Randomized Smoothing with Masked Inference for Adversarially Robust Text Classifications
Year: 2023

Abstract:
Large-scale pre-trained language models have shown outstanding performance in a variety of NLP tasks. However, they are also known to be significantly brittle against specifically crafted adversarial examples, leading to increasing interest in probing the adversarial robustness of NLP systems. We introduce RSMI, a novel two-stage framework that combines randomized smoothing (RS) with masked inference (MI) to improve the adversarial robustness of NLP systems. RS transforms a classifier into a smoothed classifier to obtain robust representations, whereas MI forces a model to exploit the surrounding context of a masked token in an input sequence. RSMI improves adversarial robustness by 2 to 3 times over existing state-of-the-art methods on benchmark datasets. We also perform in-depth qualitative analysis to validate the effectiveness of the different stages of RSMI and probe the impact of its components through extensive ablations. By empirically proving the stability of RSMI, we put it forward as a practical method to robustly train large-scale NLP models. Our code and datasets are available at https://github.com/Han8931/rsmi_nlp.

heading: 1 Introduction
text: In response to the threat of textual adversarial attacks (Ebrahimi et al., 2018; Jin et al., 2020), a variety of defense schemes have been proposed (Goyal et al., 2022; Ye et al., 2020; Zhou et al., 2021; Dong et al., 2021). Defense schemes typically involve solving a min-max optimization problem, consisting of an inner maximization that seeks the worst (adversarial) example and an outer minimization that aims to minimize a system’s loss over such examples (Madry et al., 2018). The solution to the inner maximization problem is typically obtained through iterative optimization algorithms, such as stochastic gradient descent (Ilyas et al., 2019; Madry et al., 2018).
For texts, however, the gradients cannot be directly computed due to the discrete nature of the texts. Thus, the gradients are often computed with respect to word embeddings of an input sequence as done in Miyato et al. (2016); Zhu et al. (2020); Wang et al. (2021a). The simplicity of the gradientbased adversarial training makes it attractive defense strategy, but it tends to show substantial variance in robustness enhancement (c.f., §4.7). Another prevailing approach in natural language processing (NLP) field is to substitute input words of their synonyms sampled from a pre-defined synonym set (Ye et al., 2020; Zhou et al., 2021; Dong et al., 2021). The synonym-based defense (SDA)
5145
algorithms have emerged as a prominent defense approach since many textual attack algorithms perturb input texts at a word level (Ren et al., 2019; Alzantot et al., 2018; Jin et al., 2020). However, Li et al. (2021) pointed out that they tend to show significant brittleness when they have no access to the perturbation sets of the potential attacks. In addition, assuming access to the potential perturbation sets is often unrealistic.
To address the issues, we propose RSMI, a novel two-stage framework leveraging randomized smoothing (RS) and masked inference (MI) (c.f., Fig. 1). Randomized smoothing is a generic class of methods that transform a classifier into a smoothed classifier via a randomized input perturbation process (Cohen et al., 2019; Lécuyer et al., 2019). It has come recently into the spotlight thanks to its simplicity and theoretical guarantee of certifiable robustness within a ball around an input point (Cohen et al., 2019; Salman et al., 2019), which is often considered desirable property of a defense scheme (c.f., Fig. 1 (a)). Moreover, its robustness enhancement is highly scalable to modern large-scale deep learning setups (Cohen et al., 2019; Lécuyer et al., 2019). These properties render it a promising research direction. However, there exists a non-trivial challenge in introducing RS to NLP systems due to the discrete nature of texts. We sidestep the issue and adapt RS to NLP problems by injecting noise at the hidden layers of the deep neural model. We show that perturbed representations of pre-trained language models (PLMs) still guarantees the robustness in §2.
The RS stage is followed by a gradient-guided masked inference (MI) to further reinforce the smoothing effect of RS. MI draws an inference on an input sequence via a noise reduction process that masks adversarially “salient” tokens in the input that are potentially perturbed by an attack algorithm (c.f., Fig. 1 (b)). The adversarially salient tokens are achieved via a gradient-based feature attribution analysis rather than random selections as commonly done in pre-training language models (Devlin et al., 2019) to effectively suppress adversarial perturbations. The effectiveness of our novel MI can be attributed to several aspects: (i) It is a natural regularization for forcing the model to make a prediction based on the surrounding contexts of a masked token in the input (Moon et al., 2021). (ii) It works without any prior assumption about potential attacks, which renders it an attack-agnostic
defense approach and is more practical in that it requires no sub-module for synonym-substitution. (iii) It has a close theoretical connection to the synonym-substitution-based approaches, as MI can be regarded as a special case of the weighted ensemble over multiple transformed inputs as shown in §2.2.
We evaluate the performance of RSMI through comprehensive experimental studies on large-scale PLMs with three benchmark datasets against widely adopted adversarial attacks. Our empirical studies demonstrate that RSMI obtains improvements of 2 to 3 times against strong adversarial attacks in terms of key robustness metrics over baseline algorithms despite its simplicity (§4.1). We also conduct theoretical analysis to demonstrate the effectiveness of our adapted RS (§2.1) and MI (§2.2 and appendix A.6). We further analyze the scalability of RSMI, the influence of hyperparameters, its impact on the latent representation (i.e., embedding space) of the system and its stochastic stability (§4.5). Our theoretical and empirical analyses validate the effectiveness of RSMI and propose it as a practical method for training adversarially robust NLP systems.

heading: 2 Randomized Smoothing with Masked Inference (RSMI)
text: We consider a standard text classification task with a probabilistic model Fθ : Rd → P(Y), where P(Y) is the set of possible probability distributions over class labels Y = {1, . . . , C}, and θ ∈ Rp denotes the parameters of the model Fθ (or F for simplicity). The model F is trained to fit a data distribution D over pairs of an input sequence s = (s1, . . . , sT ) of T tokens and its corresponding class label y ∈ Y . The distributed representation of s (or word embedding) is represented as x = [x1, . . . , xT ]. We assume the model is trained with a loss function L such as cross-entropy. We denote the final prediction of the model as ŷ = argmaxi F (s)i and the ground truth label as y∗.

heading: 2.1 Randomized smoothing via noise layers
text: Given the model F , our method exploits a randomized smoothing (Lécuyer et al., 2019; Cohen et al., 2019) approach to obtain a smoothed version of it, denoted by G : Rd → P(Y), which is provably robust under isotropic Gaussian noise perturbation δ at an input query u (e.g., an image). This can be
expressed as: Definition 1 Given an original probabilistic neural network classifier F , the associated smoothed classifier G at a query u can be denoted as (a.k.a. Weierstrass Transform (Ahmed I, 1996)):
G(u) = (F ∗ N (0, σ2I))(u) = Eδ∼N (0,σ2I)[F (u+ δ)] .
(1)
The standard deviation of the Gaussian noise σ is a hyperparameter that controls the robustness/accuracy trade-off of the resulting smoothed model G. The higher the noise level is, the more robust it will be, while the prediction accuracy may decrease. The asterisk ∗ denotes a convolution operation (Oppenheim et al., 1996) which, for any two functions h and ψ, can be defined as: h ∗ ψ(x) = ∫ Rd h(t)ψ(x− t)dt. In practice, G(u) can be estimated via Monte-Carlo sampling (Cohen et al., 2019; Salman et al., 2019).
Cohen et al. (2019) showed that the smoothed model G is robust around a query point u within a L2 radius R, which is given by:
R = σ 2 (Φ−1(pa)− Φ−1(pb)) , (2)
where Φ−1 is the inverse of the standard Gaussian CDF, pa and pb are the probabilities of the two most likely classes a and b, denoted as: a = argmaxy∈Y G(x)y and b = argmaxy∈Y\aG(x)y.
As per Eq. (1), a simple approach to obtain G is to perturb the input u by the noise δ and train with it. However, for a textual input, the token sequence cannot be directly perturbed by δ due to the its discrete nature. To deviate from the issue, we inject noise at the hidden layers of the model to achieve stronger smoothness as done in (Liu et al., 2018). For a given layer fl, a noise layer f δl draws a noise δ ∼ N (0, σ2I) and adds it to the output of fl in every forward pass of the model. The stronger smoothness resulting from the multi-layer noise is provably guaranteed by the following theorem: Theorem 1 Let F : Rd → P(Y) be any soft classifier which can be decomposed as F = f1 ◦ f2 ◦ · · · ◦ fL and G = g1 ◦ g2 ◦ · · · ◦ gL be its associated smoothed classifier, where gl(x) = (fl ∗ N(0, σ2l I))(x) with 1 ≤ l ≤ L and σl > 0. Let a = argmaxy∈Y G(x)y and b = argmaxy∈Y\aG(x)y be two most likely classes for x according to G. Then, we have that argmaxy∈Y G(x ′)y = a for x′ satisfying
∥∥x′ − x ∥∥ 2 ≤ 1
2σ1
L∏
l=2
(1 + σ2l )(Φ −1(pa)− Φ−1(pb)) .
We provide a proof of the theorem with Lipschitz continuity in Appendix F.

heading: 2.2 Gradient-guided masked inference
text: For an input sequence s, our method attempts to denoise its adversarially perturbed counterpart s′ by attributing saliency of input tokens through a simple gradient-based attribution analysis. Due to the discrete nature of tokens, we compute the gradients of the loss function L with respect to the word embeddings xt. The loss is computed with respect to the labels y, which is set to be the ground-truth labels y∗ during training and model predictions ŷ during inference. Formally, the gradients gt for a token st ∈ s (correspondingly xt ∈ x) can be computed as follows:
gt = ∇xtL(G(x), y)
≈ −∇xt ( log ( 1
ν
ν∑
i=1
G(x+ δi)
)) . (3)
Eq. (3) exploits a Monte-Carlo approximation to estimate the gradient gt as done in (Salman et al., 2019). Subsequently, the amount of stimulus of the input tokens toward the model prediction is measured by computing the L2-norm of gt, i.e., ||gt||2. The stimulus is regarded as the saliency score of the tokens and they are sorted in descending order of the magnitude (Li et al., 2016; Moon et al., 2022). Then, we sample M tokens from the top-N tokens in s, and mask them to generate a masked input sequence m = [s1, . . . ,mt, . . . , sT ], where t is the position of a salient token and mt is the mask token, [MASK]. During training, we mask the top-M positions (i.e., N =M ), while the mask token selection procedure is switched to a sampling-based approach during inference as detailed later in §2.3. Finally, the gradients gt computed for generating the masked sequence is repurposed for perturbing the word embeddings xt (i.e., δ = gt) to obtain robust embeddings as shown in (Zhu et al., 2020; Wang et al., 2021a; Miyato et al., 2017).
Our gradient-guided masked inference offers several advantages. First, it yields a natural regularization for forcing the model to exploit surrounding contexts of a masked token in the input (Moon et al., 2021). Second, the masking process can provide a better smoothing effect by masking ‘salient’ tokens that are probably adversarial to the model’s decision. In such cases, it works as a denoising process for reducing the strength of an attacks. In Appendix A.6, we conduct theoretical analysis about
the denoising effect of the gradient-guided masked inference in terms of Lipschitz continuity of a soft classifier.
Connection to synonym-based defense methods Another interesting interpretation is that the masked inference has a close connection to the synonym-based defense methods (Wang et al., 2021b; Ye et al., 2020; Wang and Wang, 2020; Zhou et al., 2021). Assuming only position in s is masked and treating the mask as a latent variable s̃t that could take any token from the vocabulary V , we can express the masked inference as:
p(y|m) = ∑
s̃t∈V p(y, s̃t|m) (4)
= ∑
s̃t∈V p(y|m, s̃t)p(s̃t|m) (5)
≈ ∑
s̃t∈Vt p(y|m, s̃t)p(s̃t|m) , (6)
where |Vt| ≪ |V | is the number of words to be at position t with a high probability mass. As shown in the equation, the masked inference can be factorized into a classification objective and a masked language modeling objective, which can be further approximated into a weighted ensemble inference with |Vt| substitutions of s with the highly probable tokens (e.g., synonyms) corresponding to the original word st. If we assume p(s̃t|m) to be a probability of sampling uniformly from a synonym set such as the one from the WordNet (Fellbaum, 1998), then the masked inference is reduced to a synonym-substitution based defense approach with no necessity of an explicit synonym set.

heading: 2.3 Two-step Monte-Carlo sampling for efficient inference
text: The prediction procedure of RSMI involves averaging predictions of k Monte-Carlo samples of G(m) to deal with the variations in the noise layers. A large number of k is typically required for a robust prediction but the computational cost increases proportionally as k gets larger. To alleviate the computational cost, we propose a two-step sampling-based inference (Alg. 1).
In the first step, we make k0 predictions by estimating G(m) for k0 times (k0 forward passes). We then make an initial guess about the label of the masked sample m by taking a majority vote of the predictions. Following Cohen et al. (2019), this initial guess is then tested by a one-tailed binomial test with a significance level of α. If the
guess passes the test, we return the most probable class based on the vote result. If it fails, then we attempt to make a second guess with a set of k1 masked input sequences M = [m(1), · · · ,m(k1)], where k0 ≪ k1. Note that the masked input m used in the first step is generated by masking the top-M tokens from the top-N candidates as we do during training. However, in the second step, we randomly sample M masking positions from the N candidates to create each masked sequence m(i) of M in order to maximize variations in the predictions; this step is denoted as RANDGRADMASK in Alg. 1.
Our two-step sampling based inference is based on an assumption that textual adversarial examples are liable to fail to achieve consensus from the RSMI’s predictions compared to clean samples. In other words, it is considerably harder for adversarial examples to estimate the optimal perturbation direction towards the decision boundary of a stochastic network (Däubener and Fischer, 2022; Athalye et al., 2018; Cohen et al., 2019). We conduct experiments to show the effectiveness of our two-step sampling based inference in §4.5.

heading: 3 Experiment Setup
text: Datasets We evaluate RSMI on two conventional NLP tasks: text CLaSsification (CLS) and Natural Language Inference (NLI). We adopt IMDB (Maas et al., 2011) and AG’S NEWS (Zhang et al., 2015) datasets for the classification task. For NLI, we compare the defense algorithms on the Questionanswering NLI (QNLI) dataset, which is a part of the GLUE benchmark (Wang et al., 2018). We build development sets for IMDB, AG, and QNLI by randomly drawing 10% samples from each training set via a stratified sampling strategy.
Evaluation metrics The performance of defense algorithms is evaluated in terms of four different metrics as proposed in (Li et al., 2021): (i) Standard accuracy (SAcc) is the model’s accuracy on clean samples. (ii) Robust accuracy (RAcc) measures the model’s robustness against adversarial attacks. (iii) Attack success rate (ASR) is the ratio of the inputs that successfully fool the victim models. (iv) Finally, the average number of queries (AvgQ) needed to generate the adversarial examples.
Algorithm 1 Training and prediction procedure of RSMI. 1: Initialize. s, M , N , σ, ν, k0, k1, α, step size η, and a gradient scale parameter β. 2: Compute L := [ ||g1||2, · · · , ||gT ||2 ] via Eq. (3). ▷ Gradients w.r.t. word embeddings
3: Sort L in descending order and keep top-N items 4: Get a masked sequence m by masking top-M tokens based on L. 5: if Training then 6: x := x+ β(g1, · · · ,gT ) ▷ Noise to word embeddings 7: θ := θ − η∇θL(G(x), y∗) 8: else if Prediction then 9: ϕ(m)0 = ∑k0 i=1[I(ŷ(i)(m) = y1), · · · , I(ŷ(i)(m) = yc)] ▷ First vote
10: na = maxϕ(m)0 11: p-value = BINOMTEST(na, k0, 0.5,one-tail) 12: if p-value > α then 13: Return argmaxy∈Y ϕ(m)0 14: else 15: [m(1), · · · ,m(k1)] ∼ RANDGRADMASK(k1, L) 16: ϕ(m)1 = ∑k1 i=1[I(ŷ(m(i)) = y1), · · · , I(ŷ(m(i)) = yc)] ▷ Second vote 17: Return argmaxy∈Y ϕ(m)1 18: end if 19: end if
Baselines We select FreeLB (Zhu et al., 2020)1, InfoBERT (Wang et al., 2021a), and an adversarial example augmentation (AdvAug) (Li et al., 2021) as baselines since they are representative work for gradient-based training, information-theoretical constraint, data augmentation approaches, respectively. We also choose SAFER (Ye et al., 2020) since it is a certifiable defense method based on a synonym-substitution-based approach. We then apply the baselines over BERT-base (Devlin et al., 2019) and RoBERTa-base (Liu et al., 2019) models. We also conduct experiments with RoBERTaLarge, BERT-Large, and T5-Large (Raffel et al., 2022) models to observe scalability of RSMI. Note that our experiment setup is significantly larger compared to previous works, including Li et al. (2021); Ye et al. (2020). The baseline algorithms are tuned according to their default configurations presented in the respective papers and run them three times with a different random initialization to obtain the best performance of the baselines. For AdvAug, we augment a training dataset of each task by adversarial examples sampled from 10k data points of training datasets. Further details are provided in Appendix E.
Textual adversarial attacks We generate adversarial examples via TextFooler (TF) (Jin
1FreeLB++ (Li et al., 2021) is excluded since it has a reproducibility issue as reported in github.
et al., 2020), Probability Weighted Word Saliency (PWWS) (Ren et al., 2019) and BERT-based Adversarial Examples (BAE) (Garg and Ramakrishnan, 2020). These attack algorithms are widely adopted in a variety of defense works as adversarial robustness benchmarking algorithms (Yoo and Qi, 2021; Dong et al., 2021) since they tend to generate adversarial examples with better retention of semantics and show high attack effectiveness compared to syntactic paraphrasing attacks (Iyyer et al., 2018). Moreover, the above attack algorithms have their own distinct attack process. For instance, TF and PWWS build synonym sets by counter-fitting word embeddings (Mrkšić et al., 2016) and WordNet (Fellbaum, 1998), respectively. BAE leverages BERT for building a synonym set of a target token. Note that we exclude some adversarial attack algorithms, such as BERT-Attack (Li et al., 2020) due to their expensive computation costs 2.
We randomly draw 1,000 samples from each test set following Dong et al. (2021); Li et al. (2021); Ye et al. (2020) for a fair comparison and perturb them via an attack to generate the corresponding adversarial examples for all experiments unless stated otherwise. The sample size is also partially due to the slow attack speed of textual adversarial attack
2BERT-Attack takes around 2k times more than TextFooler algorithm to generate a single adversarial example of a AGNews sample under our experiment setup. This issue is also reported in TextAttack (Morris et al., 2020).
algorithms and the strong robustness of the proposed model, which requires the attack algorithms to query a huge amount of times compared to the baselines (c.f., Table 1). We implement all attacks through the publicly available TextAttack library (Morris et al., 2020) and use their default configurations without any explicit attack constraints.
For robustness evaluation of RSMI against the attacks, we modify the second step of the two-step inference to make a final decision by averaging logit scores of k1 Monte-Carlo samples instead of the majority voting approach in Alg. 1. We do this to prevent obfuscating the perturbation processes of TF and PWWS that are devised to identify target tokens via the change of the model’s confidence, which can give a false impression about the robustness of RSMI. Nonetheless, we investigate the effectiveness of majority voting based inference as a practical defense method in Appendix B. Further details about the attack algorithms and parameter settings of the algorithms are provided in Appendix E.

heading: 4 Results and Analysis

heading: 4.1 Adversarial robustness comparison
text: We compare the performance of RSMI with the baselines in Table 1. Overall, we observe that RSMI outperforms all the baselines by quite a large
margin across the majority of the metrics such as RAcc, ASR and AvgQ. In particular, it achieves about 2 to 3 times improvements against strong attack algorithms (e.g., TextFooler and PWWS) in terms of ASR and RAcc, which are key metrics for evaluating the robustness of defense algorithms. RSMI also significantly outperforms the baselines in QNLI task by 16% ∼ 26% (c.f., Appendix C). In addition, we observe that RSMI tends to show better training stability in RAcc compared to the baselines (c.f., §4.7). For instance, the RAcc of FreeLB shows a standard deviation of 8.57%, but RSMI shows 2.10% for the IMDb task. Also, InfoBERT tuned for AGNews shows a standard deviation of 13.19% in RAcc while RSMI shows 0.84%. We also emphasize that RSMI outperforms other existing methods, such as TAVAT (Li and Qiu, 2020), MixADA (Si et al., 2020), A2T (Yoo and Qi, 2021), and ASCC (Dong et al., 2021) which we do not report in Table 1 as they show lower performance than our baselines, c.f., Li et al. (2021).3 Another interesting observation is that a simple AdvAug approach outperforms sophisticated methods, including InfoBERT, FreeLB, and SAFER in most experiment setups without hurting SAcc. This runs contrary to the claims in Li et al. (2021); Si et al.
3Li et al. (2021) put constraints to make the attack algorithms weaker which we did not do in our work.
(2020). The strong performance of RSMI can be attributed to four factors: (i) A provable robustness guarantee by the randomized smoothing approach helps attain higher robustness (c.f., Theorem 1). To further support this claim, we evaluate the robustness of RSMI without the proposed masking process (i.e., MI) during inference and the results are reported as RSMI-NoMask in Table 1. As we can see, RSMI-NoMask outperforms the baselines in most experiment scenarios. (ii) The randomized smoothing denoises adversarial perturbations in the latent space of systems. Our experiments in §4.3 bolster this claim by showing the significant noise reduction in hidden representations of RSMI. (iii) The MI leads to a reduction in the noise of the adversarial perturbations. This claim can be strongly bolstered again by comparing the results of RSMI with and without the masking strategy during inference (c.f., RSMI-NoMask and RSMI in Table 1). (iv) The two-step sampling-based inference makes it harder for the attack algorithms to estimate the optimal perturbation direction to fool the model for an input sample. An ablation study in §4.5 clearly supports this claim since the two-step sampling significantly improves the RAcc of RSMI models.

heading: 4.2 Large scale parameterization and adversarial robustness
text: We investigate the scalability of RSMI by applying RSMI over large-scale PLMs, such as RoBERTaLarge and BERT-Large, both of which have 340 million parameters. We also conduct experiments with T5-Large model of 770 million parameters. Then, we evaluate their robustness via TextFooler attack algorithm since it tends to show high ASR (c.f., Table 1). Table 2 summarizes the experiment results. From Table 2, we can clearly observe that RSMI significantly improves the robustness of the
large PLMs, which indicates the high scalability of RSMI. Especially, RoBERTa-Large with RSMI enhances the RAcc of the fine-tuned RoBERTaLarge by 66.20% for the IMDb task.

heading: 4.3 Analysis of latent representations of RSMI
text: We investigate the latent representation of clean sample hl(s) and that of its corresponding adversarial example hl(s′) for each layer l. We examine the fine-tuned base models and the base models with RSMI. For each model, we compare the L2 distance and cosine similarity between hl(s) and hl(s′) for each layer l. Fig. 2 shows that the L2 distance and cosine similarity of the fine-tuned RoBERTa and BERT models stay quite constant until 8-th layer. However, for subsequent layers, L2 distance curves rapidly increase and cosine similarity curves suddenly fall. At the final layer (l = 12), we can observe the largest changes. Thus, the latent representation of the clean sample and its corresponding adversarial example become distinct. In contrast, RSMI tends to show significant decreases of L2 distance at l1, l5, and l9 thanks to the Gaus-
sian noise perturbation processes for these layers. This indicates that RSMI effectively reduces the adversarial noise in the latent representations of adversarial examples.

heading: 4.4 Effectiveness of gradient-guided masking
text: We probe the effectiveness of the gradient-guided masking strategy by ablating the noise layers and the two-step sampling of RSMI. The resulting model, namely the gradient-guided masking (GM) is compared to a model trained on randomly masked inputs, namely the random masking model (RM). Note that GM predicts and masks inputs in a deterministic way due to the absence of noise layers. Table 3 summarizes our study of ASR changes of GM and RM over different number of mask tokens M in an input sequence as well as k randomly masked sequences drawn for estimating an expectation of RM prediction. RM tends to achieve its best performance at k = 1, but shows vulnerability as k increases, which means its robustness is largely from attack obfuscation rather than improving the model’s robustness (Athalye et al., 2018). On the other hand, ASR of GM tends to decrease as we increase M . This validates the effectiveness of gradient-guided masking for denoising adversarial perturbations injected by attack algorithms.

heading: 4.5 Effectiveness of two-step sampling
text: We study the effectiveness of the proposed two-step sampling (TS). Fig. 3 clearly shows that RSMI with TS significantly increases the robustness for both BERT and RoBERTa. For instance, RSMI without TS shows RAcc of 64% at k = 5, but RSMI with
TS shows RAcc of 74.1% against TextFooler attack. We credit this robustness to the transform process of RSMI, which masks inputs and perturbs their hidden representation with Gaussian noise. This behaves as a mixture of two stochastic transformations and makes it harder for the attack algorithms to estimate the optimal perturbation direction.

heading: 4.6 Impact of parameter settings
text: Table 4 shows the impact of different hyperparameters of RSMI. As observed, the overall ASR tends to decrease as we inject more noises into models by increasing noise size (σ), replacing more input words with the mask token (M ), and adding more noise layers (Nl). Specifically, we observe that ASR gradually decreases as we put more noise layers in the model. Also, ASR steadily declines as we increase the standard deviation of noise. Finally, we observe that the increased number of masks effectively decreases ASR. However, we observe that these improvements in ASR come at the cost of a decreasing SAcc.

heading: 4.7 Training stability
text: We investigate the stability of RSMI’s training dynamics. Table 5 summarizes average (Avg), standard deviation (Std), max, and min values of SAcc-Dtest and RAcc obtained from models trained with three different random initializations on IMDb. Note that SAcc-Dtest represents SAcc for the whole test set. As shown in the table, RSMI tends to show higher stability compared to the baselines in terms of RAcc despite its stochastic nature. Despite the high and stable SAcc gains from FreeLB and InfoBERT, they tend to show significant standard deviations in RAcc and substantial gaps between the max and the min of RAcc.

heading: 5 Conclusion
text: We have proposed RSMI, a novel two-stage framework to tackle the issue of adversarial robustness of large-scale deep NLP systems. RSMI first adapts the randomized smoothing (RS) strategy for discrete text inputs and leverages a novel gradientguided masked inference (MI) approach that reinforces the smoothing effect of RS. We have evaluated RSMI by applying it to large-scale pre-trained models on three benchmark datasets and obtain 2 to 3 times improvements against strong attacks in terms of robustness evaluation metrics over stateof-the-art defense methods. We have also studied the scalability of RSMI and performed extensive
qualitative analyses to examine the effect of RSMI on the latent representations of the original and perturbed inputs as well as the change in its stability owing to its non-deterministic nature. Our thorough experiments and theoretical studies validate the effectiveness of RSMI as a practical approach to train adversarially robust NLP systems.

heading: 6 Limitations
text: A major component of RSMI has been developed with the concept of randomized smoothing which is known to be certifiably robust within a radius of a ball around an input point. Though we have proved the robustness for the perturbed samples within this given ball, there is no theoretical guarantee that a perturbed sample will always lie within the ball. Accordingly, our study is limited to empirical validation of the effectiveness of RSMI, although it has theoretical robustness within a L2 norm ball as shown in §2. Nevertheless, certified robustness is a critical research direction for robust and reliable deployment of NLP systems to address undiscovered attacks. In our future work, we will explore the theoretical understanding of the certified-robustness of NLP systems and textual adversarial examples in-depth.

heading: 7 Ethics Statement
text: The growing concern over the robustness of deep NLP systems has lead many to dedicate to develop various defense schemes but they have been typically broken by stronger attack algorithms. The proposed method demonstrates its effectiveness and potential to serve as a strong defense scheme for text classification systems. However, the disclosure of the proposed method may result in attack algorithms that are specific to target RSMI. Nonetheless, our theoretical study demonstrates that RSMI provides certifiable robustness to the NLP systems within a ball with a radius R, which is distinctive compared many other empirical methods, including gradient- and synonym-based works.

heading: 8 Acknowledgements
text: This work is partly supported by SIMTech-NTU Joint Laboratory on Complex Systems. We would like to thank the anonymous reviewers for their insightful comments. We would also like to thank Min Jeong Song for her valuable input and proofreading of the paper.

heading: A Stochastic stability of RSMI
text: As RSMI is stochastic in nature, we examine its stability in classifying clean as well as adversarial samples. We first randomly draw 1,000 clean examples and evaluate them with RSMI with 1,000 independent runs. Next, we perform inference repeatedly using adversarial examples that were successful in fooling RSMI with 1,000 independent runs. As all the evaluations are independent, each evaluation involves a different noise sampling and masking process. Fig. 4 shows that RSMI’s evaluation on clean samples is significantly stable. On the other hand, most of the adversarial examples are correctly classified during each individual evaluation around the median of RSMI’s RAcc. This shows that the attack success rate of adversarial attack algorithms become stochastic rather than deterministic due to RSMI’s non-deterministic nature.

heading: B Majority voting-based inference
text: The inference of RSMI involves a combination of individual predictions. During evaluations in §4.1, RSMI is modified to draw a final decision about an input sequence by averaging logit scores of multiple Monte-Carlo samples for a fair comparison, because the majority voting obfuscates the perturbation processes of attack algorithms by hiding model prediction scores. However, the majority voting-based inference (c.f., Alg. 1) can be a practical defense method against adversarial attacks that require access to a victim model’s prediction probabilities for their perturbation process since most attack algorithms require the prediction information (e.g., TextFooler, PWWS, and BAE). To validate the effectiveness of the majority vote, we conduct additional experiments. As shown in Table 6, the majority voting-based inference significantly outperforms the logit averaging approaches.

heading: C Natural Language Inference Task Analysis
text: Table 7 summarizes a performance comparison of adversarial robustness of RSMI with the baselines for NLI tasks.

heading: D Run time analysis
text: We compare the computation speed of RSMI with the baselines on the RoBERTa-base model finetuned on QNLI. All experiments are conducted on an Intel Xeon Gold 5218R CPU-2.10GHz processor with a single Quadro RTX 6000 GPU. For a fair comparison, the number of gradient computation steps of FreeLB and InfoBERT is set to 3 and other parameters are configured to the default settings provided by the original papers. Also, we do not include the preprocessing time of SAFER. As shown in Table 8, RSMI is approximately 1.9x slower than the Fine-Tuned model during training and 3.5x slower during inference. The latency of RSMI is mainly caused by the additional backpropagation and forward propagation for computing the gradients. The inference speed of RSMI can be improved by removing the masking step during inference, but there exist a trade-off between the inference speed and robustness as shown in Table 1.

heading: E Experiment details
text: E.1 Experiment environment
All of the experiments are conducted on an Intel Xeon Gold 5218R CPU-2.10GHz processor with a single Quadro RTX 6000 GPU under Python with PyTorch (Paszke et al., 2019).
E.2 Models used
The models used in this work are pre-trained RoBERTa-base (Liu et al., 2019) and BERT-base (Devlin et al., 2019), both of which have 124 million parameters. We adopt Huggingface library (Wolf et al., 2020) for training the models on the benchmark datasets. The huggingface code and models are all licensed under Apache 2.0, which allows for redistribution and modification.
E.3 Datasets used
Table 10 presents the statistics of benchmarking datasets adopted in our experiments. The IMDB dataset contains movie reviews labeled with positive or negative sentiment labels. The AG’S NEWS (AG) dataset consists of news articles collected
from more than 2,000 news sources and the samples are grouped into four coarse-grained topic classes. The objective of the NLI task is to predict the entailment relationship between a pair of sentences; whether the second sentence (Hypothesis) is an Entailment, a Contradiction, or is Neutral with respect to the first one (Premise). The datasets are available in the public domain with custom license terms that allow non-commercial use.
E.4 Parameter settings of RSMI
RSMI and the fine-tuned models are optimized by AdamW (Loshchilov and Hutter, 2019)with a linear adaptive learning rate scheduler. The maximum sequence length of input sequences is set to 256 during experiments. For the T5-Large models, we used the same parameter settings as we trained RoBERTa and BERT models except a learning rate. We set it at 0.0001 as provided in the original paper (Raffel et al., 2022). Further details are summa-
rized in Table 9.
E.5 Adversarial example augmentation
Table 11 presents the number of adversarial examples used for augmenting training datasets. We generated the adversarial examples by fooling finetuned PLMs. To this end, we first sampled 10k clean input points from training datasets and kept the examples successfully fooling the victims. The generated adversarial examples are then augmented to each dataset. We used the same training parameters presented in Table 9.
E.6 Textual attack algorithm
We employed the publicly available TextAttack library (Morris et al., 2020) for TextFooler (TF) (Jin et al., 2020), PWWS (Ren et al., 2019), and BAE (Garg and Ramakrishnan, 2020) attack algorithms. We follow the default settings of each algorithm. Note that TextAttack does not include the named entity (NE) adversarial swap constraint in its PWWS implementation to extend PWWS towards a practical scenario where NE labels of input sequences are not available. As a consequence, PWWS attack in TextAttack tends to show stronger attack success rates.

heading: F Proof
text: This section provides a proof of Theorem 1. The sketch of the new theorem is as follows:
Consider a simple case where a noise is added to the output of a single intermediate layer and word embeddings of a soft neural network classifier with normalization layers. The network is denoted as F : Rd → P(Y) and word embeddings of an input sequence s are represented as x. Then, F can be
deemed as a composite function as follows:
F = f1 ◦ f2 = f1(f2(x)),
where f1: Rd ′ → P(Y) and f2: Rd → Rd′ . After injecting a noise, the new smoothed classifier can be represented as follows:
G = g1 ◦ g2,
where gi is the Weierstrass Transform (Ahmed I, 1996) of fi as stated in the following definition:
Definition 2 Denote the original soft neural network classifier as f , the associated smooth classifier (Weierstrass Transform (Ahmed I, 1996)) can be denoted as g:
g(x) = (f ∗ N (0, σ2I))(x) = E δ∼N (0,σ2I) [f(x+ δ)]. (7)
In the following sections, we will prove LLipschitzness of g1 and g2. Subsequently, we will show that the output argmaxy∈Y G(x)y does not change within a certain radius of input x (c.f., Theorem 2). Eventually, we will generalize the simplified case towards a general case where multiple
layers of activations are perturbed and its radius increases exponentially as we add more noise layers to the classifier (c.f., Theorem 1).
We also provide justifications for the gradientguide masking strategy (i.e., MI) and show that it acts as a denoising process that enhances the smoothing effect of the proposed approach (Appendix A.6). Note that we adopt Lemma 1, Lemma 2, and Lemma 6 from Li (2019) and follow its proofs.
F.1 Lipschitzness of the smoothed classifiers We will first show that g1 is √ 2 πσ2
-Lipschitz in ℓ2 norm. Note that g1 is the Weierstrass Transform (Ahmed I, 1996) of a classifier f1 (c.f., Eq. (7)).
Lemma 1 Let σ > 0, let h : Rd → [0, 1]d be measurable, and let H = h ∗ N (0, σ2I). Then H is √
2 πσ2 -Lipschitz in ℓ2.
Proof 1 In ℓ2, we have:
∇H(x)
= ∇ (
1
(2πσ2) d 2
∫
Rd h(t) exp
( − 1
2σ2 ∥x− t∥22
) dt )
= 1
(2πσ2) d 2
∫
Rd h(t) t− x σ2 exp(− 1 2σ2 ∥x− t∥22)dt .
Let v ∈ Rd be a unit vector, the norm of ∇H(x) is bounded:
|⟨v,∇H(x)⟩|
= ∣∣∣∣ 1
(2πσ2) d 2
∫
Rd h(t)
〈 v,
t− x σ2
〉
exp ( − 1
2σ2 ∥x− t∥22
) dt ∣∣∣∣
≤ 1 (2πσ2) d 2
∫
Rd
∣∣∣∣ 〈 v, t− x σ2 〉∣∣∣∣ exp ( − 1 2σ2 ∥x− t∥22 ) dt
= 1
σ2 E Z∼N (0,σ2) [|Z|] =
√ 2
πσ2 ,
where the second line holds since h : Rd → [0, 1]d. By Lemma 1, g1 is √ 2 πσ2 -Lipschitz.
Lemma 2 Let σ > 0, let h : Rd → [0, 1], and let H = h∗N (0, σ2I). Then the function Φ−1(H(x)) is σ-Lipschitz.
Proof 2 Let’s first consider a simple case where σ = 1. Then, we have that
∇Φ−1(H(x)) = ∇H(x) Φ′(Φ−1(H(x))) ,
where Φ−1 is the inverse of the standard Gaussian CDF. Then, we need to show the following inequality holds for any unit vector v.
⟨v,∇H(x)⟩ ≤ Φ′(Φ−1(H(x)))
= 1√ 2π exp
( − 1
2 Φ−1(H(x))2
) .
By Stein’s lemma (Stein, 1981), the LHS is equal to
EX∼N (0,I)[⟨v,X⟩ · h(x+X)]. We need to bound the maximum of this quantity to have the constraint that h(x) ∈ [0, 1] for all x and Ex∼N (0,I)[h(x +X)] = p. Let f(z) = h(z + x), the problem becomes:
max E X∼N (0,I)
[⟨v,X⟩ · f(X)]
s.t. f(x) ∈ [0, 1] and E X∼N (0,I) [f(X)] = p .
The solution of the optimization problem is given by the halfspace ℓ(z) = 1[⟨u, z⟩ > −Φ−1(p)] and it is a valid solution to the problem. To show its uniqueness, let f be any other possible solution and A be the support of ℓ. Then, by assumption, EX∼N (0,I)[ℓ(X) − f(X)] = 0. In particular, we must have:
E X∼N (0,I)
[(ℓ(X)− f(X))1A]
= E X∼N (0,I) [(ℓ(X)− f(X))1AC ] .
However, for any z ∈ A and z′ ∈ AC , we have that ⟨v, z⟩ ≥ ⟨v, z′⟩. Hence,
E X∼N (0,I)
[⟨v,X⟩(ℓ(X)− f(X))1A] ≥
E X∼N (0,I) [⟨v,X⟩(ℓ(X)− f(X))1AC ],
where this uses that ℓ(z) ≥ f(z) if z ∈ A and f(z) ≥ ℓ(z) otherwise. Rearranging, yields
E X∼N (0,I) [⟨v,X⟩ℓ(X)] ≥ E X∼N (0,I) [⟨v,X⟩f(X)]
as claimed. Now, we simply observe that
E X∼N(0,I)
[⟨v,X⟩ℓ(X)]
= E Z∼N (0,1)
[Z · 1Z>−Φ−1(p)]
= 1√ 2π
∫ ∞
−Φ−1(p) xe−x 2/2dx
= exp ( − 1
2 Φ−1(p)2
)
= exp ( − 1
2 Φ−1(H(x))2
) ,
as claimed. To extend the simple case to a general σ, we can take the auxiliary function h̃(z) = h(z/σ), and the corresponding smoothed function H̃ = h̃ ∗ N(0, 1). Then H̃(σx) = H(x). By the same proof as before, Φ−1 ◦ H̃ is 1-Lipschitz, and this immediately implies that Φ−1 ◦H is σ-Lipschitz.
Therefore, Φ−1(g1(x)) is a σ-Lipschitz smooth classifier.
F.2 Lipschitzness of the smoothed intermediate layers
Lemma 3 Let h : Rd → N (0, Id) and H = h ∗ N (0, σ2Id). Then, they are Lh-Lipschitz and LH - Lipschitz, respectively, where Lh = 1√2πe − 1 2 and LH = 1
1+σ2 Lh.
Proof 3 In general, a Gaussian distribution ϕ ∼ N (µ, σ2I) is 1
σ2 √ 2π e− 1 2 -Lipschitz, where ϕ(x)
can be represented as follows:
ϕ(x) = 1√ 2πσ2 exp
( − (x− µ)
T I(x− µ) 2σ2
) .
Then, the derivate of ϕ is given by
ϕ′(x) = 1√ 2πσ2 µ− x σ2 exp
( − (x− µ)
T I(x− µ) 2σ2
) .
The maximum of ∥ϕ′(x)∥ can be obtained by taking the derivative of its square and set it to zero as follows:
d
dx ∥ϕ′(x)∥2 = 1
2πσ6
( − 2∥x− µ∥
2(x− µ) σ2 exp
( − ∥x− µ∥ 2
σ2
)
+ 2(x− µ) exp ( − ∥x− µ∥ 2
σ2
)) = 0 .
Note that the square of the norm is a monotonic function as the norm is greater than 0. Thus, we have
∥x− µ∥2 = σ2 .
This equation implies that the maximum of ϕ′ can be found at a distance of σ from µ. For any unit vector v ∈ Rd, the maximum value of ϕ′ occurs at:
x = µ+ σv
Subsequently, the norm of the maximum gradient is given by:
∥ϕ′(µ+ σv)∥ = 1√ 2πσ2 exp
( − 1
2
) .
Since ∥ϕ′(x)∥ ≤ 1√ 2πσ2 exp(−12) , Lipschitz continuity of ϕ can be shown by the Mean Value Theorem:
∥ϕ(x)− ϕ(y)∥ ≤ sup x∈Rd
∥ϕ′(x)∥∥x− y∥
= 1√ 2πσ2 exp
( − 1
2
) ∥x− y∥ .
Therefore, ϕ ∼ N (µ, σ2I) is 1 σ2 √ 2π e− 1 2 -Lipschitz. Since h maps to the standard normal distribution, h(t) is 1√
2π e− 1 2 -Lipschitz.
To show the Lipschitz constraint of H(x), we exploit the fact that the convolution of two Gaussian distributions ϕ1 ∼ (µ1, σ21) and ϕ1 ∼ (µ2, σ22) is another Gaussian distribution ϕ = ϕ1 ∗ ϕ2 ∼ (µ1 + µ2, σ 2 1 + σ 2 2), which could be extended to the standard multi-dimensional independent Gaussian variables with no covariance (Bromiley, 2003). This property leads to an equality of H(x) = h ∗ N(0, σ2Id) = N(0, Id)∗N(0, σ2Id) ∼ N(0, (1+ σ2)Id), which shows that H(x) is 1√
2π(1+σ2) e− 1 2 I -
Lipschitz. Thus, LH = 11+σ2Lh.
Lemma 3 implies that randomized smoothing imposes a stronger smoothness of the function, since the Lipschitz bound of the original function will be reduced by a factor of 1
1+σ2 as 1 + σ2 > 1.
F.3 Lipschitzness of the overall composite function
Lemma 4 If f and g are L1-Lipschitz and L2Lipschitz, respectively, then the composite function f ◦ g is L1L2-Lipschitz. Proof 4
|f ◦ g(x′)− f ◦ g(x)| = |f(g(x′))− f(g(x))| ≤ L1|g(x′)− g(x)| ≤ L1L2|x′ − x| .
Lemma 2, Lemma 3, and Lemma 4 lead to the following lemma: Lemma 5 Φ−1(G) = Φ−1 ◦ g1 ◦ g2 is (
σ1 1+σ22
) -
Lipschitz when
g1(x) = (f1 ∗ N (0, σ21I))(x) = E δ∼N (0,σ21I) [f1(x+ δ)]
and
g2(x) = (f2 ∗ N (0, σ22I))(x) = E δ∼N (0,σ22I) [f2(x+ δ)]
Proof 5 If a noise is only added to the input x, then the inverse of the standard Gaussian CDF of the smoothed classifier , i.e., Φ−1 ◦ g(x), is σ1Lipschitz, as stated in Lemma 2. We can consider g as a composite function , where g = g′1 ◦ g′2, then Φ−1 ◦ g′1 ◦ g′2(x) is still σ1-Lipschitz.
Let the Lipschitz constant of Φ−1 be LΦ. Note that g′1(x) is L1-Lipschitz since gradients of g ′ 1 is clipped during a training phase. Also g′2 is L2Lipschitz as it is a soft classifier. Lemma 4 leads to the following observation:
LΦL1L2 = σ1
Subsequently, we consider a case where the intermediate outputs of the composite function are perturbed. In other words, we also apply Weierstrass transform to the layer f1 (i.e.,f1 to g1). Thus, g1 is(
1 1+σ22
L1 ) -Lipschitz by Lemma 3. Then, Lemma 3
with Lemma 4 results in the new Lipschitzness constant for Φ−1(G), which is given by
LΦ 1
1 + σ22 L1L2 = σ1 1 + σ22 .
F.4 Robust radius of input Lemma 6 Let m : R → R be a monotone, invertible function. Suppose that F : Rd → P(Y) is a soft classifier, and moreover, the function x 7→ m(F (x)y) is L-Lipschitz in norm || · ||, for every y ∈ Y . Let a and b are the most likely classes which are denoted as a = argmaxy∈Y G(x)y and b = argmaxy∈Y\aG(x)y, respectively, and their corresponding probabilities are pa and pb, then, we have that argmaxy∈Y F (x
′) = a for all x′ so that ||x′ − x|| < 12L(m(pa)−m(pb)). Proof 6 As x 7→ m(F (x)y) is L-Lipschitz, we know that for any x′ within ball 12L(m(pa) − m(pb)), we have:
|m(F (x′)a)−m(F (x)a)| = |m(F (x′)a)−m(pa)|
≤ L∥x′ − x∥ < 1 2 (m(pa)−m(pb))
In particular, this implies that m(F (x′)a) > 1 2(m(pa) +m(pb)). However, for any y ̸= a, by the same logic,
m(F (x′)y) < m(F (x)y) + 1
2 (m(pa)−m(pb))
≤ 1 2 (m(pa) +m(pb)) < m(F (x ′)a)
Hence, argmaxy∈Y F (x ′) = a.
Theorem 2 Let F : Rd → P(Y) be any soft classifier, let σ > 0, and let G be its associated soft classifier, Let
a = argmax y∈Y G(x)y and b = argmax y∈Y\a G(x)y
be two most likely classes for x according to G. Then, we have that argmaxy∈Y G(x ′)y = a for x′ satisfying
∥∥x′ − x ∥∥ 2 ≤ 1 + σ 2 2
2σ1 (Φ−1(pa)− Φ−1(pb))
Proof 7 Follows from Lemma 5 and Lemma 6.
Theorem 2 implies that a prediction of the smoothed network is robust around the input x within a radius of 1+σ 2 2
2σ1 (Φ−1(pa)−Φ−1(pb)). The
robust radius of the proposed randomized smoothing approach is scaled by a factor of (1 + σ22) > 1.
A.5 Generalization to multi-layer
Theorem 2 can be generalized to a multi-layer perturbation approach for a multi-layer network F = f1 ◦ f2 ◦ · · · ◦ fL by repetitively applying Lemma 3. Then, the new smoothed classifier G is σ1/ ∏L l=2(1 + σ 2 l )-Lipschitz and it yields Theorem 1 with Lemma 6 by iterative use of Lemma 3 with Lemma 6.
A.6 De-noising effect of the gradient-guided masked inference
The de-noising effect of the gradient-guided masked inference (MI) can be understood via its impact on the Lipschitz continuity of a soft classifier F : Rd → P(Y). Let’s consider a case where we have an input sequence s and its perturbed sequence s′. Then, their distributed representations are x and x′, respectively. Subsequently, let L be the maximum gradient for masking, then a classifier F is L-Lipschitz, as the first derivatives is bounded by the max gradient L. The Lipschitz property is given by
|F (x′)− F (x)| ≤ L|x′ − x| .
The proposed gradient-guided masking process lowers the Lipschitz constant ofF through masking a token under a guidance of max gradient signals. It implies that F will become L′-Lipschitz, where L′ < L and it can be represented as follows:
|F (x̂)− F (x)| ≤ L′|x̂− x| < L|x′ − x| ,
where x̂ is the max gradient-guided masked word embeddings. As shown in the above equation, MI can effectively lower the upper bound of the prediction change and increases a chance of pushing the model prediction to fall into the robustness radius derived by the randomized smoothing method.
ACL 2023 Responsible NLP Checklist

heading: A For every submission:
text: 3 A1. Did you describe the limitations of your work?
6
3 A2. Did you discuss any potential risks of your work? 7
3 A3. Do the abstract and introduction summarize the paper’s main claims? 1
7 A4. Have you used AI writing assistants when working on this paper? Left blank.
B 3 Did you use or create scientific artifacts? 4
3 B1. Did you cite the creators of artifacts you used? 3
B2. Did you discuss the license or terms for use and / or distribution of any artifacts? No response.
B3. Did you discuss if your use of existing artifact(s) was consistent with their intended use, provided that it was specified? For the artifacts you create, do you specify intended use and whether that is compatible with the original access conditions (in particular, derivatives of data accessed for research purposes should not be used outside of research contexts)? No response.
B4. Did you discuss the steps taken to check whether the data that was collected / used contains any information that names or uniquely identifies individual people or offensive content, and the steps taken to protect / anonymize it? Not applicable. Left blank.
3 B5. Did you provide documentation of the artifacts, e.g., coverage of domains, languages, and linguistic phenomena, demographic groups represented, etc.? F
B6. Did you report relevant statistics like the number of examples, details of train / test / dev splits, etc. for the data that you used / created? Even for commonly-used benchmark datasets, include the number of examples in train / validation / test splits, as these provide necessary context for a reader to understand experimental results. For example, small differences in accuracy on large test sets may be significant, while on small test sets they may not be. No response.
C 3 Did you run computational experiments? 4
3 C1. Did you report the number of parameters in the models used, the total computational budget (e.g., GPU hours), and computing infrastructure used? D,F
The Responsible NLP Checklist used at ACL 2023 is adopted from NAACL 2022, with the addition of a question on AI writing assistance.
3 C2. Did you discuss the experimental setup, including hyperparameter search and best-found hyperparameter values? F
3 C3. Did you report descriptive statistics about your results (e.g., error bars around results, summary statistics from sets of experiments), and is it transparent whether you are reporting the max, mean, etc. or just a single run? 4,A
3 C4. If you used existing packages (e.g., for preprocessing, for normalization, or for evaluation), did you report the implementation, model, and parameter settings used (e.g., NLTK, Spacy, ROUGE, etc.)? F
D 7 Did you use human annotators (e.g., crowdworkers) or research with human participants? Left blank.
D1. Did you report the full text of instructions given to participants, including e.g., screenshots, disclaimers of any risks to participants or annotators, etc.? No response.
D2. Did you report information about how you recruited (e.g., crowdsourcing platform, students) and paid participants, and discuss if such payment is adequate given the participants’ demographic (e.g., country of residence)? No response.
D3. Did you discuss whether and how consent was obtained from people whose data you’re using/curating? For example, if you collected data via crowdsourcing, did your instructions to crowdworkers explain how the data would be used? No response.
D4. Was the data collection protocol approved (or determined exempt) by an ethics review board? No response.
D5. Did you report the basic demographic and geographic characteristics of the annotator population that is the source of the data? No response.

heading: Future Work
text: In our future work, we will explore the theoretical understanding of the certified-robustness of NLP systems and textual adversarial examples in-depth