RMLM: A Flexible Defense Framework for Proactively Mitigating Word-level Adversarial Attacks
Year: 2023

Abstract:
Adversarial attacks on deep neural networks keep raising security concerns in natural language processing research. Existing defenses focus on improving the robustness of the victim model in the training stage. However, they often neglect to proactively mitigate adversarial attacks during inference. Towards this overlooked aspect, we propose a defense framework that aims to mitigate attacks by confusing attackers and correcting adversarial contexts that are caused by malicious perturbations. Our framework comprises three components: (1) a synonym-based transformation to randomly corrupt adversarial contexts in the word level, (2) a developed BERT defender to correct abnormal contexts in the representation level, and (3) a simple detection method to filter out adversarial examples, any of which can be flexibly combined. Additionally, our framework helps improve the robustness of the victim model during training. Extensive experiments demonstrate the effectiveness of our framework in defending against word-level adversarial attacks.

heading: 1 Introduction
text: Deep neural networks (DNNs) have achieved remarkable success in natural language processing (NLP). However, they are vulnerable when facing adversarial attacks (Alzantot et al., 2018; Liang et al., 2018; Zhong et al., 2020a; Wang et al., 2020). Textual adversarial attacks craft adversarial contexts by perturbing the input in order to fool the victim model, which keeps raising security issues.
General textual adversarial attacks can be categorized into three broad classes according to the perturbation grain, including character-level attacks (e.g., word misspelling) (Ebrahimi et al., 2018; Eger et al., 2019), word-level attacks (e.g., word
† Contribute equally. ∗ Corresponding author.
substitution) (Huang et al., 2019; Ren et al., 2019; Li et al., 2020; Garg and Ramakrishnan, 2020; Jin et al., 2020), and sentence-level attacks (e.g., paraphrasing) (Ribeiro et al., 2018; Wang et al., 2020; Maheshwary et al., 2021). Character-level and sentence-level attacks often tend to create illegal and unnatural sentences, which could be detected by the spelling and grammar checker, respectively (Pruthi et al., 2019; Ge et al., 2019). Word-level attacks utilize synonym substitutions to craft adversarial examples that do not violate grammatical and semantic requirements (Samanta and Mehta, 2017; Garg and Ramakrishnan, 2020), and thus it is more challenging to defend against them. In this paper, we focus on the defense against such synonym-based word-level adversarial attacks.
Defense methods for textual adversarial attacks can be roughly divided into two categories (Li et al., 2021): empirical defense and certified robustness. Most empirical defense methods adopt and refine adversarial training (Zhu et al., 2020; Wang and Wang, 2020; Si et al., 2021; Ivgi and Berant, 2021) to improve the robustness of models. Another line of research (Liu et al., 2022; Dong et al., 2020; Le et al., 2022; Zeng et al., 2021b) adopt regularization or ensemble methods to achieve robustness to perturbations. Certified robustness (Huang et al., 2019; Jia et al., 2019; Ye et al., 2020) is dedicated to provably certified robustness by optimizing interval bound propagation upper bound. These methods primarily focus on improving the robustness of models during training, while rarely considering mitigating adversarial attacks during inference.
Most word-level adversarial attackers iteratively search and substitute vulnerable words in order to craft adversarial examples along with several tailor-made adversarial contexts to fool the victim model. We can achieve promising results in defense against these attacks if we can (1) confuse
2757
the attacker on searching vulnerable contexts, and (2) correct adversarial contexts. Towards this less explored direction, we propose a flexible framework Randomization Masked Language Modeling (RMLM), which leverages randomness of MLM to mitigate adversarial attacks during inference.
During inference, RMLM firstly applies (1) a synonym-based transformation to randomly corrupt potential adversarial contexts. However, this introduced noise can be detrimental to the victim model. Thanks to the pre-trained model that has extensive knowledge, BERT (Devlin et al., 2019) has been demonstrated to perform well on a range of NLP tasks (Raffel et al., 2020; Zheng et al., 2022; Zhong et al., 2020b). Thus, we develop (2) a BERT defender to correct corrupted contexts and remanent adversarial contexts in representation level. By sampling from the MLM head of the BERT defender, we can reconstruct a denoised input for the final prediction of the victim model. Note that the returned logits may confuse the attacker who heavily relies on precise logits feedback, since the feedback is based on the denoised sample instead of the expected adversarial input. Furthermore, we propose (3) a simple-yet-effective detection method to filter out adversarial samples based on the cooperation between the victim model and the BERT defender. During training, the robustness of the victim model can be improved since our randomized transformation and sampling operation could enable the BERT defender to offer abundant virtual samples for robust training. The above three components constitute the proposed framework RMLM, and each component can be deployed independently to provide defense.
In summary, our contributions are as follows:
1) We explore a new approach to defense against adversarial attacks in NLP, proactively mitigating adversarial attacks by confusing attackers and correcting adversarial contexts.
2) We propose a flexible framework RMLM that can effectively mitigate adversarial attacks and improve the robustness of the victim model during inference and training, respectively.
3) Extensive experiments across 3 DNNs, 3 attack methods, 6 defense baselines, 5 metrics, and 3 benchmark datasets demonstrate the superior performance of the proposed framework.

heading: 2 Related Work
text: Spelling and grammar checkers are successful in defense against character-level and sentence-level attacks which often violate grammatical requirements (Pruthi et al., 2019; Ge et al., 2019) during inference. However, few of them can effectively defend against word-level attacks. For defense against word-level attacks, most previous works employ empirical defense for robustness enhancement (Zhu et al., 2020; Si et al., 2021; Zhou et al., 2021; Ivgi and Berant, 2021; Dong et al., 2020; Liu et al., 2022), where they heavily rely on augmenting generated adversarial examples and increase the training cost (Liu et al., 2022). By contrast, RMLM does not require additional data for augmentation, making it more practical in realistic scenarios. Certified robustness (Huang et al., 2019; Jia et al., 2019; Ye et al., 2020) is dedicated to provable robustness by expanding interval bound propagation (Gowal et al., 2019) but often restricts both the attack space and model architectures. Yet each component of RMLM can be flexibly combined and applied to different models. Besides, we focus on “proactively mitigating adversarial attacks during inference” rather than “improving the robustness of victim models during training”.
Xie et al. (2018) show success in mitigating attacks in computer vision by randomized transformations. Zeng et al. (2021b) propose RanMASK to craft a mass of masked copies for the ensemble prediction. Despite the difference in corruption, RMLM corrupts the input only once since our BERT defender is developed to recover corrupted and remanent adversarial contexts, while RanMASK corrupts the input hundreds of times for doing the ensemble. Besides, we leverage the inherent randomness of RMLM for disturbing attackers’ search procedure and correcting adversarial contexts rather than achieving certified robustness.

heading: 3 Method

heading: 3.1 Background
text: Given a victim model f and the dataset D = {(x, y)}, where x = [w1, w2, · · · , wn] is the input text with n words and y is the label. The attacker crafts several adversarial contexts by substituting synonyms for words in x, resulting in a final adversarial example xadv. The attacker iteratively searches for the one xadv that can fool the victim model, i.e., argmax f(xadv) ̸= y. The goal of de-
fense is to protect the victim model from making incorrect predictions on adversarial examples.

heading: 3.2 Overview of RMLM
text: Fig. 1 shows the proposed framework, RMLM defending against adversarial attacks. Our framework utilizes a randomized transformation and a BERT defender to first corrupt and then correct adversarial contexts, reconstructing a denoised input which is expected to be less harmful to the victim model. And the randomness can make logits feedback full of uncertainty during the attacker’s search procedure, which may prevent the attacker from finding a fatal adversarial context to fool the victim model.
RMLM is composed with three components any of which could be flexibly combined: (1) a wordlevel synonym-based transformation (§3.3), (2) a developed BERT defender (§3.4), and (3) a simpleyet-effective detection method (§3.5).

heading: 3.3 Word-Level Transformation
text: Motivated by the MLM task (Devlin et al., 2019), we employ vanilla masking to corrupt the input text. The BERT defender pre-trained by MLM has the ability to identify and correct masked contexts in order to alleviate negative effects of corruption. However, the masking scheme does not account for synonym substitutions commonly used by attackers, suggesting that the BERT defender may not be able to effectively correct remanent adversarial contexts, leading to harm the victim model.
To this end, we devise a synonym-based transformation that is similar to the perturbation strategy used by attackers. We first prepare a lookup table T that collects k synonyms for each input’s word wi from WordNet (Miller, 1998)1. Based on the setting of BERT (Devlin et al., 2019), about
1The implementation details are in Appendix A.2
25% (i.e., transformation rate s = 0.25) of input tokens would be substituted with their synonyms in the lookup table. However, a mismatch between our transformation and masking of MLM may hinder leveraging BERT’s knowledge, since MLM in the large scale pre-training stage mainly uses the [MASK] token while not involving any synonyms. To mitigate this gap, we replace a token wi with (1) a random synonym in T (SYN), (2) [MASK] token, (3) [UNK] token, (4) a random token (RAND), and (5) unchanged token wi (UNC) in 50%, 20%, 10%, 10% and 10% of the time, respectively.

heading: 3.4 BERT Defender
text: The randomized transformation for corrupting adversarial contexts has the side effect of harming the victim model, as the corrupted input is still noisy.

heading: 3.4.1 Fine-Tuning
text: We utilize the MLM task with our synonym-based transformation instead of original masking to finetune2 the BERT defender on the training set Dtrain to achieve the goal of correcting abnormal contexts. Fine-tuning would enable the BERT defender to (1) identify both the [MASK] token and synonyms which belong to remnant adversarial contexts, and (2) correct the identified abnormal token to the original one. The hidden vector of the MLM head for the corrupted token is used to predict the original token wi with cross entropy function as follows:
Lmlm = EDtrain
[ − ∑
i∈C log(PED
( wi | x′) ) ] , (1)
where C and x′ denote corrupted tokens positions and the corrupted input, respectively. After optimization, our BERT defender is able to correct
2We refer to it as fine-tuning because it performs on downstream tasks rather than using a large corpus for pre-training.
both corrupted and remanent adversarial contexts, obtaining a denoised input. Thus, the victim model can suffer less from the noisy input.

heading: 3.4.2 Joint Training
text: The denoised input may not belong to the distribution learned by the victim model though our BERT defender after fine-tuning can recover most corrupted and adversarial contexts. Therefore, we propose to jointly train the BERT defender and the victim model to further improve the robustness.
For (x = [w1, · · · , wn], y) ∈ Dtrain, we follow the aforementioned word-level transformation to form the corrupted input x′. Then, BERT defender ED encodes it as the hidden vectors h = ED(x′), where h = [h1, h2, · · · , hn] denotes hidden representation for the tokens in the corrupted input. We sample a token wsi over the distribution softmax(hi) rather than directly obtaining a token by argmax(hi) to reconstruct the denoised input x̂, since introducing randomness is shown to be effective in mitigating adversarial attacks (Xie et al., 2018), and making it possible to offer abundant virtual samples for robust training. However, the sampling operation causes the non-differentiability problem (Nie et al., 2019) due to the discrete nature of texts which would prevent the gradients pass.
Gumbel-Softmax Relaxation To deal with the above issue, we adopt the Gumbel-Softmax relaxation (Jang et al., 2017; Maddison et al., 2017) to approximate wsi with a continuous form. Specifically, the Gumbel-Max trick (Maddison et al., 2017) and the softmax function are employed to sample discrete tokens and approximate discrete tokens, respectively. The Gumbel-Max trick samples the discrete token wsi as follows:
wsi = argmax 1≤k≤|V| (h (k) i + g (k) i ), (2)
where g(k)i = − log(− log(U (k) i )) is sampled from the standard Gumbel distribution, with U (k)i ∼ Uniform(0, 1), and |V| is the vocabulary size of the BERT defender. The continuous approximation w̃si of the discrete token w s i is given as follows:
w̃si = softmax(t(hi + gi)), (3)
where t is the temperature and set to 1. w̃si is differentiable with respect to hi.
The denoised input x̂ = [w̃s1, w̃ s 2, · · · , w̃sn] can be obtained by Eq. 3. Then, it is fed into the victim
Algorithm 1 The inference procedure of RMLM. Require: original input x; BERT defender ED; victim model
f ; transformation rate s; prior threshold τ ; adversarial attacker.
1: input xadv crafted by the adversarial attacker 2: x′ ← corrupt s of tokens in xadv by our transformation 3: Compute hidden vectors h = ED(x′) 4: Obtain x̂1 and x̂2 through Eq. 2 5: Compute the entropy Sx̂1 and Sx̂2 for f(x̂1) and f(x̂2) 6: if max(Sx̂1 , Sx̂2) < τ then 7: Filter adversarial examples by Det(x̂1, x̂2) in Eq. 5 8: if Sx̂1 < Sx̂2 then 9: logits(xadv)← f(x̂1)
10: else 11: logits(xadv)← f(x̂2) 12: return logits(xadv)
model f to get the probability P = f(x̂) with respect to all M labels. And y is set to a one-hot vector where the element of the label is 1. The joint training objective is as follows:
Ljoint = EDtrain
[ − M∑
m=1
y(m)log(P (m)) ] . (4)
After joint optimization, the victim model is expected to be more robust due to the proposed randomized word-level transformation and sampling operation could make the BERT defender provide rich virtual samples for robust training.

heading: 3.5 Detection
text: As depicted in Fig. 1, we insert a simple but empirically effective detection to filter out adversarial examples after obtaining the denoised input.
Due to adversarial attacks and randomized operations, the BERT defender may not be able to recover every corrupted input with high confidence to a definitely denoised sample x̂. As a result, the predictions from the victim model f can vary significantly, providing an opportunity to detect adversarial examples. Specifically, we sample twice from the output distribution of the BERT defender to form x̂1 and x̂2. Then, the “Normal” and “Adversarial” sample is distinguished by I = ✶[argmax(f(x̂1))=argmax(f(x̂2)], in details as:
Det(x̂1, x̂2) =
{ Adversarial, I = 0
Normal, I = 1 . (5)
However, we observe that this detection may miss-detect some original samples, particularly in datasets with data scarcity and short text length (e.g., SST-2 dataset (Socher et al., 2013)).
Prior Threshold We can set a threshold τ to more precisely control which inputs should be detected and which ones are skipped to reduce potential risk of miss-detection. We first apply the detection method in Eq. 5 to the training set and gather the miss-detected samples D∗train. It is intuitive to set the average entropy of predictions as the threshold τ , calculated as follows:
τ = 1 |D∗train| ∑
x∈D∗train
− M∑
m=1
P (m)log(P (m)), (6)
where P predicted by the victim model is the probability of the denoised input x̂ with respect to M labels. During inference, for predictions with high confidence (entropy lower than τ ), we still use the detection in Eq. 5. For others lying in the decision boundary (entropy higher than τ ), we skip the detection to avoid potential miss-detections.
The whole procedure of the inference stage of RMLM is summarized in Algorithm 1.

heading: 4 Experiments

heading: 4.1 Experimental Setup
text: Datasets Experiments are conducted on three benchmark classification datasets from phase-level to document-level tasks, including IMDB (Maas et al., 2011), AG’s News (Zhang et al., 2015), and SST-2 (Socher et al., 2013). The dataset statistics are listed in Table 1. IMDB is a documentlevel sentiment classification dataset about movie reviews. The essay-level AG’s News dataset is for multi-class news classification. SST-2 is a phraselevel sentiment analysis dataset. We set a longer truncated length (Maxlen) than previous works to provide more search and attack space for attackers.
Victim Models Three different types of DNNs are adopted as victim models, including longshort term memory (LSTM) (Hochreiter and Schmidhuber, 1997), word-based convolutional neural network (WordCNN) (Kim, 2014), and BERTBASE (Devlin et al., 2019). LSTM consists of 2 layers of 300-dimensional memory cells. WordCNN uses three window sizes (i.e., 3, 4, and 5), and
each channel size is 100. Both LSTM and WordCNN use the 300-dimensional pre-trained GloVe embeddings (Pennington et al., 2014). BERTBASE contains 12 layers of 768-dimensional transformer blocks and one linear layer for classification.
Attack Methods Three strong word-level adversarial attack methods are employed as attackers. Ren et al. (2019) propose PWWS which considers the word saliency to determine the word replacement order for greedy attack. Jin et al. (2020) first identify the important words and then replace them with the semantically similar and grammatically correct words, named TextFooler. Li et al. (2020) propose BERT-Attack which uses BERT to find and substitute the vulnerable words in a semanticpreserving way.
Defense Methods Six defense baselines across empirical defense and certified robustness are compared. Following Si et al. (2021), adversarial training (AT) is implemented by augmenting generated adversarial data into the training set. SEM (Wang et al., 2021) deploys synonym encoding to map each cluster of synonyms to a unique encoding for defense. AMDA (Si et al., 2021) linearly interpolates the representations of inputs to form virtual samples for enhanced AT. Freelb++ (Li et al., 2021) extends the search region to a larger ℓ2-norm of Freelb (Zhu et al., 2020). Flooding-X (Liu et al., 2022) improves Flooding (Ishida et al., 2020) to boost model generalization by preventing further reduction of the training loss. Similar to our method, RanMASK (Zeng et al., 2021b) defends against attacks during inference but it aims at the ensemble prediction to achieve certified robustness by masking the input text hundreds of times.
Evaluation Metrics Five metrics are used to measure the performance. ↑ and ↓ represent higher or lower is better, respectively. (1) Clean accuracy (CA% ↑) is the classification accuracy of the model on clean data. (2) Post-attack accuracy (PAA% ↑) is the accuracy under adversarial attacks. (3) Attack success rate (ASR% ↓) is the percent of adversarial examples among all test samples that can successfully fool the victim model. (4) Query count (QC ↑) is the number of queries the attacker needs to search and craft one successful adversarial example. (5) Modification rate (MR% ↑) is the percent of words that are perturbed by the attacker.
Implementation Following Wang et al. (2021); Li et al. (2021); Alzantot et al. (2018); Zeng et al. (2021b), we uniformly sample 1,000 examples from the distribution of the entire test set for the evaluation. The evaluation is conducted with the help of OpenAttack (Zeng et al., 2021a). To make the evaluation more challenging, we allow attackers without limitations on QC and MR to generate different adversarial examples to target different methods dynamically. Hyperparameter and implementation details are listed in Appendix A.

heading: 4.2 Main Results
text: Table 2, 3, and 4 show experimental results of BERT, LSTM and WordCNN, respectively. We have the following observations: (1) In such challenging settings, DNNs are so fragile that their PAA drops sharply. SEM proposed for static evaluation is powerless to defend against attacks. (2) Our framework RMLM is universally effective for models with different architectures. Compared to the state-of-the-art method Flooding-X across all victim models and datasets, RMLM yields average absolute gains 15.9, 18.2, 199, and 12.2 for PAA, ASR, QC, and MR, respectively. For CA, RMLM is only 1.2 lower. The substantial increase in QC
and MR indicates the success of mitigating attacks by confusing attackers and correcting adversarial contexts, respectively. Fig. 2 also shows that attacking RMLM is more costly since attackers often have to perturb more words for success. (3) Compared to RanMASK, our method performs average 22.4%, 15.5%, 12.3%, and 57.8% relative better on PAA, ASR, QC, and MR. Additionally, our method has an advantage over RanMASK in terms of computation resources, where is shown in Fig. 5.

heading: 4.3 Adaptive Attack
text: We attempt to break our framework by devising an adaptive attack (Athalye et al., 2018). The adaptive attack is constructed after the defense method has been completely designed (Athalye et al., 2018; Tramèr et al., 2020), where the attacker can take advantage of the architecture of our framework RMLM. Based on the fact that the BERT defender would take a sampling operation to recover abnormal tokens before feeding into the victim model, we can insert several trigger tokens to attack the BERT defender. Specifically, PWWS algorithm (Ren et al., 2019) is enhanced with trigger insertions. We insert triggers (e.g., [MASK], [SEP], [unused]) to search the textual space to find vulnerable positions. These trig-
gers are likely to be recovered by the BERT defender to other meaningful tokens that may change the contexts, leading to a malicious attack to the follow-up victim model.
Table 5 reports the results of RMLM against adaptive attack (“+Adaptive”) on three datasets. We find that this adaptive attack is more effective than PWWS in breaking RMLM, resulting in a sharp drop in PAA for three different types of victim models. However, we also notice that QC and MR significantly increase due to a mass of queries and perturbations. Although this adaptive attack is not a complete success, we believe that it still exposes potential vulnerabilities of RMLM.

heading: 5 Analysis and Discussion
text: In this section, we dig into the following questions: (1) What is the effectiveness of each component in mitigating attacks? §5.1. (2) How effective is our detection method in filtering adversarial examples? §5.2. (3) What is the impact of hyperparameters? §5.3. (4) How to handle additional computation burden problem in realistic scenarios? §5.4.

heading: 5.1 Analysis about Mitigating
text: The top block of Table 6 shows the results of the victim model directly equipped with our transformation and BERT defender which are the key components for mitigating attacks. We find that, (1) enabling the transformation during inference significantly boosts average PAA by 16.5. Attackers often have to double QC and MR, which is strong evidence that our word-level transformation can effectively confuse attackers. (2) It also shows improvement in defense when we directly insert the BERT defender before the input layer of the victim (w/ Defender), confirming it can correct adversarial contexts to mitigate attacks. (3) The performance
except defending against TextFooler stops growing when two components are applied together, suggesting that the joint training is necessary.
In the bottom block of Table 6, we validate the fine-tuning of the BERT defender and compare our transformation with masking. (1) Compared to RMLM w/o Fine-tuning, we find that fine-tuning on downstream tasks can improve the performance of the BERT defender. (2) The re-trained RMLM w/ MLM Masking achieves inferior defense performance than RMLM, indicating that corruption integrated with our synonyms substitution can better defend against attacks than simply masking.

heading: 5.2 Effect of Detection
text: As shown in Table 2, we first disable the prior threshold (w/o Threshold), this variant increases the risk of miss-detecting original samples though it can offer more defense, indicating that the threshold is a double-edged sword. Next, we totally disable the detection (w/o Detection), causing a 20.5% average drop in PAA. It confirms that this simple detection is effective in filtering adversarial inputs.
We quantitatively measure the detection error rate of original samples by comparing the CA metric among these detection variants. The error rates on IMDB, AG’s News and SST-2 datasets for detection (1) w/o Threshold are 2.0%, 1.5%, 6.7%, and (2) w/ Threshold are 0.1%, 0.05%, 0.3%. It is clearly that setting a threshold can reduce the risk of miss-detecting original samples particularly in datasets with data scarcity and short text length.
We conduct a further study on SST-2, as shown in Table 7. Our detection can identify the majority of original samples and a hand of adversarial ones. The prediction is still satisfying3. After disabling the threshold, the average accuracy of identifying original ones drops by 11.4 and the variation also increases. We conjecture that the lack of training
3Miss-detected adversarial samples may be finally predicted correctly. The same is true for correct detection of the original ones, which cannot guarantee predictions are correct.
data makes both the BERT defender and victim models poorly trained. Coupled with the short input length, predictions for original samples can also vary significantly, increasing the risk of missdetection. Some suggestions are offered in §6.

heading: 5.3 Hyperparameter Analysis
text: Fig. 3 shows the impact of hyperparameters including the transformation rate s, max synonyms number k and prior threshold τ .
Transformation Rate The PAA increases when s > 0, showing that our transformation can help mitigate attacks. The CA keeps relatively stable for IMDB and AG’s News when s < 0.5, while for SST-2 when s < 0.15. Both CA and PAA decrease sharply if s is too large, since corrupting too much makes the BERT defender powerless to recover.
Max Synonym Number A moderate k can help the BERT defender identify more synonyms substituted by the attacker, while have little effect on the performance in the inference stage. However, the benefits of increasing k are limited and storing more synonyms would consume more resources.
Prior Threshold Setting τ to 0.0 or 1.0 indicates disabling detection or prior threshold, respectively. A proper τ can help RMLM balance CA and PAA. For the SST-2 dataset, a higher τ greatly increases the risk in miss-detecting original samples. Calculating this threshold using Eq. 6 is usually a good choice and can save a lot of tuning costs.

heading: 5.4 Flexibility in Realistic Scenarios
text: First, we would like to introduce a variant that has no additional overhead during inference.
A Computation-Friendly Variant The victim model after being jointly trained can be directly deployed for defense thanks to large training samples provided by our BERT defender. As shown in Table 8, this variant beats AMDA the best AT method on IMDB under 2 out of 3 attackers. Another realistic advantage is that it does not require augmenting adversarial examples. Further, it can achieve performance on par with Flooding-X when enabling the transformation, while only incurring a slight increase in computational overhead.
Through analysis, we argue that our framework RMLM is well-suited to realistic scenarios because it is a flexible framework that can easily reduce the computational overhead or improve defense performance by switching among variants, which is costless since they share the same trained model weights. Fig. 4 compares various variants of RMLM in terms of CA, PAA, and computational Resource. We have several practical suggestions: (1) For already deployed models, they can benefit from mitigating attacks by using our transformation (Victim w/ Transformation §5.1). (2) For most services, the best option is to deploy Victim w/ Joint Training introduced in §5.4. The computational resource keeps the same with the original
model but owns dozens of times better defense performance. (3) When adversarial inputs dominate services, depending on the training data, RMLM or RMLM w/o Threshold (§5.2) can be selected to offer more defense performance though there is no free lunch in computational overhead.

heading: 6 Conclusion
text: In this paper, we propose a framework RMLM for defending against word-level adversarial attacks during inference by confusing attackers and correcting adversarial contexts in both the word and representation levels. We also introduce a simple detection method to effectively filter out adversarial examples. Besides, we show that the robustness of victim models can be greatly improved by joint training with our BERT defender. Extensive experiments in a challenging evaluation setting demonstrate that RMLM owns superior defense performance across a range of models, attackers, and datasets. The analysis shows that RMLM’s flexibility allows it to balance defense performance and computation resources for handling realistic scenarios. We believe that our findings will facilitate future research on the security of NLP.
Limitations
In this section, we discuss limitations of RMLM with integrity and attempt to provide valuable directions to further improve our method. There are some potential limitations as follows:
1) RMLM does not perform well on the SST-2 dataset, indicating it may not be applicable to phrase-level datasets with data scarcity. And in some extreme cases of short text, RMLM may often give incorrect predictions. We recommend doing more MLM pre-training using our wordlevel transformation if resources are available.
2) The mitigation is mainly contributed by the transformation and the BERT defender. However, there is a lack of exploration of different types of them in this paper. It is worth exploring different transformation schemes (e.g., span masking) and a lightweight model (e.g., ALBERT (Lan et al., 2020)) as a defender to reduce the computation overhead.
3) The adopted evaluation is for testing the performance of defense against word-level adversarial attacks. RMLM may expose flaws in mitigating character-level or sentence-level attacks. The applicability of the proposed approach needs more investigation.

heading: Acknowledgments
text: We thank the anonymous reviewers for their valuable comments. This work is supported by the National Natural Science Foundation of China (62072483, 62276280), and the Guangdong Basic and Applied Basic Research Foundation (2022A1515011690, 2021A1515012298).

heading: B Computational Overhead
text: We measure the computational overhead by testing the forward time of the model with one Nvidia RTX 3090 card. The inference time is averaged over the entire training set of IMDB. The metric Resource in Fig. 4 is calculated by averaging the inverse of model’s forward propagation time across 4 different batch sizes.
As shown in Fig. 5, the additional computation of enabling our transformation is acceptable, considering that the defense performance can improve dozens of times. In details, the average additional overhead is about 12%. For RMLM or RMLM w/o Threshold, the costs are high but they can bring more defense performance. Note that the efficiency of RMLM is significantly better than RanMASK (Zeng et al., 2021b) which relies on costly hundreds of ensemble predictions.
ACL 2023 Responsible NLP Checklist

heading: A For every submission:

heading: 3 A1. Did you describe the limitations of your work?
text: Sec. Limitations.
A2. Did you discuss any potential risks of your work? Not applicable. Left blank.

heading: 3 A3. Do the abstract and introduction summarize the paper’s main claims?
text: Sec. Abstract and Sec. 1.
7 A4. Have you used AI writing assistants when working on this paper? Left blank.
B 3 Did you use or create scientific artifacts? Sec. 4 Experiments.

heading: 3 B1. Did you cite the creators of artifacts you used?
text: Sec. 4 Experiments and Appendix A.
7 B2. Did you discuss the license or terms for use and / or distribution of any artifacts? The datasets we used are popular publicly available. The codes we implement the baselines can be found at GitHub. And they often do not have a license but with a citation. We cite their paper and put corresponding URLs in the footnote.

heading: 3 B3. Did you discuss if your use of existing artifact(s) was consistent with their intended use, provided
text: that it was specified? For the artifacts you create, do you specify intended use and whether that is compatible with the original access conditions (in particular, derivatives of data accessed for research purposes should not be used outside of research contexts)? Appendix A.
B4. Did you discuss the steps taken to check whether the data that was collected / used contains any information that names or uniquely identifies individual people or offensive content, and the steps taken to protect / anonymize it? Not applicable. Left blank.
B5. Did you provide documentation of the artifacts, e.g., coverage of domains, languages, and linguistic phenomena, demographic groups represented, etc.? Not applicable. Left blank.
3 B6. Did you report relevant statistics like the number of examples, details of train / test / dev splits, etc. for the data that you used / created? Even for commonly-used benchmark datasets, include the number of examples in train / validation / test splits, as these provide necessary context for a reader to understand experimental results. For example, small differences in accuracy on large test sets may be significant, while on small test sets they may not be. Sec. 4 Experiments.
C 3 Did you run computational experiments? Section 5.4 and Appendix B.

heading: 3 C1. Did you report the number of parameters in the models used, the total computational budget
text: (e.g., GPU hours), and computing infrastructure used? Appendix B.
The Responsible NLP Checklist used at ACL 2023 is adopted from NAACL 2022, with the addition of a question on AI writing assistance.

heading: 3 C2. Did you discuss the experimental setup, including hyperparameter search and best-found
text: hyperparameter values? Appendix A.

heading: 3 C3. Did you report descriptive statistics about your results (e.g., error bars around results, summary
text: statistics from sets of experiments), and is it transparent whether you are reporting the max, mean, etc. or just a single run? Sec. 4 Experiments.

heading: 3 C4. If you used existing packages (e.g., for preprocessing, for normalization, or for evaluation), did
text: you report the implementation, model, and parameter settings used (e.g., NLTK, Spacy, ROUGE, etc.)? Appendix A.
D 7 Did you use human annotators (e.g., crowdworkers) or research with human participants? Left blank.
D1. Did you report the full text of instructions given to participants, including e.g., screenshots, disclaimers of any risks to participants or annotators, etc.? No response.
D2. Did you report information about how you recruited (e.g., crowdsourcing platform, students) and paid participants, and discuss if such payment is adequate given the participants’ demographic (e.g., country of residence)? No response.
D3. Did you discuss whether and how consent was obtained from people whose data you’re using/curating? For example, if you collected data via crowdsourcing, did your instructions to crowdworkers explain how the data would be used? No response.
D4. Was the data collection protocol approved (or determined exempt) by an ethics review board? No response.
D5. Did you report the basic demographic and geographic characteristics of the annotator population that is the source of the data? No response.

heading: Future Work
text: We believe that our findings will facilitate future research on the security of NLP. Limitations
In this section, we discuss limitations of RMLM with integrity and attempt to provide valuable directions to further improve our method. There are some potential limitations as follows:
1) RMLM does not perform well on the SST-2 dataset, indicating it may not be applicable to phrase-level datasets with data scarcity. And in some extreme cases of short text, RMLM may often give incorrect predictions. We recommend doing more MLM pre-training using our wordlevel transformation if resources are available. 2) The mitigation is mainly contributed by the transformation and the BERT defender. However, there is a lack of exploration of different types of them in this paper. It is worth exploring different transformation schemes (e. g. , span masking) and a lightweight model (e. g. , ALBERT (Lan et al. , 2020)) as a defender to reduce the computation overhead. 3) The adopted evaluation is for testing the performance of defense against word-level adversarial attacks. RMLM may expose flaws in mitigating character-level or sentence-level attacks. The applicability of the proposed approach needs more investigation