Don’t Retrain, Just Rewrite: Countering Adversarial Perturbations by Rewriting Text
Year: 2023

Abstract:
Can language models transform inputs to protect text classifiers against adversarial attacks? In this work, we present ATINTER, a model that intercepts and learns to rewrite adversarial inputs to make them non-adversarial for a downstream text classifier. Our experiments on four datasets and five attack mechanisms reveal that ATINTER is effective at providing better adversarial robustness than existing defense approaches, without compromising task accuracy. For example, on sentiment classification using the SST-2 dataset, our method improves the adversarial accuracy over the best existing defense approach by more than 4% with a smaller decrease in task accuracy (0.5 % vs. 2.5%). Moreover, we show that ATINTER generalizes across multiple downstream tasks and classifiers without having to explicitly retrain it for those settings. For example, we find that when ATINTER is trained to remove adversarial perturbations for the sentiment classification task on the SST-2 dataset, it even transfers to a semantically different task of news classification (on AGNews) and improves the adversarial robustness by more than 10%.

heading: 1 Introduction
text: Neural models in NLP have been shown to be vulnerable to adversarial attacks both during training time (Gu et al., 2017; Wallace et al., 2019, 2021; Chen et al., 2021) and at deployment (Ebrahimi et al., 2018; Jin et al., 2020; Garg and Ramakrishnan, 2020a). The attacks of the latter type aim to craft adversarial inputs by introducing small, imperceptible perturbations in the input text that erroneously change the output label of a classification model. Defending against such attacks is important because it ensures the integrity and reliability of NLP systems. If undefended, for example, an attacker could adversarially manipulate a spam email to evade a spam detector.
∗Work done during internship at Bloomberg
An ideal defense mechanism against such adversarial attacks should maintain good task performance on non-adversarial inputs, effectively mitigate adversarial attacks, and be transferable to other models and datasets. The transferability of defenses is a valuable property because it allows easy application to new and unknown models without retraining the underlying classification model. This is particularly useful when complete access to the model is not possible; for example when the model is accessed through an API. Most existing methods do not satisfy these desiderata, typically lacking in one or more desired properties. For example, the methods that use input randomization like SAFER (Ye et al., 2020) and Sample Shielding (Rusert and Srinivasan, 2022) significantly degrade task accuracies due to the smoothing and aggregation involved, and are thus ineffective defenses. Another set of methods— e.g., adversarial training (Jia and Liang, 2017; Ebrahimi et al., 2018) and SHIELD (Le et al., 2022)—require model retraining; while serving as effective defenses, they cannot be transferred to other models and datasets without retraining the classifier.
In this work, we present a novel strategy for defending against adversarial attacks that satisfies the aforementioned desiderata. Our method—Adversarial Text Interceptor and Rewriter ( ATINTER)—is based on the intuition that automatically generated adversarial inputs can be undone by learning to manipulate the textual inputs instead of retraining the classification model. Specifically, we employ an encoder-decoder module that intercepts and rewrites the adversarial input to remove any adversarial perturbations before feeding it to the classifier1. Our method differs from existing input randomization approaches in that it does not rely on random word replacements
1By intercepting, we simply mean that ATINTER stops the input from directly going to the classifier and processes it first to remove the adversarial perturbations.
13981
or deletions to counteract adversarial changes. Instead, we employ a separate model that is explicitly trained to remove adversarial perturbations. One benefit of this strategy is that it dissociates the responsibility of ensuring adversarial robustness from the classification model and delegates it to an external module, the text rewriter. Consequently, the rewriter module serves as a pluggable component, enabling it to defend models that it was not explicitly trained to protect. Figure 1 demonstrates this scenario.
We demonstrate the effectiveness of our approach using a T5 model (Raffel et al., 2020) as the general-purpose text rewriter, but our method is applicable to any transformer-based text generator/rewriter. Through extensive experimentation and comparison with existing methods, we show that ATINTER effectively removes adversarial perturbations, and consistently outperforms other defense approaches on several datasets for text classification. When used as a pluggable component, ATINTER exhibits good transferability to new models and datasets without the need for retraining (examples shown in fig. 1). Specifically, we find that this T5-based rewriter trained to remove adversarial perturbations for the sentiment classification task on the SST-2 dataset, also removes adversarial perturbations for a news classification model (on AGNews), increasing adversarial robustness by over 10%.
In summary, our contributions are:
1. We propose a novel defense mechanism
against adversarial attacks, called ATINTER that uses a text rewriter module, along with a simple strategy to train this module2.
2. We demonstrate its effectiveness on four benchmark datasets and five adversarial attacks. Compared with competitive baselines, our method substantially improves the adversarial robustness with a much smaller decrease in accuracy on non-adversarial inputs.
3. We show that ATINTER can be used as a pluggable module without retraining and that its ability to defend models is transferable to new models (e.g., BERT → RoBERTa) as well as new datasets (BERT on SST-2 → BERT on AGNews).

heading: 2 Related Work
text: Adversarial Attacks Most adversarial attacks use heuristic-based search methods to substitute vulnerable parts of the input with carefully chosen adversarial text (Ebrahimi et al., 2018; Jin et al., 2020; Jia and Liang, 2017). These substitutions can be performed at the character-level (Gao et al., 2018; Belinkov and Bisk, 2018), word-level (Ren et al., 2019; Jin et al., 2020; Garg and Ramakrishnan, 2020b; Li et al., 2020; Zhang et al., 2021), or both (Li et al., 2018). Finally, while adversarial attacks show that NLP models are over-sensitive to small perturbations, NLP models have also been
2Code will be available at https://github.com/ bloomberg
shown to be under-sensitive to certain perturbations like input reduction, etc. (Feng et al., 2018; Gupta et al., 2021). We refer the reader to the detailed recent survey of Wang et al. (2022b).
Defenses against Adversarial Attacks The typical strategies employed for defending text classification systems against adversarial attacks involve either retraining the classifiers using adversarial examples or incorporating randomized smoothing at the input stage to make robust predictions. The defenses of the former type involve adversarial training (Goodfellow et al., 2015; Alzantot et al., 2018), certified training (Jia et al., 2019; Zhou et al., 2021; Huang et al., 2019), and other specialized training schemes (Le et al., 2022; Jiang et al., 2022). While adversarial training lacks in effectiveness (Alzantot et al., 2018), the certification based methods are only applicable for a specific set of perturbations; e.g., Jia et al. (2019) restrict word substitutions to belong to a counter-fitted embedding space (Mrkšić et al., 2016). More recently, Le et al. (2022) proposed SHIELD, that trains a stochastic ensemble of experts by only patching the last layer of the BERT classifier. We use SHIELD, and adversarial training for comparison with our proposed method.
On the other end of the spectrum are the models that do not retrain the classifier and instead use randomized smoothing techniques to enhance the robustness of the models (Cohen et al., 2019; Zhou et al., 2019; Ye et al., 2020; Rusert and Srinivasan, 2022; Wang et al., 2022a). Ye et al. (2020) introduced a defense called SAFER, that significantly improves certified robustness by performing randomized substitutions using a synonym network. Rusert and Srinivasan (2022) proposed another randomization defense called Sample Shielding, which relies on making an ensemble of predictions on different random samples of the input text. One major drawback of utilizing randomizationbased techniques is that they may result in a significant decrease in task accuracies on non-adversarial inputs. To overcome this limitation, Bao et al. (2021) proposed ADFAR, which trains an anomaly detector for identifying adversarial examples and performs frequency-aware randomization only for the adversarial inputs. The authors observe that this scheme preserves adversarial robustness without sacrificing the task performance. We adopt ADFAR, Sample Shielding, and SAFER as the other set of baselines for our work.

heading: 3 Learning to Remove Adversarial Perturbations
text: As mentioned in section 2, most existing methods that operate on the textual input rely on randomization to remove any adversarial perturbations. We present a model that learns to remove these perturbations by rewriting the text. Although similar to paraphrasing in terms of the task interface, our goal is different; we focus on removing the perturbation instead of just preserving the meaning. The rest of this section formalizes this intuition.

heading: 3.1 Notation
text: Given a sequence of tokens x, suppose we have a trained classifier with parameters θ, which maps x to the output label y from the label space Y as
y = argmax yi∈Y
Pθ(yi|x)
When the classifier makes a correct prediction, y = y∗, the true label for that input. For a successful adversarial attack, the adversary takes the input sequence x and produces a perturbed variant x̂ by making a small change to x such that the prediction made by the model is incorrect:
argmax yi∈Y
Pθ(yi|x̂) ̸= y∗
Additionally, the adversary ensures that the perturbation is meaningful and imperceptible.3
Typically, this perturbation is achieved via an iterative process, during which the adversary
3Most attacks ensure this by enforcing constraints on the part-of-speech tags of the replaced words as well as maintaining the fluency through an LM perplexity score.
makes incrementally small modifications to the input (Ebrahimi et al., 2018; Jin et al., 2020). Assume that the adversary makes k successive changes to the input taking the original input x to the final adversarial variant x̂k, represented as follows
x → x̂1 → x̂2 → ... → x̂k
To construct an adversarial input, the adversary selects perturbations such that the probability of the true label decreases after each successive modification until the required incorrect prediction is achieved. In other words, the adversary wants
Pθ(y ∗|x) > Pθ(y∗|x̂1) > · · · > Pθ(y∗|x̂k) (1)
In summary, given an input sequence x, an adversary keeps introducing small changes (x → x̂1, etc.), each of which reduces the predicted probability of the correct label y∗. Figure 2 shows a visual representation of the adversarial process, which moves the example marked x to the wrong side of the decision boundary by following the red arrows.

heading: 3.2 Training the Text Rewriter
text: As we saw in section 2, the most common strategy to counter such adversarial attacks is to retrain the model with new parameters θnew such that
argmax yi∈Y
Pθnew(yi|x̂k) = y∗
In this work, our objective is to keep the model parameters θ unchanged and instead manipulate the input x by rewriting it. To this end, we define ATINTER that intercepts and rewrites potentially adversarial inputs. ATINTER is a text-to-text transducer, which we will denote by Tϕ with its own trainable parameters ϕ.
To effectively counteract adversarial inputs, the transformation function Tϕ, must transform the input x such that the task classifier makes the correct prediction on the transformed text:
argmax yi∈Y
Pθ(yi|Tϕ(x̂k)) = y∗
We can guarantee this outcome by simply training Tϕ to ensure that Tϕ(x̂k) = x. In other words, our goal is to learn a transformation function, Tϕ, that is capable of undoing or reversing the impact of adversarial modifications. However, merely training the rewriter to reverse the final step x̂k may not be sufficient because x̂k is produced through a series of small changes. Therefore, in addition to
undoing x̂k, the rewriter should also be able to reverse each intermediate step. This strategy is based on the intuition that each successive change made to the input x in constructing an adversarial input x̂k is in itself adversarial; all intermediate changes decrease the probability of the true label and are thus undesirable (eq. (1)). Green curved arrows in fig. 2 show the task of the rewriter. Figure 3 in the appendix shows an example of this process.
In summary, any adversarial modification made to the input at any stage should be reversed by ATINTER , i.e.,
Tϕ(x̂i) = x,∀i ∈ {1, k} (2)
Finally, on non-adversarial inputs, we do not need to make any changes, and the function Tϕ should therefore act as an identity function on these inputs:
Tϕ(x) = x (3)
Training Details We use the T5 model (Raffel et al., 2020) as the starting point for our text rewriter ATINTER. Since we need adversarial examples to train our rewriter, we follow Bao et al. (2021) and choose TextFooler (Jin et al., 2020) for generating these examples on the whole training set. The training data for ATINTER consists of input-output pairs of the form (x̂i,x): as described in eq. (2), for every adversarial modification x̂i, including the ones with intermediate changes, and the original, unperturbed sequence x is the desired output. In addition, as per eq. (3), the training data also includes unperturbed examples of the form (x, x). Figure 4 shows an illustrative example.
We train the base variant of the T5 model for 5 epochs with the starting learning rate of 5× 10−5. More details on the hyperparameters are provided in the appendix appendix A.2. We use the Transformers (Wolf et al., 2020) for our implementation.

heading: 4 Experimental Setup
text: In this section, we will detail the datasets we use for our experiments, the baseline defense mechanisms, and the adversarial attacks they will be pitted against, and the three metrics we will use to compare the defense methods.

heading: 4.1 Datasets
text: We evaluate our proposed defense on four text classification datasets. Stanford Sentiment Treebank (SST-2) The SST-2 dataset is used for sentiment classification (Socher
et al., 2013) among two labels: positive, and negative. We use the splits from the GLUE benchmark (Wang et al., 2019); we use the validation set for reporting our results since the test set is not available publicly. Rotten Tomatoes Movie Reviews (MR, Pang and Lee, 2005) Similar to SST-2 task, the goal is to predict a movie review’s sentiment (positive vs. negative). We use the official test set for evaluation. AG News (Zhang et al., 2015) This is a news classification dataset with four possible labels (sports, world, science/technology, business). The test set contains 7600 examples and since it can take a long time for robustness evaluation across all seven models and the five attackers, we randomly choose 1000 examples for our evaluation set. Multi-Genre Natural Language Inference (MNLI, Williams et al., 2018) This is a standard dataset for Natural Language Inference (NLI) where the goal is to determine the inferential relation between a premise and a hypothesis. The dataset requires sentence-pair classification among three labels (entailment, neutral, and contradiction). Again, we sample 1000 instances from the validation-matched subset for evaluation.

heading: 4.2 Baselines and Adversarial attacks
text: Baselines We compare our model with a number of baselines: Adversarial Training (AT, Alzantot et al., 2018), SHIELD (Le et al., 2022), SAFER (Ye et al., 2020), SampleShielder (Rusert and Srinivasan, 2022), and ADFAR (Bao et al., 2021). SAFER and SampleShielder are input randomization methods, while AT, and SHIELD require model retraining. ADFAR requires retraining the model and also uses input randomization. We could not compare the results with DISP (Zhou et al., 2019) as we were not able to run their implemen-
tation. We have provided more details in the appendix appendix A.
Adversarial Attacks We use the open source toolkit TextAttack (Morris et al., 2020a,b) to evaluate all models on five black-box adversarial attacks. TextFooler (Jin et al., 2020), PWWS (Ren et al., 2019), and BAE (Garg and Ramakrishnan, 2020b) attack at the word-level, DeepWordBug (DWB, Gao et al., 2018) attacks at the character-level, and TextBugger (Li et al., 2018) attacks at both word and character-level. TextFooler and PWWS use counter-fitted word embeddings (Mrkšić et al., 2016), while BAE uses the BERT as a masked language model (Devlin et al., 2019) to find the best word replacements. We provide an example of each of them in table 6 in the appendix. We perform our main experiments with a BERTbase classifier as the victim model with hyperparameters as suggested by Devlin et al. (2019).

heading: 4.3 Evaluation
text: Evaluation Metrics We measure the quality of the defense methods using three metrics, namely Clean Accuracy (Clean Acc.), Adversarial Accuracy (AA), and Average number of queries (#Q). Clean Accuracy is the accuracy of the model on clean non-adversarial inputs, measured on the original validation or test sets. A model that retains the clean accuracy of the original model is desirable. Adversarial Accuracy (AA) The Attack Success Rate (ASR) of an attack is the percentage of instances where the attack algorithm successfully constructs an adversarial example. A defense method that makes a model more robust results in a lower ASR. We report the Adversarial Accuracy of the defense methods, defined as 100− ASR. Average Number of Queries (#Q) is the measure of the cost for an attacker, and is the average number of forward passes (queries) to the model by the attacker. On average, a more robust defense method requires more queries.
Evaluation Protocol The adversarial accuracy depends on the number of queries an attacker is allowed to perform - a lower query budget entails a higher AA. There is currently no established protocol for evaluating the adversarial robustness of text classification systems. In this study, we do not impose a restriction on the number of queries allowed to the attacker, resulting in the most challenging conditions for the defense methods.

heading: 5 Main Results
text: Table 2 shows the results for the defense methods on all four datasets. Additionally, table 9 in the appendix summarizes the results in terms of average improvements for the five adversarial attacks.
As observed from the table, our proposed method ATINTER provides a consistent and substantial improvement in terms of adversarial robustness over the baselines. We find that there is a trade-off between clean accuracy and adversarial robustness for all the models, aligning with the findings of Raghunathan et al. (2020). The results show that ATINTER maintains the highest level of clean accuracy on all datasets except MR, where SAFER improves it by more than 1%, but does so at the cost of making the model less robust.
The most formidable baseline is ADFAR, which employs an anomaly detector to identify adversarial inputs and uses input randomization for handling adversarial instances. Our method substantially outperforms ADFAR on all settings except one. Furthermore, we observe that SampleShielder performs well on AGNews but not on other datasets. This can be attributed to the fact that SampleShielder randomly removes parts of the input before making a prediction. This is effective for tasks with longer inputs and simpler semantics (such as topic classification on AGNews), but does not work for others where removing parts of the input can alter the label. Additionally, while SampleShielder provides the best adversarial accuracies on the MNLI dataset, the clean accuracy is almost close to random. Our proposed model ATINTER on the other hand, provides the best balance between adversarial and clean accuracies.

heading: 5.1 Results against other attack types
text: Several defense methods, including ours, utilize adversarial examples from one attack type to train their models. The true effectiveness of adversarial defenses is determined when they are tested against previously unseen adversarial attacks. Our evaluation using four other attacks, excluding TextFooler, accomplishes this. Each of these attacks differ from TextFooler in one or more aspects. For example, while TextFooler is a token-level attack, DeepWordBug (DWB) is a character-level attack. TextBugger, on the other hand, is a multi-level attack, capable of attacking at both token and character level. BAE replaces words uses a BERT MLM while TextFooler uses GloVe word embeddings. PWWS, in com-
parison, employs a different algorithm for token replacement.
From table 2, we observe that, as compared to the baselines, ATINTER provides significant improvements in robustness against other attacks. Notably, while ATINTER is only trained against synonym substitutions from TextFooler, it is able to generalize to other attacks that operate at the character level. Lastly, the improvement against BAE is less than that against other attacks. We hypothesize that this is due to the fact that BAE employs a BERT language model for word replacements, which is different from the technique used by TextFooler.

heading: 5.2 Transferability to other classifiers
text: As mentioned previously, one motivation for using a separate robustness module like ours is that it can be transferred to other text classification models without retraining the rewriter. We use ATINTER which was trained to remove adversarial perturbations for the BERT classifier on the SST-2 dataset and employ it, without retraining, to remove adversarial perturbations for other classifiers on the same dataset. We assess the transferability of ATINTER against three classifiers, namely: RoBERTa (Liu et al., 2019), DistilBERT (Sanh et al., 2019), and ALBERT (Lan et al., 2019).
The results for evaluation against TextFooler are presented in table 3. We observe that ATINTER is effective in enhancing adversarial robustness for models other than BERT. Importantly, this improvement is achieved without much drop in performance on the clean examples (< 1% in all cases). On average, ATINTER improves adversarial accuracy by 16.6% across the three models. Surprisingly, the improvement for the RoBERTa model is even more pronounced than that for the BERT model. We hypothesize that this transferability from ATINTER is due to two factors. First, adversarial attacks often result in similar adversarial changes, particularly for the same dataset. Second, previous research has demonstrated that adversarial examples transfer across classifiers for the same task (Papernot et al., 2016; Liu et al., 2017).

heading: 5.3 Transferability to other tasks and datasets
text: As explained in the previous section, ATINTER allows for its application to tasks and datasets for which it was not trained. We now assess the transferability of our method with respect to other tasks and datasets. We use the ATINTER trained
for sentiment classification on SST-2 using BERT and apply for the BERT model trained on other datasets. We perform this evaluation on three datasets, namely MR, AGNews, and MNLI.
We present the results in the table 4. We find that our model ATINTER exhibits strong transferablity for other datasets. Again, as with previous results, we see only small drops in performance on non-adversarial inputs. The favorable results on the MR dataset shows that ATINTER effectively transfers for a different dataset of the same task. Note that the improvement in adversarial accuracy for MR is even higher than a model that is specifically trained for removing adversarial perturbations for the MR dataset (see table 2). This is explained by the fact that the MR dataset is much smaller and thus the ATINTER trained on that dataset has fewer adversarial instances to learn from (10k vs. 67k). We notice more than 12% increase in adversarial accuracy on the AGNews dataset. This is perhaps most surprising, since not only the task is semantically different with different set of classes, but the domain of the dataset is also different (movies vs. news). On the MNLI dataset though, we notice only small improvement, perhaps because it is a semantically harder task.
In summary, our proposed model ATINTER transfers across both models and datasets. This observation can motivate the training of a single rewriter module for all tasks and datasets. The benefits of such an approach are two-fold. First, since the defense capability transfers across models, a single shared model could be more robust than the individual ones. Second, having a single shared is more practical as it reduces the overhead in deployment of ATINTER. We leave the exploration of this shared rewriter approach to future work.

heading: 5.4 Effect of the model size
text: For all experiments in previous sections, we used the base variant of the T5 model for training ATINTER. We now investigate the effect of the size of the rewriter module on the adversarial robustness. For the SST-2 dataset, we train four variants of ATINTER with different sizes: t5-small, t5-base, t5-large, t5-3b. The results are shown in table 5. We observe that with increased size, the rewriter module defends the classification model more robustly.

heading: 5.5 Pre-training the Rewriter
text: One additional benefit of having a separate rewriter module is that we can pre-train the rewriter without using any task-specific datasets. We demonstrate this approach by artificially constructing a training corpus using the Wikipedia text. Specifically, we sample 100k sentences from the English Wikipedia and randomly substitute 15% of the words in each of those sentences with one of the neighbors from the GloVe embedding space (Pennington et al., 2014). The pre-training task for the rewriter is to simply reverse this perturbation by generating the original unperturbed sentence. Note that this setup is close to but does not perfectly simulate the actual adversarial attack scenario, as the perturbations used in the latter are chosen with greater precision. We observe that this pre-training improves the ATINTER by more than 2.5% in terms of adversarial accuracy without any significant decrease in clean accuracy. Due to space constraints, the results are shown in table 8 in the appendix .

heading: 5.6 Latency at Inference
text: One limitation of our proposed strategy is that it utilizes two neural models to make predictions, hurting the overall inference time. We measure latency for each of the models by averaging their inference time over 200 examples (100 clean + 100 adversarial). We observe that ATINTER is slower than model retraining approaches (22.0 ms for SHIELD vs. 95 ms for ATINTER), while being faster or competitive with input randomization methods. SAFER is the slowest of all since it performs averaging over a large number of candidate synonyms.
One possible approach to reduce inference time could be to use more efficient text generation models like non-autoregressive text generation (Gu et al., 2018). Moreover, a method based on text-
editing can also be promising (Malmi et al., 2022). We leave these explorations to the future work.

heading: 6 Conclusion
text: In this paper, we explore a novel strategy to defend against textual adversarial attacks that does not require model retraining. Our proposed model, ATINTER intercepts and rewrites adversarial inputs to make them non-adversarial for a downstream text classifier. We perform experiments on four text classification datasets and test its effectiveness against five adversarial attacks. The results suggest that, in comparison with baselines, our proposed approach is not only more effective against adversarial attacks but is also better at preserving the task accuracies. Moreover, when used as a pluggable module, ATINTER shows great transferability to new models and datasets—on three new datasets, it improves adversarial accuracy by 10.9% on average. We expect the future work to focus on improving inference time latency by using more sophisticated text generation methods.

heading: 7 Limitations
text: This work is subject to two limitations. First, our experiments were restricted to text classification tasks and we did not evaluate if our methods can effectively defend against adversarial attacks for other tasks like QA, etc. (Jia and Liang, 2017). It therefore remains unexplored if our conclusions transfer beyond the text classification tasks.
Second, the primary contribution of our work, ATINTER relies on using a language model like T5, which is trained on large amount of text in English. It is possible that our approach is not as effective for languages where such a model is not freely available. Additionally, in this work, we did not explore the impact of large language model pretraining on our results.

heading: 8 Ethical Considerations
text: This work is concerned with protecting or defending against adversarial attacks on text classification systems. For modeling, our method ATINTER uses another neural network based language model T5 (Raffel et al., 2020). This means the ATINTER can itself be attacked by an adversary. We believe that attacking a pipelined model such as ATINTER is not straightforward for the following two reasons. First, performing an adversarial attack on a model typically requires access to output scores from that
model. Since ATINTER is used in a pipeline with a task classifier, the attacker can never get access to ATINTER’s output scores. This adds an additional layer of complexity for the adversary. Second, targeted adversarial attacks on sequence-to-sequence models (such as ATINTER) are much less prominent and it is generally more difficult to make small alterations in the input without forcing a more significant change in the textual output (Cheng et al., 2020; Tan et al., 2020). Nevertheless, we have not explored this possibility and therefore recommend practitioners interested in using this work to carefully check for this.
Additionally, the experiments were only performed on four text classification datasets. Although we expect our method to be effective for other classification tasks like Toxicity detection, Hate Speech identification, but considering the sensitive nature of these applications, we urge the practitioners to first comprehensively evaluate our work on those tasks before deploying in a real world scenario.
For all our experiments, we used pre-established and published datasets, which do not pose any serious ethical concerns. For transparency and reproduciblity, we will make our code publicly available.

heading: Acknowledgements
text: The authors thank Bloomberg’s AI Engineering team, especially Umut Topkara and Anju Kambadur for helpful feedback and directions. We would also like to thank members of the Utah NLP group for their valuable insights, and the reviewers for their helpful feedback. This work was supported in part by the National Science Foundation under Grants #1801446, #1822877, #2007398 and #2217154. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of the National Science Foundation.

heading: A Appendix
text: A.1 Implementation Details SHIELD We find that SHIELD is very sensitive to the τ hyperparameter involved. There is a strong trade-off between the clean accuracy and adversarial robustness for the change in τ . For reporting the results, we try four values of
τ = [1.0, 0.1, 0.01, 0.001] and report the results for the model that retains the accuracy the most.
SAFER Since SAFER is an input randomization method, the default implementation provides different results for different runs, although we do not see any substantial change in numbers. For reporting clean accuracy, we average it with the numbers obtained with each of the five attacks. Additionally, since SAFER aggregates predictions by considering a large number of candidates for random synonym replacements for each word it decides to perturb, we found it is not practical to run with number of candidates equal to 100 (used in the original implementation). Therefore, we report the numbers with n = 30 in this paper.
ADFAR The official ADFAR implementation 4 only provides instructions to reproduce results for MR dataset (more specifically for tasks with single input classification and with only two possible labels). We, therefore, modify the codebase to make it work for AGNews –that has four classes, and MNLI, where the task is sentence-pair classification. We will release our modified codebase for ADFAR for the community to reproduce these results.
DISP We were not able to run the open-sourced implementation of DISP during our experiments 5. We experimented with several different versions of both PyTorch and the transformers libraries but were still unsuccessful. More details can be found at a github issue we created at: 6.
A.2 Hyperparameters for training ATINTER
We list here the hyperparameters we used for training our model.
1. Learning Rate: We found that the learning rate of 5e-5 works best. We performed the learning rate search over the set [1e-5, 5e-5, 1e-6, 5e-6]. Also, we find the best learning rate for the SST-2 dataset and use the same for other datasets.
2. Batch Size: For all our models, except t5-3b, we use the batch size of 16 during training. Wherever, the batch of 16 did not
4https://github.com/LilyNLP/ADFAR 5https://github.com/joey1993/
bert-defender 6https://github.com/joey1993/ bert-defender/issues/2
fit the GPU (for example on the 16GB V100), we use gradient accumulation to have the effective batch size of 16. We did not perform any hyperparameter search for batch size due to computational reasons.
3. Sequence Length: Since examples in the SST2 and MR datasets are smaller, we used the source and target side sequence lengths to both be 128. For AGNews, we use the sequence length of 512 and for MNLI, we use 256.
4. Number of epochs: For all our models (except that involve wiki pre-training), we used 5 epochs. For the pre-training setup, we used 10 epochs.
For training t5-3b, we needed to use DeepSpeed 7 for our experiments.
A.3 Reproducibility Details Dataset Splits We use the dataset splits from the Huggingface datasets repository. 8. For datasets where we use a subsample of the test set, we use the random seed 1 to first shuffle and then evaluate on first 1000 instances.
Hardware We run most of our experiments using the Nvidia V100 (32 GB) GPU. Some of the later experiments with T5-3b required even larger GPU RAM and therefore, I was able to use Tesla A100 (40 GB VRAM) for last few experiments. Additionally, the servers had CPU: AMD EPYC 7513 32-Core Processor with CPU RAM 512 GB.
7https://github.com/microsoft/ DeepSpeed
8https://huggingface.co/datasets
ACL 2023 Responsible NLP Checklist

heading: A For every submission:

heading: 3 A1. Did you describe the limitations of your work?
text: Section 7, Section 5.6

heading: 3 A2. Did you discuss any potential risks of your work?
text: Section 8

heading: 3 A3. Do the abstract and introduction summarize the paper’s main claims?
text: Section 1
7 A4. Have you used AI writing assistants when working on this paper? Left blank.
B 7 Did you use or create scientific artifacts? Left blank.
B1. Did you cite the creators of artifacts you used? No response.
B2. Did you discuss the license or terms for use and / or distribution of any artifacts? No response.
B3. Did you discuss if your use of existing artifact(s) was consistent with their intended use, provided that it was specified? For the artifacts you create, do you specify intended use and whether that is compatible with the original access conditions (in particular, derivatives of data accessed for research purposes should not be used outside of research contexts)? No response.
B4. Did you discuss the steps taken to check whether the data that was collected / used contains any information that names or uniquely identifies individual people or offensive content, and the steps taken to protect / anonymize it? No response.
B5. Did you provide documentation of the artifacts, e.g., coverage of domains, languages, and linguistic phenomena, demographic groups represented, etc.? No response.
B6. Did you report relevant statistics like the number of examples, details of train / test / dev splits, etc. for the data that you used / created? Even for commonly-used benchmark datasets, include the number of examples in train / validation / test splits, as these provide necessary context for a reader to understand experimental results. For example, small differences in accuracy on large test sets may be significant, while on small test sets they may not be. No response.
C 3 Did you run computational experiments? Section 4, 5

heading: 3 C1. Did you report the number of parameters in the models used, the total computational budget
text: (e.g., GPU hours), and computing infrastructure used? Section 5.4, Appendix
The Responsible NLP Checklist used at ACL 2023 is adopted from NAACL 2022, with the addition of a question on AI writing assistance.

heading: 3 C2. Did you discuss the experimental setup, including hyperparameter search and best-found
text: hyperparameter values? Section 3.2, Appendix
C3. Did you report descriptive statistics about your results (e.g., error bars around results, summary statistics from sets of experiments), and is it transparent whether you are reporting the max, mean, etc. or just a single run? Not applicable. Left blank.
C4. If you used existing packages (e.g., for preprocessing, for normalization, or for evaluation), did you report the implementation, model, and parameter settings used (e.g., NLTK, Spacy, ROUGE, etc.)? Not applicable. Left blank.
D 7 Did you use human annotators (e.g., crowdworkers) or research with human participants? Left blank.
D1. Did you report the full text of instructions given to participants, including e.g., screenshots, disclaimers of any risks to participants or annotators, etc.? No response.
D2. Did you report information about how you recruited (e.g., crowdsourcing platform, students) and paid participants, and discuss if such payment is adequate given the participants’ demographic (e.g., country of residence)? No response.
D3. Did you discuss whether and how consent was obtained from people whose data you’re using/curating? For example, if you collected data via crowdsourcing, did your instructions to crowdworkers explain how the data would be used? No response.
D4. Was the data collection protocol approved (or determined exempt) by an ethics review board? No response.
D5. Did you report the basic demographic and geographic characteristics of the annotator population that is the source of the data? No response.

heading: Future Work
text: We expect the future work to focus on improving inference time latency by using more sophisticated text generation methods