UniT: A Unified Look at Certified Robust Training against Text Adversarial Perturbation
Authors: Muchao Ye
Ziyi Yin
Tianrong Zhang
Tianyu Du
Jinghui Chen
Ting Wang
Fenglong Ma
Venue: NeurIPS 2023 poster (2023)
Keywords: certified robust training
text adversarial defense
TL;DR: This paper propose a unified certified robust training framework named UniT for text data with a novel loss term named DR loss to realize the unification of existing training frameworks and improve the robustness of base model.

Abstract: Recent years have witnessed a surge of certified robust training pipelines against text adversarial perturbation constructed by synonym substitutions. Given a base model, existing pipelines provide prediction certificates either in the discrete word space or the continuous latent space. However, they are isolated from each other with a structural gap. We observe that existing training frameworks need unification to provide stronger certified robustness. Additionally,  they mainly focus on building the certification process but neglect to improve the robustness of the base model. To mitigate the aforementioned limitations, we propose a unified framework named UniT that enables us to train flexibly in either fashion by working in the word embedding space. It can provide a stronger robustness guarantee obtained directly from the word embedding space without extra modules. In addition, we introduce the decoupled regularization (DR) loss to improve the robustness of the base model, which includes two separate robustness regularization terms for the feature extraction and classifier modules. Experimental results on widely used text classification datasets further demonstrate the effectiveness of the designed unified framework and the proposed DR loss for improving the certified robust accuracy.

UniT: A Unified Look at Certified Robust Training against Text Adversarial Perturbation
Muchao Ye! Ziyi Yin' Tianrong Zhang' Tianyu Du² Jinghui Chen' Ting Wang" Fenglong Ma
'The Pennsylvania State University, 'Zhejiang University, *Stony Brook University (muchac, zmy5171, tbz5156, jzc5917, fengl ong) @psu. edu, = zjradty edu. en, twangê cs stonybrook. edu
Abstract
Recent years have witnessed a surge certified robust training pipelines against text adversarial perturbation constructed by synonym substitutions. Given base model, existing pipelines provide prediction certificates either in the discrete word space the continuous latent space. However, they are isolated from each other with a structural gap. We observe that existing training frameworks need unifica- tion provide stronger certified robustness. Additionally, they mainly focus building the certification process but neglect to improve the robustness of the base model. To mitigate the aforementioned limitations, we propose unified framework named UniT that enables us to train flexibly in either fashion by working in the word embedding space. It can provide a stronger robustness guarantee obtained directly from the word embedding space without extra modules. In addition, we introduce the decoupled regularization (DR) loss to improve the robustness of the base model, which includes two separate robustness regularization terms for the feature extraction and classifier modules. Experimental results on widely used classification datasets further demonstrate the effectiveness of the designed unified framework and the proposed DR loss for improving the certified robust accuracy f
Introduction
Despite the tremendous performance of deep neural networks (DNNs) in natural language process- ing (NLP) tasks, their robustness has been doubted due to their vulnerability against adversarial attacks (15). Particularly, type of word-level adversarial perturbation named synоnуm substitution can generate adversarial examples with high semantic similarity even in the hard-label setting with limited information [14 26). Accordingly. recent years have seen an urge for robust NLP models that can provide certified robust predictions [23] 25 31 for this type of attack. A prediction for text sample is certified if the hard-label prediction is correct and remains unchanged when the input is changed to any text sample constructed from the synonym substitution. The key to producing certified predictions is certified robust training, which introduces perturbation during training to ask the model to adapt to it and enables it to still perform well in the inference stage under perturbation.
Due the large scale of NLP models nowadays, certification methods adopted for text data usually probabilistic ones. In this context, given a base model that outputs a single prediction, a smoothed model is built it in the inference stage with randomized mechanisms, whose outputs are used to decide whether predictions are certified. Thus, two aspects are essential for generating certified predictions: the robustness of the base model and the certification of the smoothed model.
Corresponding author.
'hhe implementation code is available httpps//gthhbb.conmmaciillllllar
UniT
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

Existing studies have established the foundation for designing smoothing techniques and their corresponding certification conditions. As Figure manifests, a base model usually consists of three modules: (1) an embedding module that converts discrete words into continuous embeddings, (2) a feature extraction module that obtains its deep representation, and (3) classifier constructed by the fully connected (FC) layer that converts the deep representation to logits. Given ei-
Foodlorward Prosess)
in Base Model
Type iPerturbation
Perturbed Sampless
film good _
G Type il Perturbation
Original: "Thi great....
Spronyeta
Text
Embeddings
Feature Extraction
Chasiier IPC Loyer)
that, randomized mechanisms ther build in the discrete word space (Type D) or the continuous latent space (Type II. Figure [b) shows that Type I pipelines, including SAFER (25) and WordDP [23], use perturbed text sam- ples generated by replacing original words with their corresponding syn- onyms to train the base model and construct a smoothed model for cer- tification. Another type of training, the Type II one, is shown in Fig- ure Te). which are recently proposed by CISS [1. They add Gaussian
Certified Thaining
Emboodiings
IP Centifcation
Injecting Gassdlan Nake
+aadun Regularier
"This mouie
Type
groat
Synonyms
Teat
Embeddings
Estraction
Feature
BC Layer)
Clsiifer
Normal Training Date Model
(d) Certitted Robust Training in Continuton Labent Space
Figure 1: Given the (a) base model, (b) Type frameworks construct the smoothed model in the discrete word space while (c) Type II frameworks construct in the latent space with IBP. There is need for unifying these training frame- works and improving the robustness of the base model.
noise to latent features of original text samples to train the base model and certify the prediction the latent space in randomized smoothing [1] fashion with the help of the interval bound propagation
(IBP) [5] module.
Given these profound pioneering works, the observation motivating our work is that existing pipelines ignore the unification of training frameworks and robusiness of the base model. For one thing, structure-wise speaking, Type II frameworks like CISS need to include an extra IBP module compared to Type frameworks, which affects the certification because of the loose bound problem [30 of IBP. This is validated by our finding that IBP can cause the failure to strike a balance between natural accuracy and certification ratio. For another, both types of frameworks mainly use the cross-entropy (CH) loss calculated from the perturbed inputs for training to improve the discriminative ability of the base model, which the same as normal training. However, this strategy lacks fine- -reigraieed robustness regularization for individual modules and consideration of the final certification target.
To develop new method that mitigates the aforementioned limitations, we will face two research questions: (RQ1) how to build a unified framework for these two types of pipelines to provide stronger certified robustness and (RQ2) how to design robustness regularization terms for individual modules to further improve the base model robustness. Our solution to them is as follows:
For RQ1, propose
framework named UniT to unify Type and Type II training. UniT resorts to the embedding space as an intermediate for unification. In the Type scenario, it uses embeddings of perturbed words to train the base model directly. For the Type II scenario, it does not need the IBP module and adds Gaussian noise directly to the concatenated word embeddings of the text sample. We accordingly provide novel certification condition in the embedding space.
For RQ2, we design novel loss for certified robust training named decoupled regularization (DR) loss that compensates the CE loss with the modular regularization (MR) term. It consists of two parts. Part is the l2 norm between the representations of the original sample and the perturbed input, which concentrates the feature extraction module. Part II includes novel term calculating the prediction margin from the logits when the original sample representation is slightly perturbed (modeled by Gaussian noise), which takes the certification target into consideration and aims to regularize the classifier module. They are linearly combined to provide supportive regularization for different modules based on their responsibilities and refine the robustness. To sum up, our contributions are:
To the best of our knowledge, we are the first to provide comprehensive viewpoint on certified robust training in text. We design a unified structure named UniT built in the embedding space that enables Type II frameworks to be conducted without using IBP during training and certification.
We propose the DR loss to improve the robustness of the base model. It provides modular regularization directly to aid the CE loss. That is, the feature extraction module is regularized by
2

---

the representational l2 norm, while the classifier module is regularized based on the prediction margin calculated from the perturbed representations obtained by adding noise to the original ones.
Experimental results show that the design of the UniT with DR loss is effective in improving the certified robust accuracy of both types of certification scenarios.
2
Preliminaries and Related Work
2.1 Certified Robust Training in Image
The development of certified robust training dates back to certifying multi-layer perceptions (MLPs) for image data. Early work tries to formulate certification as an optimization problem with the techniques of mixed integer linear programming (2T and semidefinite relaxation [T8]. A practical solution to this problem is using the IBP 33 method and its variants [8], whose key idea is to regard the upper and lower bounds of activated output in each layer as parameters and they are trained by backpropagation. Later development on deterministic certification methods also includes developing Lipschitz networks [1O]. However, they can only certify the robustness of shallow neural networks. Another line of certified robust training is conducted by randomized smoothing [.]. It helps provide certificate in a probabilistic manner, which is more scalable and can certify larger DNNs.
2.2 Certified Robust Training in Text
Problem Formulation. Suppose that we are given a text classification dataset D. Let y (Mi,".- .ye} denote the set of с classes of 'D. We have (X, y) as a sample drawn from D. For the text sample X = [w1,... ......................... .un] with n words, w; is the i-th word, and its ground truth is y E V We denote f as the base model for the text classification task, which outputs the prediction logits [f (X), fv. (X)] for each class in V. Suppose that f can make the correct prediction. i.c. arg ey fz. (X)
y. In the context of certified robustness, we are interested in getting certified prediction result such that arg max fg,()) = y holds for any allowed perturbed sam- ple X' of X. In this paper, we center on certifying perturbed samples that are constructed by powerful adversarial attack named synonym substitutions Appendix). Note that this setting is different from the one in [27 which certifies the prediction under unconstrained word perturbation for a limited amount of words, and adversarial examples generated from synonym substitution have lower perturbation rates compared to the ones from rephrasing (17) and prompting. In this setting, for each word w; E X, suppose it has m, synonyms, its allowable adversarial substitution set is denoted by S(w;) = (w!!) (1)
(an example shown Table [0 in the
w (m==) } (Note that S(w;) includes w;)). All perturbed samples X' obtained by replacing original words with their synonyms construct the allowed perturbed sample set A(X) = X'' = [w],... ... w'/] w/ E S(wss,, = =00==1... 1,.... ,n).
= Training and Certification. Since A(X) is a large set of perturbed samples (|A(X))=III: -I[== m.). it is impractical to certify the prediction by asking f to make prediction on every X' E A(X). Therefore, existing techniques usually certify prediction results by the upper bound condition. If such a certification condition satisfies, the prediction is certified robust. Certified robust training needed to attain a certified prediction result for X such that the certification condition can be satisfied in testing. For example, 4 and [5] introduce the IBP-based methods and use the upper bound of text representation in the final layer to certify the result. However, due to the costly bound propagation, IBP-based methods can only be used in shallow MLPs and cannot be applied to large language models like BERT 22. Besides, IBP has a loose bound problem 30, i.e., upper bounds get loose in the last several layers during propagation, which obstructs the certification of some samples.
Thus, recent studies mainly use probabilistic certified defense methods obtain certified predictions for more powerful but intricate networks. As demonstrated in Figure L training methods for probabilistic certification are categorized into two types. Their common treatment is to introduce perturbation during training. They ask the whole network to get used to the perturbed samples, which are either perturbed input texts X' (Type D) 23 25) or perturbed latent features injected into Gaussian noise (Type II) [I]. They usually use the CE loss to improve the discriminative ability of the base model. In certification, they construct a smoothed model for f. A prediction is certified when the logit score of the ground truth class output by F is larger than that of the up class by a large enough margin, which we refer to as the certification condition. Denote yy as the soft-labe prediction score of F on class ys. The runner-up class is defined as
existing certified robust
3

---

yB arg maxy, wee.syyeeu..n. yo Fg. (X) with the largest logit except for Fg. We now briefly mention their certification and kindly ask readers to review their works for more complete picture if needed.
(1) For the Type I scenario, F is constructed by averaging the results attained from inputting several perturbed text samples f. The certification depends explicitly on the prediction margin (X) Fgg (X). For example, the certification condition of SAFER (Proposition in (25)) is (X) Vv (x) > 2qx. where qx is a constant calculated from the synonym set of the input X.
(2) In the Type II scenario, F' is constructed by repeatedly adding Gaussian noise d ~ NN 1 to the text representation in the latent space, where a is the standard deviation and / is the identity matrix. To illustrate, under the randomized smoothing framework, CISS [31] repeatedly draws Gaussian noise perturbations and adds them to the latent feature of the original sample. counts the top-1 prediction distribution of V given all perturbed inputs. After that, the prediction is certified if Py > 0.5 and R o
R (Algorithm 2 in 3II. where Py is the lower bound of the expected value of the event that the hard-label prediction output by f of the given perturhed input is class y. R is the certified radius, Φ- is the inverse of the standard Gaussian cumulative distribution function (CDF), and ft is the maximum l2 norm between X and any X' E A(X) in the latent space obtained from IBP. The certification implicitly depends on the prediction margin. If the prediction margin is large, the calculated Py and R will get greater, which helps the certification.
There are also some interesting discussions extended from certified robustness such as whether certified robustness helps fairness [16]. We mainly focus on the certification performance herein and kindly ask readers to review related works for further information about those discussions.
3 UniT: Unified Certified Robust Training
To provide stronger certified robustness for those important but independent frameworks, we design unified one named UniT that can unify these two types of training without intro- ducing extra modules such as the IBP module used CISS. In this paper, we utilize BERT as the base model because it yields the best perfor- mance for state-of-the-art training frameworks such as SAFER and CISS in two settings. The basic processing procedure of the base model is shown in Figure 2 indicated by the black solid lines. It first transforms the input sample with words to concatenated BERT word embedding word embedding. Then the word embeddings will be processed by the BERT feature extraction module (Transformer 22 24 blocks) which outputs the [CLS]] token embedding 2 E Rd as the representation of the whole text. Finally, the classifier module (FC layer) outputs logits from 2, and the loss is calculated for training. We shall notice that the structural decomposition analysis above is general among different models, e.g., RoBERTa [ and ALBERT [7]. so we can also adopt DR loss for other structures when needed. We now detail our motivation and design of UniT.
words
Riod BERT Embedding
gd BERT Festure Extraction
Classifier Layer)
DR
Input
Feodforward Process
Type I: Inputting BERT Embeddingg of Perturbed Samples
Type Injecting
Gaussian Noise
Parturbation
Perturbation
Figure 2: Given the base model, UniT unifies two frameworks by working in the embedding space. Type I training replaces original embeddings with embeddings of perturbed samples. Type II training adds Gaussian noise to original word embeddings.
Raxd where d 768 is the dimension of
3.1 Motivation: Why Do We Need Unification and Better Supervision?
The supervision for improving the discriminative ability of the model during certified robust training generally builds on the CE loss. Since the calculation of the loss function is only related to the last FC layer in the classifier, we denote the last FC layer as g for illustration. We denote 2' E Rd as the representation obtained from the feature extraction module given a perturbed input.
The CE loss is calculated from 2', i.e., fee = - log( exp(sx(="))
Σ, exp(ay, (='1) ). where [9p.. 9v. is the logit distribution given the perturbed input for each class y E y. As depicted in Figure [ Type training builds a smoothed model in the discrete word space, and its training is almost the same as normal training except for perturbed inputs. Meanwhile, the loss for Type II training e,r lee +7 le where y is the weight hyperparameter. It contains not only the CE loss but also a certified radius regularizer la max(A- - R + μ. 0), where μ is the relaxation hyperparameter, R. is the certified

---

radius, and R is the maximum deviation caused by synonym substitution in the latent space that we introduce in Sec. 2.2 We notice that there a trade-off between the certification ratio and the natural accuracy for for in Type II training: relaxed regularization on the certified radius can make the base model have higher natural accuracy but a lower certification ratio, and vice versa.
We verify this observation by taking CISS for in- stance. We can obtain relaxed regularization on cer- tified radius by replacing R with its lower bound Ry and strict one by its upper bound Rub- Suppose the minimum and the maximum deviation in any dimen- sion is p and p. respectively, and the number of dimen- sions in the latent space is dj. We then have Rip /di P and Rut /d,- p. We denote the corre- sponding regularizers as & R.. = max Rv. 0)
Regularization
2 Rtg.
Natural Acc. (%)
93.88
89.57
96.34
Cert. Ratio (%)
94.38
99.56
0.81
CRA (%)
88.60
89.18
0.78
Table 1: Trade-off between natural accuracy and certification ratio. Experiments are con- ducted in Yelp [19] with CISS.
and Ri... = max(fu. - R + μ. 0).
We show the results of how this trade-off affects certified robust accuracy in Table [ Compared to the original R. if we impose a relaxed regularization RR. the natural accuracy will increase but the certification condition is hard to satisfy, and consequently, the certified robust accuracy is near 0%. On the contrary, stricter regularization & f... makes the smoothed model satisTy the certification condition easily (almost 100%), but it hurts the natural accuracy. An interesting finding in Table is that strict regularization R... helps obtain higher certified robust accuracy (CRA) than the original
regularization & used CISS. This is because It CISS obtained from IBP, and has a loose bound problem. The certified radius regularization lg from IBP is somewhat strict one, so CISS cannot strike balance for this trade-off with IBP. Therefore, we shall remove IBP and avoid this calculation. In addition, since the CE loss is deployed to improve discriminative ability, another direction for mitigation is to adopt better supervision other than the CE loss for ameliorating the model robustness, which motivates us to provide individual supervision for each module.
3.2 Training Input
Recall that in the Type I scenario, the original input X = [Me1," ".. WT] is replaced by the perturbed sample X" [w1,"" w/]] E A(X). Correspondingly, in this scenario, UniT uses the embedding x' = =[u(w)),-" "0],.,,,([[[ u(w,)) ] as the input to train the base model, where u is the BERT embedding function. For the Type II scenario, to facilitate randomized smoothing, UniT needs to inject Gaussian noise into the BERT embeddings for training. Thus, given a sample of zero-mean Gaussian noise o(0,021) Raxd UniT uses the embedding x + 5 as the input. In this sense, we unify two types of certified robust training in one framework by utilizing the embedding space as the intermediate. Thus, all modules can remain the same for either type of certified robust training.
5
3.3 Certification
For the Type I scenario, we can obtain the certified robustness guarantee from Proposition 1 of SAFER [25] by constructing the smoothed model based on synonym substitutions. We thereby intend to detail our proposed certification for the Type II scenario without IBP. Note that the key calculation for certification in this scenario is Rł which is the maximum la norm caused by allowed perturbed synonyms in the embedding space. This calculation by UniT' is different from CISS because UniT does not need IBP module, and it is directly obtained in the BERT embedding space R R follows.
Given the text sample X = [w],... w,I. its BERT embedding x = [u(w]),... ,u(w))] Similarly, for any perturbed sample X' [w', ... wh1l E A(X), its embedding x' [u(w)),- ... u(ww)). Since each word independent of the others in the embedding space, the 22 norm between x and any x' is ||æ/ - x||| = v - [u(w;) - u(w()] For each word w; E X, }}. the maximum deviation between Wi and any word in S(w)) measured by is |.:/| max.eu, [|u[w;) - ell. Due to the independence of embedding of each word, the maximum deviation caused by all synonyms is
because its synonym embedding set is U, [u(w) ).... u(w!"") (m))))
R= V1lu
||
(1)
5

---

By adopting Eq. ① to calculate R, we can train and certify in the Type II scenario without IBP and avoid bound propagation. We can conduct the certification in the embedding space with Theorem
Theorem Given(X, X ,y) from D, suppose that the text embedding of X is x. Let h - y be the hard-label prediction function of UniT in the Type II scenario that takes as the input a vector E Rexd in the text embedding space and outputs the class with the largest logit. Let 8 ~ NO, T²T). where a is the standard deviation of the added Gaussian noise. If
Es(h(x + 0) - -
max e.
Es[h(x + + -y)l,
(2)
then Vz', ,(x'' = y is robust where x' the text embedding of any X' E A(X) if R. and
R / + (Bsh(z + 8) = Φ-
Es(h(x + 6) wDl. (3)
where $-1 1 is the inverse of the standard Gaussian CDF, and R is calculated from Eq. T Due to the space limit, the proof and certification algorithm are shown in Sec. A.7 in the Appendix.
3.4 Training Loss
To provide better supervision for training the base model, propose decoupled regularization (DR) learning paradigm that directly conducts modular regularization to aid the CE loss. We decouple the regularization on the whole model into one the feature extraction module and the other on the classifier module. Thus, this pathway includes two branches. Such a regularization decomposition requires each module to be robust under the perturbation, which contributes to enhancing the robustness of the base model with more flexibility, leading to hetter training and certification results.
Feature Extraction Regularization. For the feature extraction module, its responsibility is given text.
CE Loss
to output a deep representation The stability of representation, i.e., the degree of change in the representation space given a small change of input, depicts the robustness of the feature extraction module. To regularize it, we calculate the l2 norm between perturbed representation z' and original representation 2,
=il
max(0. By (z c) max By. (x +))
8
MR Term
(O,
Figure 3: DR loss contains a pathway (MR term) for providing modular regularization for CE loss.
Ef - 2||-
where || || is the 12 norm.
We choose l2 norm over cosine similarity because it is directly related to the prediction margin defined in Sec. 2.2 in calculation. Thus, it can limit the influence of perturbation on downgrading the certification performance. Intuitively, it functions obtained from the feature extraction module given the original sample and perturbed sample to be similar to each other, which is helpful for obtaining similar logit for 2' given the same classifier module. Hence, it further enhances the representational stability and the model robustness.
regularization term that asks the representations
Classifier Robustness Regularization. Since the representational stability regularization in Eq. (4) only concerns the feature extraction module, another direction for strengthening the base model robustness is to design a feedback signal in the classifier level that is complementary to Eq. (4) We know that the classifier module is the one that outputs the logits. Recall that in Sec. 2.2 we discuss that the certification is highly dependent on the prediction margin output by the smoothed model, which is the difference between the logits of the ground truth class and the runner-up class. By connecting these two observations together, in the context of certified robust training, we can interpret the robustness of the classifier module as being able to generate a positive prediction margin despite the perturbation added to the original input
Consequently, we introduce a novel regularization term for the classifier module based on its ability to output positive prediction margin against a small perturbation. Since this regularizer is confined to the classifier, we introduce a small amount of Gaussian noise here to model the perturbation and sample point + from the neighbor of z. Note that only serves for modeling small

---

perturbation in training. It will not be added in certification and is not related to the Gaussian noise 5 used for certification in Type Il scenario. That is, it starts with adding Gaussian noise e E R" to 2, where ~ (0, 1² is drawn from the zero-mean isotropic Gaussian distribution with v as the standard deviation hyperparameter. Denote the prediction margin given a vector & E R as M(k) = 9n (k) m EV.y, 94: (k), where Fy(+) and maxy,ey dy Iu, (-) refers to the logits of the ground truth class and the runner-up class, respectively. We then calculate the margin given perturbed input 2 + as M( 22 + c). We take its negative as an optimization term for minimization:
(5) for has max operation that outputs when M(z +) < This operation acts feedback for asking the optimization to concentrate on improving the representation space and the discriminative ability through the other terms when MM2 + e) < 0, which will not regularize g if not well leameed
for - maxmmax(M(2 e).
Modular Regularization Term. After that, these two regularizers are combined
fmr max(e + far:E).
(6)
which we refer to the modular regularization (MR) term. In Eq. (6). the MR term is calculated from the linear combination of fyr and for, where a is a weight hyperparameter greater than Additionally, we introduce relaxation during optimization with max operation, and & >> 0 is the relaxation hyperparameter. Putting them together provides a regularization on how small || 2|| should be given the margin information. This geometric interpretation is detailed in Sec. Sec.
DR loss. Given the MR term, we can combine it with the CE loss as the DR loss, which
Edr Lee + -mrr
(7)
where is a weight hyperparameter for leor term. Given that, in the Type I training, we can directly use far for training. For Type training, since the certification is related to R, we also have a regularizer for R with &a = max ft R + μs 0) as CISS does, where R is calculated from Eq. (3) and μ is the relaxation hyperparameter. Thus, the training loss in the Type II scenario is lor = dr + 7- pz where and y are hyperparameters.
Remark. From Eq. (7). we observe that the DR loss is composed of the CE loss and the MR term, which are indispensable each other. If we only use the CE loss, the individual regularization will be ignored. With the help of the MR term, the introduced regularizers in Eq. (6) directly request the representation to be stable and the classifier be robust under the perturbation, which helps the CE loss to improve the base model robustness. Mcanwhile, since the MR term does not penalize the wrongly classified cases, the CE loss necessary for improving the discriminative ability.
As for computation cost, we acknowledge that compared to CE loss calculating the proposed DR loss needs increase the computation complexity due to the calculation of getting the features of perturbed input and original input during training. Such a tradeoff is natural: to obtain better robustness it is generally unavoidable increase computation cost, and the increase of computation cost also occurs for existing training techniques for improving robustness such as using PGD [13 loss and TRADES 28) loss. We want point out that the computation cost of calculating DR loss is relatively lower which is approximately twice of the cost of caluating CE loss, which is similar to that of single-step PGD and is acceptable implementation.
Experiments
Given the proposed method above, the questions interest include: (Q1) Does the unified framework UniT outperform existing otate-of-the-art approaches in both scenarios? (Q2) How does UniT improve the robustness of the base model in certified robust training? (Q3) Is the design of the UniT reasonable? We now answer them with the following experimental results.
4.1 Experimental Setup
We describe the experimental setup first. Due to the space limit, we kindly ask the readers to refer to the Appendix for the details of hyperparameters, dataset description, and metric calculation.
7

---

Datasets. We conduct experiments on four widely used text classification datasets: (1) IMDB 12] (2) SST2 20). (3) Yelp 19 and (4) AG 22
Baselines. Because of different certification conditions used in different works, to gain a fair comparison, we compare the proposed method with baselines individually in Type and Type II scenarios. To illustrate: (1) Since the code of WordDP (23) is unavailable, the Type baseline we use is SAFER (25), which is the ground-breaking method that trains model by inputting perturbed text samples constructed by randomly sampled synonyms and certifies the prediction results directly by the prediction margin. (2) The Type II baseline is CISS [1 a recently proposed method that trains the model and certifies the prediction with IBP in randomized smoothing manner. Their implemented base models are BERT because it yields the best performance. Since [31] has shown that IBP methods [ [ cannot certify large networks like BERT, we hereby do not discuss them. We
also include adversarial training losses like PGD loss
13 and TRADES loss (8 as baselines.
Metric. Naturally, certified robust accuracy (CRA) is the used comparison metric, and certified robust accuracy = natural accuracy certification ratio. It denotes the fraction of predictions that are not only correctly classified but also certified robust. As for its calculation, we follow the same process used in the baseline methods to have fair comparison. Further details are in Appendix.
4.2 Comparison Results
Comparison of Certified Robustness in Type I Scenario. To answer QI, we first conduct the comparison experiments in Type I scenario. For SAFER and UniT, both of them use BERT as the base model, and the difference that SAFER is trained with the CE loss and UniT' with the DR loss. The comparison results are in Table 2 which show that the DR loss increases the certified robust accuracy up to 3.68%, 1.37%, 0.68%, and 0.53% in IMDB, SST2, Yelp, and AG datasets, respectively. These results indicate that the MR term enlarges the prediction margin from the CE loss under perturbation to yield a higher certified robust accuracy. Hence, the DR loss can improve the robustness of the base model and help UniT achieve better performance in Type scenario.
We also include adversarial training losses as baselines for Type Scenario. From Table 2] DR loss can consistently perform better than PGD loss and TRADES loss in four datasets. Especially, DR loss able to obtain relatively high increment in terms of CRA on the datasets with long text samples such as IMDB and SST2. Thus, DR loss is a more suitable choice for certified robust training for its decomposed regularization, which requires each module to be robust under perturbation.
Base Model
Loss
IMDB
SST2
Yelp
AG
CE Loss (SAFER)
85.36
91.65
97.19
93.78
PGD Loss
87.52
90.28
97.86
93.98
BERT
TRADES Loss
86.80
90.44
97.56
93.96
DR Loss (UniT)
89.04
93.02
97.87
94.31
Table 2: Comparison of certified robust accuracy (%) in the Type scenario.
Comparison of Certified Robustness in Type II Scenario. We further conduct the comparison experiments in the Type II scenario to answer Q1, and the results are shown in Ta- ble 3 During implementation, we find that the training for randomized smoothing in CISS can only work in relatively large datasets (100k+ training samples). Therefore, we can only report comparison results on two large datasets satisfying this condition, i.c., Yelp and AG, with CISS as the baseline. As we have seen before, directly replacing the CE loss (first row) with the DR loss (second row) can help improve CRA.
Method
Loss
Yelp
AG
CISS
CE
88.60
82.47
CISS
DR
89.22
82.93
UniT
DR
91.24
84.32
Table 3: Comparison of certified
robust accuracy (%) in the Type II scenario.
In this setting, we more interested in the analysis of whether using the structure of UniT can make Type II training achieve stronger certification without using extra modules. By comparing the last two rows in Table 3 we find that UniT achieves an increase of 2.02% and 1.39% in Yelp and AG in terms of certified robust accuracy than the CISS structure trained with the DR loss, respectively. This improvement shows that by directly conducting randomized smoothing in the BERT embedding space, UniT not only adapts to both Type and Type II training but also improves the certified robust accuracy by avoiding the loose bound problem of the IBP module.
8

---

Comparison of Empirical Robustness. We also conduct experiments on comparing empirical robustness. We employ BERT as the base model and use PGD loss and TRADES loss as baselines. In our experiments, we conduct adversarial attacks by utilizing TextBugger [9, a commonly used method for generating text adversarial examples. Following the existing adversarial attack setup, we randomly draw 1,000 test samples for adversarial example generation. The defense results of different methods are shown in Table 4 which demonstrate the empirical robust accuracy of DR loss is higher than those of PGD loss and TRADES loss. Compared to baselines, the improvement is obtained by the individual robustness supervision for each module provided by DR loss.
Base Model
Loss
IMDB
SST2
Yelp
AG
PGD Loss
62.0 (87.1)
87.6
92.4
(96.9)
85.5 (93.7)
BERT
TRADES Loss
57.8 (84.8)
(91.7
(97.0)
84.4 (94.3)
DR Loss
72.7 (86.9)
89.8 (93.3)
96.9 (98.4)
87.6 (92.9)
Table 4: Comparison of empirical robust accuracy (%) with adversarial training losses.
We also show
the corresponding natural accuracy indicated by the parentheses.
4.3 Insight Analysis on UniT
Analysis on Certification Condition. For Q2, we first find that the improvement is achieved by improving the certifica- tion ratio in the Type II scenario. As shown in Theorem D UniT includes a stronger certification condition in the Type II scenario that does not require the calculation from IBP. We now verify it by comparing the certification ratio between CISS and UniT. The certification ratio results shown in Table 5 in- dicate that UniT has a larger ratio of correctly classified test samples that increases up to 2.84% and 4.23% compared to CISS, and 2.06% and 3.85% compared to CISS trained with the DR loss, in Yelp and AG, respectively. This is mainly because the calculation of R in UniT does not need IBP and is able to avoid the loose bound problem caused by IBP. Consequently, directly certifying in the BERT embedding space leads to more correctly classified samples that satisfy the certification condition. Note that the certified robust accuracy equals the natural accuracy times the certification ratio. Thus, UniT can contribute to higher certified robust accuracy in the Type II setting, as it can have a higher ratio of test samples that satisfy the certification condition.
Method
Loss
Yelp
AG
CISS
CE
94.37
94.48
CISS
DR
95.15
94.86
UniT
DR
97.21
98.71
Table 5: Comparison of certifica-
tion ratio (%) in the Type II sce- nario.
Analysis on the Effect of the DR Loss. Another aspect of the answer to Q2 is that the DR loss helps improve the robustness of the base model. To obtain better understanding of the improvement achieved by the DR loss, w.l.o.g.. we analyze how the DR loss improves the perturbed sample representation and classification in IMDB in the Type I scenario. We calculate the average 12 norm between the representa- tions of the perturbed and original samples, i.e., ||2" 2|I, learned from the CE loss and the DR loss in the test set, which are the inputs of the last FC layer. We also evaluate how the classifier (FC layer) is affected by calculating the margin change MMx') M(=) given perturbed samples.
Measure Loss
2
2|
M(z')
M(z)
CE
DR
CE
DR
Mean
1.752
0.382
-0.060
-0.032
Variance
1.374
0.494
0.877
0.282
Table 6: Comparison of representational l2
norm and margin change between the CE and DR loss in IMDB.
For both of them, the closer O, the better. In Table it is shown that the mean and variance of ||='=2| ob- tained from the DR loss is significantly smaller than
Regularization
Natural Acc. (%)
93.86
90.37
96.72
the ones obtained from the CE loss, which means that
Cert. Ratio (%)
97.21
99.15
1.08
the DR loss effectively improves the representation compactness between perturbed samples and original ones. Besides, we replace the CE loss with the DR loss, on average, the margin change will reduce from -0.060 to -0.032, given the perturbed samples in testing. Therefore, the DR loss can improve the quality of representation and certified results. To further demonstrate, we take one test sample as a visualization example for demonstration. Due to the space limit, we present the visualization result in Sec. A.9 in the Appendix.
CRA (%)
91.24
89.60
1.05
Table 7: Trade-off between natural accuracy and certification ratio of UniT in Yelp.

---

Analysis on Trade-Off Balance. To answer Q3, we conduct the oofe experiment in Yelp again but on UniT. Comparing Table and T we can see that UniT does not suffer as much drop in certification ratio as CISS does when it adopts & compared to RR... and l leads to the best performance. It is because UniT avoids the restriction caused by IBP. Therefore, the design of UniT for conducting certification in the embedding space can achieve a balance for the mentioned trade-off.
Analysis on the Design of DR Loss. For Q3, w.l.o.g.. we further justify the design of the DR loss with ablation studies in IMDB in the Type I scenario. First, illustrate the necessity of designing separate regularization terms for dif- ferent modules. A straightforward choice that regularizes these two modules simultaneously is I|9(=)) g(>)|, which is referred to as the ad- versarial logit pairing (ALP) [6] and g-) E R the corresponding logit vector. From Table if we adopt ALP that penalizes two modules together, the CRA only improves from 85.36% to 86.64% Thus, the decoupled regularization brings optimization flexibility.
CE
ALP
E1
Eor
CRA (%)
85.36 (86.03)
86.64 (86.36)
88.08 (87.62)
V (2 ()
85.92 (87.42)
(2)
87.68 (87,45)
v v (2)
85.76 (85.71)
(z +)
89.04 (87.87)
Table 8: Ablation study results on loss design in IMDB. ltr and for are indispensable. The natural accuracy is indicated by the parentheses.
Meanwhile, from Table g we can see that only using err or for causes a drop of 0.96% and 3. 3.12%, respectively, compared to the DR loss. Thus, these two terms are indispensable for modular regularization. Additionally, we also validate our design of modeling perturbation for classifier by Gaussian noise. We incorporate the negative margin calculated from z' with éyr. but this regularization does not collaborate with the representational 22 norm and worsens the regularization effectiveness. Thus, we should use + e to model the perturbation for the classifier module to enhance its robustness.
We further justify the design of each term in the MR term. For clarity, we here denote t t= t= MM= + <). For the choice of the clas- sifier regularization, it could be the ALP term, the margin loss max(-t, 0), or the function without max operation -t. Ta- ble / indicates that these choices all un- dermine the improvement brought by the representational l2 norm. This is because the calculation of [g)(²²) g(>)ll depends on || - 2|| too, and it attaches too much weight to || - =Il. Additionally, compared to max(-1, 0) or -t, the used - max(1, 0) has a selected gradient activation area for &. >> 0. so it adjusts the optimization direction when has not been trained well yet and sends a clearer optimization guidance than the others. We also note that the improvement decreases if we change the (2 norm to the squared l2 norm. Thus, the design in Figure 3 is reasonable.
Feature Extraction Reg.
Classifier Reg.
CRA (%)
l[((²') g(2)]
85,44
2''
max( f, 0) -t
86.24
E''
86.64
2
max(1. 0)
87.36
max(f, 0)
89.04
Table 9: Ablation study results on the regularization (Reg.) design in IMDB. We denote M(= + c).
Conclusion
The development of certified robust training in text is restricted by the lack of a unified framework and modular regularization. To alleviate these problems, we propose a unified framework named UniT to strengthen the certification of prediction results for text data. Under this framework, we introduce the DR loss combining the CE loss with the modular regularization term for different modules specifically to improve the base model robustness. Experiments show that UniT allows more correctly classified samples to satisfy the certification condition by avoiding IBP. Additionally, the DR loss can generate more similar representations for perturbed samples to the original ones and reduce the drop of prediction margin. Higher certified robust accuracy is achieved consequently.
Acknowledgments and Disclosure of Funding
This work is partially supported by the National Science Foundation under Grant No. 1951729, 1953813, 2119331, 2212323, and 2238275.
10

---

References
[1] Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In International Conference Machine Learning, pages 1310-1320. PMLR, 2019.
[2] Jacob Devlin, Ming-Wei. Chang, Kenton Lee, and Kristina Toutanova. BERT: pre-training of deep bidirectional transformers for language understanding. In NAACL-HLT, pages 4171-4186. Association for Computational Linguistics, 2019. doi: 1...8865/11/191111
[3] Sven Gowal, Krishnamurthy Dj Dvijotham, Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Uesato, Relja Arandjelovie, Timothy Mann, and Pushmeet Kohli. Scalable verified training for provably robust image classification. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4842-4851, 2019.
[4] Po-Sen Huang, Robert Stanforth, Johannes Welbl, Chris Dyer, Dani Yogatama, Sven Gowal, Krishnamurthy Dvijotham, and Pushmeet Kohli. Achieving verified robustness to symbol substitutions via interval bound propagation. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLE) pages 4083 4093, 2019.
[5] Robin Jia, Aditi Raghunathan, Kerem Göksel, and Percy Liang. Certified robustness to adver- sarial word substitutions. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pages 4129-4142, 2019.
[6] Harini Kannan, Alexey Kurakin, and Ian Goodfellow. Adversarial logit pairing, arXiv preprint 18Xiv:1803.06373, 2018.
[7] Zhenzhong Lan, Mingda Chen, Sebastian Goodman, Kevin Gimpel, Piyush Sharma, and Radu Soricut. Albert: A lite bert for self-supervised learning of language representations. arXiv preprint arXiv: 1909. / 1942, 2019.
[8] Sungyoon Lee, Woojin Lee, Jinscong Park, and Jaewook Lec. Towards better understanding of training certifiably robust models against adversarial examples. Advances in Neural Information Processing Systems, 34:953-964 2021.
[9] Li, S Ji, T Du, B Li, and T Wang. Textbugger: applications. In 26th Annual Network and Distributed System Security Symposium, 2019.
Generating adversarial text against real-world
[10] Qiyang Li, Saminul Haque, Cem Anil, James Lucas, Roger B Grosse, and Jörn-Henrik Jacobsen. Preventing gradient attenuation in lipschitz constrained convolutional networks. Advances in neural information processing systems, 32, 2019.
[11] Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. Roberta: robustly optimized bert pretraining approach. arXiv preprint
2019.
[12] Andrew Maas, Raymond E Daly, Peter T Pham, Dan Huang, Andrew Y Ng, and Christopher Potts. Learning word vectors for sentiment analysis. In Proceedings of the 49th annual meeting of the association for computational linguistics: Human language technologies, pages 142-150, 2011.
[13] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018
[14] Rishabh Maheshwary, Saket Maheshwary, and Vikram Pudi. Generating natural language attacks in hard label black box setting. In Proceedings of the AAAI Conference Artificial Intelligence, volume 35, pages 13525-13555 13533, 2021.
[15] Takeru Miyato, Andrew M. Dai, and lan J. Goodfellow. Adversarial training methods for semi- supervised text classification. In 5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings, 2017.
11

---

[16] Yada Pruksachatkun, Satyapriya Krishna, Jwala Dhamala, Rahul Gupta, and Kai- tei Chang. Does robustness improve fairesss? approaching fairness with word substitution robustness methods for text classification. In Findings of the Association for Computational Linguistics: ACI-IJCNLP 2021, pages 3320-3331, 2021.
[17] Fanchao Qi, Yangyi Chen, Xurui Zhang, Mukai Li, Zhiyuan Liu, and Maosong Sun. Mind the style of text! adversarial and backdoor attacks based on text style transfer. In Proceedings of the 2021 Conference on Empirical Methods Natural Language Processing, pages 4569-45888 2021.
[18] Aditi Raghunathan, Jacob Steinhardt, and Percy S Liang. Semidefinite relaxations for certifying robustness to adversarial examples. Advances in Neural Information Processing Systems, 31, 2018.
[19] Tianxiao Shen, Tao Lei, Regina Barzilay, and Tommi Jaakkola. Style transfer from non-parallel text by cross-alignment. Advances in neural information processing systems, 30, 2017.
[20] Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Y Ng, and Christopher Potts. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 conference on empirical methods in natural language processing, pages 1631-1642, 2013.
[21] Vincent Tjeng, Kai Y Xiao, and Russ Tedrake. Evaluating robustness of neural networks with mixed integer programming. In International Conference on Learning Representations, 2018.
[22] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Eukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems, 30, 2017.
[23] Wenjie Wang. Pengfei Tang, Jian Lou, and Li Xiong. Certified robustness to word substitution attack with differential privacy. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies,
pages 1102- 11111111 1112, 2021.
[24] Thomas Wolf. Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, Mariama Drame, Quentin Lhoest, and Alexander M. Rush. Transformers: State-of- the-art natural language processing. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pages 38-45, Online, October 2020. Association for Computational Linguistics. URL https: / www. ac aclweb org/ wonttelogyy20000
[25] Mao Ye, Chengyue Gong, and Qiang Liu. Safer: A structure- free approach for certified robustness to adversarial word substitutions. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguisties, pages 3465-3475, 2020.
[26] Muchao Ye, Jinghui Chen, Chenglin Miao, Ting Wang, and Fenglong Ma. Leapattack: Hard- label adversarial attack on text via gradient- optimization. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 2307-2315, 2022.
[27] Jiehang Zeng, Jianhan Xu, Xiaoqing Zheng, and Xuanjing Huang. Certified robustness text adversarial attacks by randomized [mask]. Computational Linguistics, 49(2):395-42) 2023.
[28] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning, pages 7472-7482. PMLR, 2019.
[29] Xiang Zhang, Junbo Jake Zhao, and Yann LeCun. Character-level convolutional networks for text classification. In NewrIPS, pages 649-657, 2015.
[30] Yuhao Zhang, Aws Albarghouthi, and Loris D' Antoni. Certified robustness to programmable transformations in Istms. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, 2021.
12

---

[31] Haiteng Zhao, Chang Ma, Xinshuai Dong, Anh Tuan Luu, Zhi-Hong Deng, and Hanwang Zhang. Certified robustness against natural language attacks by causal intervention. In Kamalika Chaudhuri, Stefanie Jegelka, Le Song, Csaba Szepesvari, Gang Niu, and Sivan Sabato, editors, Proceedings of the 39th International Conference on Machine Learning, 2022.
13

---

A Appendix
A.1 Limitations
The datasets used in experiments are mainly the ones used in the text classification task. We notice that there are other types of text datasets, such as question answering and text generation ones. In our experiments, we follow the existing works and test methods in text classification datasets only. We expect future works to include a discussion on defending adversarial synonym substitution on text datasets of other types.
A.2 Broader Impacts
The proposed UniT has a positive societal impact because it able to generate not only accurate but also certified robust predictions on text-related tasks. Nowadays, large language models (LLMs) such as ChatGPT have attracted great attention due to their powerful performance and intriguing interface. However, they are mostly deployed as a black-box service for users to use and lack reliability for their predictions. For UniT, it provide robustness guarantee for predictions for tasks such as text classification, and it can be scalable for LLMs. As a result, UniT can positively impact the employment of LLMs in real-world applications and improve the trust between users and LLM service providers.
A.3 Dataset Details
The used datasets are all in English. Each text sample is tokenized by the "BertTokenizer" provided by the Transformers [24 library. The detailed descriptions of the datasets are as follows:
is a sentiment analysis dataset for movie reviews with either positive or negative sentiment Its text samples have comparatively longer lengths than the ones of the rest datasets. It has 25,000 train and test samples, respectively.
IMDB 12
2. SST2 20 is another binary text classification dataset for movie reviews. It has 67,349 train samples and 1,821 test samples Its license is CCO.
3. Yelp [9
a large-scale sentiment analysis dataset collected from restaurant reviews written
8 by Yelp users with two classes, i.e., positive and negative ones It has 444,101 samples for training and 126,670 samples for testing. Its license the Apache-2.1 2.0 license.
4. AG 22 is comparably large-scale news classification dataset with classes, including world, sports, scienceftechollogy and business The number of train and test samples are 120,000 and 7,600, respectively.
A.4 Calculation of Certified Robust Accuracy
Because the existing approaches use different ways calculate the certified robust accuracy, to make a fair comparison, we follow the methods used in different scenarios and compare baselines separately.
When comparing with SAFER, we follow the same setting that conducts sampling for choosing test samples and construct 5,000 perturbed samples for each test sample through random synonym replacement. The output from the smoothed model is derived by averaging the prediction the 5,000 perturbed samples for each original text sample. We calculate the certified robust accuracy in this setting for both SAFER and UniT based the certification condition proposed in Proposition of SAFER (25). The confidence level is set to 99.0%. We take text sample in IMDB constructed by adversarial synonym substitution in Table 10
example and show one of the perturbed samples
synoony
https: http://wwwweeeoeeeeeeeeeaaaaaaan
data/yelp
14

---

Sample Original Text (Label: Negative)
Text
I went and saw this movie last night after being coaxed to by a few friends of mine. I'll admit that was reluctant to see because from what knew of Ashton Kutcher he was only able to do comedy. was wrong. Kutcher played the character of Jake Fischer very well, and Kevin Costner played Ben Randall with such professionalism. The sign of good movie is that can toy with our emotions. This one did exactly that. The entire theater (which was sold out) was overcome by laughter during the first half of the movie, and were moved to tears during the second half. While exiting the theater not only saw many women in tears, but many full grown men as well, trying desperately not to let anyone see them crying. This movie was great, and suggest that you go see it before you judge.
Perturbed Sample
I went and saw this cinemalographic last nuit after being coaxed to by few friends of mined. I'll admit that was loath to see because from what knew of Ashton Kutcher he was only able to do comedy. I was awry. Kutcher played the character of Jake Fischer very well, and Kevin Costner played Ben Randall with such professionalism. The sign of a good einematic is that it can plaything with unser emotions. This one did exactly that. The totaled theatres (which was sale out) was overcoming by laughter during the firstly half of the movie, and were moved to tears during the second half. While exit the theatres not exclusively saw many daughter in tears, but varying full grown males as well, trying desperately not to letting anyone them crying. This films was great, and I suggest that you go see avant you judges.
Table 10: Example of a perturbation sample. We color and underline the perturbed words (corre- sponding synonyms of original words) in the perturbed sample to demonstrate the difference between these two text samples.
When comparing with CISS, we follow its setting of using the whole test set for calculating certified robust accuracy. The certified robust accuracy of CISS is calculated based on Algorithm 2 proposed in CISS [31] and we adopt the same certification process except that we adopt Theorem I the certification condition for our unified framework in this setting. We show the pseudocode for prediction and certification under UniT in the Type II setting in Algorithm [ and its details are discussed in Sec. A.7 Due to computing restrictions, the certification results are calculated from 9,000 perturbed samples constructed in the hidden space by adding Gaussian noise to the original sample embedding. The confidence level is set to 99.9%. During certification, the required inputs are the original text sample and the corresponding synonym set of each original word.
A.5 Implementation
Since UniT is based on BERT, it has similar parameter number to the one of BERT, which is 110M. We use the pretrained BERT model "bert-base-uncasee provided by the Transformers [24 library. When we conduct Type I training with UniT, for every dataset, we fine-tune the pretrained model with epochs, which usually takes 10 minutes on an Nvidia A6000 GPU. When we conduct Type training with UniT, the training takes about 48 hours for both datasets on an Nvidia A 1100 GPU. For Yelp and AG, we fine-tune the pretrained model with 110 and 200 epochs, respectively.
A.6 Hyperparameters
The tuning of hyperparameters is not tricky for the DR loss due to their clear interpretation. During training with the DR loss, we set the hyperparameters v 0.1 to keep the Gaussian noise relatively small, = 0.7 to allow the margin to increase while penalizing l2 norm, and = 0.6 to allow appropriate relaxation. In addition, while calculating the final loss, we set 3 to make the MR term and the CE loss have equal weight. In the Type II setting, the extra hyperparameters μ and have been studied by [3I, so we follow them to set μ = and incrementally increase 7 to 4 as the training epoch increases.
15

---

Algorithm 1: Prediction and certification by UniT in Type II Setting
function PREDICT
Input: Hard-label prediction function based on UniT h, Standard deviation of Gaussian noise o, Embedding of original text æ, Number of Gaussian noise 7/, Confidence level
Process:
Draw 7) samples of Gaussian noise, add them to x repeatedly, and obtain vector of class counts
CNT for all perturbed inputs;
UA. DB top two indices CNT;
MA MB + (A.), CNT(
if BINOMPVALUE 77. 7 + nA, 0.5) $ w then
Return DA! else
Return ABSTAIN
end end
function CERTIFY
Input: Hard-label prediction function based on UniT h, Standard deviation of Gaussian noise a,, Embedding of original text æ, 1st number of Gaussian noise Th 2nd number of Gaussian noise
1/,, Lower confidence
Process:
Draw 7n samples of Gaussian noise, add them to æ repeatedly, and obtain a vector of class counts CNT, for all perturbed inputs;
AA - top index in CNT1;
Obtain vector of class counts CNT₂ similarly with n22 samples of Gaussian noise: 72, w);
PA < LOWERCONFBOUND
if PA > 0.5 and R S ot of-11(p (pa) then
Return DA:
end
We also include the results of the influence of hyperparameters on the DR loss. Without the loss of generality, we test on the IMDB dataset in the Type scenario. The results are obtained when we keep the values of other hyperparameters fixed as the ones we use.
Influence of From Table I1 comparably small is beneficial modeling the perturbation and loss optimization. Selecting small y as 0.05 has already increased the performance compared to that of using the CE loss. As grows greater than 0.1, the positive impact of using Gaussian noise improve the robustness of the classifier module will gradually downgrade. Thus, a comparably small 0.1 most beneficial.
V
0.05
0.1
0.15
0.2
Result
87.44
89.04
88.08
86.96
Table 11: Influence of on certified robust accuracy (%).
Influence of a the weight of the negative margin the DR loss. As we have seen in the ablation study, the introduction of the negative margin contributes to enhancing the base model robustness by regularizing the robustness the feature extraction and the classifier module. Thus, from Table [2] setting a comparatively high will be helpful for improving the certified robust accuracy. Thus, we can set a 0.7 help improve the 1 norm.
a 0.1
0.3
0.5
0.7
Result 88.08
88.72
88.24
89.04
89.04
Table 12: Influence of on certified robust accuracy (%).
Influence of 9. As the weight of the MR term, shall be set approximately equal From Table 13 we observe that only when 3 is too large, e.g., = 2, can the MR term damage the training of the base model. Therefore, we can just set /3 have equal weights with the CE loss to improve robustness of the base model.
16

---

0.5
1.5
2.0
Result 88.40
89.04
88.24
83.60
Table 13: Influence 3 on certified robust accuracy (%)..
Influence of Ç. From Table 14 the introduction of relaxation will helpful for getting high certified robust accuracy. As shown in Table [4] the certified robust accuracy grows as & increases from 0 to 0.6 and gradually decreases when gets higher. Therefore, 0.6 the relaxation hyperparameter we use in our experiment.
5
0.2
0.4
0.6
0.8
1.0
Result
86.40
86.96
87.92
89.04
88.34
87.44
Table 14: Influence of g on certified robust accuracy (%)
A.7 Proof for Theorem
Proof.
Given the results of Theorem in [ for all ||||| < R, we have h(x + A) = Denote the word embedding function. Recall that xt [m(w)),... ui [w)] for the text for any allowed perturbed sample X' [wi, .... w/l A(X). Because each word independent of the others in the embedding space, the la norm between v and any x' is
sample = [wh. ... Ww]. and x' = [u(w)), .... u(ww)]
|| - -x11
[u(w:;) unw()
(8)
Note that for each word E X, the embedding set of its synonyms is U; {u(ro) (1) ) m(ww("))), )], and the maximum deviation between wl and any word w E S(w:) is ||ss|| = maxegu; ((ws)) - ell- Since each word is independent the others, the maximum deviation of ||a" - æ0l caused by all possible combinations of the synonyms of different words is
R = max | x|| = + ||.,
(9)
Now since we have R S R, we correspondingly have || - x|| s for all X' E A(X), thus
h(x') h(r + (x'- x)) h(z)) y,
(10)
for any X' E A(X) whose corresponding text embedding is x'. Q.E.D.
Remark. In certification, we also follow the calculation used by and [3] that is lower bounded by o o where Py is the lower bound of Es(h(x 5) yl estimated from the Binomial proportion confidence interval. Thus, the certification condition becomes Py > 0.5 and
R < cΦ ((,)) which is hameessed in and 31 as well.
We also show the prediction and certification process in the Type II setting in Algorithm [ This process mainly follows the same idea those of [ and [31] In Algorithm BINOMPVALUE 7A V)8, p) returns the p-value of the two-sided hypothesis test that 1)4 Binomial + 1)B,)) p). And LOWERCONFBOUND((> 77, - w) returns one-sided w) lower confidence interval for the Binomial parameter p given a sample ~ Binomial p).
A.8 Geometric Interpretation of MR Term
Eq. (6) has an explicit geometric interpretation. As shown in Figure 4 after projecting the original sample and perturbed sample in the high- nigh-dimensional representation space Rd (the input space of the last FC layer g). Eq. 66 requires the perturbed representation z' to locate around within the radius That is, it tries to guide the original sample and perturbed sample representations to be close each other and improve the inter-sample compactness of the high-dimensional space with the margin information.
r =
17

---

Perturbed (CE)
1.00
Perturbed (DR) Original
z'
0.75
++ +M
0.50
0.25
1lz z|1
Ra
0.00
Z
Figure 4: Geometric interpretation of the MR term. Figure 5: Comparison of perturbed text sample representation distribution. The representations of perturbed samples obtained from DR loss are closer to the original ones than the ones obtained from CE loss.
A.9 Visualization of Representation Distribution
As mentioned in the Experiment section, we take one test sample as a visualization example to demonstrate that DR loss is able to improve the representation compactness between perturbed samples and the original ones. The used text sample is randomly chosen from the IMDB dataset and the visualization experiment is conducted in the Type I scenario. We now show the visualization result as follows.
Given this randomly chosen text sample, in the certification process, we will need 5,000 perturbed samples to certify the prediction result. As Figure Higure5Jshows, shows, for all the used perturbed samples for certification, we first obtain two groups of representations with the CE and DR loss from the feature extraction module, respectively. We denote the la distance between the original sample representation and the representation of any perturbed sample z' as L. We then project those nigh-dimensional representations z' into two-dimensional space based on L: if the l2 distance and angle of 2 with is L and w respectively, the coordinate of 2 in Figure 5 is (L cos w, L sinw), and the origin (0, 0) represents z. this example, the average ||=' - z| for representations obtained from the CE and DR loss are 1.768 and 0.353, respectively. From the visualization in Figure 5 the perturbed sample representation obtained from the DR loss distributes much closer to with smaller divergence, which demonstrates that the representation learned from the DR loss is of higher quality.
18


Reviews:
[{"review_id": "hs9kU5oHxP", "reviewer": "Reviewer_ZzE2", "summary": "This paper introduces a unified framework called UniT, aiming to solve the limitations of existing certified robust training pipelines against text adversarial perturbations. The main contribution is that it works in the word embedding space and provides stronger robustness guarantees without extra modules. Additionally, the paper proposes a decoupled regularization (DR) loss to improve the base model's robustness. Experimental results show the effectiveness of the unified framework and DR loss in enhancing certified robust accuracy.", "questions": "* It appears to be a forced combination of two robust training methods. Can you provide more insight, such as whether our motivation is to unify Type 1 and Type 2 methods, or to address the issue of requiring IBP in Type 2 methods?\n* Upon reviewing the supplementary code, it appears that the authors have used transformers for their experiments, specifically focusing on BERT. To provide a more comprehensive evaluation, it would be beneficial to include additional experimental results with other models such as BERT-large, RoBERTa, and ELECTRA. This would further showcase the effectiveness and compatibility of the proposed framework across various state-of-the-art models. (I think it is very easy to switch to other models)\n* Can you provide more explanation and justification for why UniT does not require Interval Bound Propagation (IBP), it is essential to understand the core concept of UniT.\n* I have also discovered some other methods that were not compared in the paper. (Such as Jiehang Zeng, Xiaoqing Zheng, Jianhan Xu, Linyang Li, Liping Yuan, and Xuanjing Huang. 2021. Certified robustness to text adversarial attacks by randomized [MASK], Yada Pruksachatkun, Satyapriya Krishna, Jwala Dhamala, Rahul Gupta, and Kai-Wei Chang. 2021. Does robustness\nimprove fairness? Approaching fairness with word substitution robustness methods for text classification. arXiv\npreprint arXiv:2106.10826)", "limitations": "See above", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "This work presents three advantages:\n\n1. It successfully combines the smoothed model in the discrete word space and the latent space, effectively bridging the structural gap between the two spaces and providing a unified approach for certified robustness. It avoids the loose bound problem caused by IBP.\n\n2. The introduction of a decoupled regularization (DR) loss specifically targets improving the robustness of the base model, separating the robustness regularization terms for feature extraction and classifier modules, leading to better performance.\n\n3. Experiments are conducted on used text classification datasets, demonstrating the effectiveness of the proposed unified framework and the DR loss in improving certified robust accuracy.", "weaknesses": "See the question part.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We deeply thank the reviewer for the time spent reading our paper and for recognizing the reasonableness of the proposed unified framework and DR loss. The questions raised in the review are constructive for our paper. We understand that there is some misunderstanding, and we would like to address it and answer each raised question with deadly earnestness and seriousness. We sincerely hope the following response can clarify any misunderstanding and address the posted questions, and we will be more than happy to answer any followed-up questions.\n\n**Q1: Can you provide more insight?**\n\n**A**: With all due respect, we hold that our method is not a forced combination. Our design is based on a detailed analysis of bottlenecks of existing certified robust training by (1) conducting a structural analysis on two types of frameworks to analyze the similarity and difference between them and (2) validating that IBP is the hindrance against obtaining higher certified robust accuracy for Type II training.\n\nWe would like to further illustrate our motivation and insights as follows. In this work, our aim is to improve the certified robustness performance of text classifiers, and it depends on two things: (1) the satisfaction of certification condition in randomized mechanisms and (2) the robustness of the base model. As for our motivation and insights:\n- Firstly, after showing the structural analysis in Figure 1, we notice that Type II methods require IBP to conduct the calculation of certification condition, which has a loose bound problem that makes certification condition harder to satisfy, leading to a lower certified robust accuracy.  We thus want to address the IBP issue in Type II methods by removing it from certified robust training and certification. However, removing IBP would mean that a new certification condition is needed, so we further address the certification condition design problem without IBP by using the newly designed one shown in Theorem 1 which can be directly calculated from the embedding space. Thus, one aspect of our motivation is to use the unified viewpoint on certified robust training to address the IBP issue in Type II scenario. And we correspondingly tackle the challenge of designing a certification condition without IBP in Type II scenario based on the independence of each word. \n- Secondly, based on our analysis, both types of certified robust training use CE loss for supervising the robustness training of base model. Nonetheless, CE loss lacks specialized robustness supervision for each module (feature extractor and classifier). Since improving the robustness of the base model also helps improve the certified robustness, we further design a modular regularization term for improving the robustness of each module based on their corresponding responsibility. And the designed DR loss can work well with the designed unified framework in both scenarios. \n\n**Q2:  It would be beneficial to include additional experimental results with other models.**\n\n**A**: We thank the reviewer for the suggestion. Before showing the evaluation suggested by the reviewer, we just want to point out that as mentioned in L160-L163, we focus on using BERT as the base model because it outputs the best performance for existing methods and we follow their setting. As for the additional experimental results with other models, without loss of generality, we take the case of Type I training on IMDB dataset for illustration. The results are shown in Table R1. \n\nTable R1: Comparison of certified robust accuracy (%) with different base models on IMDB.\n|Base Model |SAFER | UniT |\n|---|---|---|\n|BERT-Base  | 85.36 |  89.04|\n|RoBERTa | 89.12 | 89.20|\n|BERT-Large |  87.84 | 89.76|\n\nFrom Table R1, UniT consistently outperforms baseline SAFER in Type I scenario with different types of base models including the added RoBERTa and BERT-Large, which further validates the effectiveness and compatibility of the proposed framework.\n\n**Q3: Can you provide more explanation and justification for why UniT does not require IBP?**\n\n**A**: UniT does not require IBP because we have proposed a novel certification condition that is calculated directly in the embedding space. Recall that IBP is used for certification in Type II methods such as CISS. Thus, if we have a new way to certify the prediction results without IBP, we do not require IBP in our training and certification. However, designing a certification condition without IBP is challenging. By utilizing the independence of embedding of each word, we propose Eq. (1) to calculate the maximum deviation $\\hat{R}$ caused by all synonyms. We correspondingly propose a novel certification condition based on the word embedding space as shown in Theorem 1, which indicates that the prediction result can be certified if the certified radius $R$ calculated from Eq. (3) is greater than $\\hat{R}$. Since this certification does not need IBP, UniT does not require IBP.\n\n**Q4: There are some other methods that were not compared in the paper.**\n\n**A**: We thank the reviewer for pointing those papers out, but they are not appropriate for comparison in certified robust accuracy. Firstly, the method proposed by Zeng et al. is to certify the prediction given a limited amount of unconstrained word perturbation, e.g., only 2 words for the SST2 dataset. For our comparison, we concentrate on the scenario where any word can be replaced by its synonyms. The method proposed in that paper cannot handle this situation and is not suitable for being used as the comparison baseline. Secondly, the other mentioned paper by Pruksachatkun et al. is more about a discussion on whether certified robustness helps fairness, and it is not about designing a method for getting certified robust prediction. The proposed method in that paper is supposed to be a baseline for fairness-related methods, which is not related to our task. We will include those papers in the discussion of related work in the final version."}, {"review_id": "CbpVU2lHLq", "reviewer": "Reviewer_FiMX", "summary": "This research paper discusses the vulnerability of Deep Neural Networks (DNNs) used in Natural Language Processing (NLP) tasks against adversarial attacks, specifically word-level adversarial perturbation (or synonym substitution). The authors delve into two existing training frameworks (Type I and Type II) for these NLP models, highlighting the shortcomings related to unified training frameworks and the robustness of the base model. To overcome these limitations, the authors suggest a novel framework, UniT, which merges the two types of models to provide stronger certified robustness. They also propose a Decoupled Regularization (DR) loss to optimize robustness regularization for individual modules. Experimental results provided deliver evidence that the UniT with DR loss improves the certified robust accuracy of both types of certification scenarios.", "questions": "- No particular questions ", "limitations": "yes", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. **Novelty**: The paper presents an original perspective on certified robust training for adversarial attacks in text data bringing unique insights and implementations, which addresses the identified gaps in the field.\n2. **Improved Certification Accuracy**: The proposal of a unified framework (UniT) and a novel decoupled regularization (DR) loss show promising results, achieving higher certified robust accuracy. This moves us towards creating models with stronger robustness.\n3. **Bypasses IBP Issues**: The UniT framework allows Type II methods to bypass using Interval Bound Propagation (IBP) during training, which has been shown to have problems in certification due to its loose bound problem. This successfully solves a major complexity in the training process.", "weaknesses": "1. **Increased Complexity**: While the UniT framework and DR loss may improve robustness, they potentially increase the complexity of model training because it requires handling the embedding space as an intermediate for unification and decoupling the CE loss, which could be time and resource consuming.\n2. **Limited Validation**: Although the paper claims improved results, tests and validations seem limited. It would be beneficial to test the proposed methods on different tasks or datasets to better assess their efficacy and robustness.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank the reviewer for the positive feedback and comments, and we appreciate the reviewer very much for the recognition on the novelty, improved performance, and meaningfulness of our solution. Taking the raised questions seriously, we answer each of them with utmost sincerity as follows. We genuinely hope our response can clarify the concerns and will be more than happy to address any further concerns.\n\n**C1: Increased Complexity.**\n\n**A**: We admit that compared to the training using CE loss, calculating the proposed DR loss needs to increase the computation complexity due to the calculation of getting the features of perturbed input and original input during training. Such a tradeoff is natural: to obtain better model robustness we have to increase computation cost. In fact, the increase of computation cost also occurs for existing robust training techniques such as using PGD (Madry et al., 2017) loss and TRADES (Zhang et al., 2019) loss for improving empirical adversarial robustness. Additionally, we want to highlight the fact that compared to existing robust training techniques, the computation cost of calculating DR loss is relatively lower. Suppose the calculation cost of CE loss is $C$. The computation cost of DR loss would be approximately $2C$. However, for existing robust training techniques such as using PGD loss and TRADES loss, suppose the number of steps of generating adversarial examples is $k$, and the computation cost of PGD loss or TRADES loss will be $k\\cdot C$. Since $k$ is generally larger than 2 in their implementation, the computation cost of DR loss is relatively smaller. We will include this discussion in the final version.\n\n**C2: Limited Validation.**\n\n**A**: We thank the reviewer for the suggestion and introduce the empirical robust training methods including PGD loss and TRADES loss as baselines to further validate the effectiveness of the proposed methods. Firstly, we want to compare DR loss with the added baselines on certified robust accuracy. Secondly, we conduct a comparison between ours and those baselines in terms of empirical robust accuracy. We will include those results in the final version, which further demonstrates the effectiveness of the proposed DR loss in improving model robustness. To detail:\n\nFirstly, without loss of generality, we extend our experiments in Table 1 in Type I scenario by adding PGD loss and TRADES loss as baselines. The results are shown in Table R1. \n\nTable R1: Comparison of certified robust accuracy (%) in the Type I scenario.\n Base Model | Loss | IMDB| SST2 | Yelp | AG\n----|--|---|---|---|---\n BERT | CE Loss|85.36 |91.65| 97.19| 93.78\n BERT | PGD Loss | 87.52 | 90.28| 97.86 | 93.98\n BERT | TRADES Loss | 86.80 | 90.44 | 97.56 | 93.96\nBERT | DR Loss | **89.04** | **93.02**| **97.87** |**94.31**\n\nFrom Table R1, DR loss can consistently perform better than PGD loss and TRADES loss in four datasets. Especially, DR loss is able to obtain a relatively high increment in terms of certified robust accuracy (CRA) on the datasets with long text samples such as IMDB and SST2. Thus, DR loss is a more suitable choice for certified robust training for its decomposed regularization for each module, which requires each module to be robust under perturbation.\n\nSecondly, we also conduct experiments in the task of defending against adversarial attacks. We employ BERT as the base model and use PGD loss and TRADES loss as baselines. In our experiments, we conduct adversarial attacks by utilizing TextBugger (Li et al., 2019), a commonly used method for conducting text adversarial attacks. Following the existing adversarial attack setup, we randomly draw 1,000 test samples for adversarial example generation. The defense results of different methods are as follows.\n\nTable R2: Comparison of empirical robust accuracy (%) with robust training loss. We also show the corresponding natural accuracy indicated by the parentheses. \n\nBase Model | Loss | IMDB| SST2 | Yelp | AG\n---|---|---|---|---|---\n BERT | PGD Loss | 62.0 (87.1) | 87.6 (91.5) | 92.4 (96.9)  | 85.5 (93.7) \n BERT | TRADES Loss | 57.8 (84.8) | 86.3 (91.7) | 91.9 (97.0) | 84.4 (94.3)  \nBERT | DR Loss | **72.7** (86.9)  | **89.8** (93.3) | **96.9** (98.4) | **87.6** (92.9)\n\nFrom Table R2, the empirical robust accuracy of DR loss is higher than those of PGD loss and TRADES loss. Compared to the baselines in Table R2, the improvement is obtained by the individual robustness supervision for each module provided by DR loss. Such results further show the effectiveness of the designed DR loss in improving model robustness, and we hope they can address the raised concern of the reviewer.\n\n**References**\n\nMadry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2017). Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083.\n\nZhang, H., Yu, Y., Jiao, J., Xing, E., El Ghaoui, L., & Jordan, M. (2019, May). Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning (pp. 7472-7482). PMLR.\n\nLi, J., Ji, S., Du, T., Li, B., & Wang, T. (2019, January). TextBugger: Generating Adversarial Text Against Real-world Applications. In 26th Annual Network and Distributed System Security Symposium."}, {"review_id": "vUQJF6PjLr", "reviewer": "Reviewer_Wx5f", "summary": "This paper focuses on the certified robustness of language models. To improve the certified robustness, the authors propose a better robust training method that enables robust feature extraction and a larger prediction margin. Experiment results show the effectiveness of the proposed DR loss, leading to a better certified accuracy compared to traditionally used CE loss.", "questions": "The maximum deviation caused by all synonyms computed in Equation (1) seems to make the $l_{2}$ the constraint for the perturbation too large. Assuming the average  $l_{2}$ radius for each token embedding is $r$, then the total $l_{2}$ radius would be enlarged by $\\sqrt{n}$ times.  The input length of some datasets used in this paper could be rather large. For example, IMDb contains average 300-500 words. After tokenization, the number of tokens, $n$, could be more than 500. Then the radius of the perturbation is enlarged more than 10x. In that case, the certification process in Theorem 1 (Equation 3) would be very possible to lead to a 0 certified accuracy. I would ask for more details about the computation of $\\hat{R}$ and additional certification operations to ensure the validity of the results.", "limitations": "The authors discussed the limitations and potential negative social impact of their work ", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "This paper is well-motivated. The authors first identify the existing challenge of certification when using CE loss. Based on that, the DR loss is proposed to alleviate the non-robust feature extraction and improve the prediction margin. Empirical evaluations also demonstrate the effectiveness of the proposed DR loss.", "weaknesses": "- An important baseline is missing: robust training. The overall objective of the proposed DR loss is to improve the robustness of the base classifier so that it is easier to be certified. Robust training such as min-max adversarial training [1], and TRADES [2] is also known to be beneficial for the certification. Since the proposed method manipulates the training objective, which is very similar to min-max adversarial training and TRADES, it would be great to compare the certification performance of the model after training with [1,2] and the proposed loss. For example, one may use greedy search-based attack methods from  [3] to find the perturbation for each batch during training. Then minimize the CE loss on the perturbed batch (when using TRADES it will be slightly different). Please note that the synonym set for each word should be consistent with SAFER's (if compare in the Type-I scenario) rather than using the original candidate set of the attack methods.\n- An empirical robustness evaluation would make the evaluation more comprehensive. It would greatly demonstrate the effectiveness of the proposed method if improvements in the empirical robustness can be observed and outperform robust training methods.\n\nOverall, this paper is well-motivated and clearly written. The proposed technique makes sense and is verified to be effective in some settings. If my concerns could be addressed, I would like to raise my rating.\n\n\n\n[1] Madry, Aleksander, et al. \"Towards deep learning models resistant to adversarial attacks.\" arXiv preprint arXiv:1706.06083 (2017).\n\n[2] Zhang, Hongyang, et al. \"Theoretically principled trade-off between robustness and accuracy.\" *International conference on machine learning*. PMLR, 2019.\n\n[3] Morris, John X., et al. \"Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in NLP.\" *arXiv preprint arXiv:2005.05909* (2020).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank the reviewer for the encouraging and constructive comments. We are deeply grateful to the reviewer for acknowledging the significance of our research and thinking highly of the novelty and effectiveness of the proposed DR loss. We take the posted comments and questions seriously and would like to address the concerns of the reviewer on the comparison with robust training loss and empirical robustness evaluation with the following response. We will be more than happy to address any further concerns.\n\n**C1: An important baseline is missing: robust training.**\n\n**A**: We thank the reviewer for the comment and would like to further demonstrate the effectiveness of the designed loss. Without loss of generality, we use Type I scenario for illustration and extend our experiments in Table 1 with the following comparison results. We use the representative PGD (Madry et al., 2017) loss and TRADES (Zhang et al., 2019)  loss to adversarially train the model with the perturbation added to the word embedding space, which are the robust training baselines.\n\nTable R1: Comparison of certified robust accuracy (%) with robust training loss in the Type I scenario.\nBase Model | Loss | IMDB| SST2 | Yelp | AG\n---|---|---|---|---|---\n BERT | CE Loss|85.36 |91.65| 97.19| 93.78\n BERT | PGD Loss | 87.52 | 90.28| 97.86 | 93.98\n BERT | TRADES Loss | 86.80 | 90.44 | 97.56 | 93.96\n BERT | DR Loss | **89.04**  | **93.02** | **97.87**  |**94.31** \n\nFrom Table R1, we can find that DR loss consistently outperforms PGD loss and TRADES loss in four datasets. The increment of certified robust accuracy (CRA) is relatively considerable for the datasets with longer text such as IMDB and SST2. Specifically, the CRA of DR loss is 1.52% and 2.24% higher than those of PGD and TRADES in IMDB, respectively, and it is 2.74% and 2.58% higher than those of PGD and TRADES in SST2, respectively. Thus, DR loss is more suitable for the certified robust training task because (1) the perturbation for each word is randomly drawn from their corresponding synonyms, which covers a larger variety of perturbed samples, and (2) our designed modular regularization eyes on reducing the negative effect of the perturbation on prediction margin, which is the key to satisfying certification condition. We will include this discussion in the final version.\n\n**C2: An empirical robustness evaluation would make the evaluation more comprehensive.**\n\n**A**: We thank the reviewer for the comment and would like to address this concern with the following results on empirical robustness evaluation. Without loss of generality, we conduct a comparison of empirical robust accuracy with PGD loss and TRADES loss on the four datasets. We use BERT as the base model, and train BERT with PGD loss, TRADES loss, and the proposed DR loss, respectively. After that, we follow the existing adversarial attack setup and randomly draw 1,000 test samples for adversarial example generation. The adversarial examples are generated by TextBugger (Li et al., 2019), a representative text adversarial method. The results are as follows.\n\nTable R2: Comparison of empirical robust accuracy (%) with robust training loss. We also show the natural accuracy which is indicated by the parentheses. \n\nBase Model | Loss | IMDB| SST2 | Yelp | AG\n---|---|---|---|---|---\n BERT | PGD Loss | 62.0 (87.1) | 87.6 (91.5) | 92.4 (96.9)  | 85.5 (93.7) \n BERT | TRADES Loss | 57.8 (84.8) | 86.3 (91.7) | 91.9 (97.0) | 84.4 (94.3)  \nBERT | DR Loss | **72.7** (86.9)  | **89.8** (93.3) | **96.9** (98.4) | **87.6** (92.9)\n\nFrom the comparison results in Table R2, the proposed DR loss in UniT also outperforms PGD loss and TRADES loss with respect to empirical robust accuracy. This also attributes to the individual robustness supervision provided by DR loss for each module, which helps each module to work together more coherently to defend against adversarial attacks. We will include this discussion in the final version.\n\n\n\n**Q1: On the computation of $\\hat{R}$ and additional certification operations to ensure the validity of the results.**\n\n**A**: This question is mainly about the certification process in Type II and especially the calculation of $\\hat{R}$. It is a good question for $\\hat{R}$ is the key to certification in Type II scenario. To answer this question, firstly, it is true that some datasets generally have long text inputs, and we follow previous works and truncate the text inputs for efficiency reasons. For example, the input text of IMDB is truncated to 128 tokens in training and certification. Secondly, the embedding of each word is not frozen during training, i.e., they are regarded as part of model parameters. Since in Type II scenario, the word embedding is supervised with a regularizer $\\ell_{\\hat{R}}$ (shown in L295), the embedding of each word tends to shrink its norm and becomes small. As a result, in certification, $\\hat{R}$ will be relatively small after training, which makes the satisfaction of certification in Theorem 1 much easier.\n\n**References**\n\nMadry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2017). Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083.\n\nZhang, H., Yu, Y., Jiao, J., Xing, E., El Ghaoui, L., & Jordan, M. (2019, May). Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning (pp. 7472-7482). PMLR.\n\nLi, J., Ji, S., Du, T., Li, B., & Wang, T. (2019, January). TextBugger: Generating Adversarial Text Against Real-world Applications. In 26th Annual Network and Distributed System Security Symposium."}, {"review_id": "6ZralQcKBK", "reviewer": "Reviewer_3SMy", "summary": "This paper proposes a unified framework called UniT for certified robust training against text adversarial perturbation. UniT can train and certify in both discrete word space and continuous latent space by working in the word embedding space, without extra modules or loose bounds. It also introduces a decoupled regularization loss called DR loss to improve the base model robustness by regularizing the feature extraction and classifier modules separately. The paper shows that UniT outperforms existing state-of-the-art methods in both scenarios, and DR loss enhances the certified robust accuracy by providing modular regularization.", "questions": "The introduction of DR loss indeed results in a more unified model, but it also brings additional hyperparameters. The paper could provide guidance on how to efficiently and accurately select the best hyperparameters for practical applications. This would make the proposed approach more accessible and easier to implement for researchers and practitioners alike.", "limitations": "See the weakness section", "rating": 5, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The paper clearly identifies the limitations of existing approaches and highlights the advantages of combining them with a novel DR loss into a unified framework. The authors have made an effort to address these limitations and have proposed a novel solution that capitalizes on the strengths of both discrete word space and continuous latent space approaches. Its evaluation demonstrates the effectiveness of their proposed approach. ", "weaknesses": "1. The selection of synonyms (Type I) is indeed an important aspect of the paper, and it would be helpful if the authors could provide more clarity on how synonyms are chosen based on embeddings. I'm not sure about the probability of changing labels due to synonym substitution for the task of sentiment analysis. Could the authors provide some concrete examples? Additionally, a discussion on how the base model is obtained (whether it's fine-tuned BERT or not) and any improvements in generalization performance could shed more light on the robustness of the proposed approach.\n\n2. The paper's focus on BERT and sentiment classification may indeed limit its applicability to other tasks or models, especially in the era of large-scale pre-trained models with improved generalization capabilities. The authors could address this concern by discussing the potential of their framework to be extended to other tasks and models, and whether the problem they are investigating remains relevant in the current research context.\n\n3. The paper mainly discusses synonym substitution and noise addition, but there are now more advanced perturbation methods based on large language models (LLMs) that could potentially generate more realistic adversarial examples (e.g., through rephrasing or prompting). A comparison or discussion of these alternative methods and their implications for the proposed approach could provide a more comprehensive understanding this paper's contribution.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We genuinely thank the reviewer for the positive and constructive feedback on our paper. We thank the reviewer for recognizing the novelty and effectiveness of our solution. Each comment and question is of great importance to us, and we hope our response can address the raised concerns. Moreover, we are eager to answer any additional questions.\n\n**Q1: On the guidance for selecting the best hyperparameters.**\n\n**A**: This is a good question, and in fact, we have provided guidance on selecting hyperparameters in Section A.6 in the submitted Appendix. Due to the word limit, we kindly ask the reviewer to view our experimental results on the influence of hyperparameters in the Appendix. From those results, we can find that the tuning of hyperparameters is not tricky for the DR loss due to their clear interpretation, and these settings can be used widely for different datasets. To specific, $\\mu$ is kept as small as 0.1 to keep Gaussian noise relatively small. $\\alpha$ is set to 0.7 to ask the margin to increase while penalizing $l_2$ norm of text representation. $\\epsilon=0.6$ is fine for allowing some relaxation. And we just make CE loss and MR term have equal weights by setting $\\beta=1$. \n\n**C1: On the selection of synonyms, their influence on prediction labels, and how the base model is obtained.**\n\n**A**: We would like to provide those implementation details as follows. With respect to synonym selection, in Type I scenario we follow the baseline SAFER and use the same set of synonyms and the selection of synonyms is based on the similarity between two words in a pretrained embedding space. To illustrate, by using the embedding space of GLOVE embeddings (Pennington et al., 2014), for a specific word, any other word that has a cosine similarity that is greater than 0.8 are considered a synonym of that word. \n\nAs for how synonym substitution can change the label, we would like to show one example in the Yelp dataset. Given a text sample “Great buffet. Lots of selections. The prime rib was delicious. It was worth the 30 dollars” that is correctly predicted as a sample with positive sentiment by a text classifier, the prediction can be changed to negative sentiment when only the word “delicious” is changed by “loverly”. That is, “Great buffet. Lots of selections. The prime rib was loverly. It was worth the 30 dollars” will be classified incorrectly by the text classifier when only one word is changed. We also include a long text sample in Table 9 in the Appendix for illustrating how synonym substitution changes the prediction results. Since our work mainly focuses on certified robustness and not on text adversarial attacks, and due to the word limit, we kindly refer the reviewer to representative works on text adversarial attacks such as TextBugger (Li et al., 2019), and TextFooler (Jin et al., 2019) if needed to get a detailed look on how synonym substitution changes prediction labels and fool text classifiers.\n\nFinally, the base model is obtained from pre-trained “bert-base-uncased” BERT provided by the transformers package by huggingface. We have included this discussion in Section A.5 in the Appendix and kindly ask the reviewer to review that section if further information is needed due to the word limit. \n\n**C2: On the generalization capabilities of the proposed method.**\n\n**A**: We thank the reviewer for this question. As mentioned in L160-L163, our focus on BERT and sentiment classification is mainly because of the existing literature related to the task of prediction certification for text data. Our structural decomposition analysis of the base model in Figure 2 is general among different models, such as RoBERTa, ALBERT and even more recently proposed foundation models such as ViLT and UNITER. Since the proposed DR loss is designed from this general point of view, DR loss can still be used for those latest structures, and it can help improve the robustness of those models in other classification tasks such as visual-question answering. We will include this discussion in the final version.\n\n**C3: On the other ways of generating adversarial examples such as through rephrasing or prompting.**\n\n**A**: We have also noticed the methods of generating adversarial examples by rephrasing and prompting, but they have the weakness of changing a lot of words and increasing the perturbation rate, which disobeys the definition of good adversarial examples that the difference between adversarial examples and the original samples should be imperceptible. For example, the method proposed by (Qi et al., 2021) rewrites the text with a different style by rephrasing and the changes are easily noticeable. In this sense, the adversarial examples generated in those ways are not of high quality because of their high perturbation rates. We thank the reviewer for the suggestion and will include those works in the discussion to distinguish why we shall focus on the adversarial examples conducted by synonym substitution.\n\n**References**\n\nPennington, J., Socher, R., & Manning, C. D. (2014, October). Glove: Global vectors for word representation. In Proceedings of the 2014 conference on empirical methods in natural language processing (EMNLP) (pp. 1532-1543).\n\nLi, J., Ji, S., Du, T., Li, B., & Wang, T. (2019, January). TextBugger: Generating Adversarial Text Against Real-world Applications. In 26th Annual Network and Distributed System Security Symposium.\n\nJin, D., Jin, Z., Zhou, J. T., & Szolovits, P. (2019). Is bert really robust? natural language attack on text classification and entailment. arXiv preprint arXiv:1907.11932, 2, 10.\n\nQi, F., Chen, Y., Zhang, X., Li, M., Liu, Z., & Sun, M. (2021). Mind the style of text! adversarial and backdoor attacks based on text style transfer. arXiv preprint arXiv:2110.07139.\n\n\n"}, {"review_id": "dnjeEiHE1C", "reviewer": "Reviewer_yTLz", "summary": "The paper presents UniT, a unified certified robust training against text adversarial perturbation. The paper identifies two frameworks of robust training: type (I) does random data augmentation over the text inputs, and type (II) adds Gaussian noise to the latent feature space. The paper unifies two types of training by doing data augmentation in the inputs and adding Gaussian noise to the latent feature space. The paper also introduces a novel loss function, which modularizes the feature extraction regularization and robust regularization as a loss term to fuse these two types of training besides the original cross-entropy loss.\n\nThe paper evaluates UniT and demonstrates that it consistently outperforms SAFER and CISS. The paper also does ablation studies of different loss function designs and different hyper-parameter settings (in the appendix).", "questions": "Comment:\n1. It would be better to also present natural Acc in Table 7 and 8. And in all the hyper-parameter tables. \n2. The motivation part in lines 202-208 is not well-justified. I think the IBP is necessary if one wants to get a certification. The reason why UniT can get rid of IBP but still gets a certification is because UniT uses BERT embedding and add noise before feature extraction. Then IBP in CISS only needs to analyze the embedding part, which is easy to analyze and in fact, do not need IBP at all. \n3. In lines 283-285, the paper states \"which will not regularize g if z is well learned\". However, it is not the case, the only thing the -max(., 0) does is to not penalize the wrongly classified cases. In other words, \"which will not regularize g if z is NOT well learned\".\n\nQuestions:\n1. Is there any intuition why the paper chooses the l2 norm over cosine similarity?\n2. The original $l_{\\hat{R}}$ loss used in type II training also tries to minimize the distance of $\\| z-z'\\|$ in the latent space of IBP, no? \n3. What's the performance of CISS using their original loss term in Table 3? Table 3 only shows the results of CE and DR loss.\n4. Why can CISS not do IBP on BERT? UniT and CISS both add Gaussian noise before feature extraction. Then CISS only needs to analyze the BERT embedding part, which is easy because of the independence of embedding of each word, as mentioned in line 231. I agree that IBP might be looser, consider x=[0,0], x_1=[0,1], x_2=[1,0], then $\\hat{R} = 1$ but the over-approximated $\\hat{R}$ via IBP should be $\\sqrt{1+1}=\\sqrt{2}$. ", "limitations": "The authors do not address the limitation. One limitation of the paper is that the paper only handles word substitutions but not general perturbation spaces such as insertion, deletion, and their combinations. ", "rating": 6, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 2, "strengths": "1. The modular loss function design is interesting and novel. The ablation studies of the loss function are very strong.\n2. The paper outperforms existing certified approaches SAFER and CISS.", "weaknesses": "1. The paper only handles the perturbation space of synonym substitutions but not other text adversarial perturbations such as insertion, deletion, and their combinations. This weakness makes the title \"text adversarial perturbation\" overclaimed.\n2. The comparison between UniT and CISS needs to be presented more clearly. See questions 2-4.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We would like to sincerely express our thankfulness to the reviewer for the positive and insightful feedback on our paper. We are deeply appreciative of the acknowledgment of our paper on the novelty of loss design and the practical effectiveness of the proposed UniT framework. We take every comment or question seriously and hope that our response can clarify the concerns. Meanwhile, we will be more than happy to address any additional concerns.\n\n\n**Q1: Is there any intuition why the paper chooses the l2 norm over cosine similarity?**\n\n**A**: UniT chooses l2 norm over cosine similarity in Eq. (4) because l2 norm can limit the influence of perturbation on downgrading the prediction margin (defined in Sec. 2.2) and is good for certification. For the ease of illustration, we confine our discussion in a binary classification case and the (unbiased) weight of the last layer is for classifying the original input vector $z$ into class $a$ and class $b$ are $w_a$ and $w_b$, respectively. Suppose the ground truth is class $a$. Thus, the prediction margin will be $M(z)=w_a^T z-w_b^T z=(w_a-w_b)^T z$. Similarly, the prediction margin given the perturbed representation in $z^\\prime$ will be $M(z^\\prime)=(w_a-w_b)^T z^\\prime$. Thus, the influence on the prediction margin after the attack will be $M(z^\\prime)-M(z)= (w_a-w_b)^T (z^\\prime-z)$. Since we want to reduce this influence for better certification results, we shall use the l2 norm of $z^\\prime-z$ as an optimization target to limit the change $ M(z^\\prime)-M(z)$. We will include this discussion in the final version.\n\n**Q2: Does the original $l_{\\hat{R}}$ loss used in type II training also try to minimize the distance of $||z−z^\\prime||$ in the latent space of IBP?**\n\n**A**: No, it doesn’t. $z$ and $z^\\prime$ are the output from the penultimate layer (the last but one layer), while $l_{\\hat{R}}$ in the Type II training is calculated from the mid-level layer. To specify, $l_{\\hat{R}}$ uses the feature output from the feature encoder that is before the base model, and the base model is the module that outputs $z$ and $z^\\prime$. Therefore, the original $l_{\\hat{R}}$ cannot minimize $||z−z^\\prime||$.\n\n**Q3: What's the performance of CISS using their original loss term in Table 3?**\n\n**A**: To clarify, the performance of CISS using their original loss terms is the first row in Table 3. We use CE to denote the loss of CISS because the main difference between our loss and the loss of CISS lies in the CE term, and both losses include $l_{\\hat{R}}$. We have discussed this difference in L343-L345 and illustrated our loss terms for Type II in L294-L297.\n\n**C2 and Q4: On the necessity of IBP in CISS.**\n\n**A**: We believe C2 and Q4 is correlated and would like to answer them together. Recall that in the context of certified robustness there are two important things for obtaining high certified robust accuracy: training and certification. Thus, for this research task, the design of the training mechanism is related to or depends on the design of the certification condition. CISS designs a certification condition in the mid-level latent space, so it has to introduce IBP for the purpose of certification. Since the parameters in IBP has to be learned, it needs to be trained with the base model together to make the extracted features satisfy the certification condition (shown in L148). Thus, IBP cannot be removed from CISS unless CISS has a certification condition not related to the latent space. And in fact, one of our main contributions in this paper is to propose a stronger certification condition by taking into consideration the independence of words in the embedding space, and this certification condition helps us design our Type II training without IBP.\n\n**C1: It would be better to also present natural Acc in Table 7 and 8. And in all the hyper-parameter tables.**\n\n**A**: We thank the reviewer for the suggestion. We also have natural accuracy in the record and will present them in the final version. For example, Table 7 added with natural accuracy will be as follows. The natural accuracy is calculated on all test samples.\n\nTable R1: Ablation study results on loss design in IMDB.\nCE | ALP | $l_{fr}$| $l_{cr}$ | Natural Acc (%) | CRA (%)\n---|---|---|---|---|---\n$\\checkmark$  |  |  |   |   86.03 |  85.36\n$\\checkmark$ | $\\checkmark$ | |   |  86.36 |  86.64\n$\\checkmark$ |   |  $\\checkmark$ |   | 87.62  |  88.08\n$\\checkmark$ |  |    |  $\\checkmark$  (Input: $z+\\epsilon$) | 87.42 | 85.92\n$\\checkmark$ |   | $\\checkmark$ |  $\\checkmark$ (Input: $z$)  | 87.45  |    87.68\n$\\checkmark$ |   |$\\checkmark$ | $\\checkmark$ (Input: $z^\\prime$) |  85.71 |   85.76\n$\\checkmark$ |   | $\\checkmark$ | $\\checkmark$  (Input: $z+\\epsilon$)  |  87.87 | 89.04\n\n**C3: A typo in L285.**\n\n**A**: Thank you for your carefulness when reading our paper. You have understood our loss design correctly and it should be \"which will not regularize g if z is NOT well learned\". We will correct this typo in the final version.\n\n**C4: The paper only handles the perturbation space of synonym substitutions but not other text adversarial perturbations such as insertion, deletion, and their combinations.**\n\n**A**: Throughout our literature review on text adversarial perturbations, synonym substitution has been considered as the standard way to construct text adversarial perturbation in adversarial attack and defense. This is because insertion and deletion have been regarded as two special forms of word substitution: insertion can be considered as replacing an ‘[EOS]’ token with a new word and putting the replaced word in the inserted position, and deletion can be considered as replacing a word by the '[UNK]' token. Thus, previous literature holds that the ability to defend against synonym substitution generally reflects the ability to defend against other two forms of adversarial perturbations. Thus, we follow the existing setup to conduct adversarial perturbations in the context of synonym substitutions."}]

Author rebuttal:
Dear Reviewers,

We sincerely thank you for your time and effort spent on our paper. We deeply appreciate all your constructive feedback for improving our paper. We have responded to every raised concern with utmost sincerity, deadly seriousness, and the hope that our response can address them. Please find our response to your specific comments and questions in each corresponding separate response. For each response, Q, C, and A are short for question, comment and answer, respectively.

We are excited that most of the reviewers acknowledge the novelty of the designed unified framework UniT and the proposed DR loss for certified robustness training, the effectiveness of our method, and the high quality of our presentation. In our response, we have provided additional illustrations on certain concepts as requested. In addition, we have conducted all requested experiments and put the results and analysis in the corresponding response section. We will accordingly further enhance our paper in the final version with these useful suggestions. 

Thanks again for your time and effort!

Best regards,

Authors

Meta-review: The authors propose a robust training framework against text adversarial perturbation. The proposed method makes sense and the results are convincing. All reviewers agree that the paper is above the bar. I vote for acceptance.
Decision: Accept (poster)