Prior Knowledge-Guided Adversarial Training (2024)

Abstract: We introduce a simple yet effective Prior Knowledge-Guided ADVersarial Training (PKG-ADV) algorithm to improve adversarial training for natural language understanding. Our method simply utilizes task-specific label distribution to guide the training process. By prioritizing the use of prior knowledge of labels, we aim to generate more informative adversarial perturbations. We apply our model to several challenging temporal reasoning tasks. Our method enables a more reliable and controllable data training process than relying on randomized adversarial perturbation. Albeit simple, our method achieved significant improvements in these tasks. To facilitate further research, we will release the code and models.

heading: 1 Introduction
text: Class imbalance, a classification setting where one or multiple classes (minority classes) are considerably less frequent than others (majority classes), is a common yet challenging problem in natural language processing (NLP) (Henning et al., 2023). The uneven distribution of target categories often leads to lower performance for minority classes. Despite that, NLP research often overlooks the importance of incorporating methods for addressing it, and finding effective solutions remains an open research challenge (Henning et al., 2023). While deep learning models have been successful in various NLP tasks, they are sensitive to changes in the input data distribution.
We explore the use of adversarial training techniques to enhance model performance on such scenarios. More specifically, our proposed approach incorporates the knowledge of task-specific label distribution into the adversarial training process. Typically, the perturbation direction is chosen to mislead the model to flip the current model prediction away from the correct label. However, this strategy might not be optimal because it does not
make use of the knowledge of task-specific label distribution during the training process. We hypothesize that such information might indicate which category a model is more likely to misclassify as another category. We focus on temporal reasoning tasks. These tasks are essential for NLP, for timing events, for estimating their duration, frequencies, ordering, etc. Due to the nature of the task, classes are highly imbalanced, as shown in Figure 1 and Table 2. Even the performance of recent large language models (LLMs), such as ChatGPT, is still underperformed by a large margin by simpler and smaller models such as BERT and RoBERTa (Yuan et al., 2023; Chan et al., 2024), indicating the inherent challenge of temporal reasoning tasks. For instance, on the TB-Dense dataset (Cassidy et al., 2014), due to the high label imbalance, the model might misclassify the samples with the true label “VAGUE” as “BEFORE” or "AFTER", as these labels occur more often in the dataset, as shown in Figure 1. Our model, PKG-ADV , can intentionally attack those vulnerable categories and learn how to better distinguish each label class, improving the model performance.
Our experimental results show that, despite its simplicity, our proposed model outperforms standard fine-tuning and a strong adversarial training method on several challenging temporal reasoning tasks. Moreover, our model can outperform ChatGPT-based models with a large gap. Our findings contribute to the understanding and improvement of adversarial training in NLP and can help enhance model performance in scenarios with imbalanced classes, such as temporal reasoning tasks.

heading: 2 Adversarial Training for NLP
text: Standard training objectives seek to learn a function (a classifier) f(x; θ) : x → C, parametrized by θ, where C is the class label set. Given a training dataset D of input-output pairs (x, y)
51
and the loss function l(., .) (e.g., cross entropy), f(x; θ) is trained to minimize the empirical risk:
minθ E(x,y)∼D[l(f(x; θ), y)]. While this is effective in training a classifier, it usually suffers from overfitting and poor generalization to unseen cases. Recently, adversarial training has been proven effective in several tasks in nlp (Zhu et al., 2019; Jiang et al., 2019; Pereira et al., 2020). The standard approach is to add the adversarial perturbation to the embeddings. The input is augmented with a small perturbation that maximizes the adversarial loss:
min θ E(x,y)∼D[max δ l(f(x+ δ; θ), y)],
where the inner maximization can be solved by projected gradient descent (Madry et al., 2017). More recent approaches have explored adding the perturbation to other layers of the model (Pereira et al., 2021). Although these adversarial training algorithms substantially enhance model performance and generalization, such methods adopt non-targeted attacks, where the model prediction is not driven towards a specific incorrect label, i.e., such attacks lack a specific target. This might not be optimal, since many natural language processing (NLP) tasks are naturally imbalanced, as some labels occur much more frequently than others. In Figure 1, we illustrate this typical label imbalance scenario with the MATRES dataset (Ning et al., 2018a). Thus, there are consistently classes where the trained classifier may exhibit a higher error rate. This information can highlight the models’ weaknesses. Our goal is to incorporate this prior knowledge to enhance model performance.

heading: 3 Prior Knowledge Guided Adversarial
text: Training
In our work, we propose to enhance the ALICE (Pereira et al., 2020) algorithm. ALICE is an adversarial training algorithm that combines the two approaches to estimate the perturbation δ: one that uses the label y (Zhu et al., 2019) and another that uses the model prediction f(x; θ), i.e., a "virtual" label (Miyato et al., 2018; Jiang et al., 2019). The first goal is to improve the robustness of our target label by preventing an increase in error for unperturbed inputs. The second goal is to enforce model smoothness, ensuring the model’s output does not change significantly when a small perturbation is injected to the input. The formula of ALICE is shown below:
Algorithm 1 PKG-ADV : We explore incorporating the knowledge of task-specific label distribution into the adversarial training process. The two lines in blue color are the only changes from ALICE. Input: T : the total number of iterations, X = {(x1, y1), . . . , (xn, yn)}: the dataset, f(x; θ): the machine learning model parametrized by θ, σ2: the variance of the random initialization of perturbation δ1 and δ2, δ1r and δ2r : the perturbations added to the embedding vector, ϵ: perturbation bound, K: the number of iterations for perturbation estimation, η: the step size for updating perturbation, τ : the global learning rate, α: the smoothing proportion of adversarial training in the augmented learning objective, Π: the projection operation and C: the classes.
1: for t = 1, .., T do 2: for (x, y) ∈ X do 3: δ1 ∼ N (0, σ2I) 4: δ2 ∼ N (0, σ2I) 5: yt = sample(C\y) 6: for m = 1, ..,K do 7: gadv ← ∇δ1 l(f(x+ δ1; θ), yt) 8: δ1 ← Π∥δ1∥∞≤ϵ(δ1 − ηgadv) 9: gadv ← ∇δ2 l(f(x+ δ2; θ), f(x; θ))
10: δ2 ← Π∥δ2∥∞≤ϵ(δ2 + ηgadv) 11: end for 12: gθ ← ∇θl(f(x+ δ1; θ), y) +α∇θl(f(x+ δ2; θ), f(x; θ)) 13: θ ← θ − τgθ 14: end for 15: end for Output: θ
min θ E(x,y)∼D[max δ1 l(f(x+ δ1; θ), y)+
αmax δ2 l(f(x+ δ2; θ), f(x; θ))],
(1)
where δ1 and δ2 are two different perturbations, bounded by a general lp norm ball, estimated by a fixed K steps of the gradient-based optimization approach and p = ∞. Effectively, the second term encourages smoothness in the input neighborhood, and α is a hyperparameter that controls the tradeoff between standard errors and adversarial errors. ALICE has been originally applied for the commonsense reasoning task, however, it is a general algorithm that can be applied to other tasks as well.
We enhance ALICE by modifying the first term of Equation 1, to improve the robustness of our target label. PKG-ADV first samples a label from the class label set (excluding the correct label). This label class is sampled with a probability proportional to its frequency in the training dataset. Intuitively, we would like to focus training on prior knowledge at hand. This knowledge consists of the dataset label information, generated offline.
More specifically, PKG-ADV explicitly picks a target yt ̸= y and tries to steer the model towards yt. We accomplish this by sampling yt from C\y = C − {y} in proportion to the dataset label distribution. PKG-ADV can flexibly use different prior knowledge, i.e. the dataset label information, as shown in line 5. Then the adversarial sample is estimated by the opposite direction as in line 8. The two lines in blue color are the only changes from ALICE. At last, following Jiang et al. (2019) and Miyato et al. (2018), the adversarial regularizer is added to the standard training objective (e.g., cross-entropy between the correct label and prediction). The algorithm of PKG-ADV is depicted in Algorithm 1.

heading: 4 Experiments
text: We compare PKG-ADV with ALICE (Pereira et al., 2020), a strong adversarial training baseline, and several state-of-the-art temporal reasoning models. We use the standard uncased RoBERTaBASE model (Liu et al., 2019b) as the text encoder, unless noted otherwise.

heading: 4.1 Datasets and Evaluation Metrics
text: We evaluated our model on the following tasks: temporal ordering prediction task, event duration prediction, and temporal commonsense reasoning. We used the following datasets, respectively: MATRES (Ning et al., 2018b), TimeML (Pan et al., 2006), MC-TACO (Ben Zhou and Roth, 2019), TBDense (Cassidy et al., 2014), and MAVEN-ERE (Wang et al., 2022). Details of each dataset are in Appendix A. We evaluate the performance of MATRES and MAVEN-ERE in terms of accuracy and F1-score, and TimeML in terms of accuracy. For the MC-TACO and TB-Dense datasets, we report F1 scores.

heading: 4.2 Implementation Details
text: Our model implementation is based on the MTDNN framework (Liu et al., 2019a, 2020). We use RoBERTaBASE (Liu et al., 2019b) as the text encoder. RoBERTa remains a competitive pretrained model for its size among NLP practitioners. We used ADAM (Kingma and Ba, 2014) as our optimizer with a learning rate in the range ∈ {9 × 10−6, 1 × 10−5} and a batch size in the range ∈ {16, 32, 64}. The maximum number of epochs was set to 10. A linear learning rate decay schedule with warm-up over 0.1 was used unless stated otherwise. To avoid gradient exploding, we
clipped the gradient norm within 1. All the texts were tokenized using WordPiece and were chopped to spans no longer than 512 tokens. We also set the dropout rate of all the task-specific layers as 0.3. During adversarial training, we follow Jiang et al. (2019) and set the perturbation size to 1 × 10−5, the step size to 1× 10−3, and to 1× 10−5 the variance for initializing perturbation. We search the regularization weight α in {0.01, 0.1, 1}. We set the number of projected gradient steps to 1.

heading: 4.3 Main Results
text: We present our results in Table 1. We compare our model, PKG-ADV , with ALICE and other temporal reasoning models. Overall, the adversarial methods, ALICE and PKG-ADV , were able to outperform the standard fine-tuning approach (Standard) and the other baselines, without using any additional knowledge source, and without using any additional datasets other than the target task datasets. Overall, PKG-ADV was able to outperform the other baselines. Kimura et al. (2022) trains an ALBERT XXLarge v2 model using multi-task learning with several additional temporal datasets. Note that ALBERT XXLarge v2 is around 2x larger than the RoBERTa_BASE model. Except on the MATRES dataset, our PKG-ADV model trained on RoBERTa_BASE can outperform their model, without using any additional dataset. Bian et al. (2023) and Chan et al. (2024) use zero-shot inference and designs prompt templates for different datasets in the ChatGPT and ChatGPT_Prompt baselines. In the ChatGPT_PE baseline, Chan et al. (2024) manually designed a more sophisticated prompt template based on the expert understanding. The ChatGPT_ICL baseline refers to the in-context learning approach (Brown et al., 2020), where a
number of input-output exemplars for the prompt were manually selected. We observe that still there is a considerable gap between these models and that of supervised methods. Chan et al. (2024) hypothesizes that the poor performance of ChatGPT might be attributed to inadequate human feedback during the model’s training process on temporal features.

heading: 5 Conclusion
text: We have presented a Prior Knowledge Guided Adversarial Training (PKG-ADV) algorithm to improve adversarial training for natural language understanding. Albeit simple and drawn from a simple observation (label imbalance, common in most nlp tasks), incorporating task-specific label distribution into the training process for generating better adversarial perturbations has not yet been explored in the literature. PKG-ADV overall shows superior performance compared to standard fine-tuning, strong adversarial training baselines, and ChatGPTbased baselines. PKG-ADV can be applied to other language models as well by incorporating label distribution information. Other types of knowledge, such as annotator agreement data, might help further enhance the performance, and we leave this for future work.

heading: 6 Limitations and Ethical Statement
text: Although our method is task, model, and languageagnostic, we have conducted experiments only on English classification benchmarks, and using only the RoBERTa model. We focus on sentence-level tasks at this time. Although we focused on temporal reasoning tasks, our model can be generalized to other tasks as well. We plan to expand the scope of the experiments in the future. In our work, we have
only used publicly available datasets in our experiments, ensuring that there are no privacy concerns or violations.

heading: Acknowledgments
text: We thank the reviewers for their helpful feedback. This work has been supported by the project KAKENHI ID: 21K17802.

heading: A Evaluation Datasets
text: TimeML (Pan et al., 2006): This task involves predicting whether a given event has a duration longer or shorter than a day. TB-Dense (Cassidy et al., 2014): TB-Dense is a public benchmark for temporal relation extraction (TRE). It was annotated from TimeBank (Pustejovsky et al., 2003) and TempEval (UzZaman et al., 2013). Given a passage and two event points, the task is to classify the relations between events into one of 6 types: BEFORE, AFTER, SIMULTANEOUS, VAGUE, IS_INCLUDED, and INCLUDES. An example of a sentence with two events, e1 and e2 (in bold) that hold the SIMULTANEOUS relation is shown below:
Nobody (e1:hurried) her up. No one (e2:held) her back.
MATRES (Ning et al., 2018b): This dataset was annotated from TimeBank (Pustejovsky et al., 2003), AQUAINT, and Platinum documents. The task involves predicting the temporal relation between a pair of input events in a span of text. It originally contains 13,577 pairs of events annotated with a temporal relation (BEFORE, AFTER, EQUAL, VAGUE). The relations named EQUAL and VAGUE are equivalent to SIMULTANEOUS and NONE in TB-Dense. An example of a sentence with two events, e1 and e2 (in bold) that hold the BEFORE relation is shown below:
At one point , when it (e1:became) clear controllers could not contact the plane, someone (e2:said) a prayer.
MC-TACO (Ben Zhou and Roth, 2019): This task entirely focuses on temporal commonsense reasoning. It considers five temporal properties, (1) duration (how long an event takes), (2) temporal ordering (typical order of events), (3) typical time (when an event occurs), (4) frequency (how often an event occurs), and (5) stationarity (whether a state is maintained for a very long time or indefinitely). It contains 13k tuples, each consisting of a sentence, a question, and a candidate answer, that should be judged as plausible or not. An example from the dataset is below. The correct answer is in bold.
Paragraph: Carl Laemmle, head of Universal Studios, gave Einstein a tour of his studio and introduced him to Chaplin.
Question: How long did the tour last?
a) 9 hours
b) 45 minutes
c) 15 days
d) 5 seconds
MAVEN-ERE (Wang et al., 2022): This is a unified large-scale human-annotated event relation extraction dataset. It was annotated at the document level from Wikipedia and FrameNet (Baker et al., 1998), for four tasks: event coreference, temporal, causal, and subevent relations. In our work, we focus on the sentence level temporal event pair relations. Given a passage and two event points, the task is to classify the relations between
events into one of 6 types: BEFORE, SIMULTANEOUS, CONTAINS, OVERLAP, ENDS-ON, and BEGINS-ON. Despite its larger size, the authors highlight that the label distribution in the dataset is severely unbalanced, but decided to keep the unbalanced distribution so that the dataset reflects the real-world data distribution (Wang et al., 2022). An example of a sentence with two events, e1 and e2 (in bold) that hold the BEFORE relation is shown below:
It (e1: turned) again to 270 then began an abnormal (e2: descent).

heading: Future Work
text: We plan to expand the scope of the experiments in the future. In our work, we have
only used publicly available datasets in our experiments, ensuring that there are no privacy concerns or violations