Original: T OWARDS R OBUSTNESS A GAINST N ATURAL L ANGUAGE W ORD S UBSTITUTIONS
Revised: T OWARDS R OBUSTNESS A GAINST N ATURAL L ANGUAGE W ORD S UBSTITUTIONS

Original: Anonymous authors

Original: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: Robustness against word substitutions has a well-deﬁned and widely acceptable form, i.e. , using semantically similar words as substitutions, and thus it is considered as a fundamental stepping-stone towards broader robustness in natural language processing.
Revised: Robustness against word substitutions has a well-deﬁned and widely acceptable form, i.e. , using semantically similar words as substitutions, and thus it is considered as a fundamental stepping-stone towards broader robustness in natural language processing.

Original: Previous defense methods capture word substitutions in vector space by using either l 2 -ball or hyper-rectangle, which results in perturbation sets that are not inclusive enough or unnecessarily large, and thus impedes mimicry of worst cases for robust training.
Revised: Previous defense methods capture word substitutions in vector space by using either l 2 -ball or hyper-rectangle, which results in perturbation sets that are not inclusive enough or unnecessarily large, and thus impedes mimicry of worst cases for robust training.

Original: In this paper, we introduce a novel
Revised: In this paper, we introduce a novel

Original: Adversarial Sparse Convex Combination (ASCC) method.
Revised: Adversarial Sparse Convex Combination (ASCC) method.

Original: We model the word substitution attack space as a convex hull and leverages a regularization term to enforce perturbation towards an actual substitution, thus aligning our modeling better with the discrete textual space.
Revised: We model the word substitution attack space as a convex hull and leverages a regularization term to enforce perturbation towards an actual substitution, thus aligning our modeling better with the discrete textual space.

Original: Based on the ASCC method, we further propose ASCC-defense, which leverages ASCC to generate worst-case perturbations and incorporates adversarial training towards robustness.
Revised: Based on the ASCC method, we further propose ASCC-defense, which leverages ASCC to generate worst-case perturbations and incorporates adversarial training towards robustness.

Original: Experiments show that
Revised: Experiments show that

Original: ASCC-defense outperforms the current state-of-the-arts in terms of robustness on two prevailing NLP tasks, i.e. , sentiment analysis and natural language inference, concerning several attacks across multiple model architectures.
Revised: ASCC-defense outperforms the current state-of-the-arts in terms of robustness on two prevailing NLP tasks, i.e. , sentiment analysis and natural language inference, concerning several attacks across multiple model architectures.

Original: Besides, we also envision a new class of defense towards robustness in NLP, where our robustly trained word vectors can be plugged into a normally trained model and enforce its robustness without applying any other defense techniques.
Revised: Besides, we also envision a new class of defense towards robustness in NLP, where our robustly trained word vectors can be plugged into a normally trained model and enforce its robustness without applying any other defense techniques.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Recent extensive studies have shown that deep neural networks (DNNs) are vulnerable to adversarial2 attacks (Szegedy et al., 2013; Goodfellow et al., 2015; Papernot et al., 2016a; Kurakin et al., 2017;3 Alzantot et al., 2018); e.g. , minor phrase modiﬁcation can easily deceive Google’s toxic comment4 detection systems (Hosseini et al., 2017).
Revised: Recent extensive studies have shown that deep neural networks (DNNs) are vulnerable to adversarial attacks (Szegedy et al., 2013; Goodfellow et al., 2015; Papernot et al., 2016a; Kurakin et al., 2017; Alzantot et al., 2018); e.g. , minor phrase modiﬁcation can easily deceive Google’s toxic comment detection systems (Hosseini et al., 2017).

Original: This raises grand security challenges to advanced natural5 language processing (NLP) systems, such as malware detection and spam ﬁltering, where DNNs6 have been broadly deployed (Stringhini et al., 2010; Kolter & Maloof, 2006).
Revised: This raises grand security challenges to advanced natural language processing (NLP) systems, such as malware detection and spam ﬁltering, where DNNs have been broadly deployed (Stringhini et al., 2010; Kolter & Maloof, 2006).

Original: As a consequence, the7 research on defending against natural language adversarial attacks has attracted increasing attention.
Revised: As a consequence, the research on defending against natural language adversarial attacks has attracted increasing attention.

Original: Existing adversarial attacks in NLP can be categorized into three folds: (i) character-level modiﬁca9 tions (Belinkov & Bisk, 2018; Gao et al., 2018; Eger et al., 2019), (ii) deleting, adding, or swapping10 words (Liang et al., 2017; Jia & Liang, 2017; Iyyer et al., 2018), and (iii) word substitutions using11 semantically similar words (Alzantot et al., 2018;
Revised: Existing adversarial attacks in NLP can be categorized into three folds: (i) character-level modiﬁcations (Belinkov & Bisk, 2018; Gao et al., 2018; Eger et al., 2019), (ii) deleting, adding, or swapping words (Liang et al., 2017; Jia & Liang, 2017; Iyyer et al., 2018), and (iii) word substitutions using semantically similar words (Alzantot et al., 2018;

Original: Ren et al., 2019; Zang et al., 2020).
Revised: Ren et al., 2019; Zang et al., 2020).

Original: The ﬁrst two12 attack types usually break the grammaticality and naturality of the original input sentences, and thus13 can be detected by spell or grammar checker (Pruthi et al., 2019).
Revised: The ﬁrst two attack types usually break the grammaticality and naturality of the original input sentences, and thus can be detected by spell or grammar checker (Pruthi et al., 2019).

Original: In contrast, the third attack type14 only substitutes words with semantically similar words, thus preserves the syntactic and semantics15 of the original input to the most considerable extent and are very hard to discern, even from a hu16 man’s perspective.
Revised: In contrast, the third attack type only substitutes words with semantically similar words, thus preserves the syntactic and semantics of the original input to the most considerable extent and are very hard to discern, even from a human’s perspective.

Original: Therefore, building robustness against such word substitutions is a fundamental17 stepping stone towards robustness in NLP, which is the focus of this paper.
Revised: Therefore, building robustness against such word substitutions is a fundamental stepping stone towards robustness in NLP, which is the focus of this paper.

Original: Adversarial attack by word substitution is a combinatorial optimization problem.
Revised: Adversarial attack by word substitution is a combinatorial optimization problem.

Original: Solving this prob19 lem in the discrete textual space is considered NP-hard as the searching space increases exponen20 tially with the length of the input.
Revised: Solving this problem in the discrete textual space is considered NP-hard as the searching space increases exponentially with the length of the input.

Original: As such, many methods have been proposed to model word21 substitutions in the continuous word vector space (Sato et al., 2018;
Revised: As such, many methods have been proposed to model word substitutions in the continuous word vector space (Sato et al., 2018;

Original: Gong et al., 2018;Jia et al.,
Revised: Gong et al., 2018;

Original:  2019; Huang et al., 2019), so that they can leverage the gradients generated by a victim model eitherfor attack or robust training.
Revised: Jia et al., 2019; Huang et al., 2019), so that they can leverage the gradients generated by a victim model either for attack or robust training.

Original: However, previous methods capture word substitutions in the vectorspace by using either l 2 -ball or hyper-rectangle, which results in perturbation sets that are not inclusive enough or unnecessarily large, and thus impedes precise mimicry of the worst cases for robusttraining (see Fig.
Revised: However, previous methods capture word substitutions in the vector space by using either l 2 -ball or hyper-rectangle, which results in perturbation sets that are not inclusive enough or unnecessarily large, and thus impedes precise mimicry of the worst cases for robust training (see Fig.

Original: 1 for an illustration).
Revised: 1 for an illustration).

Original: In this paper, we introduce a novel Adversarial Sparse Convex Combination (ASCC) method, whosekey idea is to model the solution space as a convex hull of word vectors.
Revised: In this paper, we introduce a novel Adversarial Sparse Convex Combination (ASCC) method, whose key idea is to model the solution space as a convex hull of word vectors.

Original: Using a convex hull bringstwo advantages: ( i ) a continuous convex space is beneﬁcial for gradient-based adversary generation,and ( ii ) the convex hull is, by deﬁnition, the smallest convex set that contains all substitutions, thus isinclusive enough to cover all possible substitutions while ruling out unnecessary cases.
Revised: Using a convex hull brings two advantages: ( i ) a continuous convex space is beneﬁcial for gradient-based adversary generation, and ( ii ) the convex hull is, by deﬁnition, the smallest convex set that contains all substitutions, thus is inclusive enough to cover all possible substitutions while ruling out unnecessary cases.

Original: In particular,we leverage a regularization term to encourage adversary towards an actual substitution, whichaligns our modeling better with the discrete textual space.
Revised: In particular, we leverage a regularization term to encourage adversary towards an actual substitution, which aligns our modeling better with the discrete textual space.

Original: We further propose ASCC-defense, whichemploys the ASCC to generate adversaries and incorporates adversarial training to gain robustness.
Revised: We further propose ASCC-defense, which employs the ASCC to generate adversaries and incorporates adversarial training to gain robustness.

Original: We evaluate ASCC-defense on two prevailing NLP tasks, i.e. , sentiment analysis on IMDB andnatural language inference on SNLI, across four model architectures, concerning two common attackmethods.
Revised: We evaluate ASCC-defense on two prevailing NLP tasks, i.e. , sentiment analysis on IMDB and natural language inference on SNLI, across four model architectures, concerning two common attack methods.

Original: Experimental results show that our method consistently yields models that are more robustthan the state-of-the-arts with signiﬁcant margins; e.g. , we achieve 79 .
Revised: Experimental results show that our method consistently yields models that are more robust than the state-of-the-arts with signiﬁcant margins; e.g. , we achieve 79 .

Original: 0% accuracy under Geneticattacks on IMDB while the state-of-the-art performance is 75 . 0% .
Revised: 0% accuracy under Genetic attacks on IMDB while the state-of-the-art performance is 75 . 0% .

Original: Besides, our robustly trained wordvectors can be easily plugged into standard NLP models and enforce robustness without applyingany other defense techniques, which envisions a new class of approach towards NLP robustness.
Revised: Besides, our robustly trained word vectors can be easily plugged into standard NLP models and enforce robustness without applying any other defense techniques, which envisions a new class of approach towards NLP robustness.

Original: For instance, using our pre-trained word vectors as initialization enhances a normal LSTM model toachieve 73 .
Revised: For instance, using our pre-trained word vectors as initialization enhances a normal LSTM model to achieve 73 .

Original: 4% robust accuracy, while the state-of-the-art defense and the undefended model achieve72 .
Revised: 4% robust accuracy, while the state-of-the-art defense and the undefended model achieve 72 .

Original: 5% and 7 . 9% , respectively.
Revised: 5% and 7 . 9% , respectively.

Original:  P RELIMINARIES2. N OTATIONS AND P ROBLEM S ETTING
Revised:  P RELIMINARIES 2. N OTATIONS AND P ROBLEM S ETTING

Original: In this paper, we focus on text classiﬁcation problem to introduce our method, while it can also beextended to other NLP tasks.
Revised: In this paper, we focus on text classiﬁcation problem to introduce our method, while it can also be extended to other NLP tasks.

Original: We assume we are interested in training classiﬁer X
Revised: We assume we are interested in training classiﬁer X

Original: → Y that predictslabel y ∈ Y given input x ∈ X .
Revised: → Y that predicts label y ∈ Y given input x ∈ X .

Original: The input x is a textual sequence of L words { x i } Li =1 .
Revised: The input x is a textual sequence of L words { x i } Li =1 .

Original: We considerthe most common practice for NLP tasks where the ﬁrst step is to map x into a sequence of vectorsin a low-dimensional embedding space, which is denoted as v ( x ) .
Revised: We consider the most common practice for NLP tasks where the ﬁrst step is to map x into a sequence of vectors in a low-dimensional embedding space, which is denoted as v ( x ) .

Original: The classiﬁer is then formulatedas p ( y | v ( x )) , where p can be parameterized by using a neural network, e.g. , CNN or LSTM model.
Revised: The classiﬁer is then formulated as p ( y | v ( x )) , where p can be parameterized by using a neural network, e.g. , CNN or LSTM model.

Original: We examine the robustness of a model against adversarial word substitutions (Alzantot et al., 2018;
Revised: We examine the robustness of a model against adversarial word substitutions (Alzantot et al., 2018;

Original: Ren et al., 2019).
Revised: Ren et al., 2019).

Original: Speciﬁcally, any word x i in x can be substituted with any word ˆ x i in S ( x i ) =
Revised: Speciﬁcally, any word x i in x can be substituted with any word ˆ x i in S ( x i ) =

Original: { S ( x i ) j } T j =1 , where S ( x i ) represents a predeﬁned substitution set for x
Revised: { S ( x i ) j } Tj =1 , where S ( x i ) represents a predeﬁned substitution set for x

Original: i (including itself) and Tdenotes the number of elements in S ( x i ) .
Revised: i (including itself) and T denotes the number of elements in S ( x i ) .

Original: To ensure that ˆ x is likely to be grammatical and has thesame label as x , S ( x i ) is often comprised of semantically similar words of x i , e.g. , its synonyms.
Revised: To ensure that ˆ x is likely to be grammatical and has the same label as x , S ( x i ) is often comprised of semantically similar words of x i , e.g. , its synonyms.

Original: Attack algorithms such as Genetic attack (Alzantot et al., 2018) and PWWS attack (Ren et al. , 2019)aim to ﬁnd the worst-case ˆ x to fool a victim model, whereas our defense methods aim to buildrobustness against such substitutions.
Revised: Attack algorithms such as Genetic attack (Alzantot et al., 2018) and PWWS attack (Ren et al., 2019) aim to ﬁnd the worst-case ˆ x to fool a victim model, whereas our defense methods aim to build robustness against such substitutions.

Original: 2. P ERTURBATION S ET AT V ECTOR L EVEL
Revised: 2. P ERTURBATION S ET AT V ECTOR L EVEL

Original: Gradients provide crucial information about a victim model for adversary generation (Szegedy et al.,63 2013; Goodfellow et al., 2015).
Revised: Gradients provide crucial information about a victim model for adversary generation (Szegedy et al., 2013; Goodfellow et al., 2015).

Original: However, in NLP, the textual input space is neither continuous nor64 convex, which impedes effective use of gradients.
Revised: However, in NLP, the textual input space is neither continuous nor convex, which impedes effective use of gradients.

Original: Therefore, previous methods capture perturba65 tions in the vector space instead, by using the following simplexes (see Fig.1 for an illustration):
Revised: Therefore, previous methods capture perturbations in the vector space instead, by using the following simplexes (see Fig.1 for an illustration):

Original: L 2 -ball with a ﬁxed radius.
Revised: L 2 -ball with a ﬁxed radius.

Original: Miyato et al.
Revised: Miyato et al.

Original: (2017) ﬁrst introduced adversarial training to NLP tasks.
Revised: (2017) ﬁrst introduced adversarial training to NLP tasks.

Original: 67 They use a l 2 -ball with radius (cid:15) to constrain the perturbation, which is formulated as:
Revised: They use a l 2 -ball with radius (cid:15) to constrain the perturbation, which is formulated as:

Original: [Equation]
Revised: [Equation]

Original: where r denotes sequence-level perturbation in the word vector space and ˆ v denotes the adversar69 ial sequence of word vectors.
Revised: where r denotes sequence-level perturbation in the word vector space and ˆ v denotes the adversarial sequence of word vectors

Original: While such modeling initially considers l 2 -ball at the sentence-level,70 it can also be extended to word-level to capture substitutions.
Revised: While such modeling initially considers l 2 -ball at the sentence-level, it can also be extended to word-level to capture substitutions.

Original: Following that, Sato et al.
Revised: Following that, Sato et al.

Original: (2018) 71 and Barham & Feizi (2019) propose to additionally consider the directions towards each substitu72 tion.
Revised: and Barham & Feizi (2019) propose to additionally consider the directions towards each substitution.

Original: However, they still use the l 2 -ball, which often fails to capture the geometry of substitutions73 precisely.
Revised: However, they still use the l 2 -ball, which often fails to capture the geometry of substitutions precisely.

Original: Axis aligned bounds.
Revised: Axis aligned bounds.

Original: Jia et al.
Revised: Jia et al.

Original: and
Revised: and

Original: Huang et al.
Revised: Huang et al.

Original: (2019) use axis-aligned bound to capture75 perturbations at the vector level.
Revised: (2019) use axis-aligned bound to capture perturbations at the vector level.

Original: They consider the smallest axis-aligned hyper-rectangular that76 contains all possible substitutions.
Revised: They consider the smallest axis-aligned hyper-rectangular that contains all possible substitutions.

Original: Such perturbation set provides useful properties for bound prop77 agation towards robustness.
Revised: Such perturbation set provides useful properties for bound propagation towards robustness.

Original: However, the volume of the unnecessary space it captures can grow78 with the depth of the model and grow exponentially with the dimension of the word vector space.
Revised: However, the volume of the unnecessary space it captures can grow with the depth of the model and grow exponentially with the dimension of the word vector space.

Original: Thus it ﬁts shallow architectures but often fails to utilize the capacity of neural networks fully.
Revised: Thus it ﬁts shallow architectures but often fails to utilize the capacity of neural networks fully.

Original: Besides, instead of fully deﬁning the vector-level geometry of substitutions, Ebrahimi et al.
Revised: Besides, instead of fully deﬁning the vector-level geometry of substitutions, Ebrahimi et al.

Original: (2018)81 propose to ﬁnd substitutions by ﬁrst-order approximation using directional gradients.
Revised: (2018) propose to ﬁnd substitutions by ﬁrst-order approximation using directional gradients.

Original: It is effective82 in bridging the gap between continuous embedding space and discrete textual space.
Revised: It is effective in bridging the gap between continuous embedding space and discrete textual space.

Original: However, it is83 based on local approximation, which often fails to ﬁnd global worst cases for robust training.
Revised: However, it is based on local approximation, which often fails to ﬁnd global worst cases for robust training.

Original:  M ETHODOLOGY
Revised:  M ETHODOLOGY

Original: In this section, we ﬁrst introduce the intuition of using a convex hull to capture substitutions.
Revised: In this section, we ﬁrst introduce the intuition of using a convex hull to capture substitutions.

Original: Then,86 we propose how Adversarial Sparse Convex Combination (ASCC) generates adversaries.
Revised: Then, we propose how Adversarial Sparse Convex Combination (ASCC) generates adversaries.

Original: Finally,87 we introduce ASCC-defense that incorporates adversarial training towards robustness.
Revised: Finally, we introduce ASCC-defense that incorporates adversarial training towards robustness.

Original: 3. O PTIMALITY OF U SING C ONVEX H ULL
Revised: 3. O PTIMALITY OF U SING C ONVEX H ULL

Original: From the perspective of adversarial defense, it is crucial to well capture the attack space of word90 substitutions.
Revised: From the perspective of adversarial defense, it is crucial to well capture the attack space of word substitutions.

Original: There are three aspects we need to consider: (i) Inclusiveness : the space should in91 clude all vectors of allowed substitutions to cover all possible cases.
Revised: There are three aspects we need to consider: (i) Inclusiveness : the space should include all vectors of allowed substitutions to cover all possible cases.

Original: (ii) Exclusiveness : on the basis92 of satisfying inclusiveness, the space should be as small as possible since a loose set can generate93 unnecessarily intricate perturbations, which impede a model from learning useful information.
Revised: (ii) Exclusiveness : on the basis of satisfying inclusiveness, the space should be as small as possible since a loose set can generate unnecessarily intricate perturbations, which impede a model from learning useful information.

Original: (iii)94 Optimization : the space should be convex and continuous to facilitate effective gradient-based op95 timization, whether the objective function is convex or not (Bertsekas, 1997; Jain & Kar, 2017).
Revised: (iii) Optimization : the space should be convex and continuous to facilitate effective gradient-based optimization, whether the objective function is convex or not (Bertsekas, 1997; Jain & Kar, 2017).

Original: Inspired by archetypal analysis (Cutler & Breiman, 1994), we propose to use a convex hull to build97 the attack space: the convex hull is a continuous space and, by deﬁnition, the minimal convex set98 containing all vectors of substitutions.
Revised: Inspired by archetypal analysis (Cutler & Breiman, 1994), we propose to use a convex hull to build the attack space: the convex hull is a continuous space and, by deﬁnition, the minimal convex set containing all vectors of substitutions.

Original: We argue that using a convex hull can satisfy all the above99 aspects (as illustrated in Fig.1), and thus it is considered as theoretical optimum.
Revised: We argue that using a convex hull can satisfy all the above aspects (as illustrated in Fig.1), and thus it is considered as theoretical optimum.

Original: 3. A DVERSARIAL S PARSE C ONVEX C OMBINATION
Revised: A DVERSARIAL S PARSE C ONVEX C OMBINATION

Original: Efﬁcient representation of and optimization over a convex hull.
Revised: Efﬁcient representation of and optimization over a convex hull.

Original: A classical workaround in literature for optimization over a constraint set is the projected gradient descent (Cauchy, 1847; Frank &
Revised: A classical workaround in literature for optimization over a constraint set is the projected gradient descent (Cauchy, 1847; Frank &

Original: Wolfe, 1956; Bubeck, 2014; Madry et al., 2018).
Revised: Wolfe, 1956; Bubeck, 2014; Madry et al., 2018).

Original: As for optimization over a convex hull, it necessitates characterizing the convex hull, e.g. , by vertexes, to perform projections.
Revised: As for optimization over a convex hull, it necessitates characterizing the convex hull, e.g. , by vertexes, to perform projections.

Original: However, computingvertexes is computationally unfavorable because we need to recalculate the vertexes whenever wordembeddings change, which frequently occurs during the training process.
Revised: However, computing vertexes is computationally unfavorable because we need to recalculate the vertexes whenever word embeddings change, which frequently occurs during the training process.

Original: In this paper, we propose a more efﬁcient fashion for optimization over the concerning convex hull,based on the following proposition (the proof of which lies in the deﬁnition of convex hull):
Revised: In this paper, we propose a more efﬁcient fashion for optimization over the concerning convex hull, based on the following proposition (the proof of which lies in the deﬁnition of convex hull):

Original: Proposition 1.
Revised: Proposition 1.

Original: Let S ( u ) =
Revised: Let S ( u ) =

Original: { S ( u ) 1 , ..., S ( u ) T } be the set of all substitutions of word u , conv S ( u ) bethe convex hull of word vectors of all elements in S ( u ) , and v ( · ) be the word vector function.
Revised: { S ( u ) 1 , ..., S ( u ) T } be the set of all substitutions of word u , conv S ( u ) be the convex hull of word vectors of all elements in S ( u ) , and v ( · ) be the word vector function.

Original: Then,we have conv 
Revised: Then, we have conv S ( u ) = { (cid:88) T i =

Original: [Equation]
Revised: 1 w i v ( S ( u ) i ) | (cid:88) T i = 1 w i = 1 , w i ≥ 0 } .

Original: According to Proposition 1, we can formulate ˆ v ( x i ) , which denotes any vector in the convex hullaround v ( x i ) , as:
Revised: According to Proposition 1, we can formulate ˆ v ( x i ) , which denotes any vector in the convex hull around v ( x i ) , as:

Original: [Equation]
Revised: [Equation]

Original: As such, we use Eq.2 to transform the original optimization on ˆ v ( x i ) to the optimization on w i ,the coefﬁcient of convex combination.
Revised: As such, we use Eq.2 to transform the original optimization on ˆ v ( x i ) to the optimization on w i , the coefﬁcient of convex combination.

Original: Considering that w i still belongs to a set with constraint{(cid:107) w i (cid:107) 1 = 1 , w ij ≥ 0 } , to achieve better ﬂexibilities of optimization, we introduce a variable ˆ w ∈ Rto relax the constraint on w by the following equation:
Revised: Considering that w i still belongs to a set with constraint {(cid:107) w i (cid:107) 1 = 1 , w ij ≥ 0 } , to achieve better ﬂexibilities of optimization, we introduce a variable ˆ w ∈ R to relax the constraint on w by the following equation:

Original: [Equation]
Revised: [Equation]

Original: After such relaxation in Eqs.2 and 3, we are able to optimize the objective function over the convexhull by optimizing ˆ w ∈ R .
Revised: After such relaxation in Eqs.2 and 3, we are able to optimize the objective function over the convex hull by optimizing ˆ w ∈ R .

Original: It provides a projection-free way to generate any adversaries inside theconvex hull using gradients. .
Revised: It provides a projection-free way to generate any adversaries inside the convex hull using gradients. .

Original: Gradient-based adversary generation.
Revised: Gradient-based adversary generation.

Original: Let L be a loss function concerning a classiﬁer.
Revised: Let L be a loss function concerning a classiﬁer.

Original: We cangenerate the worst-case convex combinations ˆ v ( x ) by ﬁnding the worst-case ˆ w :
Revised: We can generate the worst-case convex combinations ˆ v ( x ) by ﬁnding the worst-case ˆ w :

Original: [Equation]
Revised: [Equation]

Original: where L is classiﬁcation-related, e.g. , the cross-entropy loss over ˆ v ( x ) :
Revised: where L is classiﬁcation-related, e.g. , the cross-entropy loss over ˆ v ( x ) :

Original: [Equation]
Revised: [Equation]

Original: However, since we relax the discrete textual space to a convex hull in the vector space, any w i that(cid:107) w i (cid:107) 0 > 1 is highly possible to give rise to ˆ v ( x i ) that does not correspond to a real substitution.
Revised: However, since we relax the discrete textual space to a convex hull in the vector space, any w i that (cid:107) w i (cid:107) 0 > 1 is highly possible to give rise to ˆ v ( x i ) that does not correspond to a real substitution.

Original: To align better with the discrete nature of textual input, we propose to impose a regularizer on thecoefﬁcient of convex combination, w i .

Original: To be speciﬁc, we take w i as a probability distribution andminimize the entropy function of w i to softly encourage the l 0 sparsity of w i .

Original: We formulate thisword-level entropy-based regularization term as:

Original: [Equation]

Original: Combining loss function L and the entropy-based regularizer H , we here formulate Adversarial

Original: Sparse Convex Combination (ASCC) for adversary generation as:

Original: [Equation]

Original: [Equation]

Original: where α ≥ 0 is the weight controlling the regularization term (the effectiveness of which is validatedin Sec.4.3).

Original: Input : dataset D , parameters of Adam optimizer.
Revised: Input : dataset D , parameters of Adam optimizer.

Original: Output : parameters θ and φ .
Revised: Output : parameters θ and φ .

Original: 1: repeat 2: for random mini-batch ∼ D do 3: for every x , y in the mini-batch(in parallel) do 4:
Revised: 1: repeat 2: for random mini-batch ∼ D do 3: for every x , y in the mini-batch parallel) do 4:

Original: Solve the inner maximization in Eq.11 to ﬁnd the optimal ˆ w by Adam; 5:
Revised: Solve the inner maximization in Eq.11 to ﬁnd the optimal ˆ w by Adam; 5:

Original: Compute ˆ v ( x ) by Eq.10 using ˆ w and then compute the inner-maximum in Eq.11; 6: end for 7:
Revised: Compute ˆ v ( x ) by Eq.10 using ˆ w and then compute the inner-maximum in Eq.11; 6: end for 7:

Original: Update θ and φ by Adam to minimize the calculated inner-maximum; 8: end for 9: until the training converges.
Revised: Update θ and φ by Adam to minimize the calculated inner-maximum; 8: end for 9: until the training converges.

Revised: To align better with the discrete nature of textual input, we propose to impose a regularizer on the coefﬁcient of convex combination, w i .

Revised: To be speciﬁc, we take w i as a probability distribution and minimize the entropy function of w i to softly encourage the l 0 sparsity of w i .

Revised: We formulate this word-level entropy-based regularization term as:

Revised: [Equation]

Revised: Combining loss function L and the entropy-based regularizer H , we here formulate Adversarial

Original:  3. ASCC-D EFENSE T OWARDS R OBUSTNESS
Revised: Sparse Convex Combination (ASCC) for adversary generation as: [Equation] where α ≥ 0 is the weight controlling the regularization term (the effectiveness of which is validated in Sec.4.3). 3. ASCC-D EFENSE T OWARDS R OBUSTNESS

Original: We here introduce ASCC-defense, which uses ASCC for adversaries and employs adversarial training towards robustness.
Revised: We here introduce ASCC-defense, which uses ASCC for adversaries and employs adversarial training towards robustness.

Original: We denote θ and φ as the parameters of p ( y | v ( x )) and v ( x ) , respectively.
Revised: We denote θ and φ as the parameters of p ( y | v ( x )) and v ( x ) , respectively.

Original: Adversarial training paradigm for NLP.
Revised: Adversarial training paradigm for NLP.

Original: Adversarial training (Szegedy et al., 2013; Goodfellowet al., 2015; Madry et al., 2018) is currently one of the most effective ways to build robustness.
Revised: Adversarial training (Szegedy et al., 2013; Goodfellow et al., 2015; Madry et al., 2018) is currently one of the most effective ways to build robustness.

Original: Miyato et al.
Revised: Miyato et al.

Original: (2017) are the ﬁrst to use adversarial training for text classiﬁcation.
Revised: (2017) are the ﬁrst to use adversarial training for text classiﬁcation.

Original: They use l 2 -ballwith radius (cid:15) to restrict perturbations and the training objective can be deﬁned as:
Revised: They use l 2 -ball with radius (cid:15) to restrict perturbations and the training objective can be deﬁned as:

Original: [Equation]

Original: [Equation]
Revised: [Equation]

Original: where r denotes the perturbations in the vector space and L denotes a classiﬁcation-related loss.
Revised: where r denotes the perturbations in the vector space and L denotes a classiﬁcation-related loss.

Original: Therefore, maximizing L can generate adversarial perturbations r to fool a victim model, whereasminimizing L can let the model learn to predict under perturbations.
Revised: Therefore, maximizing L can generate adversarial perturbations r to fool a victim model, whereas minimizing L can let the model learn to predict under perturbations.

Original: ASCC-Defense.
Revised: ASCC-Defense.

Original: Instead of using l 2 -ball in Eq.8, we leverage ASCC to capture perturbations insidethe convex hull to perform adversarial training.
Revised: Instead of using l 2 -ball in Eq.8, we leverage ASCC to capture perturbations inside the convex hull to perform adversarial training.

Original: This is to re-deﬁne ˆ v ( x ) in Eq.8 using ASCC, andthe resulting training objective is formulated as:
Revised: This is to re-deﬁne ˆ v ( x ) in Eq.8 using ASCC, and the resulting training objective is formulated as:

Original: [Equation]
Revised: [Equation]

Original: To specify L in Eq.9 for ASCC-defense, we consider the KL-divergence between the predictionby vanilla input and the prediction under perturbations (Miyato et al., 2018; Zhang et al., 2019a).
Revised: To specify L in Eq.9 for ASCC-defense, we consider the KL-divergence between the prediction by vanilla input and the prediction under perturbations (Miyato et al., 2018; Zhang et al., 2019a).

Original: In the meantime, we also encourage the sparsity of w i by the proposed regularizer for adversarygeneration.
Revised: In the meantime, we also encourage the sparsity of w i by the proposed regularizer for adversary generation.

Original: Taking these together, we formulate the training objective of ASCC-defense as follows:
Revised: Taking these together, we formulate the training objective of ASCC-defense as follows:

Original: [Equation]
Revised: [Equation]

Revised: [Equation]

Revised: [Table]

Original:  where α, β ≥ 0 control the weight of regularization and KL term, respectively.
Revised: [Figure] [Table] [Figure] where α, β ≥ 0 control the weight of regularization and KL term, respectively.

Original: Noted that term H ( · )has no gradient with respect to θ and φ , so it only works during inner-max adversary generation.
Revised: Noted that term H ( · ) has no gradient with respect to θ and φ , so it only works during inner-max adversary generation.

Original: Robust word vectors.
Revised: Robust word vectors.

Original: We here explain why ASCC-defense can yield more robust word vectors.
Revised: We here explain why ASCC-defense can yield more robust word vectors.

Original: Previous defenses such as Miyato et al.
Revised: Previous defenses such as Miyato et al.

Original: (2017) fail to train word vectors in a robust way, as theyupdate φ by only using the clean data ﬂow.
Revised: (2017) fail to train word vectors in a robust way, as they update φ by only using the clean data ﬂow.

Original: Speciﬁcally, Miyato et al.
Revised: Speciﬁcally, Miyato et al.

Original: (2017) obtains ˆ v ( x i ) through
Revised: (2017) obtains ˆ v ( x i ) through

Original: Eq.1, where perturbation r has no gradient with respect to φ , and thus ∇ φ ˆ v ( x i ) = ∇ φ v ( x i ) .
Revised: Eq.1, where perturbation r has no gradient with respect to φ , and thus ∇ φ ˆ v ( x i ) = ∇ φ v ( x i ) .

Original: On thecontrary, ˆ v ( x i ) modeled by ASCC-defense has gradient w.r.t.
Revised: On the contrary, ˆ v ( x i ) modeled by ASCC-defense has gradient w.r.t.

Original: φ concerning all substitutions, as:
Revised: φ concerning all substitutions, as:

Original: [Equation]
Revised: [Equation]

Original: Therefore, ASCC-defense updates the word vector considering all potential adversarial substitutionssimultaneously, which gives rise to more robust word vectors (we validate our claim in Sec.4.4).
Revised: Therefore, ASCC-defense updates the word vector considering all potential adversarial substitutions simultaneously, which gives rise to more robust word vectors (we validate our claim in Sec.4.4).

Original: Optimization.
Revised: Optimization.

Original: We employ Adam (Kingma & Ba, 2014) to solve both inner-max and outer-minproblems in Eq.11.
Revised: We employ Adam (Kingma & Ba, 2014) to solve both inner-max and outer-min problems in Eq.11.

Original: Our training process is illustrated in Fig.
Revised: Our training process is illustrated in Fig.

Original: 2 and presented in Algorithm 1.
Revised: 2 and presented in Algorithm 1.

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original:  E XPERIMENTS 
Revised:  E XPERIMENTS 4. E XPERIMENTAL S ETTING

Original: 4. E XPERIMENTAL S ETTING

Original: Tasks and datasets.
Revised: Tasks and datasets.

Original: We focus on two prevailing NLP tasks to evaluate the robustness and compareour method to the state-of-the-arts: (i) Sentiment analysis on the IMDB dataset (Maas et al., 2011).(ii
Revised: We focus on two prevailing NLP tasks to evaluate the robustness and compare our method to the state-of-the-arts: (i) Sentiment analysis on the IMDB dataset (Maas et al., 2011).

Original: ) Natural language inference on the SNLI dataset ( Bowman et al.
Revised: (ii) Natural language inference on the SNLI dataset (Bowman et al., 2015).

Original: Model architectures.
Revised: Model architectures.

Original: We examine robustness on the following four architectures to show the scalability of our method: (i) BOW, the bag-of-words model which sums up the word vectors andpredictsby a multilayer perceptron (MLP), (ii) CNN model, (iii) Bi-LSTM model, (iv) DCOM, decomposable attention model (Parikh et al., 2016), which generates context-aware vectors and predictsby a
Revised: We examine robustness on the following four architectures to show the scalability of our method: (i) BOW, the bag-of-words model which sums up the word vectors and predicts

Original: MLP.
Revised: [Table]

Original: We align our implementation details with Jia et al. for fair comparisons.
Revised: [Figure]

Original: Comparative methods.
Revised: Comparative methods.

Original: (i)
Revised: (i)

Original: Standard training.
Revised: Standard training.

Original: It uses the cross-entropy loss as the main loss function.
Revised: It uses the cross-entropy loss as the main loss function.

Original: (ii) First-order approximation (Ebrahimi et al., 2018).
Revised: (ii) First-order approximation (Ebrahimi et al., 2018).

Original: While it is initially proposed to modelchar ﬂip, it can also be applied to word substitutions.
Revised: While it is initially proposed to model char ﬂip, it can also be applied to word substitutions.

Original: We implement its word-level version forcomparison.
Revised: We implement its word-level version for comparison.

Original: (iii)
Revised: (iii)

Original: Adv l 2 -ball (Miyato et al., 2017).
Revised: Adv l 2 -ball (Miyato et al., 2017).

Original: It ﬁrst normalizes the word vectors and thengenerates perturbations inside a l 2 -ball for adversarial training.
Revised: It ﬁrst normalizes the word vectors and then generates perturbations inside a l 2 -ball for adversarial training.

Original: We implement it with word levell 2 -ball and radius (cid:15) varying from 0 .
Revised: We implement it with word level l 2 -ball and radius (cid:15) varying from 0 .

Original: 1 to 1 .
Revised: 1 to 1 .

Original: We only plot the best performance among different (cid:15) .(iv)
Revised: We only plot the best performance among different (cid:15) .

Original:  Axis aligned bound (Jia et al., 2019).
Revised: (iv) Axis aligned bound (Jia et al., 2019).

Original: It models perturbations by an axis-aligned box and usesbound propagation for robust training.
Revised: It models perturbations by an axis-aligned box and uses bound propagation for robust training.

Original: (v) ASCC-defense.
Revised: (v) ASCC-defense.

Original: We set the hyper-parameters α = 10and β = 4 .
Revised: We set the hyper-parameters α =and β = 4 .

Original: For fair comparisons, KL term is employed for all compared adversarial training basedmethods.
Revised: For fair comparisons, KL term is employed for all compared adversarial training based methods.

Original: More implementation details as well as runtime analysis can be found in the Appendix A.
Revised: More implementation details as well as runtime analysis can be found in the Appendix A.

Original: Attack algorithms.
Revised: Attack algorithms.

Original: We employ the following two powerful attack methods to examine the robustness: (i) Genetic attack (Alzantot et al., 2018) maintains a population to generate attacks in anevolving way.
Revised: We employ the following two powerful attack methods to examine the robustness: (i) Genetic attack (Alzantot et al., 2018) maintains a population to generate attacks in an evolving way.

Original: Aligned with Jia et al.
Revised: Aligned with Jia et al.

Original: (2019), we set the population size as 60 to run for 40 iterations.
Revised: (2019), we set the population size as 60 to run for 40 iterations.

Original: (ii) PWWS attack (Ren et al., 2019) calculates the saliency of each word and then substitutesgreedily.
Revised: (ii) PWWS attack (Ren et al., 2019) calculates the saliency of each word and then substitutes greedily.

Original: Aligned with Alzantot et al.
Revised: Aligned with Alzantot et al.

Original: and Jia et al.
Revised: and Jia et al.

Original: (2019), we do not attack premise on SNLI.
Revised: (2019), we do not attack premise on SNLI.

Original: Substitution set.
Revised: Substitution set.

Original: For fair comparisons with state-of-the-art defense Jia et al.
Revised: For fair comparisons with state-of-the-art defense Jia et al.

Original: (2019), we followtheir setting to use substitution set from Alzantot et al.
Revised: (2019), we follow their setting to use substitution set from Alzantot et al.

Original: We apply the same language model 
Revised: We apply the same language model constraint on Genetic as in Jia et al.

Original: [Table]
Revised: (2019), while do not apply it on PWWS attacks.

Original: [Table]
Revised: As we aim at using prevailing setting to compare with the state-of-the-arts, we do not focus on how to construct the substitution set in this work and leave it for future exploration.

Original: 4. M AIN R ESULT
Revised: 4. M AIN R ESULT

Original: Aligned with Jia et al.
Revised: Aligned with Jia et al.

Original: (2019), we evaluate robustness on 1000 randomly selected examples from thetest set of IMDB and all 9824 test examples from SNLI.
Revised: (2019), we evaluate robustness on 1000 randomly selected examples from the test set of IMDB, and all 9824 test examples from SNLI.

Original: As shown in Tab.1, our method achievesleading robustness across all architectures with signiﬁcant margins.
Revised: As shown in Tab.1, our method achieves leading robustness across all architectures with signiﬁcant margins.

Original: For example, on IMDB, wesurpass LSTM-based runner-up method by 6 .5% under Genetic and 10 .
Revised: For example, on IMDB, we surpass LSTM-based runner-up method by 6 .

Original: 4% under PWWS attacks.
Revised: [Table]

Original: Plus, the robust performance of ASCC-defense is consistent against different attacks: e.g. , on IMDB,
Revised: Plus, the robust performance of ASCC-defense is consistent against different attacks: e.g. , on IMDB,

Original: LSTM-based ASCC-defense achieves 79 .
Revised: LSTM-based ASCC-defense achieves 79 .

Original: 0% under Genetic attacks and77 .
Revised: 0% under Genetic attacks and

Revised: [Table]

Original: 1% under PWWS attacks, which shows ASCC-defense does not rely on over-ﬁtting to a speciﬁc attack algorithm.
Revised: 1% under PWWS attacks, which shows ASCC-defense does not rely on over-ﬁtting to a speciﬁc attack algorithm.

Original: Inaddition to robust accuracy, we also plot the tradeoff between robustness and accuracy in Fig.3,which shows our method can trade off some accuracy for more robustness compared to the stateof-the-art.
Revised: In addition to robust accuracy, we also plot the tradeoff between robustness and accuracy in Fig.3, which shows our method can trade off some accuracy for more robustness compared to the stateof-the-art.

Original: More detailed vanilla accuracy and our performance on BERT (Devlin et al., 2019) areshown in Appendix B.
Revised: More detailed vanilla accuracy and our performance on BERT (Devlin et al., 2019) are shown in Appendix B.

Original: 4. O N THE R EGULARIZATION AND O THER D ISCUSSIONS
Revised: 4. O N THE R EGULARIZATION AND O THER D ISCUSSIONS

Original: Fig.4 qualitatively shows how the proposed regularizer encourages sparsity.
Revised: Fig.4 qualitatively shows how the proposed regularizer encourages sparsity.

Original: After applying theregularization, the resulting ˆ v is close to a substitution, corresponding better with the discrete natureof textual input.
Revised: After applying the regularization, the resulting ˆ v is close to a substitution, corresponding better with the discrete nature of textual input.

Original: Tab.2 quantitatively shows the inﬂuence of the regularization term on robustness.
Revised: Tab.2 quantitatively shows the inﬂuence of the regularization term on robustness.

Original: Speciﬁcally, when α = 10 our method performs the best.
Revised: Speciﬁcally, when α = 10 our method performs the best.

Original: As α keeps increasing, ASSC focus toomuch on the sparsity and thus fail to ﬁnd strong enough perturbations for robust training.
Revised: As α keeps increasing, ASSC focus too much on the sparsity and thus fail to ﬁnd strong enough perturbations for robust training.

Original: We now discuss some other intuitive defense methods.
Revised: We now discuss some other intuitive defense methods.

Original: The thought of enumerating all combinations during training is natural and yet impractical on benchmark datasets; e.g. , on IMDB theaverage number of combinations per input is 6 108 .
Revised: The thought of enumerating all combinations during training is natural and yet impractical on benchmark datasets; e.g. , on IMDB the average number of combinations per input is 6 108 .

Original: Augmenting training with random combinationsis also ineffective, since it fails to ﬁnd hard cases in the exponentially large attack space; e.g. , under
Revised: Augmenting training with random combinations is also ineffective, since it fails to ﬁnd hard cases in the exponentially large attack space; e.g. , under

Original: Genetic ASCC-defense surpasses random augmentation by 46.0% on IMDB and by 7.8% on SNLI(more signiﬁcant margin owes to larger attack space on IMDB).
Revised: Genetic ASCC-defense surpasses random augmentation by 46.0% on IMDB and by 7.8% on SNLI (more signiﬁcant margin owes to larger attack space on IMDB).

Original: Besides, though simply groupingall substitutions can achieve ensured robustness, it sacriﬁces discriminative powerness: two wordsthat are not semantically similar will be mapped together just because they are indirectly related byone or more mediators.
Revised: Besides, though simply grouping all substitutions can achieve ensured robustness, it sacriﬁces discriminative powerness: two words that are not semantically similar will be mapped together just because they are indirectly related by one or more mediators.

Original: For instance, 
Revised: For instance, grouping defense achieves 71.3% robust accuracy and 71.3% vanilla accuracy on IMDB while ASCC-defense achieves 79.0% and 82.5% respectively.

Original: [Table]
Revised: 4. R OBUST W ORD V ECTORS

Original: As mentioned in Sec.3. [Table] ASCC-defense updates the vector of a word by considering all its substitutions, and thus the obtained word vectors are robust in nature.
Revised: As mentioned in Sec.3.3, ASCC-defense updates the vector of a word by considering all its substitutions, and thus the obtained word vectors are robust in nature.

Original: To validate, we use the standardtraining process to train models but with different pre-trained word vectors as initialization.
Revised: To validate, we use the standard training process to train models but with different pre-trained word vectors as initialization.

Original: Wecompare word vectors pre-trained by ASCC-defense with Glove and word vectors pre-trained by
Revised: We compare word vectors pre-trained by ASCC-defense with Glove and word vectors pre-trained by

Original: Ebrahimi et al.
Revised: Ebrahimi et al.

Original: (the best performing setting for Miyato et al.
Revised: (the best performing setting for Miyato et al.

Original: (2017) and Jia et al.
Revised: (2017) and Jia et al.

Original: (2019) is tofreeze the word vectors as Glove, which laterally validates our claim about robust word vectors in
Revised: (2019) is to freeze the word vectors as Glove, which laterally validates our claim about robust word vectors in

Original: Sec.3.3).
Revised: Sec.3.3).

Original: As shown in Tab.3, the models initialized by our robustly trained word vectors (and ﬁxedduring normal training) are robust to attacks without applying any other defense techniques.
Revised: As shown in Tab.3, the models initialized by our robustly trained word vectors (and ﬁxed during normal training) are robust to attacks without applying any other defense techniques.

Original: Forexample, armed with our robust word vectors, a normally trained LSTM-based model can achieve73 .
Revised: For example, armed with our robust word vectors, a normally trained LSTM-based model can achieve 73 .

Original: 4% under Genetic attacks, whereas using GloVe achieves 7 .
Revised: 4% under Genetic attacks, whereas using GloVe achieves 7 .

Original: In addition, this result also implies a new perspective towards robustness in NLP: the vulnerabilitiesof NLP models relate to word vectors signiﬁcantly, and transferring pre-trained robust word vectorscan be a more scalable way towards NLP robustness.
Revised: In addition, this result also implies a new perspective towards robustness in NLP: the vulnerabilities of NLP models relate to word vectors signiﬁcantly, and transferring pre-trained robust word vectors can be a more scalable way towards NLP robustness.

Original: For more result, please refer to Appendix B.
Revised: For more result, please refer to Appendix B.

Original:  R ELATED W ORK
Revised:  R ELATED W ORK

Revised: Though achieved success in many ﬁelds, DNNs appear to be susceptible to adversarial examples (Szegedy et al., 2013).

Revised: Initially introduced to attack CV models, attack algorithms vary from L p bounded Goodfellow et al.

Revised: ; Carlini & Wagner (2017); Madry et al.

Revised: (2018), universal perturbations (Moosavi-Dezfooli et al., 2017; Liu et al., 2019), to wasserstein distance-based attack (Wong et al., 2019), while defense techniques for CV models include adversarial training(Goodfellow et al., 2015; Kurakin et al., 2017; Madry et al., 2018), preprocessing (Chen et al., 2018; Yang et al., 2019), and generative classiﬁers (Li et al., 2019; Schott et al., 2019; Dong et al., 2020).

Original: Recently, various classes of NLP adversarial attacks have been proposed.
Revised: Recently, various classes of NLP adversarial attacks have been proposed.

Original: Typical methods considerchar-level manipulations (Hosseini et al., 2017; Ebrahimi et al., 2018; Belinkov & Bisk, 2018; Gaoet al., 2018; Eger et al., 2019; Pruthi et al., 2019).
Revised: Typical methods consider char-level manipulations (Hosseini et al., 2017; Ebrahimi et al., 2018; Belinkov & Bisk, 2018; Gao et al., 2018; Eger et al., 2019; Pruthi et al., 2019).

Original: Another line of thought focus on deleting, adding,or swapping words (Iyyer et al., 2018;
Revised: Another line of thought focus on deleting, adding, or swapping words (Iyyer et al., 2018;

Original: Ribeiro et al., 2018; Jia & Liang, 2017; Zhao et al., 2018).
Revised: Ribeiro et al., 2018; Jia & Liang, 2017; Zhao et al., 2018).

Original: In contrast to char-level and sequence-level manipulations, word substitutions consider prior knowledge to preserve semantics and syntactics, such as synonyms from WordNet (Miller, 1998), Sememes (Bloomﬁeld; Dong et al., 2006), and neighborhood relationships (Alzantot et al., 2018),
Revised: In contrast to char-level and sequence-level manipulations, word substitutions consider prior knowledge to preserve semantics and syntactics, such as synonyms from WordNet (Miller, 1998), Sememes (Bloomﬁeld; Dong et al., 2006), and neighborhood relationships (Alzantot et al., 2018),

Original: Some focus on heuristic searching in the textual space (Alzantot et al., 2018;
Revised: Some focus on heuristic searching in the textual space (Alzantot et al., 2018;

Original: Liang et al., 2017; Renet al., 2019; Jin et al., 2020; Zhang et al., 2019b; Zang et al., 2020), while (Papernot et al., 2016b;
Revised: Liang et al., 2017; Ren et al., 2019; Jin et al., 2020; Zhang et al., 2019b; Zang et al., 2020), while (Papernot et al., 2016b;

Original: Gong et al., 2018) propose to leverage gradients for adversary generation in the vector space.
Revised: Gong et al., 2018) propose to leverage gradients for adversary generation in the vector space.

Original: As for defense, Ebrahimi et al.
Revised: As for defense against adversarial word substitutions, Ebrahimi et al.

Original: ﬁnd substitutions by ﬁrst-order approximation.
Revised: ﬁnd substitutions by ﬁrst-order approximation.

Original: Miyato et al.(2017), Barham & Feizi (2019) and Sato et al.
Revised: Miyato et al. (2017), Barham & Feizi (2019) and Sato et al.

Original: (2018) use l 2 -ball to model perturbations, while Jia et al.
Revised: (2018) use l 2 -ball to model perturbations, while Jia et al.

Original: and
Revised: and

Original: Huang et al.
Revised: Huang et al.

Original: (2019) use axis-aligned bound.
Revised: (2019) use axis-aligned bound.

Original: Zhou et al.
Revised: Zhou et al.

Original: (2020) sample from Dirichlet distribution to initialize a convex combination of substitutions, but the sparsity might belost during adversary generation.
Revised: (2020) sample from Dirichlet distribution to initialize a convex combination of substitutions, but the sparsity might be lost during adversary generation.

Original: Our work differs as we model the convex hull with sparsity byentropy function, and the sparsity is enforced during the whole process, which makes our capturedgeometry of substitutions more precise.
Revised: Our work differs as we model the convex hull with sparsity by entropy function, and the sparsity is enforced during the whole process, which makes our captured geometry of substitutions more precise.

Original:  C ONCLUSION
Revised:  C ONCLUSION

Original: In this paper, we proposed a novel method to use the convex hull to capture and defense againstadversarial word substitutions.
Revised: In this paper, we proposed a novel method to use the convex hull to capture and defense against adversarial word substitutions.

Original: Our method yields models that consistently surpass the state-of-thearts across datasets and architectures.
Revised: Our method yields models that consistently surpass the state-of-thearts across datasets and architectures.

Original: The experimental results further demonstrated that the wordvectors themselves can be vulnerable and our method gives rise to robust word vectors that canenforce robustness without applying any other defense techniques.
Revised: The experimental results further demonstrated that the word vectors themselves can be vulnerable and our method gives rise to robust word vectors that can enforce robustness without applying any other defense techniques.

Original: As such, we hope this work canbe a stepping stone towards even broader robustness in NLP.
Revised: As such, we hope this work can be a stepping stone towards even broader robustness in NLP.

Revised: A CKNOWLEDGEMENTS

Revised: This work is supported by the National Science Fund for Distinguished Young Scholars (No. 62025603), and the National Natural Science Foundation of China (No. U1705262,

Revised: No. 62072386, No. 62072387, No. 62072389, No. 62002305, No. 61772443, No. 61802324, and

Revised: No. 61702136).

Original: A A PPENDIX A. I MPLEMENTATION D ETAILS
Revised: A A PPENDIX A. I MPLEMENTATION D ETAILS

Original: Text processing.
Revised: Text processing.

Original: We employ the tokenizer from NLTK and ignore all punctuation marks when tokenizing the textual input.
Revised: We employ the tokenizer from NLTK and ignore all punctuation marks when tokenizing the textual input.

Original: We set the maximum length of input as 300 for IMDB and 80 for
Revised: We set the maximum length of input as 300 for IMDB and 80 for

Original: SNLI.
Revised: SNLI.

Original: For unknown words, we set them as ”NULL” token.
Revised: For unknown words, we set them as ”NULL” token.

Original: Hyper-parameters and optimization.
Revised: Hyper-parameters and optimization.

Original: We set α as 10 and β as 4 for the training procedure deﬁned in Eq.12.
Revised: We set α as 10 and β as 4 for the training procedure deﬁned in Eq.12.

Original: To generate adversaries for robust training, we employ Adam optimizer with a learning rate of 10 and a weight decay of 0 . 00002 to run for 10 iterations To update φ and θ , we also employ
Revised: To generate adversaries for robust training, we employ Adam optimizer with a learning rate of 10 and a weight decay of 0 . 00002 to run for 10 iterations To update φ and θ , we also employ

Original: Adam optimizer, the parameters of which differ between architectures and will be discussed as follows.
Revised: Adam optimizer, the parameters of which differ between architectures and will be discussed as follows.

Original: Architecture parameters (i) CNN for IMDB:
Revised: Architecture parameters (i) CNN for IMDB:

Original: We use a 1-d convolutional layer with kernal size of 3 to extract features and then make predictions.
Revised: We use a -d convolutional layer with kernal size of 3 to extract features and then make predictions.

Original: We set the batch-size as 64 and use Adam optimizer with a learning rate of 0 .
Revised: We set the batch-size as 64 and use Adam optimizer with a learning rate of 0 .

Original: 005 and a weight decay of 0 . 0002 .
Revised: 005 and a weight decay of 0 . 0002 .

Original: (ii) Bi-LSTM for IMDB:
Revised: ii) Bi-LSTM for IMDB

Revised: We use a

Revised: bi-directional

Revised: LSTM

Revised: layer to

Revised: process

Original: We use a bi-directional LSTM layer to process the input sequence, and then use the last hidden state to make predictions.
Revised: the input sequence and then use the last hidden state to make predictions

Original: We set the batch-size as 64 and use Adam optimizer with a learning rate of 0 .
Revised: We set the batch-size as 64 and use Adam optimizer with a learning rate of 0 .

Original: 005 and a weight decay of 0 . 0002 .
Revised: 005 and a weight decay of 0 . 0002 .

Original: (iii) BOW for SNLI:
Revised: iii ) BOW for SNLI:

Original: We ﬁrst sum up the word vectors at the dimension of sequence and concat the encoding of the premise and the hypothesis.
Revised: We ﬁrst sum up the word vectors at the dimension of sequence and concat the encoding of the premise and the hypothesis.

Original: Then we employ a MLP of 3 layers to predict the label.
Revised: Then we employ a MLP of 3 layers to predict the label.

Original: We set the batch-size as 512 and use Adam optimizer with a learning  rate of 0 . 0005 and a weight decay of 0 . 0002 .
Revised: We set the batch-size as 512 and use Adam optimizer with a learning [Table] [Table] rate of 0 . 0005 and a weight decay of 0 . 0002 .

Original: (iv) DECOMPATTN for SNLI:
Revised: (iv) DECOMPATTN for SNLI:

Original: We ﬁrst generates context-aware vectors and then employ a MLP of 2 layers to make predictions given the contextaware vectors.
Revised: We ﬁrst generates context-aware vectors and then employ a MLP of 2 layers to make predictions given the contextaware vectors.

Original: We set the batch-size as 256 and use Adam with a learning rate of 0 . 0005 and a weight decay of 0 .
Revised: We set the batch-size as 256 and use Adam with a learning rate of 0 . 0005 and a weight decay of 0 .

Original: A. R UNTIME A NALYSIS
Revised: A. R UNTIME A NALYSIS

Original: All models are trained using the GeForce GTX1080 GPU.
Revised: All models are trained using the GeForce GTX1080 GPU.

Original: (i)
Revised: (i)

Original: As for IMDB, it takes about 1 .
Revised: As for IMDB, it takes about 1 .

Original: 5 GPU hours to train a CNN-based model and 2 GPU hours for a LSTM-based model.
Revised: 5 GPU hours to train a CNN-based model and 2 GPU hours for a LSTM-based model.

Original: (ii)
Revised: (ii)

Original: As for SNLI, it takes about 12 GPU hours to train a BOW-based model and 15 GPU hours for DECOMPATTNbased model.
Revised: As for SNLI, it takes about 12 GPU hours to train a BOW-based model and 15 GPU hours for DECOMPATTNbased model.

Original: B A DDITIONAL E XPERIMENTAL R ESULT B. V ANILLA A CCURACY AND R OBUST A CCURACY UNDER G ENETIC ATTACKS WITHOUT C ONSTRAINT
Revised: B A DDITIONAL E XPERIMENTAL R ESULT B. V ANILLA A CCURACY AND R OBUST A CCURACY UNDER G ENETIC ATTACKS WITHOUT C ONSTRAINT

Original: In Tab.1, we have plotted the robust accuracy under attacks to compare with state-of-the-arts.
Revised: In Tab.1, we have plotted the robust accuracy under attacks to compare with state-of-the-arts.

Original: Here we plot the vanilla accuracy of all compared methods in Tab.4 as an addition.
Revised: Here we plot the vanilla accuracy of all compared methods in Tab.4 as an addition.

Original: Aligned with Tab.3, the parameters of each compared method here are chosen to have the best robust accuracy instead of vanilla accuracy.
Revised: Aligned with Tab.3, the parameters of each compared method here are chosen to have the best robust accuracy instead of vanilla accuracy.

Original: In our main result in Tab.1, for fair comparisons we align our setting with SOTA defense Jia et al., where genetic attacks are constrained by a language model.
Revised: In our main result in Tab.1, for fair comparisons we align our setting with SOTA defense Jia et al., where genetic attacks are constrained by a language model.

Original: Here we plot our performance under genetic attacks without any language model constraint as an addition: ASCC-defense achieves [Table] [Table] [Table]
Revised: Here we plot our performance under genetic attacks without any language model constraint as an addition: ASCC-defense achieves 76.7% robust accuracy under Genetic without constraint on IMDB based on LSTM, and 72.8% on

Original: [Table]
Revised: SNLI based on BOW.

Original:  P ERFORMANCE ON BERT
Revised: B. P ERFORMANCE ON BERT

Original: ASCC-defense models perturbations at word-vecotr level, and thus it can be applied to architectures like Transformers, as long as it uses word embeding as its ﬁrst layer.
Revised: ASCC-defense models perturbations at word-vecotr level, and thus it can be applied to architectures like Transformers, as long as it uses word embeding as its ﬁrst layer.

Original: To validate, we conduct experiments on BERT (bert-base-uncased) using standard training and ASCC-defense respectively.
Revised: To validate, we conduct experiments on BERT (bert-base-uncased) using standard training and ASCC-defense respectively.

Original: As shown in Tab. [Table] ASCC-defense enhances the robustness of BERT model signiﬁcantly.
Revised: As shown in Tab.5, ASCC-defense enhances the robustness of BERT model signiﬁcantly.

Original: Speciﬁcally, BERT ﬁnetuned by standard method on IMDB achieves 16.4% robust accuracy under Genetic attacks, while using the proposed ASCC-defense achieves 70.2%. 
Revised: Speciﬁcally, BERT ﬁnetuned by standard method on IMDB achieves 16.4% robust accuracy under Genetic attacks, while using the proposed ASCC-defense achieves 70.2%. [Table]

Original: B. R EDUCED P ERTURBATION R EGION
Revised: B. R EDUCED P ERTURBATION R EGION

Original: In this section, we show the reduced perturbation region by using convex hull compared to l 2 -ball and hyper-rectangle.
Revised: In this section, we show the reduced perturbation region by using convex hull compared to l 2 -ball and hyper-rectangle.

Original: To make the result more intuitive, we ﬁrst project word vectors into a 2D space by SVD, and than calculate the average area of each modeling (to rule out irrelevant factors, we use word vectors from GloVe and consider words whose substitution sets are of the same size).
Revised: To make the result more intuitive, we ﬁrst project word vectors into a 2D space by SVD, and than calculate the average area of each modeling (to rule out irrelevant factors, we use word vectors from GloVe and consider words whose substitution sets are of the same size).

Original: We choose the smallest l 2 -ball and hyper-rectangle that contain all substitutions to compare with convex hull.
Revised: We choose the smallest l 2 -ball and hyper-rectangle that contain all substitutions to compare with convex hull.

Original: The result shows that using convex hull reduce the perturbation region signiﬁcantly.
Revised: The result shows that using convex hull reduce the perturbation region signiﬁcantly.

Original: Speciﬁcaly, the average ratio of the area modeled by convex hull to the area modeled by hyperrectangle is 29.2%, and the average ratio of the area modeled by convex hull to the area modeled by l 2 -ball area is 8.4%.[Table]
Revised: Speciﬁcaly, the average ratio of the area modeled by convex hull to the area modeled by hyperrectangle is 29.2%, and the average ratio of the area modeled by convex hull to the area modeled by l 2 -ball area is 8.4%.

Original: B. C ROSS -A RCHITECTURES P ERFORMANCE OF R OBUST W ORD V ECTORS
Revised: B. C ROSS -A RCHITECTURES P ERFORMANCE OF R OBUST W ORD V ECTORS

Original: As discussed in Sec.4.4, our robustly trained word vectors can enforce the robustness of a normally trained model without applying any other defense techniques.
Revised: As discussed in Sec.4.4, our robustly trained word vectors can enforce the robustness of a normally trained model without applying any other defense techniques.

Original: In this section, we aim to examine whether such a gain of robustness over-ﬁts to a speciﬁc architecture.
Revised: In this section, we aim to examine whether such a gain of robustness over-ﬁts to a speciﬁc architecture.

Original: To this end, we ﬁrst employ
Revised: To this end, we ﬁrst employ

Original: ASCC-defense to obtain robust word vectors and then ﬁx the word vectors as the initialization of another model based on a different architecture to perform normal training.
Revised: ASCC-defense to obtain robust word vectors and then ﬁx the word vectors as the initialization of another model based on a different architecture to perform normal training.

Original: We examine the accuracy under attacks.
Revised: We examine the accuracy under attacks.

Original: As shown in Tab.6, our robustly trained word vectors consistently enhance the robustness of a normally trained model based on different architectures.
Revised: As shown in Tab.6, our robustly trained word vectors consistently enhance the robustness of a normally trained model based on different architectures.

Original: For example, though trained by a
Revised: For example, though trained by a

Original: LSTM-based model
Revised: LSTM-based model

Original: , the robust word vectors can still enforce a CNN-based model to achieve robust accuracy of 71 .
Revised: , the robust word vectors can still enforce a CNN-based model to achieve robust accuracy of 71 .

Original: 9% under Genetic attacks (whereas initializing by GloVe achieves 8 . 6% ), demonstrating the across-architecture transferability of the robustness of our pre-trained word vectors .
Revised: 9% under Genetic attacks (whereas initializing by GloVe achieves 8 . 6% ), demonstrating the across-architecture transferability of the robustness of our pre-trained word vectors .