Original: Robust Conversational Agents against Imperceptible Toxicity Triggers
Revised: Robust Conversational Agents against Imperceptible Toxicity Triggers

Original: Anonymous ACL submission

Original: Abstract
Revised: Abstract

Original: Warning : this paper contains content that maybe offensive or upsetting.
Revised: Warning : this paper contains content that may be offensive or upsetting.

Original: Recent research in Natural Language Processing (NLP) has advanced the development ofvarious toxicity detection models with the intention of identifying and mitigating toxic language from existing systems.
Revised: Recent research in Natural Language Processing (NLP) has advanced the development of various toxicity detection models with the intention of identifying and mitigating toxic language from existing systems.

Original: Despite the abundance of research in this area, relatively lessattention has been given to adversarial attacksthat force the system to generate toxic language and the defense against them.
Revised: Despite the abundance of research in this area, less attention has been given to adversarial attacks that force the system to generate toxic language and the defense against them.

Original: Existingwork to generate such attacks is either basedon human-generated attacks which is costlyand not scalable or, in case of automatic attacks, the attack vector does not conform tohuman-like language, which can be detectedusing a language model loss.
Revised: Existing work to generate such attacks is either based on humangenerated attacks which is costly and not scalable or, in case of automatic attacks, the attack vector does not conform to human-like language, which can be detected using a language model loss.

Original: In this work, wepropose attacks against conversational agentsthat are imperceptible, i.e., they fit the conversation in terms of coherency, relevancy, andfluency, while they are effective and scalable,i.e., they can automatically trigger the systeminto generating toxic language.
Revised: In this work, we propose attacks against conversational agents that are imperceptible, i.e., they fit the conversation in terms of coherency, relevancy, and fluency, while they are effective and scalable, i.e., they can automatically trigger the system into generating toxic language.

Original: We then propose a defense mechanism against such attackswhich not only mitigates the attack but alsoattempts to maintain the conversational flow.
Revised: We then propose a defense mechanism against such attacks which not only mitigates the attack but also attempts to maintain the conversational flow.

Original: Through automatic and human evaluations, weshow that our defense is effective at avoidingtoxic language generation even against imperceptible toxicity triggers while the generatedlanguage fits the conversation in terms of coherency and relevancy.
Revised: Through automatic and human evaluations, we show that our defense is effective at avoiding toxic language generation even against imperceptible toxicity triggers while the generated language fits the conversation in terms of coherency and relevancy.

Original: Lastly, we establishthe generalizability of such a defense mechanism on language generation models beyondconversational agents.
Revised: Lastly, we establish the generalizability of such a defense mechanism on language generation models beyond conversational agents.

Original:  Introduction
Revised:  Introduction

Original: Adversarial attacks on different Machine Learning (ML) and Natural Language Processing (NLP)applications can reveal important vulnerability issues related to these systems.
Revised: Adversarial attacks on different Machine Learning (ML) and Natural Language Processing (NLP) applications can reveal important vulnerability issues related to these systems.

Original: Most existing research focuses on adversarial attacks that degradeperformance of existing ML systems with regardsto accuracy (Chakraborty et al., 2018; Zhang et al.,
Revised: Most existing research focuses on adversarial attacks that degrade performance of existing ML systems with regards

Original: [Table]
Revised: [Table]

Original: (cid:39)(cid:72)(cid:73)(cid:72)(cid:81)(cid:71)(cid:72)(cid:85)(cid:29) (cid:3)(cid:44)(cid:3)(cid:79)(cid:82)(cid:89)(cid:72)(cid:3)(cid:68)(cid:81)(cid:76)(cid:80)(cid:68)(cid:79)(cid:86)(cid:17)(cid:3)(cid:44)(cid:3)(cid:72)(cid:81)(cid:77)(cid:82)(cid:92)(cid:3) (cid:73)(cid:72)(cid:72)(cid:71)(cid:76)(cid:81)(cid:74)(cid:3)(cid:87)(cid:75)(cid:72)(cid:80)(cid:17)
Revised: (cid:39)(cid:72)(cid:73)(cid:72)(cid:81)(cid:71)(cid:72)(cid:85)(cid:29) (cid:3)(cid:44)(cid:3)(cid:79)(cid:82)(cid:89)(cid:72)(cid:3)(cid:68)(cid:81)(cid:76)(cid:80)(cid:68)(cid:79)(cid:86)(cid:17)(cid:3)(cid:44)(cid:3)(cid:72)(cid:81)(cid:77)(cid:82)(cid:92)(cid:3) (cid:73)(cid:72)(cid:72)(cid:71)(cid:76)(cid:81)(cid:74)(cid:3)(cid:87)(cid:75)(cid:72)(cid:80)(cid:17)

Original: [Figure]
Revised: [Figure]

Original:  2020b).
Revised: to accuracy (Chakraborty et al., 2018; Zhang et al., 2020b).

Original: More recent work has considered attacks that target ethical concerns, such as triggering the models into outputting unfair predictions (Mehrabi et al., 2021; Solans et al., 2021), or in the context of NLP, generating biased (Sheng et al., 2020) and toxic (Wallace et al., 2019) text.
Revised: More recent work has considered attacks that target ethical concerns, such as triggering the models into outputting unfair predictions (Mehrabi et al., 2021b; Solans et al., 2021), or in the context of NLP, generating biased (Sheng et al., 2020) and toxic (Wallace et al., 2019) text.

Original: In this paper, we consider adversarial attacks on human-centric chatbots and dialog systems.
Revised: In this paper, we consider adversarial attacks on human-centric chatbots and dialogue systems.

Original: It is important for these systems to be safe and robust in the face of natural(-looking) human conversations.
Revised: It is important for these systems to be safe and robust in the face of natural(-looking) human conversations.

Original: Further, the defender should ensure a satisfying user experience via relevant and coherent generation.
Revised: Further, the defender should ensure a satisfying user experience via relevant and coherent generation.

Original: An instance of the attack and defense is demonstrated in Figure 1 in which the adversary tries to trigger the defender while the defender avoids the attack by not generating toxic utterances.
Revised: An instance of the attack and defense is demonstrated in Figure 1 in which the adversary tries to trigger the defender while the defender avoids the attack by not generating toxic utterances.

Original: The existing work on adversarial attacks on language generation is relatively thin.
Revised: The existing work on adversarial attacks on language generation is relatively thin.

Original: Wallace et al.
Revised: Wallace et al.

Original: (2019) offer attacks based on universal adversarial triggers (UAT) that can result in toxic text generation with a relatively high success rate.
Revised: (2019) offer attacks based on universal adversarial triggers (UAT) that can result in toxic text generation with a relatively high success rate.

Original: However, those triggers are unnatural, incoherent sequences of words that can be easily detected via a language model loss.
Revised: How- ever, those triggers are unnatural, incoherent sequences of words that can be easily detected via a language model loss.

Original: Furthermore, such attacks cannot be successful in voice-based dialog systems where the input to the dialog model comes from speech recognition and should necessarily conform to humanlanguage norms.
Revised: Furthermore, such attacks cannot be successful in voice-based dialogue systems where the input to the dialogue model comes from speech recognition and should necessarily conform to human language norms.

Original: Xu et al.
Revised: [Equation]

Original: (2020) use human-andmodel-in-the-loop framework to generate naturallooking attacks to break chatbots, but this approachis costly and inherently not scalable.
Revised: (2020) use human-and-model-in-the-loop framework to generate natural-looking attacks to break chatbots, but this approach is costly and inherently not scalable.

Original: In this paper, we propose imperceptible adversarial attacks on dialogue systems that leveragenatural-looking and coherent utterances as triggers,which cannot be easily detected using anomaly detection techniques.
Revised: In this paper, we propose imperceptible adversarial attacks on dialogue systems that leverage natural-looking and coherent utterances as triggers, which cannot be easily detected using anomaly detection techniques.

Original: As such, these attacks can alsotarget voice-based assistants who see the worldthrough the lens of speech recognition systems.
Revised: As such, these attacks can also target voice-based assistants who see the world through the lens of speech recognition systems.

Original: Our proposed approach works by augmenting the
Revised: Our proposed approach works by augmenting the

Original: UAT from Wallace et al.
Revised: UAT from Wallace et al.

Original: (2019) with additionalselection criteria to generate imperceptible yet effective triggers.
Revised: (2019) with additional selection criteria to generate imperceptible yet effective triggers.

Original: The method is fully automated andscalable, thus affording the exploration of a largenumber of attack vectors and system vulnerabilitiesefficiently.
Revised: The method is fully automated and scalable, thus affording the exploration of a large number of attack vectors and system vulnerabilities efficiently.

Original: Through human and automatic evaluations we show the effectiveness of the proposedattack in provoking the defender into generatingtoxic responses while keeping the fluency and coherency of the conversation intact.
Revised: Through human and automatic evaluations we show the effectiveness of the proposed attack in provoking the defender into generating toxic responses while keeping the fluency and coherency of the conversation intact.

Original: We then focus on a defense mechanism for thenon-adversarial (defender) model to avoid generating toxic utterances.
Revised: We then focus on a defense mechanism for the non-adversarial (defender) model to avoid generating toxic utterances.

Original: While simple defense methodssuch as (Xu et al., 2020) achieve near-perfect effectiveness against adversarial triggers, those methodswork by essentially resetting the conversation topicwhich breaks the flow.
Revised: While simple defense methods such as (Xu et al., 2020) achieve near-perfect effectiveness against adversarial triggers, those methods work by essentially resetting the conversation topic which breaks the flow.

Original: Instead, we are interestedin a defense mechanism that “detoxifies" the response while preserving the natural conversationflow.
Revised: Instead, we are interested in a defense mechanism that “detoxifies" the response while preserving the natural conversation flow.

Original: Our proposed method relies on two levels ofinterpretable reasoning that helps the model to (1)identify the key adversarial tokens responsible forthe attack and (2) avoid generating toxic responseby masking those tokens during the generation process.
Revised: Our proposed method relies on two levels of interpretable reasoning that helps the model to (1) identify the key adversarial tokens responsible for the attack and (2) avoid generating toxic responses by masking those tokens during the generation process.

Original: We perform automatic and human evaluationsto assess the effectiveness of our defense mechanism and demonstrate that it compares favorablywith various state of the art baselines, both in termsof detecting the attacks and generating conversationally fluent responses.
Revised: We perform automatic and human evaluations to assess the effectiveness of our defense mechanism and demonstrate that it compares favorably with various state of the art baselines, both in terms of detecting the attacks and generating conversationally fluent responses.

Original: We finally demonstratethe generalizability of such a defense mechanismon generation tasks beyond conversational models.
Revised: We finally demonstrate the generalizability of such a defense mechanism on generation tasks beyond conversational models.

Original: We emphasize that while our problem formulation focuses on the adversarial scenario, the imperceptible and coherent-looking triggers used in ourproposed attacks can also be invoked inadvertentlyby regular (non-adversarial) users.
Revised: We emphasize that while our problem formulation focuses on the adversarial scenario, the imperceptible and coherent-looking triggers used in our proposed attacks can also be invoked inadvertently by regular (non-adversarial) users.

Original: Thus, the defense mechanism proposed against such triggers will improve the overall robustness of conversational agents, not only against adversaries but also in interactions with regular users.
Revised: Thus, the defense mechanism proposed against such triggers will improve the overall robustness of conversational agents, not only against adversaries but also in interactions with regular users.

Original:  Attack Approaches
Revised:  Attack Approaches

Original: In this section, we first discuss the universal adversarial trigger attack proposed by Wallace et al.
Revised: In this section, we first discuss the universal adversarial trigger attack proposed by Wallace et al.

Original: (2019), which we use as our baseline.
Revised: (2019), which we use as our baseline.

Original: We then propose alterations to this baseline to make the universal triggers more natural-looking and suitable for conversational domain.
Revised: We then propose alterations to this baseline to make the universal triggers more natural-looking and suitable for conversational domain.

Original: Finally, we discuss our performed experiments and results.
Revised: Finally, we discuss our performed experiments and results.

Original: 2. Methodology 
Revised: 2. Methodology Universal Adversarial Trigger (UAT) (Wallace et al., 2019)

Original: Universal Adversarial Trigger (UAT) (Wallace et al., 2019)

Original: The goal in universal adversarial trigger attack is to find a universal trigger sequence for a given trained model, which if attached to the start of any given input can cause the model to output the desired outcome (Wallace et al., 2019).
Revised: The goal in universal adversarial trigger attack is to find a universal trigger sequence for a given trained model, which if attached to the start of any given input can cause the model to output the desired outcome (Wallace et al., 2019).

Original: This attack starts with a fixed-length sequence as the initial trigger, e.g., “the the the the the the” and tries to iteratively replace the tokens in the sequence to satisfy an objective.
Revised: This attack starts with a fixed-length sequence as the initial trigger, e.g., “the the the the the the” and tries to iteratively replace the tokens in the sequence to satisfy an objective.

Original: The iterations terminate when no improvement (replacement) can be made to further optimize the objective.
Revised: The iterations terminate when no improvement (replacement) can be made to further optimize the objective.

Original: The objective in this generative process is to search for triggers that can maximize the likelihood of toxic tokens being generated as follows:
Revised: The objective in this generative process is to search for triggers that can maximize the likelihood of toxic tokens being generated as follows:

Original: [Equation]
Revised: [Equation]

Original: where Y is the set of toxic outputs, t denotes the trigger sequence, and θ is a trained language model.
Revised: where Y is the set of toxic outputs, t denotes the trigger sequence, and θ is a trained language model.

Original: One important drawback of this kind of attack is that since there is no constraint on the trigger, it does not necessarily satisfy any language modeling loss; thus, the obtained trigger sequence usually is a nonsensical phrase that can be easily detectable as a (high-perplexity) anomaly.
Revised: One important drawback of this kind of attack is that since there is no constraint on the trigger, it does not necessarily satisfy any language modeling loss; thus, the obtained trigger sequence usually is a nonsensical phrase that can be easily detectable as a (high-perplexity) anomaly.

Original: Universal Adversarial Trigger with Language 
Revised: Universal Adversarial Trigger with Language Model

Original: Model Loss (UAT-LM)
Revised: Loss (UAT-LM)

Original: An intuitive solution to address the above shortcoming of UAT is to impose a language modeling objective on the trigger tokens.
Revised: An intuitive solution to address the above shortcoming of UAT is to impose a language modeling objective on the trigger tokens.

Original: Thus, the objective for UAT-LM attack is 
Revised: Thus, the objective for UAT-LM attack is f UAT-LM = f UAT + (cid:88)

Original: [Equation]
Revised: y ∈Y | t | (cid:88) j = log P ( t j | t 1: j − 1 , θ ) .

Original: Note that this optimization does not guarantee generation of sufficiently fluent triggers.
Revised: Note that this optimization does not guarantee generation of sufficiently fluent triggers.

Original: Even if the generated triggers by themselves might be sensible,they will not generally retain the flow of the conversation in terms of coherency and relevancy.
Revised: Even if the generated triggers by themselves might be sensible, they will not generally retain the flow of the conversation in terms of coherency and relevancy.

Original: Thus,we propose a different modification to the attackstrategy to accommodate these requirements.
Revised: Thus, we propose a different modification to the attack strategy to accommodate these requirements.

Original: Unigram Trigger with Selection Criteria(UTSC)
Revised: (UTSC)

Original: To consider the history of the conversationh and retain the fluency, coherency, and relevancyaspects of the conversation in generating the attack,we propose an alternative approach in which wegenerate a collection of unigram triggers (with sequence length one) from UAT .
Revised: To consider the history of the conversation h and retain the fluency, coherency, and relevancy aspects of the conversation in generating the attack, we propose an alternative approach in which we generate a collection of unigram triggers (with sequence length one) from UAT .

Original: We then feed thesetriggers along with the history of the conversationh to our dialogue model and generate differentattack utterances.
Revised: We then feed these triggers along with the history of the conversation h to our dialogue model and generate different attack utterances.

Original: Next, we pick the best suitedattack utterance amongst all the generated attackutterances according to our selection criterion asdemonstrated in Figure 2.
Revised: Next, we pick the best suited attack utterance amongst all the generated attack utterances according to our selection criterion as demonstrated in Figure 2.

Original: Since we are relying onthe dialogue model to generate the attack utterancegiven h , the generated utterance will be relevant tothe conversation, Furthermore, since we are usingonly a unigram trigger from UAT , the fluency of theutterance is not going to be sacrificed noticeably.
Revised: Since we are relying on the dialogue model to generate the attack utterance given h , the generated utterance should be relevant to the conversation. Furthermore, since we are using only a unigram trigger from UAT , the fluency of the utterance is not going to be sacrificed noticeably.

Original: We quantify the toxicity of each candidate attackutterance using either a single toxicity classifier oran ensemble of such classifiers; see Section 2.2 and
Revised: We quantify the toxicity of each candidate attack utterance using either a single toxicity classifier or an ensemble of such classifiers; see Section 2.2 and

Original: Appendix A for more information.
Revised: Appendix A for more information.

Original: We use the average (for multiple classifiers) or raw (for a singleclassifier) output probability scores obtained by thetoxicity classifiers, which we refer to as the toxicityscore x i for example i , and select the final attack utterance amongst the n candidate adversarial examples considering three selection criteria.
Revised: We use the average (for multiple classifiers) or raw (for a single classifier) output probability scores obtained by the toxicity classifiers, which we refer to as the toxicity score x i for example i , and select the final attack utterance amongst the n candidate adversarial examples considering three selection criteria.

Original: Previouswork (Xu et al., 2020) has shown that toxic triggersare more likely to provoke toxic responses.
Revised: Previous work (Xu et al., 2020) has shown that toxic triggers are more likely to provoke toxic responses.

Original: Thus, in
Revised: Thus, in

Original: UTSC-1, we select the most toxic utterance amongall generated attack utterances according to toxicityscores from toxicity classifiers as our final attackutterance (i.e., arg max i ∈ [ n ] { x i } ).
Revised: UTSC-1, we select the most toxic utterance among all generated attack utterances according to toxicity scores from toxicity classifiers as our final attack utterance (i.e., arg max i ∈ [ n ] { x i } ).

Original: We experimentwith two additional criteria.
Revised: We experiment with two additional criteria.

Original: For UTSC-2, we firstapply a threshold T to toxicity scores of the candidate utterances and label the utterances above thisthreshold as toxic.
Revised: For UTSC-2, we first apply a threshold T to toxicity scores of the candidate utterances and label the utterances above this threshold as toxic.

Original: Next, from the pool of all toxicutterances, we select the utterance with the lowest toxicity score (i.e., arg min i ∈ [ n ] { x i | x i ≥ T } ).
Revised: Next, from the pool of all toxic utterances, we select the utterance with the lowest toxicity score (i.e., arg min i ∈ [ n ] { x i | x i ≥ T } ).

Original: If no utterances fall above the threshold, then themost toxic utterance is selected.
Revised: If no utterances fall above the threshold, then the [Figure] most toxic utterance is selected.

Original: Lastly, in UTSC3 we select the utterance with the lowest toxicityscore, i.e., arg min i ∈ [ n ] { x i } .
Revised: Lastly, in UTSC3 we select the utterance with the lowest toxicity score, i.e., arg min i ∈ [ n ] { x i } .

Original: Details are providedin Appendix A.
Revised: Details are provided in Appendix A.

Original: [Figure]

Original: 2. Experimental Setup
Revised: 2. Experimental Setup

Original: General Setup We use DialoGPT (Zhang et al., 2020c) to generate 100 conversations around a specific topic.
Revised: General Setup We use DialoGPT (Zhang et al., 2020c) to generate 100 conversations around a specific topic.

Original: The topic is determined by the context sentence that starts the conversation between the adversary and the defender.
Revised: The topic is determined by the context sentence that starts the conversation between the adversary and the defender.

Original: Each conversation runs for 10 turns.
Revised: Each conversation runs for 10 turns.

Original: To measure the effectiveness of the attack and defense mechanisms given the conversation history as well preservation of relevancy and coherency, the adversary generates the attack utterance on the third turn of each conversation.
Revised: To measure the effectiveness of the attack and defense mechanisms given the conversation history as well preservation of relevancy and coherency, the adversary generates the attack utterance on the third turn of each conversation.

Original: Toxicity Detection Models To determine toxicity of the candidate attack utterances by the adversary, we utilize an ensemble of three different toxicity detection models: Toxic-bert 1 , Perspective API 2 , and
Revised: Toxicity Detection Models To determine toxicity of the candidate attack utterances by the adversary, we utilize an ensemble of three different toxicity detection models: Toxic-bert 2 , Perspective API 3 , and

Original: Safety classifier (Xu et al., 2020).
Revised: Safety classifier (Xu et al., 2020).

Original: In short, Toxicbert is the least sensitive of the three, followed by
Revised: In short, Toxicbert is the least sensitive of the three, followed by

Original: Perspective API, and the Safety classifier (details in Appendix A).
Revised: Perspective API, and the Safety classifier (details in Appendix A).

Original: While using an ensemble of the three models results in the most effective attacks, to ensure that the adversary is not simply overfitting the toxicity detection model but rather forcing the defender to actually generate toxic language, we also study the transferability of these attacks.
Revised: While using an ensemble of the three models results in the most effective attacks, to ensure that the adversary is not simply overfitting the toxicity detection model but rather forcing the defender to actually generate toxic language, we also study the transferability of these attacks.

Original: We allow the adversary to only use one of the toxicity detection models to design its attack.
Revised: We allow the adversary to only use one of the toxicity detection models to design its attack.

Original: We then quantify toxicity using the other two toxicity detection methods, not accessed by the adversary.
Revised: We then quantify toxicity using the other two toxicity detection methods, not accessed by the adversary.

Original: Data
Revised: Data

Original: The context sentences around which bots start their conversations come from two different datasets, Wizard of Wikipedia (Dinan et al., 2018) and ConvoKit’s Reddit Corpus.
Revised: The context sentences around which bots start their conversations come from two different datasets, Wizard of Wikipedia (Dinan et al., 2018) and ConvoKit’s Reddit Corpus.

Original: 3 We intend to consider both controversial and neutral topics; thus, we consider two different datasets in which the Wizard of Wikipedia dataset contains context around neutral topics and the Reddit corpus contains contextaround more sensitive topics.
Revised: 4 We intend to consider both controversial and neutral topics; thus, we consider two different datasets in which the Wizard of Wikipedia dataset contains context around neutral topics and the Reddit corpus contains context around more sensitive topics.

Original: We picked 50 randomcontext sentences from the Wizard of Wikipediaand 50 from the Reddit datasets.
Revised: We picked 50 random context sentences from the Wizard of Wikipedia and 50 from the Reddit datasets.

Original: AMT Experiments To compare and verify thequality of conversations generated during and after the attacks, we conduct human experiments inwhich we ask workers on Amazon’s
Revised: AMT Experiments To compare and verify the quality of conversations generated during and after the attacks, we conduct human experiments in which we ask workers on Amazon’s

Original: Mechanical
Revised: Mechanical

Original: Turk (AMT) to rate the conversations in which
Revised: Turk (AMT) to rate the conversations in which

Original: UAT, UAT-LM, and UTSC-1 attacks had happened.
Revised: UAT, UAT-LM, and UTSC-1 attacks had happened.

Original: We pick UTSC-1 attack as it is the strongest attack amongst our proposed UTSC attacks.
Revised: We pick UTSC-1 attack as it is the strongest attack amongst our proposed UTSC attacks.

Original: Wethen asked AMT workers to rate the generated attack’s fluency, relevancy of the attack to previousutterances, and overall conversation coherency ona likert scale of 1 to 3 representing poor, moderate, and good qualities respectively.
Revised: We then asked AMT workers to rate the generated attack’s fluency, relevancy of the attack to previous utterances, and overall conversation coherency on a likert scale of 1 to 3 representing poor, moderate, and good qualities respectively.

Original: We also asked
Revised: We also asked

Original: AMT workers to rate if the utterance after the attack is toxic or not to verify the effectiveness of theattack according to human judgment.
Revised: AMT workers to rate if the utterance after the attack is toxic or not to verify the effectiveness of the attack according to human judgment.

Original: During thisstudy, AMT workers annotated 100 conversationsfrom each of the three attacks and each conversation was annotated by 3 AMT workers giving usoverall 900 annotated conversations 300 from eachattack.
Revised: During this study, AMT workers annotated 100 conversations from each of the three attacks and each conversation was annotated by 3 AMT workers giving us overall 900 annotated conversations 300 from each attack.

Original: More details about this study along with thesurvey can be found in Appendix A.
Revised: More details about this study along with the survey can be found in Appendix A.

Original: 2. Results
Revised: 2. Results

Original: We first discuss the results from our automatic evaluations demonstrating the efficacy of each attack.
Revised: We first discuss the results from our automatic evaluations demonstrating the efficacy of each attack.

Original: We then discuss how well the attacks transfer toother toxicity detection classifiers.
Revised: We then discuss how well the attacks transfer to other toxicity detection classifiers.

Original: Finally, wepresent results from our human evaluation study.
Revised: Finally, we present results from our human evaluation study.

Original: Unless otherwise mentioned, for the UTSC attacks,the adevrsary uses an equally weighted ensembleof all three toxicity detection classifiers to chosethe final attack utterance.
Revised: Unless otherwise mentioned, for the UTSC attacks, the adversary uses an equally weighted ensemble of all three toxicity detection classifiers to chose the final attack utterance.

Original: Attack Effectiveness Here we report the “attackeffectiveness” by calculating the percentage of con- [Figure] versations in which the defender was provoked by the adversary to generate a toxic response.
Revised: Attack Effectiveness Here we report the “attack effectiveness” by calculating the percentage of conversations in which the defender was provoked by the adversary to generate a toxic response.

Original: We first demonstrate the results comparing the UAT baseline with UAT-LM and UTSC attacks.
Revised: We first demonstrate the results comparing the UAT baseline with UAT-LM and UTSC attacks.

Original: Results in Figure 3 demonstrate that two of our proposed attacks UAT-LM and UTSC-1 are performing the best according to the Perspective API and Toxicbert classifiers.
Revised: Results in Figure 3 demonstrate that two of our proposed attacks UAT-LM and UTSC-1 are performing the best according to the Perspective API and Toxicbert classifiers.

Original: UAT baseline performs the best according to Safety classifier.
Revised: UAT baseline performs the best according to Safety classifier.

Original: Overall results show that UTSC-1 and UAT-LM attacks are competitive attacks in terms of attack effectiveness.
Revised: Overall results show that UTSC-1 and UAT-LM attacks are competitive attacks in terms of attack effectiveness.

Original: In addition,
Revised: In addition,

Original: UTSC-1 and UAT-LM attacks have the advantage of being more fluent which makes the attack more imperceptible.
Revised: UTSC-1 and UAT-LM attacks have the advantage of being more fluent which makes the attack more imperceptible.

Original: UAT attack tends to generate meaningless phrases, e.g., “acist neighborhoodsJohnson carry morals Ukrain” which can easily be detected as an anomaly and make the conversation not flow naturally.
Revised: UAT attack tends to generate meaningless phrases, e.g., “acist neighborhoodsJohnson carry morals Ukrain” which can easily be detected as an anomaly and make the conversation not flow naturally.

Original: In our experiments, we observe that the average perplexity score according the the GPTlanguage model for the attack phrases generated by
Revised: In our experiments, we observe that the average perplexity score according to the GPTlanguage model for the attack phrases generated by

Original: UAT is absurdly high ( ∼ 10 7 ) compared to ∼ 10 for UAT-LM, and ∼ 160 for UTSC-1.
Revised: UAT is absurdly high ( ∼ 10 7 ) compared to ∼ 10for UAT-LM, and ∼ 160 for UTSC-1.

Original: The perplexity for UTSC-1 is comparable to the no attack case  ∼ 39 .
Revised: The perplexity of the no attack case (unaltered DialoGPT conversations) is ∼ 39 .

Original: This automatically confirms that our attacks are more fluent and natural, and thus more imperceptible.
Revised: This automatically confirms that our attacks are more fluent and natural, and thus more imperceptible.

Original: This observation is further confirmed by our human evaluations which we discuss later.
Revised: This observation is further confirmed by our human evaluations which we discuss later.

Original: Imposing the language model constraint on UAT not only makes UAT-LM attack more fluent, but it also causes UAT-LM to generate more toxic triggers which results in more attack effectiveness.
Revised: Imposing the language model constraint on UAT not only makes UAT-LM attack more fluent, but it also causes UAT-LM to generate more toxic triggers which results in more attack effectiveness.

Original: Our results confirm the previous results (Xu et al., 2020) in which authors show in a human adversary case that more toxic attacks perform better in forcing the model to generate toxic utterances.
Revised: Our results confirm the previous results (Xu et al., 2020) in which authors show in a human adversary case that more toxic attacks perform better in forcing the model to generate toxic utterances.

Original: In our results, we also show that UTSC-3 performs the worst which is based on non-toxic utterances followed by the UTSC-2 attack which is based on the least toxic utterance attack constraint.
Revised: In our results, we also show that UTSC-3 performs the worst which is based on non-toxic utterances followed by the UTSC-2 attack which is based on the least toxic utterance attack constraint.

Original: However, UTSC-1 is the strongest as it relies on most toxic utterances followed by UAT-LM.
Revised: However, UTSC-1 is the strongest as it relies on most toxic utterances followed by UAT-LM.

Original: Thus, results confirm that the toxicity of the attack plays a significant role in attack effectiveness. 
Revised: Thus, results confirm that the toxicity of the attack plays a significant role in attack effectiveness. In addition

Original: In addition, we found that the adversary is able to force the defender into generating toxic utterances  regardless of the context sentence and whether or not the conversation is around a sensitive topic (e.g., the Reddit corpus) or a more neutral one (e.g., the
Revised: [Figure] we found that the adversary is able to force the defender into generating toxic utterances [Figure] regardless of the context sentence and whether or not the conversation is around a sensitive topic (e.g., the Reddit corpus) or a more neutral one (e.g., the

Original: Wizard of Wikipedia).
Revised: Wizard of Wikipedia).

Original: Details are in Appendix B.1.
Revised: Details are in Appendix B.1.

Revised: Note that even the smallest percentage of attack effectiveness (e.g., 10%-20%) poses a major risk for real-world conversational systems when those systems are deployed at scale.

Original: Attack Transferability Here, we discuss the transferability of our UTSC-1 attack toward different toxicity detection classifiers.
Revised: Attack Transferability Here, we discuss the transferability of our UTSC-1 attack toward different toxicity detection classifiers.

Original: In Figure 4, wedemonstrate that even if the attacker only uses oneof the toxicity detection models (Toxic-bert), it stillcan force the defender to generate toxic responsesaccording to Perspective API and Safety classifierand have comparable performance to when it usesall the toxicity classifiers.
Revised: In Figure 4, we demonstrate that even if the attacker only uses one of the toxicity detection models (Toxic-bert), it still can force the defender to generate toxic responses according to Perspective API and Safety classifier and have comparable performance to when it uses all the toxicity classifiers.

Original: This confirms that theattack is forcing the defender to generate actualtoxic language rather than fooling the toxicity classifier.
Revised: This confirms that the attack is forcing the defender to generate actual toxic language rather than fooling the toxicity classifier.

Original: The results for UTSC-1 using other toxicitydetection models can be found in Appendix B.1.
Revised: The results for UTSC-1 using other toxicity detection models can be found in Appendix B.1.

Original: Human Evaluation Results from our human evaluation studies are in Figure 5.
Revised: Human Evaluation Results from our human evaluation studies are in Figure 5.

Original: Our UTSC-1 attack is rated to have the highest coherency.
Revised: Our UTSC-1 attack is rated to have the highest coherency.

Original: UTSC1 is rated to have more fluent attacks generatedwith mostly moderate to good scores and a higheraverage–shown by the black dotted lines–comparedto the UAT and UAT-LM baselines.
Revised: UTSC1 is rated to have more fluent attacks generated with mostly moderate to good scores and a higher average–shown by the black dotted lines–compared to the UAT and UAT-LM baselines.

Original: UTSC-1 alsohas better relevancy scores in terms of the attackbeing more relevant to the conversation.
Revised: UTSC-1 also has better relevancy scores in terms of the attack being more relevant to the conversation.

Original: However,since UAT generates meaningless phrases, it israted very poorly for all the mentioned qualities.
Revised: However, since UAT generates meaningless phrases, it is rated very poorly for all the mentioned qualities.

Original: With regards to toxicity scores, attacks are ratedto have competitive and comparable performancesat around 20% effectiveness close to automatic results from Perspective API classifier.
Revised: With regards to toxicity scores, attacks are rated to have competitive and comparable performances at around 20% effectiveness close to automatic results from Perspective API classifier.

Original: Fleiss Kappa(Fleiss, 1971) annotator agreement results from thisevaluation is reported in Table 1.
Revised: Fleiss Kappa (Fleiss, 1971) annotator agreement results from this [Figure] [Figure] evaluation is reported in Table 1.

Original: Annotators havereasonable overall agreement for all the qualities.
Revised: Annotators have reasonable overall agreement for all the qualities.

Original:  Defense Approaches
Revised:  Defense Approaches

Original: The defense against adversarial attacks has twocomponents (a) detecting the attack and (b) mitigating its effect by ensuring that the defenderdoes not generate a toxic response.
Revised: The defense against adversarial attacks has two components (a) detecting the attack and (b) mitigating its effect by ensuring that the defender does not generate a toxic response.

Original: The detectionproblem is rather straightforward, as the defensecan simply run a toxicity classifier on the gener- [Figure] [Figure] ated response.
Revised: The detection problem is rather straightforward, as the defense can simply run a toxicity classifier on the generated response.

Original: The mitigation is more challenging.
Revised: The mitigation is more challenging.

Original: Xu et al.
Revised: Xu et al.

Original: (2020) suggested a mitigating approach which, when a toxic response is detected, simply resets the dialogue and generates a (non-toxic) utterance by randomly sampling from a predefined set of topics (see Section 3.2.1).
Revised: (2020) suggested a mitigating approach which, when a toxic response is detected, simply resets the dialogue and generates a (non-toxic) utterance by randomly sampling from a predefined set of topics (see Section 3.2.1).

Original: As we mentioned before, we are interested in mitigation strategies that avoid generating toxic utterances but at the same time manage to keep the conversation flow intact.
Revised: As we mentioned before, we are interested in mitigation strategies that avoid generating toxic utterances but at the same time manage to keep the conversation flow intact.

Original: We now discuss our approach in more details.
Revised: We now discuss our approach in more details.

Original: 3. Methodology
Revised: 3. Methodology

Original: Our defense is based on a two-stage mechanism in which the defender first runs a toxicity detection model on its generated utterance.
Revised: Our defense is based on a two-stage mechanism in which the defender first runs a toxicity detection model on its generated utterance.

Original: If it finds that the generated utterance is toxic, it then proceeds with the second stage of the defense.
Revised: If it finds that the generated utterance is toxic, it then proceeds with the second stage of the defense.

Original: The proposed defense mechanism in the second stage utilizes two layers of reasoning using two different interpretability techniques.
Revised: The proposed defense mechanism in the second stage utilizes two layers of reasoning using two different interpretability techniques.

Original: The first layer aims to detect which tokens in the defender’s utterance is making the toxicity detection model to label the utterance as being toxic.
Revised: The first layer aims to detect which tokens in the defender’s utterance is making Coherency Fluency Relevancy

Revised: Toxicity

Original:  We call these tokens the L1 tokens.
Revised: [Table] [Table] the toxicity detection model to label the utterance as being toxic. We call these tokens the L1 tokens.

Original: The second layer aims to detect which tokens in the adversary’s attack utterance are responsible for generation of L1 tokens form defender’s utterance.
Revised: The second layer aims to detect which tokens in the adversary’s attack utterance are responsible for generation of L1 tokens form defender’s utterance.

Original: We call these tokens identified in layer 2 as the
Revised: We call these tokens identified in layer 2 as the

Original: L2 tokens.
Revised: L2 tokens.

Original: The defender then masks the L2 tokens from the adversary, which were responsible for triggering the defender model to generate toxic tokens, and generates a new utterance.
Revised: The defender then masks the L2 tokens from the adversary, which were responsible for triggering the defender model to generate toxic tokens, and generates a new utterance.

Original: We then apply a tox- [Table] [Table] icity classifier on this new utterance.
Revised: We then apply a toxicity classifier on this new utterance.

Original: If it is deemedsafe, it is then going to replace the defender’s oldtoxic utterance, otherwise we iteratively apply thetwo-stage defense mechanism to mask more inputtokens until the generated output is deemed safe.
Revised: If it is deemed safe, it is then going to replace the defender’s old toxic utterance, otherwise we iteratively apply the two-stage defense mechanism to mask more input tokens until the generated output is deemed safe.

Original: As we shall see, a single iteration of our defense issufficient in most of the experiments.
Revised: As we shall see, a single iteration of our defense is sufficient in most of the experiments.

Original: The defense framework is demonstrated in Figure 6.
Revised: The defense framework is demonstrated in Figure 6.

Original: For the first layer, we use transformers interpret 4 which provides explanations and identifies the
Revised: For the first layer, we use transformers interpret 5 which provides explanations and identifies the

Original: L1 token according to Toxic-bert model.
Revised: L1 token according to Toxic-bert model.

Original: For thesecond layer, we use LERG (Tuan et al., 2021) thatprovides local explanations for dialogue responsegeneration and identifies the L2 token (given the
Revised: For the second layer, we use LERG (Tuan et al., 2021) that provides local explanations for dialogue response generation and identifies the L2 token (given the

Original: L1 token in the response utterance it identifies the
Revised: L1 token in the response utterance it identifies the

Original: L2 token in the query utterance).
Revised: L2 token in the query utterance).

Original: 3. Experimental Setup
Revised: 3. Experimental Setup

Original: We use the aforementioned attacks, and apply ourdefense against them.
Revised: We use the aforementioned attacks, and apply our defense against them.

Original: This follows the same experimental setup, with the addition of baseline defensesto compare our defense effectiveness against.
Revised: This follows the same experimental setup, with the addition of baseline defenses to compare our defense effectiveness against.

Original: 3.2. Baselines
Revised: 3.2. Baselines

Original: Two-stage Non Sequitur Baseline (Xu et al.
Revised: Two-stage Non Sequitur Baseline (Xu et al., 2020)

Original: This baseline is also a two-stage approachlike ours in which the defender first uses a toxicityclassifier to detect if the utterance is toxic or not.
Revised: This baseline is also a two-stage approach like ours in which the defender first uses a toxicity classifier to detect if the utterance is toxic or not.

Original: Itthen changes the topic of the conversation if the utterance was detected to be toxic, e.g., “Hey do youwant to talk about something else?
Revised: It then changes the topic of the conversation if the utterance was detected to be toxic, e.g., “Hey do you want to talk about something else?

Original: How about wetalk about X?”
Revised: How about we talk about X?”

Original: where X is a randomly chosen topicfrom 1087 topics judged as safe from the Wizardof Wikipedia conversational topic list (Dinan et al.,2018).
Revised: where X is a randomly chosen topic from 1087 topics judged as safe from the Wizard of Wikipedia conversational topic list (Dinan et al., 2018).

Original: Xu et al.
Revised: Xu et al.

Original: (2020) used this defense against ad- versarial attacks performed by human adversaries that force the model to generate toxic responses.
Revised: (2020) used this defense against adversarial attacks performed by human adversaries that force the model to generate toxic responses.

Original: Notice that although this defense is using a templated sentence to change the topic into a non-toxic topic and can be considered as the perfect solution to avoid generating toxic responses, it can provide the user with a non-plausible conversational experience given that the topic of the conversation changes each time the defender detects a toxic utterance.
Revised: Notice that although this defense is using a templated sentence to change the topic into a non-toxic topic and can be considered as the perfect solution to avoid generating toxic responses, it can provide the user with a non-plausible conversational experience given that the topic of the conversation changes each time the defender detects a toxic utterance.

Original: To this end, we expect this baseline to do almost perfectly in terms of avoiding toxic response generation given that the toxicity detection classifier is a good detector; however, in terms of conversational quality it will have worse relevancy and coherency scores compared to our method as shown in our human evaluations.
Revised: To this end, we expect this baseline to do almost perfectly in terms of avoiding toxic response generation given that the toxicity detection classifier is a good detector; however, in terms of conversational quality it will have worse relevancy and coherency scores compared to our method as shown in our human evaluations.

Original: Trigger Masking (TM) Baseline
Revised: Trigger Masking (TM) Baseline

Original: In this baseline, we consider masking the adversarial trigger tokens.
Revised: In this baseline, we consider masking the adversarial trigger tokens.

Original: Note that the defender does not generally know which tokens were the trigger-tokens used by the adversary, so this approach is not applicable in realistic settings.
Revised: Note that the defender does not generally know which tokens were the trigger-tokens used by the adversary, so this approach is not applicable in realistic settings.

Original: However, we believe that considering  this type of oracle baseline can still give us interesting insights, so we include it in our experiments.
Revised: However, we believe that considering [Figure] this type of oracle baseline can still give us interesting insights, so we include it in our experiments.

Original: 3.2. AMT Experiments
Revised: 3.2. AMT Experiments

Original: We asked AMT workers to evaluate the defense quality according to relevancy and fluency, the coherency of the overall conversation, and the toxicity of the defense utterance.
Revised: We asked AMT workers to evaluate the defense quality according to relevancy and fluency, the coherency of the overall conversation, and the toxicity of the defense utterance.

Original: 27 conversations were rated from each of the three defenses (TM, Twostage Non Sequitur, and our proposed defense)
Revised: 27 conversations were rated from each of the three defenses (TM, Twostage Non Sequitur, and our proposed defense).

Original: AMT workers rated each conversation which gave us 243 annotations 81 from each defense.
Revised: AMT workers rated each conversation which gave us 243 annotations 81 from each defense.

Original: More details can be found in Appendix A.
Revised: More details can be found in Appendix A.

Original: [Figure]

Original: 3. Results
Revised: 3. Results

Original: Defense Effectiveness We report “defense effectiveness” as the percent decrease in a defender generating a toxic response after adversary’s attackwhen the defense is applied compared to when itisn’t.
Revised: Defense Effectiveness We report “defense effectiveness” as the percent decrease in a defender generating a toxic response after adversary’s attack when the defense is applied compared to when it isn’t.

Original: From our results, we observe that both ourproposed defense mechanism as well as the Non
Revised: From our results, we observe that both our proposed defense mechanism as well as the Non

Original: Sequitur baseline achieve 100% defense effectiveness according to Toxic-bert classifier.
Revised: Sequitur baseline achieve 100% defense effectiveness according to Toxic-bert classifier.

Original: We alsonoticed that for our proposed method for all the attacks except UAT-LM, we were able to reach 100%defense effectiveness by only masking one token.
Revised: We also noticed that for our proposed method for all the attacks except UAT-LM, we were able to reach 100% defense effectiveness by only masking one token.

Original: For UAT-LM, almost 90% of cases were resolvedby masking one token and the rest were resolvedby the iterative approach that masked multiple tokens (up to 3).
Revised: For UAT-LM, almost 90% of cases were resolved by masking one token and the rest were resolved by the iterative approach that masked multiple tokens (up to 3).

Original: In addition, our defense is alsooutperforming the oracle Trigger Masking whichshows that using model interpretability can give usmore valuable insights than blindly masking outthe triggers.
Revised: In addition, our defense is also outperforming the oracle Trigger Masking which shows that using model interpretability can give us more valuable insights than blindly masking out the triggers.

Original: In some cases tokens generated afterthe trigger can themselves be more toxic and decisive in forcing the defender into generating toxicutterances (more details in Appendix B.1 Table 4.).
Revised: In some cases tokens generated after the trigger can themselves be more toxic and decisive in forcing the defender into generating toxic utterances (more details in Appendix B.1 Table 4.).

Original: As expected, the Non Sequitur defense is alwayseffective as it replaces the toxic utterance with anon-toxic utterance by changing the topic; however, this approach is not necessarily creating thebest conversational experience as also verified byour human experiments in terms of maintainingrelevancy and coherency of the conversation.
Revised: As expected, the Non Sequitur defense is always effective as it replaces the toxic utterance with a non-toxic utterance by changing the topic; however, this approach is not necessarily creating the best conversational experience as also verified by our human experiments in terms of maintaining relevancy and coherency of the conversation.

Original: Defense Transferability We analyze transferability of our defense mechanism with regards to threedifferent aspects as follows:
Revised: Defense Transferability We analyze transferability of our defense mechanism with regards to three different aspects as follows:

Original: Transferability to other toxicity detection
Revised: Transferability to other toxicity detection

Original: classifiers: Results in Figure 7 demonstrate that
Revised: classifiers: Results in Figure 7 demonstrate that

Original: even if the defender is using the interpretability results provided by the Toxic-bert classifier,
Revised: even if the defender is using the interpretability results provided by the Toxic-bert classifier,

Original: itcan
Revised: it

Original:  still be effective in reducing toxicity according to 
Revised: can still be effective in reducing toxicity according to Perspective

Original: Perspective API and Safety classifier on all attacks.
Revised: API and Safety classifier on all attacks

Original: Transferability when UTSC attack uses dif- ferent toxicity classifier than what the defender uses in its defense: We also noticed that even if the defender and the attacker do not use the same 
Revised: Transferability when UTSC attack uses different toxicity classifier than what the defender uses in its defense: We also noticed that even if the defender and the attacker do not use the same toxicity detectors the defense can be effective.

Original: toxicity detectors the defense can be effective.

Original: To see the results of our defense on all the combina- tion of toxicity detectors used by the attacker for its selection criteria refer to Appendix B.1.
Revised: To see the results of our defense on all the combination of toxicity detectors used by the attacker for its selection criteria refer to Appendix B.1.

Original: Transferability of the defense to human

Original: generated attacks: Lastly, to make sure that

Original: our

Original:  defense also transfers to human generated attacks and not just automatic attacks, we tried to generate attacks against the DialoGPT model and converse with it as the adversary.
Revised: Transferability of the defense to human generated attacks: Lastly, to make sure that our defense also transfers to human generated attacks and not just automatic attacks, we tried to generate attacks against the DialoGPT model and converse with it as the adversary.

Original: We managed to trigger the system for 10% of the cases, in line with the automatic attacks.
Revised: We managed to trigger the system for 10% of the cases, in line with the automatic attacks.

Original: We also saw 70% reduction in toxic generation when we applied only one iteration of our defense mechanism on these attacks.
Revised: We also saw 70% reduction in toxic generation when we applied only one iteration of our defense mechanism on these attacks.

Original: Human Evaluation Results of our human evaluations are demonstrated in Figure 8.
Revised: Human Evaluation Results of our human evaluations are demonstrated in Figure 8.

Original: Our defense is rated to have the highest fluency and relevancy scores.
Revised: Our defense is rated to have the highest fluency and relevancy scores.

Original: While our defense is mostly rated to have moderate to good ratings for relevancy, the Non
Revised: While our defense is mostly rated to have moderate to good ratings for relevancy, the Non

Original: Sequitur defense has poor relevancy scores.
Revised: Sequitur defense has poor relevancy scores.

Original: This is because the Non Sequitur defense changes the topic every-time a toxic utterance is generated which lowers the quality of the conversational experience.
Revised: This is because the Non Sequitur defense changes the topic every-time a toxic utterance is generated which lowers the quality of the conversational experience.

Original: Thus, even if the Non Sequitur defense can be really effective in reducing the toxicity as it replaces the toxic utterance with a non-toxic templated sentence, it can create poor conversational experience as also rated by human annotators.
Revised: Thus, even if the Non Sequitur defense can be really effective in reducing the toxicity as it replaces the toxic utterance with a non-toxic templated sentence, it can create poor conversational experience as also rated by human annotators.

Original: Human annotator agreements were also reasonable for these tasks (Table 2) according to Fleiss Kappa scores. 
Revised: Human annotator agreements were also reasonable for these tasks (Table 2) according to Fleiss Kappa scores. [Table] Fluency Relevancy

Revised: Toxicity

Revised: [Table]

Original: Beyond Conversational Agents
Revised: [Figure] [Table] [Figure] [Table]

Revised: [Figure]

Revised: [Table]

Revised: [Figure]

Revised: [Table]

Revised: [Figure]

Revised: [Table]

Revised: [Figure]

Revised: [Table]

Revised: [Figure]

Revised: [Table]

Revised: [Figure]

Original:  We show the generalizability of our defense method against non-conversational generation tasks, by conducting experiments with RealToxicityPrompts dataset (Gehman et al., 2020).
Revised: [Table] [Figure]  Beyond Conversational Agents We show the generalizability of our defense method against non-conversational generation tasks, by conducting experiments with RealToxicityPrompts dataset (Gehman et al., 2020).

Original: Previous work showed that the prompts in RealToxicityPrompts can force different generative models such as GPT2 (Radford et al., 2019) to generate toxic responses.
Revised: Previous work showed that the prompts in RealToxicityPrompts can force different generative models such as GPT2 (Radford et al., 2019) to generate toxic responses.

Original: Thus, we used our defense to test whether it can also be effective in reducing the number of toxic responses given these prompts in RealToxicityPrompts in the GPT-2 model.
Revised: Thus, we used our defense to test whether it can also be effective in reducing the number of toxic responses given these prompts in RealToxicityPrompts in the GPT-2 model.

Original: As evident from the previous discussions, the Non Sequitur baseline defense (Xu et al., 2020) that we considered in our paper, only works for the conversational domain; however, our method has the advantage of working on any conditional generation task.
Revised: As evident from the previous discussions, the Non Sequitur baseline defense (Xu et al., 2020) that we considered in our paper, only works for the conversational domain; however, our method has the advantage of working on any conditional generation task.

Original: We used the[Table] [Table] 100k prompts in RealToxicityPrompts and reportedthe number of toxic generations before and afterapplying our defense from the GPT-2 model.
Revised: We used the 100k prompts in RealToxicityPrompts and reported the number of toxic generations before and after applying our defense from the GPT-2 model.

Original: Results in Figure 9 demonstrate that one iteration of our defense reduces the number of generatedtoxic responses by 81%, 31%, and 23%, accordingto Toxic-bert, Perspective API, and Safety classifier, respectively.
Revised: Results in Figure 9 demonstrate that one iteration of our defense reduces the number of generated toxic responses by 81%, 31%, and 23%, according to Toxic-bert, Perspective API, and Safety classifier, respectively.

Original: Although the defense is based on
Revised: Although the defense is based on

Revised: [Figure]

Original: Toxic-bert, the results still transfer to Perspective
Revised: Toxic-bert, the results still transfer to Perspective

Original: API and Safety classifier.
Revised: API and Safety classifier.

Original: These results show theeffectiveness of our defense in reducing toxic generations beyond conversational domain and a steptoward reducing toxic generation.
Revised: These results show the effectiveness of our defense in reducing toxic generations beyond conversational domain and a step toward reducing toxic generation.

Original: Notice that thesetup of this experiment was not adversarial; however, prompts were causing the toxic generations.
Revised: Notice that the setup of this experiment was not adversarial; however, prompts were causing the toxic generations.

Original:  Related Work
Revised:  Related Work

Original: Crafting adversarial examples and using them intraining was previously shown to be an effectivetechnique in improving NLP and ML models (Nieet al., 2020; Dinan et al., 2019; Kiela et al., 2021).
Revised: Crafting adversarial examples and using them in training was previously shown to be an effective technique in improving NLP and ML models (Nie et al., 2020; Dinan et al., 2019; Kiela et al., 2021).

Original: Not only that, but adversarial attacks can reveal important vulnerabilities in our systems (Zhang et al.,2020a).
Revised: Not only that, but adversarial attacks can reveal important vulnerabilities in our systems (Zhang et al., 2020a).

Original: Although previous work has studied adversarial examples in NLP (Li et al., 2017; Zanget al., 2020) most of them focused on accuracy asa metric of interest.Among the ones that studied
Revised: Although previous work has studied adversarial examples in NLP (Li et al., 2017; Zang et al., 2020; Morris et al., 2020; Mozes et al., 2021) most of them focused on accuracy as a metric of interest.

Original: [Figure] toxicity and other ethical considerations (Wallace et al., 2019; Sheng et al., 2020) they did not put the focus on either conversational agents or they did not consider attacks being imperceptible.
Revised: Among the ones that studied toxicity and other ethical considerations (Wallace et al., 2019; Sheng et al., 2020) they did not put the focus on either conversational agents or they did not consider attacks being imperceptible.

Original: Cheng et al.
Revised: Cheng et al.

Original: ; Niu and Bansal (2018) studied adversarial attacks on conversational agents; however, their focus was on task oriented dialogue systems and also did not consider toxicity but accuracy as a metric.
Revised: ; Niu and Bansal (2018) studied adversarial attacks on conversational agents; however, their focus was on task oriented dialogue systems and also did not consider toxicity but accuracy as a metric.

Original: Xu et al.
Revised: Xu et al.

Original: (2020) also considered conversational domains; however, they relied on human adversaries which can be costly and non-scalable.
Revised: (2020) also considered conversational domains; however, they relied on human adversaries which can be costly and non-scalable.

Revised: Beyond attacks, we discussed a possible defense mechanism to improve robustness of generative models against generating toxic responses using interpretability methods.

Revised: Using interpretability mechanisms was also previously shown to be effective in reducing bias in ML applications (Mehrabi et al., 2021a).

Revised: In addition, there is a body of work in detecting toxic behavior in conversational agents (Zhang et al., 2018; Almerekhi et al., 2019;

Revised: Baheti et al., 2021) that can be utilized to design ethically aligned systems.

Original:  Conclusion
Revised:  Conclusion

Original: We studied the possibility of generating imperceptible attacks against conversational agents that, while fluent and coherent, target the model into generating toxic responses.
Revised: We studied the possibility of generating imperceptible attacks against conversational agents that, while fluent and coherent, target the model into generating toxic responses.

Original: Through various automatic and human experiments, we showed the effectiveness of our attacks both in terms of being adversarial as well as being able to maintain coherency, relevancy, and fluency of the generated conversation (what we referred as the attack being imperceptible).
Revised: Through various automatic and human experiments, we showed the effectiveness of our attacks both in terms of being adversarial as well as being able to maintain coherency, relevancy, and fluency of the generated conversation (what we referred as the imperceptibility of the attack).

Original: We then proposed a defense mechanism that was shown to be effective through various automatic and human evaluations as well as its transferability to human attacks, general generations tasks, and different toxicity classifiers.
Revised: We then proposed a defense mechanism that was shown to be effective through various automatic and human evaluations as well as its transferability to human attacks, general generation tasks, and different toxicity classifiers.

Original: Future work can focus on improving our proposed attacks both in terms of imperceptibility and effectiveness as well as more advanced defense mechanisms. 
Revised: Future work can focus on improving our proposed attacks both in terms of imperceptibility and effectiveness as well as more advanced defense mechanisms. Acknowledgments

Revised: We thank anonymous reviewers for providing insightful feedback.

Revised: We are also thankful to Emily

Revised: Dinan (Meta AI) for providing useful pointers about safety classifiers.

Original:  Broader Impact
Revised: Ninareh Mehrabi’s research was funded by USC + Amazon Center on Secure and Trusted Machine Learning fellowship. This work is partially sponsored by the Defense Advanced Research Projects Agency (DARPA) under the contract HR00112290021. Broader Impact

Original: In this work, we proposed possible attacks and defenses against conversational models that can helpimprove robustness of conversational agents.
Revised: In this work, we proposed possible attacks and defenses against conversational models that can help improve robustness of conversational agents.

Original: Wealso discussed the extension of our defense workon any general generation task that can be an important contribution towards mitigating toxic generations from our models.
Revised: We also discussed the extension of our defense work on any general generation task that can be an important contribution towards mitigating toxic generations from our models.

Original: By proposing effectiveimperceptible automatic attacks, we also eliminatethe need for human labor, reduce the cost, and makethis process more scalable.
Revised: By proposing effective imperceptible automatic attacks, we also eliminate the need for human labor, reduce the cost, and make this process more scalable.

Original: Previous work has shown the importance of adversarially crafted examples into improving NLPsystems (Nie et al., 2020; Dinan et al., 2019; Kielaet al., 2021); thus, our automatically generated examples can be useful in not only improving robustness of these systems and highlighting their vulnerabilities, but also a step towards their improvement.
Revised: Previous work has shown the importance of adversarially crafted examples into improving NLP systems (Nie et al., 2020; Dinan et al., 2019; Kiela et al., 2021); thus, our automatically generated examples can be useful in not only improving robustness of these systems and highlighting their vulnerabilities, but also a step towards their improvement.

Original: Not to mention our defense mechanism that candirectly mitigate the discussed issues.
Revised: Not to mention our defense mechanism that can directly mitigate the discussed issues.

Original: However, we also acknowledge the negative impacts that our work can have if used irresponsibly.
Revised: However, we also acknowledge the negative impacts that our work can have if used irresponsibly.

Original: We acknowledge that our attack can be used byunethical adversaries to force the models to generate toxic responses which is undesirable as alsopreviously observed in chatbots (Wolf et al., 2017;
Revised: We acknowledge that our attack can be used by unethical adversaries to force the models to generate toxic responses which is undesirable as also previously observed in chatbots (Wolf et al., 2017;

Original: Henderson et al., 2018; Dinan et al., 2021).
Revised: Henderson et al., 2018; Dinan et al., 2021).

Original: Since our defense mechanism relies on modelinterpretability, some of the models may be blackbox or not-interpretable.
Revised: Since our defense mechanism relies on model interpretability, some of the models may be blackbox or not-interpretable.

Original: In that case, we showthat the defender still can use proxy models whichare interpretable and as shown in the results of ourexperiments the defense can still be transferable.
Revised: In that case, we show that the defender still can use proxy models which are interpretable and as shown in the results of our experiments the defense can still be transferable.

Original: However, we acknowledge that in such cases thedefense might not be as effective, which can beconsidered a limitation of our work.
Revised: However, we acknowledge that in such cases the defense might not be as effective, which can be considered a limitation of our work.

Revised: Another possible limitation of our defense mechanism can be the token-level dependence of our defense approach which can cause our defense mechanism to possibly fail on more subtle cases where there is no clear token that makes a sentence toxic.

Original: In our studies, we also incorporated human annotators to annotate the quality of our generatedconversations.
Revised: In our studies, we also incorporated human annotators to annotate the quality of our generated conversations.

Original: We made sure to provide the annotators with appropriate and sufficient instructionsto complete the work along with a reasonable andacceptable compensation for their labor.
Revised: We made sure to provide the annotators with appropriate and sufficient instructions to complete the work along with a reasonable and acceptable compensation for their labor.

Original: We alsomade the annotators aware of possible toxic or inappropriate language in our generations ahead oftime.
Revised: We also made the annotators aware of possible toxic or inappropriate language in our generations ahead of time.

Revised: More details can be found in Appendix A.

Original: We hope that our study can be used for the benefit of the society and development of robust conversational systems along with reduced toxic generations in our models.
Revised: We hope that our study can be used for the benefit of the society and development of robust conversational systems along with reduced toxic generations in our models.

Original: Wewill release our code anddata in a public Github repository for the community to be able to use and reproduce our results.
Revised: We release our code and data in a public Github repository for the community to be able to use and reproduce our results.

Original: Appendix
Revised: Appendix

Original: We discuss additional detailed experimental setups,quantitative, and qualitative results that were leftout from the main paper due to space limitation.
Revised: We discuss additional detailed experimental setups, quantitative, and qualitative results that were left out from the main paper due to space limitation.

Original: A Details of Experimental Setup
Revised: A Details of Experimental Setup

Original: General Setup For the UAT and UAT-LM attacks,we used a 6-gram trigger to include in our baselines.
Revised: General Setup For the UAT and UAT-LM attacks, we used a 6-gram trigger to include in our baselines.

Original: For “attack effectiveness”, we report the percentageof conversations out of 100 conversations that westudy in this paper in which the defender was fooledby the adversary after the performed attack intogenerating a toxic response.
Revised: For “attack effectiveness”, we report the percentage of conversations out of 100 conversations that we study in this paper in which the defender was fooled by the adversary after the performed attack into generating a toxic response.

Original: This is done over oneround of analysis.
Revised: This is done over one round of analysis.

Original: For “defense effectiveness”, wereport the percent decrease in a defender generatinga toxic response after adversary’s attack when thedefense is applied compared to when it isn’t onthe same set of 100 conversations that we usedthroughout the paper for different analysis.
Revised: For “defense effectiveness”, we report the percent decrease in a defender generating a toxic response after adversary’s attack when the defense is applied compared to when it isn’t on the same set of 100 conversations that we used throughout the paper for different analysis.

Original: Similarto attack effectiveness, this is done over one roundof analysis.
Revised: Similar to attack effectiveness, this is done over one round of analysis.

Original: Computational Resources We used Nvidia
Revised: Computational Resources We used Nvidia

Original: GeForce RTX 2080 to perform all our experimentsexcept the experiment using the GPT-2 modelwhich was ran on CPU for memory constraints.
Revised: GeForce RTX 2080 to perform all our experiments except the experiment using the GPT-2 model which was ran on CPU for memory constraints.

Original: Model details We used the small DialoGPT modelfrom Hugging face 5 .
Revised: Model details We used the small DialoGPT model from Hugging face 6 .

Original: The GPT-2 6 and Unitary
Revised: The GPT-2 7 and Unitary

Original: Toxic-bert 7 models were also adapted from Hugging face.
Revised: Toxic-bert 8 models were also adapted from Hugging face.

Original: Safety classifier was adapted from ParlAI 8 .
Revised: Safety classifier was adapted from ParlAI 9 .

Original: We used all the default thresholds set by thedevelopers for all these toxicity detection classifiersand a threshold value of 0.5 for the Perspective APIto detect whether an utterance is toxic or not.
Revised: We used all the default thresholds set by the developers for all these toxicity detection classifiers and a threshold value of 0.5 for the Perspective API to detect whether an utterance is toxic or not.

Original: Weuse the same threshold values both in our attacksfor the selection criteria and in defenses to determine if a generated utterance is toxic or not.
Revised: We use the same threshold values both in our attacks for the selection criteria and in defenses to determine if a generated utterance is toxic or not.

Original: Comparing the performance of three classifiers alongwith analyzing qualitative results, we realized that
Revised: Comparing the performance of three classifiers along with analyzing qualitative results, we realized that

Original: Toxic-bert is the least sensitive amongst the threeclassifiers, followed by Perspective API that has theclosest agreement to humans, and Safety classifier.
Revised: Toxic-bert is the least sensitive amongst the three classifiers, followed by Perspective API that has the closest agreement to humans, and Safety classifier.

Original: Mechanical Turk Mechanical turk experimentswere performed on Amazon’s MTurk platform 9 .
Revised: Mechanical Turk Mechanical turk experiments were performed on Amazon’s MTurk platform 10 .

Original: We tested the experiment carefully on the sandboxplatform before releasing it live.
Revised: We tested the experiment carefully on the sandbox platform before releasing it live.

Original: The turkers were chosen from the master workers pool with additional qualifications set (e.g., HIT approval rate above 85, number of approved HITs above 1000) to make sure workers are reliable workers.
Revised: The turkers were chosen from the master workers pool with additional qualifications set (e.g., HIT approval rate above 85, number of approved HITs above 1000) to make sure workers are reliable workers.

Original: We left a comment section to make sure we hear the workers’ concerns about the task and the pay.
Revised: We left a comment section to make sure we hear the workers’ concerns about the task and the pay.

Original: We received couple of comments about the task being interesting with no complains on the pay.
Revised: We received couple of comments about the task being interesting with no complains on the pay.

Original: We made sure to give reasonable and on time compensation for the amount of work the workers put into and made sure to hear their comments about the pay.
Revised: We made sure to give reasonable and on time compensation for the amount of work the workers put into and made sure to hear their comments about the pay.

Original: We paid 0.30 for each HIT to be completed.
Revised: We paid 0.30 for each HIT to be completed.

Original: Detailed survey instruction forms of our attack and defense are included in Figures 13 and 14.
Revised: Detailed survey instruction forms of our attack and defense are included in Figures 13 and 14.

Original: Selection Criteria Details in UTSC Attack For selection criteria, we used the average toxicity scores from three different classifiers (Perspective API,
Revised: Selection Criteria Details in UTSC Attack For selection criteria, we used the average toxicity scores from three different classifiers (Perspective API,

Original: Toxic-bert, and Safety classifier)
Revised: Toxic-bert, and Safety classifier)

Original: unless otherwise stated in which we either used the score from one toxicity classifier or the average score from two classifiers.
Revised: unless otherwise stated in which we either used the score from one toxicity classifier or the average score from two classifiers.

Original: To determine whether an utterance is toxic or not, we used the default thresholds set by the developers for Toxic-bert and Safety classifiers and a threshold value of 0.5 for Perspective API.
Revised: To determine whether an utterance is toxic or not, we used the default thresholds set by the developers for Toxic-bert and Safety classifiers and a threshold value of 0.5 for Perspective API.

Original: In addition to toxicity scores, we considered other selection criteria, such as length of the generated attack; however, we saw no significant signal in using the length.
Revised: In addition to toxicity scores, we considered other selection criteria, such as length of the generated attack; however, we saw no significant signal in using the length.

Original: Thus, we focused on using toxicity scores in the main text which as shown in the results play a significant role in attack effectiveness.
Revised: Thus, we focused on using toxicity scores in the main text which as shown in the results play a significant role in attack effectiveness.

Original: Notice that other selection criteria can be considered along with length and toxicity scores, such as perplexity score for fluency or other metrics; however, for this study, we considered these two cases.
Revised: Notice that other selection criteria can be considered along with length and toxicity scores, such as perplexity score for fluency or other metrics; however, for this study, we considered these two cases.

Original: In our experiments the adversary generates 10 candidate attack utterances for each of its attacks and the final attack utterance is selected based on the selection criteria out of those 10 generated candidates.
Revised: In our experiments the adversary generates 10 candidate attack utterances for each of its attacks and the final attack utterance is selected based on the selection criteria out of those 10 generated candidates.

Original: Additionally, we report some statistics about toxicity scores of the adversary on the attack utterance as well as defender’s toxicity score after the attack for UTSC-1, UTSC-2, and
Revised: Additionally, we report some statistics about toxicity scores of the adversary on the attack utterance as well as defender’s toxicity score after the attack for UTSC-1, UTSC-2, and

Original: UTSC-3 attacks which can provide additional intuition on how toxic each attack is.
Revised: UTSC-3 attacks which can provide additional intuition on how toxic each attack is.

Original: These results are on the 100 conversations that are used in our experiments and are reported in Table 3.
Revised: These results are on the 100 conversations that are used in our experiments and are reported in Table 3.

Original: B Additional Results 
Revised: B Additional Results B. Additional Quantitative Results

Original: B. Additional Quantitative Results

Original: Data Sensitivity In Figure 15, we demonstrate what proportion of the attack effectiveness comes
Revised: Data Sensitivity In Figure 15, we demonstrate what proportion of the attack effectiveness comes

Original: [Table]
Revised: [Table]

Original: from which of the two Wizard of Wikipedia and
Revised: from which of the two Wizard of Wikipedia and

Original: Reddit datasets.
Revised: Reddit datasets.

Original: As also mentioned in the main text,
Revised: As also mentioned in the main text,

Original: Reddit dataset contains context topics around moresensitive issues, while the Wizard of Wikipediadata is more neutral.
Revised: Reddit dataset contains context topics around more sensitive issues, while the Wizard of Wikipedia data is more neutral.

Original: We show in our results thatthe topic context does not play a major role inour attacks being effective and indeed our attackcan work as well or even better for the Wizardof Wikipedia dataset that contains more neutralcontext topics.
Revised: We show in our results that the topic context does not play a major role in our attacks being effective and indeed our attack can work as well or even better for the Wizard of Wikipedia dataset that contains more neutral context topics.

Original: Attack Transferability In Figure 11, we demonstrate that no matter what toxicity detection classifier the attacker uses to chose its attack utterance,the attack can still transfer to other toxicity detection classifiers.
Revised: Attack Transferability In Figure 11, we demonstrate that no matter what toxicity detection classifier the attacker uses to chose its attack utterance, the attack can still transfer to other toxicity detection classifiers.

Original: For instance, if the attacker onlyuses Perspective API to perform its attack, resultsshow that the attack is still successful accordingto Toxic-bert and Safety classifiers in addition to
Revised: For instance, if the attacker only uses Perspective API to perform its attack, results show that the attack is still successful according to Toxic-bert and Safety classifiers in addition to

Original: Perspective API.
Revised: Perspective API.

Original: Results for different combinationsis shown in Figure 11.
Revised: Results for different combinations is shown in Figure 11.

Original: Defense Transferability In Figures 10 and 12, weshow two different types of defense transferability.
Revised: Defense Transferability In Figures 10 and 12, we show two different types of defense transferability.

Original: In Figure 10, we show that the defender andthe attacker do not need to use the same toxicitydetection classifiers for the defense to be effective.
Revised: In Figure 10, we show that the defender and the attacker do not need to use the same toxicity detection classifiers for the defense to be effective.

Original: We show that for instance, if the attacker is onlyusing Perspective API to perform its attack and thedefender is using Toxic-bert to perform the defensethe defense is still effective for 100% of the times.
Revised: We show that for instance, if the attacker is only using Perspective API to perform its attack and the defender is using Toxic-bert to perform the defense the defense is still effective for 100% of the times.

Original: We demonstrate different combinations of classifiers used by the attacker against a defender thatuses Toxic-bert to perform the defenese.
Revised: We demonstrate different combinations of classifiers used by the attacker against a defender that uses Toxic-bert to perform the defenese.

Original: In all thecases, we show that the defense is effective 100%of the times for our defense mechanism.
Revised: In all the cases, we show that the defense is effective 100% of the times for our defense mechanism.

Original: In Figure 12, we show that the defense transfers to other toxicity detection classifiers as well not only Toxic-bert for all the different combinations of the attacker toxicity detection classifiers.
Revised: In Figure 12, we show that the defense transfers to other toxicity detection classifiers as well not only Toxic-bert for all the different combinations of the attacker toxicity detection classifiers.

Original: Thus, results show that even if the defender is using Toxic-bert to perform the defense, according to both Perspective API and Safety classifiers the amount of toxicity is still decreased after the attack irrespective of what toxicity classifier the attacker is using.
Revised: Thus, results show that even if the defender is using Toxic-bert to perform the defense, according to both Perspective API and Safety classifiers the amount of toxicity is still decreased after the attack irrespective of what toxicity classifier the attacker is using.

Original: Of course, the defense is the most effective for Toxic-bert classifier; however, it is interesting that the attack also transfers to other classifiers.
Revised: Of course, the defense is the most effective for Toxic-bert classifier; however, it is interesting that the attack also transfers to other classifiers.

Original: B. Additional Qualitative Results
Revised: B. Additional Qualitative Results

Original: Finally, we show some qualitative results from our attacks and defenses in Figure 16.
Revised: Finally, we show some qualitative results from our attacks and defenses in Figure 16.

Original: We show results from our automatic attack strategy as well as our defense mechanism on it (Figure 16 (a)) along with our human experimental results in which a human adversary tries to fool the system into generating toxic utterances (Figure 16 (b)) and lastly the GPT2 experiments using the RealToxicityPromts and how effective our proposed defense mechanism works on these sets of prompts and model (Figure 16 (c-f)).
Revised: We show results from our automatic attack strategy as well as our defense mechanism on it (Figure 16 (a)) along with our human experimental results in which a human adversary tries to fool the system into generating toxic utterances (Figure 16 (b)) and lastly the GPT2 experiments using the RealToxicityPromts and how effective our proposed defense mechanism works on these sets of prompts and model (Figure 16 (c-f)).

Original: Notice that our human performed attacks did not consider any contexts since the human adversary was defining the context and starting the conversation with the context in mind all in one shot.
Revised: Notice that our human performed attacks did not consider any contexts since the human adversary was defining the context and starting the conversation with the context in mind all in one shot.

Original: This is slightly different than our automatically performed attack setup in which we always start the conversations given a context topic to force the bots to converse around the given topic and not just a random topic.
Revised: This is slightly different than our automatically performed attack setup in which we always start the conversations given a context topic to force the bots to converse around the given topic and not just a random topic.

Original: The rest of the experimental setup, however, is similar to the automatic attack/defense setup.
Revised: The rest of the experimental setup, however, is similar to the automatic attack/defense setup.

Original: [Table]
Revised: [Table]

Original: U T S CU T S CU T S CU T S Cw
Revised: U T S CU T S CU T S CU T S Cw

Original: T o x i c - b e r t
Revised: T o x i c - b e r t

Original: U T S Cw
Revised: U T S Cw

Original: T o x i c - b e r t
Revised: T o x i c - b e r t

Original: U T S Cw
Revised: U T S Cw

Original: T o x i c - b e r t
Revised: T o x i c - b e r t

Original: U T S Cw
Revised: U T S Cw

Original: P e r s p e c t i v e
Revised: P e r s p e c t i v e

Original: A P
Revised: A P

Original: I
Revised: I

Original: U T S Cw
Revised: U T S Cw

Original: P e r s p e c t i v e
Revised: P e r s p e c t i v e

Original: A P
Revised: A P

Original: I
Revised: I

Original: U T S Cw
Revised: U T S Cw

Original: P e r s p e c t i v e
Revised: P e r s p e c t i v e

Original: A P
Revised: A P

Original: I
Revised: I

Original: U T S Cw
Revised: U T S Cw

Original: S a f e t y c
Revised: S a f e t y c

Original: l a ss i f
Revised: l a ss i f

Original: i e r
Revised: i e r

Original: U T S Cw
Revised: U T S Cw

Original: S a f e t y c
Revised: S a f e t y c

Original: l a ss i f
Revised: l a ss i f

Original: i e r
Revised: i e r

Original: U T S Cw
Revised: U T S Cw

Original: S a f e t y c
Revised: S a f e t y c

Original: l a ss i f
Revised: l a ss i f

Original: i e r
Revised: i e r

Original: U T S Cw
Revised: U T S Cw

Original: P e r s p e c t i v e + S a f e t y
Revised: P e r s p e c t i v e + S a f e t y

Original: U T S Cw
Revised: U T S Cw

Original: P e r s p e c t i v e + S a f e t y
Revised: P e r s p e c t i v e + S a f e t y

Original: U T S Cw
Revised: U T S Cw

Original: P e r s p e c t i v e + S a f e t y
Revised: P e r s p e c t i v e + S a f e t y

Original: [Figure]
Revised: [Figure]

Original: D e f e n s e
Revised: D e f e n s e

Original: E ff e c t i v e n e ss
Revised: E ff e c t i v e n e ss

Original: Ours
Revised: Ours

Original: Non Sequitur
Revised: Non Sequitur

Original: TM
Revised: TM

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: A tt a c k E ff e c t i v e n e ss
Revised: A tt a c k E ff e c t i v e n e ss

Original: Wizard of Wikipedia Reddit
Revised: Wizard of Wikipedia Reddit

Original: [Figure]
Revised: [Figure]

Original: UAT UAT
Revised: UAT UAT

Original: [Figure]
Revised: [Figure]

Original: [Figure]
Revised: [Figure]

Original: A tt a c k E ff e c t i v e n e ss
Revised: A tt a c k E ff e c t i v e n e ss

Original: Wizard of Wikipedia Reddit
Revised: Wizard of Wikipedia Reddit

Original: [Figure]
Revised: [Figure]

Original: UAT UAT-LM
Revised: UAT UAT-LM

Original: [Figure]
Revised: [Figure]

Original: [Figure]
Revised: [Figure]

Original: -2 UTSC-3    %
Revised: -2 UTSC-3    %

Original: A tt a c k E ff e c t i v e n e ss
Revised: A tt a c k E ff e c t i v e n e ss

Original: Wizard of Wikipedia Reddit
Revised: Wizard of Wikipedia Reddit

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Table]
Revised: [Table]

Original: (cid:39)(cid:72)(cid:73)(cid:72)(cid:81)(cid:71)(cid:72)(cid:85)(cid:29)
Revised: (cid:39)(cid:72)(cid:73)(cid:72)(cid:81)(cid:71)(cid:72)(cid:85)(cid:29)

Original: [Table]
Revised: [Table]

Original: (cid:82)(cid:81)(cid:79)(cid:92)(cid:3)(cid:82)(cid:81)(cid:72)(cid:3)(cid:87)(cid:75)(cid:68)(cid:87)(cid:3)(cid:90)(cid:68)(cid:81)(cid:87)(cid:86)(cid:3)(cid:87)(cid:82)(cid:3)(cid:74)(cid:82)(cid:3)(cid:87)(cid:82)(cid:3)(cid:45)(cid:68)(cid:83)(cid:68)(cid:81)(cid:15)(cid:3)(cid:69)(cid:88)(cid:87)(cid:3)(cid:87)(cid:75)(cid:72)(cid:3)(cid:74)(cid:88)(cid:92)(cid:3)(cid:90)(cid:75)(cid:82)(cid:3)(cid:90)(cid:68)(cid:81)(cid:87)(cid:86)(cid:3)(cid:87)(cid:82)(cid:3)(cid:74)(cid:82)(cid:3)(cid:87)(cid:82)(cid:3)(cid:45)(cid:68)(cid:83)(cid:68)(cid:81)(cid:3)(cid:75)(cid:68)(cid:86)(cid:3)(cid:68)(cid:3)(cid:69)(cid:88)(cid:81)(cid:70)(cid:75)(cid:3)(cid:82)(cid:73)(cid:3)(cid:88)(cid:86)(cid:17)
Revised: (cid:82)(cid:81)(cid:79)(cid:92)(cid:3)(cid:82)(cid:81)(cid:72)(cid:3)(cid:87)(cid:75)(cid:68)(cid:87)(cid:3)(cid:90)(cid:68)(cid:81)(cid:87)(cid:86)(cid:3)(cid:87)(cid:82)(cid:3)(cid:74)(cid:82)(cid:3)(cid:87)(cid:82)(cid:3)(cid:45)(cid:68)(cid:83)(cid:68)(cid:81)(cid:15)(cid:3)(cid:69)(cid:88)(cid:87)(cid:3)(cid:87)(cid:75)(cid:72)(cid:3)(cid:74)(cid:88)(cid:92)(cid:3)(cid:90)(cid:75)(cid:82)(cid:3)(cid:90)(cid:68)(cid:81)(cid:87)(cid:86)(cid:3)(cid:87)(cid:82)(cid:3)(cid:74)(cid:82)(cid:3)(cid:87)(cid:82)(cid:3)(cid:45)(cid:68)(cid:83)(cid:68)(cid:81)(cid:3)(cid:75)(cid:68)(cid:86)(cid:3)(cid:68)(cid:3)(cid:69)(cid:88)(cid:81)(cid:70)(cid:75)(cid:3)(cid:82)(cid:73)(cid:3)(cid:88)(cid:86)(cid:17)

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Figure]
Revised: [Figure]