on the accuracy of adversarial detection, which limits RPD's performance. In the future, will explore other adversarial detection methods and explicit constraints of semantic similarity in pertur- bation defocusing improve RPD's defense robustness.
methods. However, the adversarial defense performance of RPD depends

---

Under review as a conference paper at ICLR 2023
REFERENCES
Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani B. Srivastava, and Kai- Wei Chang. Generating natural language adversarial examples. In Ellen Riloff, David Chiang, Julia Hockenmaier, and ichi Tsujui (eds.), Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing. Brussels, Belgium, October 31 November 4, 2018, pp. 2890-2896. Association for Computational Linguistics, 2018. doi: 10. 10.18653/v1/d18. 1316. URL https: /doii org / 10. 18 11653/v1/d11 1316.
Rongzhou Bao, Jiayi Wang, and Hai Zhao. Defending pre-trained language models from adversarial word substitution without performance sacrifice. In Chengqing Zong, Fei Xia, Wenjie Li, and Roberto Navigli (eds.), Findings of the Association for Computational Linguistics: ACL/JCCNPP
2021, Online Event, August 1-6, 2021, volume ACL/UCCLPP 2021 of Findings of ACL, pp. 3248 3258. Association for Computational Linguistics, 2021. doi: 10. 10.53/3/1112001 1. findings-acl..22 ac1.287.
URL hwtps:tpp//... / /oi .org 10. 10. 081316633vv wll 22021 fi mndiinngge ngs acl 228.
Guandan Chen, Kai Fan, Kaibo Zhang, Boxing Chen, and Zhongqiang Huang. Manifold adversarial augmentation for neural machine translation. In Chengging Zong, Fei Xia, Wenjie Li, and Roberto
Navigli (eds.), Findings of the Association for Compulational Linguistics: ACI/UCNLP 2021, Online Event, August 1-6, 2021, volume ACL/IICNLP 2021 of Findings of,, pp. 3184-3189. Association for Computational Linguistics. 2021. doi: 10. (18653/11222211111 1in.:./.nn/... findings-acl.281. URL
https: /ooi.....//// orgg 10 18653/ 2021 f nd ngs acl 281.
Yong Cheng, Lu Jiang, and Wolfgang Macherey. Robust neural machine translation with doubly adversarial inputs. Anna Korhonen, David R. Traum, and Lluís Mårquez (eds.), Proceedings of the 57th Conference of the Association for Computational Linguistics, ACI. 2019, Florence, Italy, July 28- August 2, 2019, Volume 1: Long Papers, pp. 4324-4333. Association for Computational Linguisties, 2019. doi: 10. 10.1866/11//11914425 URL https: /doi. org/ 10..3/10..111/1111 p1 9425.
Xinshuai Dong, Anh Tuan Luu, Min Lin, Shuicheng Yan, and Hanwang Zhang. How should pre-trained language models be fine-tuned towards adversarial robustness? In Mare' Aurelio Ranzato, Alina Beygelzimer, Yann N. Dauphin, Percy Liang, and Jennifer Wortman Vaughan (eds.), Advances in Neural Information Processing Systems 34: Annual Conference on Neu- ral Information Processing Systems 2021, NeurIPS 2021, December 6-14, 2021, virtual, pp. 4356 4369, 2021. URL https: http:///poeeeeeenn...e.. h 4bb--/4bbabb---baatttte.a html.
neuri newrips..p..... wttpppppp..pppppee..e/// h/t0//hhhhhh////
Ji Gao, Jack Lanchantin, Mary Lou Soffa, and Yanjun Qi. Black-box generation of adversarial text sequences to evade deep learning classifiers. In 2018 IEEE Security and Privacy Workshops, SP Workshops 2018, San Francisco, CA, USA, May 24, 2018, pp. 50-56. IEEE Computer Society, 2018. doi: 10.1109/PW22018.0000 URL https:/ / /doii org/ /0////0.00 10. 1109/SPM. 2018. 00016.
Siddhant Garg and Goutham Ramakrishnan. BAE: bert-based adversarial examples for text clas- sification. In Bonnie Webber, Trevor Cohn, Yulan He, and Yang Liu (eds.), Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing. EMNLP 2020, On- line, November 16-20, 2020, pp. 6174-6181, Association for Computational Linguistics, 2020. doi: 1200655/1/2222.mmmmmpmmooaa emnlp-main. 498.
URL https: //oii/oi..//// . org. 10w.00.16633311//2
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference on Learning Representations, ICLR 2015, San Diego CA, USA, May 7-9, 2015, Conference Track Proceed- ings, 2015. URL http: /tt//aaivvvv.. wrt. /atos//1112 1412. 6572.
Maor Ivgi and Jonathan Berant. Achieving model robustness through discrete adversarial training. In Marie-Francine Moens, Xuanjing Huang, Lucia Specia, and Scott Wen-tau Yih (eds.), Proceed- ings of the 2021 Conference on Empirical Methods in Natural Language Processing, EMNLP 2021, Virtual Event / Punta Cana, Dominican Republic, 7-11 November, 2021, pp. 1529-1544. Association for Computational Linguistics, 2021. doi: 10. 1/2021..20112ppp.. main. 115. URL https: / //o..//oo..oo .org/10 10. 0653/ / emn 1 i 115.
10

---

Under review as a conference paper at ICLR 2023
Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. Is BERT really robust? A strong baseline for natural language attack on text classification and entailment. The Thirty-Fonid Fourth AAAI Conference on Artificial Intelligence, AAAI 2020, The Thirty-Second Innovative Applica- fions of Artificial Intelligence Conference, IAAI 2020, The Tenth AAAI Symposium on Educa- tional Advances Artificial Intelligence, EAAI 2020, New York, NY, USA, February 7-12, 2020, Pp. 8018-8025, AAAI Press, 2020. URL https: http::://ojs.aast aaai. www..........rg.........oo www..oiw....iiii/o/eooooo. http/iidxx..pp.. php/ BAAA/ article/view/ce 6311.
Erik Jones, Robin Jia, Aditi Raghunathan, and Perey Liang, Robust encodings: A framework for combating adversarial typos. In Dan Jurafsky, Joyce Chai, Natalie Schluter, and Joel R. Tetreault (eds.). Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, ACL 2020, Online, July 5-10, 2020, pp. 2752-2765, Association for Computational Linguis- tics, 2020. doi: 00.16653v1/2220.acl- 245. URL https: /tt.i//oiiioa//////// org/ / 18653/v1 2020 acl ma 245.
Yannik Keller, Jan Mackensen, and Steffen Eger. Bert-defense: A probabilistic model based on BERT to combat cognitively inspired orthographic adversarial attacks. In Chengqing Zong, Fei Xia, Wenjie Li, and Roberto Navigli (eds.), Findings of the Association for Computa- tional Linguisties: ACL/IICNLP 2021, Online Event, August 1-6, 2021, volume ACL/ICCNLP 2021 of Findings of ACL, pp. 1616-1629. Association for Computational Linguistics, 2021. doi: 10. 0/665//w/2021.finiinig 141.
141. URL https: //o///o.ii.//// 1ttp///1...1553/1/2/000000
Aandings-ccl. 141.
Thai Le, Jooyoung Lee, Kevin Yen, Yifan Hu, and Dongwon Lee. Perturbations the wild: Lever- aging human-written text perturbations for realistic adversarial attack and defense. In Smaranda Muresan, Preslav Nakov, and Aline Villavicencio (eds.), Findings of the Association for Com- putational Linguistics: ACL 2022, Dublin, Ireland, May 22-27, 2022, pp. 2953-2965. Asso- ciation for Computational Linguistics, 2022. doi: 10.18653/v h2t.:///n2222..ngsa-aa.aa f findiiinnnnniie .22.
URL
https: /opp:///do...e ooriioorg/000
Dianqi Li, Yizhe Zhang, Hao Peng. Liqun Chen, Chris Brockett, Ming-Ting Sun, and Bill Dolan. Contextualized perturbation for textual adversarial attack. In Kristina Toutanova, Anna Rumshisky, Luke Zettlemoyer. Dilek Hakkani-Tür, Iz Beltagy, Steven Bethard, Ryan Cot- terell, Tanmoy Chakraborty, and Yichao Zhou (eds.). Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Lan- guage Technologies, NAACL-HLT 2021, Online, June 6-11, 2021, pp. 5053-5069. Association for Computational Linguisties, 2021a. doi: 10.18653/v//0221 //doi. orri..rg/100 10. www.118661110000 htt.:///1/222.maaaccll...
-naacl-mann.400 URL https:
www.aaccllla..... maacclmminn 400..
Linyang Li, Ruotian Ma, Qipeng Guo, Xiangyang Xue, and Xipeng Qiu. BERT-ATTACK: ad- versarial attack against BERT using BERT. In Bonnie Webber, Trevor Cohn, Yulan He, and
Yang Liu (eds.), Proceedings of the 2020 Conference on Empirical Methods Natural Lan- guage Processing, EMNLP 2020, Online, November 16-20, 2020, pp. 6193-6202. Association URL https:
for Computational Linguistics, 2020. doi: 10. emnlp-main... 500.
//doi. o 10. 1ww11/86/1vvoo
Linyang Li, Demin Song, Jiehang Zeng, Ruotian Ma, and Xipeng Qiu. Rebuild and ensemble: Exploring defense against text adversaries. CoRR, abs/2203. 14207, 2022. doi: 10.48550/arXiv. 2203. 14207. URL. / /0g/ 48550/arXiv 2203. 14207..
Zongyi Li, Jianhan Xu, Jiehang Zeng, Linyang Li, Xiaoqing Zheng, Qi Zhang, Kai-Wei Chang, and Cho-Jui Hsieh. Searching for effective defender: Benchmarking defense against adversarial word substitution. In Marie-Francine Moens, Xuanjing Huang, Lucia Specia, and Scott Wen- Yih (eds.), Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, EMNLP 2021, Virtual Event / Punta Cana, Dominican Republic, 7-11 November; 2021, pp- 3137-3147, Association for Computational Linguistics, 2021b. doi: 10.18653/v1/2021. emalp-main.251 251. URL hwtps:ttpse... /ooi .rgg 10..0000000 11653881110000
wwnnlpmmee i in 251.
Hui Liu, Yongzheng Zhang, Yipeng Wang, Zheng Lin, and Yige Chen. Joint character- word embedding and adversarial stability training defend adversarial text. In The Thirty-Fourth

---

Under review as a conference paper at ICLR 2023
AAAI Conference on Artificial Intelligence, AAAI 2020, The Thirty-Second Innovative Applica- tions of Artificial Intelligence Conference, IAAI 2020, The Tenth AAAI Symposium on Educa- tional Advances in Artificial Intelligence, EAAI 2020, New York, NY, USA, February 7-12, 2020, pp. 8384-8391. AAAI Press, 2020a. URL https:/tt////e /ttps//sasss.... www.aaaiii.aaaaa.a...a... .rg. phhpexx.pp/AAa article/viewe 6356.
Kai Liu, Xin Liu, An Yang, Jing Liu, Jinsong Su, Sujian Li, and Qiaoqiao She. A robust adversarial training approach to machine reading comprehension. In The Thirty-Fourth AAAI Conference on Artificial Intelligence. AAAI 2020, The Thirty-Second Innovative Applications of Artificial Intelli- gence Conference, IAAI 2020, The Tenth AAAI Symposium on Educational Advances in Artificial AAAI Press, 6357.
Intelligence, EAAI 2020, New York, NY, USA, February 7-12, 2020, pp. 2020b. URL htwp:::tt//.... //t/:///j/s jojs aaai org/ wttg//nde.....ooooooo.oooo.oeeee php AAA./AAAAAA//.//AA
Takeru Miyato, Andrew M. Dai, and Ian J. Goodfellow. Adversarial training methods for semi- supervised text classification. In 5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings. OpenReview.net, 2017.
URL httpt:://///. ht/p//peeeeviiieee net / fooum? idxxrxdd2xxx____1 x1.
Maximilian Mozes, Pontus Stenetorp, Bennett Kleinberg, and Lewis D. Griffin. Frequency-guided word substitutions for detecting textual adversarial examples. In Paola Merlo, Jörg Tiedemann, and Reut Tsarfaty (cds.), Proceedings of the 16th Conference of the European Chapter of the Association for Computational Linguisties: Main Volume, EACL 2021, Online, April 19 23, 2021, pp- 171-186. Association for Computational Linguistics, 2021. doi: 10.18653/1122021. eacl-main. 13. URL https: http://oi....ooo 10. 18653 (13865/vvl// /ttp/////122/eeee http://221eeac1mmeeeeee maaen--mmai... 13.
Danish Pruthi, Bhuwan Dhingra, and Zachary C. Lipton. Combating adversarial misspellings with robust word recognition. In Anna Korhonen, David R. Traum, and Lluís Mårquez (eds.), Proceedings of the 57th Conference of the Association for Computational Linguistics, ACL 2019, Florence, Italy, July 28- August 2, 2019, Volume 1: Long Papers, pp. 5582-5591, As- sociation for Computational Linguistics, 2019. doi: 10.18653/v1/p19.1 1561. URL https:
Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. Generating natural language adversarial examples through probability weighted word saliency. Anna Korhonen, David R. Traum, and Lluís Marquez (eds.). Proceedings of the 57th Conference of the Association for Computational Lingwistics, ACL 2019, Florence, Italy, July 28- August 2. 2019, Volume 1: Long Papers, pp. 1085-1097, Association for Computational Linguistics, 2019, doi: 10. 10.18653/11p11-1100.. URL attps:///oli http:///oooooog///// 10. 186.3 1ww.//////1//////// 1103.
Abigail Swenor and Jugal Kalita, Using random perturbations to mitigate adversarial attacks on sentiment analysis models. CoRR, abs/2202.05758, 2022. URL /tttps://axxiv....t abs/
22C2. 22C2.05758.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Good- fellow, and Rob Fergus. Intriguing properties of neural networks. In Yoshua Bengio and Yann LeCun (eds.), 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014. URL http: //arxiv.orq//////o...l..o... abs 13122112 2.2..199 6199.
Samson Tan, Shatiq R. Joty, Lav R. Varshney, and Min- Yen Kan. Mind your inflections! improving NLP for non-standard englishes with base-inflection encoding. In Bonnie Webber, Trevor Cohn, Yulan He, and Yang Liu (eds.), Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing, EMNLP 2020, Online, November 16-20, 2020, pp. 5647-5663. URL
Association for Computational Linguistics, 2020. doi: 10. 16653//12222.emmlppple emn p- ma in. 455.
nttps:://oii wrgg/10g 10. 28653/v1/220/
Boxin Wang, Chejian Xu, Xiangyu Liu, Yu Cheng, and Bo Li. Semattack: Natural textual at- tacks via different semantic spaces. In Marine Carpuat, Marie-Catherine de Marneffe, and Iván Vladimir Meza Ruíz (eds.), Findings of the Association for Computational Linguistics: NAACL 2022, Seattle, WA, United States, July 10-15, 2022, pp. 176-205. Association for Computational Linguistics, 2022. doi: 10. 1t.18653/w1/0022.fff findings 18653/vll /2022.22222 fi findingeen naacl.1.1111
htw.://002..nnnnn-aaaaa.llllllll naacl. URL https: //ooi. org/10.
12

---

Under review as a conference paper at ICLR 2023
Xiaosen Wang, Jin Hao, Yichen Yang, and Kun He. Natural language adversarial defense through synonym encoding. In Cassio P. de Campos, Marloes H. Maathuis, and Erik Quaeghebeur (eds.). Proceedings of the Thirth-Seventh Conference on Uncertainty in Artificial Intelligence, UAI 2021, Virtual Event, 27-30 July 2021, volume 161 of Proceedings of Machine Learning Research, pp. 823-833 AUAT Press, 2021a. URL https: / /ttp//eedooee.s.////ee/eeeee..ee mwr.press/////.. v161/wand htsl//anglaa.tm..
Xiaosen Wang, Yichen Yang, Yihe Deng, and Kun He. Adversarial training with fast gradient projection method against synonym substitution based text attacks. In Thirty-Fifth AAAI Confer- ence on Artificial Intelligence, AAAI 2021, Thirty-Third Conference on Innovative Applications of Artificial Intelligence, IAAI 2021, The Eleventh Symposiun Educational Advances in Artifi- cial Intelligence, EAAI 2021, Virtual Event, February 2-9, 2021, pp. 13997-14005, AAAI Press, 2021b. URL https::////.
wtrg/index... php/ wttpp//t..aattcee//a/opap htt.//artiieeeeiiieieeeeeeeeeeee 648.
Jianhan Xu, Cenyuan Zhang, Xiaoqing Zheng, Linyang Li, Cho-Jui Hsich, Kai- Wei Chang, and Xuanjing Huang. Towards adversarially robust text classifiers by learning to reweight clean ex- amples. In Smaranda Muresan, Preslav Nakov, and Aline Villavicencio (eds.), Findings of the As- sociation fo Computational Linguistics: ACL 2022, Dublin, Ireland, May 22-27, 2022, pp. 1694- 1707. Association for Computational Linguistics, 2022. doi: 10.18653/41/2022..mmm www.://s..iiingnaall....m URL https://////. / / www.dooo...o.ooooooooooooooooeee wrg/ /10 11w131/1///0000
Yuan Zang, Fanchao Qi, Chenghao Yang, Zhiyuan Liu, Meng Zhang, Qun Liu, and Maosong Sun. Word-level textual adversarial attacking as combinatorial optimization. In Dan Jurafsky, Joyce Chai, Natalie Schluter, and Joel R. Tetreault (eds.). Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, ACL 2020, Online, July 5-10, 2020, pp. 6066- 6080. Association for Computational Linguistics, 2020. doi: wttpp//........../..//o///////// /0/05///v/2200/00 acl-mai-- 540.
URL httpht http://ooi.aaa http://ooo..rggg/////// 10. wet.s/666vvvv/.
Xinze Zhang, Junzhe Zhang. Zhenhua Chen, and Kun He. Crafting adversarial examples for neural machine translation. In Chengqing Zong, Fei Xia, Wenjie Li, and Roberto Navigli (eds.), Proceedings of the 59th Annual Meeting of the Association for Computational Linguis- tics and the 11th International Joint Conference on Natural Language Processing, ACL/IC- NLP 2021, (Volume 1: Long Papers), Virtual Event, August 1-6, 2021, pp. 1967-1977. As- sociation for Computational Linguistics, 2021. doi: 10.18653/v1/2022 aacl-long, 153. URL https: / //co:///ooi..
doi. . org/10..o/ooo wtt.o//.......//.... 1ww.1/1161////.
acl-long. 153.
Zhengli Zhao, Dheeru Dua, and Sameer Singh. Generating natural adversarial examples. In 6th International Conference on Learning Representations, ICLR 2018, Vanconver, BC, Canada, April 30- May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018. URL https: / openneviei. net/ forummid=d1Bijppepp
Yichao Zhou, Jyun- Yu Jiang, Kai-Wei Chang, and Wei Wang. Learning to discriminate pertur- bations for blocking adversarial attacks in text classification. In Kentaro Inui, Jing Jiang, Vin- cent Ng, and Xiaojun Wan (eds.), Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Lan- guage Processing, EMNLP-IJCNLP 2019, Hong Kong, China, November 3-7, 2019, pp. 4903- 4912. Association for Computational Linguistics, 2019. doi: 10.18653/v1/D19. 1496. URL https: /oiiooioooo///o.ooo// woooooo../............oo / v wwwp/9--1/// 9494..
Chen Zhu, Yu Cheng, Zhe Gan, Siqi Sun, Tom Goldstein, and Jingjing Liu. Freelb: Enhanced adver- sarial training for natural language understanding. In 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.net, 2020. URL BKLLhttpp://opereeviiee net wtt////rummmieeeeeee do
A APPENDIX
A.1 IMPLEMENTATION DETAILS
A. HYPER- SETTINGS
We use the following configurations to fine-tune classifiers:
13

---

Under review as a conference paper at ICLR 2023
1. The learning rates for both BERT and DEBERTA are x 10
The batch size and maximum sequence modeling length are 16 and 80, respectively.
3. The dropouts set to 0.5 for all models.
The loss functions of all objectives are cross-entropy.
5. The objective models and RPD models trained with 5 epochs.
6. The optimizer used for fine-tuning objective models is Adank.
A.1.2 EXPERIMENT ENVIRONMENT
The experiments are conducted on Cent OS which is equipped with an RTX 3090 GPU and Core i-12900k. We use PyTorch 1.12 and revised version TextAttack based on v0.3.7.
A.1.3 METRIC CLARIFICATIONS
The clean accuracy and attacked accuracy denote the objective model's original (i.c., clean) perfor- mance and performance under attacks. The detection accuracy and defense accuracy measure the RPD's performance in adversarial detection and repair, which only measure adversaries. As a global evaluation, the restored accuracy denotes the objective model's performance on the attacked dataset (i.e., replacing the natural examples with their adversaries in the dataset if their adversaries exist.). We terminate an attack if it takes longer than 10 minutes and ignore the example in the metrics calculation.
A.2 PERFORMANCE ON CLEAN DATA
The adversarial defense performance depends on the adversarial detection accuracy. In this case, we evaluate the adversarial detection eтrоr rate and the classification accuracy on clean data with- out defense. From the experimental results listed in Table 6, we observe that RPD achieves up to 90+ adversarial detection accuracy, which indicates if we use RPD as a regular classifier, original performance will not significantly decrease. On the other hand, the classification accu- racy of adversarics also benefits from the adversarial detection training objective, c.g. SST2 and AGNews datasets.
Table 6: The performance of RPDon clean data
Target Model
Clean Acc. %
Detection
Classification
Dataset
Attacker
Acc.(% )
Error (8)
Acc.(%)
Diff. (8)
95.11
PRWS
97.31
2.69
95.06
0.33
TEX:FOGLBE
97.03
2.97
95.99
1,26
Multi -ate-aatttt aatack
90.33
9.67
$1.39
0.16
BAE
95.80
4.20
95.85
00.3
99.01
0.99
96.92
0.72
Amazon Polarity
DeBERTA
96.20
TEX"FOCIRR
98.15
1.85
96.20
0.00
Mul. -attack
95.93
4.07
95.67
0..3
BAL
98.85
1.15
90.95
-1.17
PXRS
90.25
0.75
92.50
0.38
AGNeMs
DeBERTA
92.12
98.40
1.60
92.45
0.33
Mulli-aLLacs
97.60
2.40
92.70
0.58
A.3 COMPARISON WITH ASCC
From the perspective of adversarial repair, RPD achieves impressive results compared with exist- ing methods (e.g.. ASCC). The experimental results are available in Table 7. The experimental results show that perturbation defocusing which distracts the objective model from the malicious perturbations achieves comparable performance. We explain why perturbation defocusing works for adversarial defense in Figure
14

---

Under review as a conference paper at ICLR 2023
Table 7: The adversary defense performance comparison TMDB dataset between RPD and other state-of-the-art defense methods under GA attack. means that due to computation resource limi- tation, sampled 100 adversaries generated by GA to train RPD, which enough (e.g., the whole training set contains 8000 examples).
Method
Dataset
Model
Defense Acc. (%)
ASCC RIFT
IMDB
BERT
70.20
IMDB
BERT
77.20
RPD
IMDB
BERT
81.31
SST2, S (TEXTROOLEEO)
S5T2 (BAE)
S512 (PWWS)
Notural
Natural Adversary
Natural
Adversicy
0.2
Repoited Advenary
Requited Advensry
Reyaired Advensrry
6.5
-0.5
Au 0.86% A. 0.92%
Auhi 0.80% A...i 0.50%
Agp -0.0%% Ayeal 0.92%%
0.8
Amooon (TTX (OOOTOO
0.8
Amusoo (BAT)
Acaaccn (PWWS)
0.6
0.4
Natural
6.2
Advrtsscy
Adversary
0.2
Advutssr
Regaired Adversrry
Repaired Advensry
Repalent Advenary
0.5
0.5
-05
Auti Arci
Ause -011%% Auest 0.77%
ACNNows (TEXTTOOLER)
AG N.G.orlllhh (PWW5)
AGNomdlff (BAB)
0.2
Natural
Adversszy
Natural
Adversagy
0.2
Natural
Adverssry
Regaited Adbwaary
Regairad Adoensay
Repoired Advensury
-0.
0.5
-0.5
Ausi 0.07% Auc.t
0.88%5
Auii 0.51% A...: 0.93%
Aya 0.50% Ara 0.84%
Figure 5: The cumulative distribution of output's cosine similarity scores towards natural examples. Ando and Ares indicate the average cosine similarity scores of adversaries and defocused adver- saries.
A.4 FULL VISUALIZATIONS OF RQI
A.5
TRANSFER EXPERIMENTS OF S-RPD
We show the performance of RPD in transfer experiments in Table Interestingly, the stronger the naturalness constraints cause the worse transfer ability of the adversarial detectors, e.g., PWWS and TEXTFOOLER suffer from up to 62.7% and 62.75% adversarial detection performance and ad- versarial repair performance drop the BAE-based adversaries, especially the SST2 dataset. Therefore, we argue that imperative to train the detector to simultaneously consider attackers with different constraint strengths.
15

---

Under review as a conference paper at ICLR 2023
Natural
Natura
Natunal
Advensary
Adversary
Arneon BIENTROOD (ER)
Adversrr
Repalied Adveraryy
Repairod Adversmry
Repalved Arversary
(sttat cLSs
SS12
Natural
ACNNews10K (TEXTFOOLER
Advensory
Advensory
Adversrry
Repaired Adversoryy
Roperred Arvvnsery
Repoired Adversary
Amnsoon (PWWS)
Amnzon [DAE)
Natural
Natural
Natural
Adversary
Advensary
Advensary
ACNoostiK (BAB)
Regsired Adversary
A.NewsllIc Iik (PW (www))
Repaized Advensary
Repaired Advemarry
PROOIEINEE eIss
Figure 6: The t-SNE cluster visualizations of natural examples, adversaries and restored examples. The average cosine similarity scores of the clusters are indicated below the figures.
Table 8: The transferred performance of single attack- S SPRPD models for different attackers.
Source
Target
delection accuracy ST
defenee accuracy! (1
resfrre accurncyl' S
Dataset
Attack
Attark
OR. [N]
Fannk
(S7
Franst
IREAST
Frans
W
BAE
FMAS
61.56
27.48
50.2
50.82
10.12
62.08
77.01
18.70
78.70
17.43
72.93
50.02
79.13
0.20
1,20
25.30
10.70
2520
-0275
M0.07
33390
BMKS
LEXEOGLER
86.50
15.27
15.82
95.45
17.00
21.00
$4.98
70.85
Tex:Poct.en
87.00
25.00
20.70
-97.89
83.00
83.42
85.1
2000
50.71
$5.67
30.07
57.07
-28
0.30
BAF
TEXEPOCLED
FMXE
9577
$7.25
$7.25
03.76
87:25
02.11
51.25
1:33
00.85
30,00
30.00
11:00
-3.55
Polarity
PMK
TextFocLen BAB
SAE
96.95
30000
02.14
02.14
10.25
96.25
02:14
50000
90.14
-0.25
94.65
50.55
01.75
-2.90
PWAE
96.49
95.40
01.05
R&F
87.14
83.81
$3.00
96.72
05.35
68.90
Lex:PPoLei
94.60
91.63
$5.40
RQ4: DOES DETACHED ADVERSARIAL. TRAINING OBJECTIVE WORK IN RPD?
To alleviate the performance sacrifice caused by adversarial training on clean data, we adopt the detached adversarial training objective. To verify its feasibility, employ traditional adversarial training in RPD. The results in Table 9 show that traditional adversarial training works for perturba- tion defocusing, while the performance drop clean data is inevitable. We also evaluate ablated RPD without adversarial training objective; the experimental results show that the detection aceu- racy and restored accuracy increases by 1% 2%, this is because the adversarial detection
16

---

Under review as a conference paper at ICLR 2023
objective attracts more attention while 3 0. However, restored accuracy drops 2% 3%. Therefore, we believe that detached adversarial training is effective in RPD.
Table 9: The experimental results of RPD based on ensemble adversarial training objective.
Targst
Clean Acc(%))
Dutaset
Model
Attacker
Acca%)
Aec. %
DIFI. (6)
Accr%)
DIEE. (5)
Acc]%)
birz. (N)
BAE
$5.96
70.97
0.42
68.28
-0.79
77.00
-0.7
20.22
96.72
0.63
95.05
0.73
02.04
0,83
22102
1.30
-241
86.30
-2.14
Anazon Folarity
DEBERTA
96.20
PSWS
:RXFFOOCRS ER
21.0
96.40
0.25
95.40
0.26
01.12
-1.53
BAE
$1.00
80.96
-0.73
80.95
-4.20
85.06
-0.09
AGXOMS
POWS
55.35
96.15
-1.15
96.15
0.20
88.84
-2.01
3200
1222
-0.40
A.6 DEPLOYMENT DEMO
We deploy an anonymous demonstration of RPD on Huggingface Space", and we provide two examples of this demonstration in Figure show the usage of RPD. In this demonstration, the user may either enter a new phrase with a label randomly choose example from the dataset supplied order to execute an attack, adversarial detection, and adversarial repair.
hhttps://hugiinggfac.cco wtwp:///aaaaaaaaa..aa.c..aaaaaaa /ttp:///pcc////oooooo//////////a
17

---

Under review as a conference paper at ICLR 2023
Dranpled Prrmnce
2012
4Dhomati
Amazoe
By
jeares
coltociiun Sericiiaaaaliie www.eooooooooooooooooooooo cololanniii
Files
Testboder
bcrsec cambl afficee
commplr ror bestngeet the tore
Lubel
Siversary
pestammee 1oo!
corfidance
waanna' calaeaannnn on neridd snutes fibee diyilll dfaee
Jebel
aedlideno
by procede celledoo atrovee reted wwcehrrneteee elept bhly vntroste almpltty
Connact
Genante Advemary Adherarry Repai
beltwhh gradoo
Palout
Pramplen
soa2
Anusee
Plicker
bedhhcee la ansarted curntgg.
Sentance
my grik buct
mryou geooggele... andtles Age grus.
Original bumppl
St.adeessity
postattoo_
Original
Fomple
Liviing tat gels aut ddallag my cnnge in and cariit naviee rnal would the aveeade assenad lige.
pabd_
condadence
SA,cocoast
Fota
Ii de poppoyyouoaa dorics
dovic so vire take log time coecutte Mose paiion
Gonents Adwuneryyyyyyy tha Adveraary Delocion Rapei
bultwett
Figure 7: The demo snapshots of adversary detection and defense built RPD for defending against multi-attacks.
18


Reviews:
[{"review_id": "ZkjIqI-_klK", "reviewer": "Reviewer_Kc7s", "summary": "", "questions": "", "limitations": "", "rating": 1, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors propose a methodology for detecting and correcting adversarial examples computed against text pertained language models (PLM). The correction is done by adding non-toxic words that cancels the presence of adversarial noise inside the input sample.\nTo show the effectiveness of the methodology, the authors test their framework against language models fine-tuned on specific datasets.", "summary_of_the_review": "The paper is unclear and very difficult to read at the point that the contribution is not understandable.", "strength_and_weaknesses": "**Strenghts.**\n\n+ the intuition of injecting noise to counter adversarial attacks is interesting.\n\n**Weaknesses.**\n\n+ **The paper is not readable.** The content of the paper is not clear, as it lacks many technical details that help the reader understand the contribution. In particular:\n    + the paper does not give any definition of PLM (I had to infer it from abstract and introduction), and it does not have any background section describing how such technology is developed and trained. Moreover, there are details (like the term *pool*) inside the text that are never explained properly. Such lacking of proper introduction makes the contribution very difficult to understand.\n    + the paper does not provide technical understanding on how the correction is applied, but it is left vague. The only technical description is given by the algorithm, which is not informative enough.\n    + the detection of adversarial example is an hard problem (as also specified by the authors) but the detection mechanism described by the authors is not clear. The authors should discuss in greater detail how they tackle the problem, since the current discussion is not helping the reader in understanding the concept.\n    + no limitations of the approach are discussed.\n+ **Adaptive attacks are not discussed.** The authors show that not-adaptive attacks are not able to bypass the proposed mechanism, however the authors did not try to implement an attacker that is aware of such correction mechanism. \n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "Yry9vJ2qYp", "reviewer": "Reviewer_pngk", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This work has proposed a new adversarial defense method based on multi-task learning and reactive perturbation defocusing. This method has achieved very impressive restored accuracy. ", "summary_of_the_review": "I am impressed by the good results of this work and would really like to know the details of this method. So I am looking forward to author response to clarify the core method (perturbation defocusing). ", "strength_and_weaknesses": "Strength:\n1. The proposed perturbation defocusing method can restore the attacked accuracy from very low accuracy to almost the same as the original clean accuracy, which is impressive.\n\nWeaknesses:\n1. The proposed RDP method consists of two phases. The first phrase is a normal multi-task learning by combining standard classification objective, the adversarial training, and the adversarial detection, which is not that novel. The second phase is the reactive perturbation defocusing, which is novel. However, this so-called perturbation defocusing method is not described at all. Specifically, the equation 9 is critical, but how to implement the A_{PD} is not described at all. I tried to understand this so-called PD method in the Introduction but failed. \n2. The main text only compares with one baseline, RAT (comparison with another two baselines are put in the supplementary, which is not formal). There is no reference to this method. And according to the method description in this work, I know it is an adversarial classifier. But then how do you use this classifier to defend against the adversarial attack? If we only know whether a sample is an adversary or not, then how do we know what is the correct prediction for those detected adversaries?\n3. The related work has mentioned that there are three types of defense methods, but this work has compared with one baseline in the main text. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "H0U6hTGZ-8", "reviewer": "Reviewer_6CCu", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper propose perturbation defocusing to apply perturbations to a single word in each text input of PLM models to repair potential adversarial inputs. By combining the technique with detection and detached adversarial training, the result show promising task accuracies under adversarial attacks.\n", "summary_of_the_review": "The idea of the perturbation defocusing is interesting, but appear to be limited as it removes information from the text, and would thus ultimately impact task performance on clean inputs.", "strength_and_weaknesses": "### Strengths\nPerturbation defocusing appears to be a simple, novel and effective technique to restore task accuracies for PLM models under adversarial attacks.\n\n### Weaknesses\n* The paper proposes an adversary detection objective. Would it work well under adaptive attacks, i.e. what happens when a white-box attacker can also try to fool your detector?\n* Detached adversarial training transfers adversarial examples from a surrogate model for the adversarial training of RPD models, and mentions Table 9 for its effectiveness. However, it is not clear how transferred and online examples may impact model robustness. In addition the caption of Table 9 mentions “ensemble adversarial training objective”, but there is no such objective in the paper.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject