Original: T EXT S HIELD : B EYOND S UCCESSFULLY D ETECTING A DVERSARIAL S ENTENCES
Revised: T EXT S HIELD : B EYOND S UCCESSFULLY D ETECTING A DVERSARIAL S ENTENCES

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: In NLP, the adversarial attack serves as a major challenge for neural network models, which precludes their deployment in safety-critical applications.
Revised: Adversarial attack serves as a major challenge for neural network models in NLP, which precludes the model’s deployment in safety-critical applications.

Original: A recent line of works aims to distinguish adversarial sentences from benign ones, named detection-based defense.
Revised: A recent line of work, detection-based defense, aims to distinguish adversarial sentences from benign ones.

Original: However, there remains a significant gap between successfully detecting adversarial sentences and predicting correct labels of adversarial sentences.
Revised: However, there remains a significant gap between successfully detecting adversarial sentences and correctly classifying adversarial sentences for a specific application.

Original: To mitigate such a huge gap, this paper proposes TextShield: (1) we discover that explainability can be leveraged to detect adversarial sentences. Thus, we propose  saliency-based detector, which shows stronger performance than previous detectors in adversarial detection.
Revised: To mitigate such a huge gap, this paper proposes TextShield: (1) we discover a link between text attack and saliency information, and then we propose a saliency-based detector, which can effectively detect whether an input sentence is adversarial or not.

Original: (2) We design a corrector for NLP adversary correction.
Revised: (2) We design a saliencybased corrector, which converts the detected adversary sentences to benign ones.

Original: By combining theelaborate corrector and the saliency-based detector, TextShieldcan predict correct labels on adversarial sentences. Overall, such a design extends theexisting detection-only paradigm to a detection-correction paradigm and compensates for the key issue in  existing detection-based defense in NLP.
Revised: By combining the saliency-based detector and corrector, TextShield extends the detection-only paradigm to a detection-correction paradigm, thus filling the gap in the existing detection-based defense.

Original: Comprehensive experiments show that (a)our saliency-based detectors outperform existing detectors when distinguishing adversarial sentences.
Revised: Comprehensive experiments show that (a)

Original: (b) TextShield consistently achieves higher or comparable performance than state-of-the-art defense methods across  different models.
Revised: TextShield consistently achieves higher or comparable performance than state-ofthe-art defense methods across various attacks on different benchmarks.

Original: (c) ablation studies demonstrate that our corrector is a plug-and-play module that achieves strong performance when combining previous detectors.
Revised: (b) our saliency-based detector outperforms existing detectors for detecting adversarial sentences.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Deep Neural Networks (DNNs) have obtained great progress in  natural language processing  but are vulnerable to adversarial attacks, leading to security and safety concerns, and research on defense algorithms against such attacks is urgently needed.
Revised: Deep Neural Networks (DNNs) have obtained great progress in the field of natural language processing (NLP) but are vulnerable to adversarial attacks, leading to security and safety concerns, and research on defense algorithms against such attacks is urgently needed.

Original: While some defense techniques addressing this issue can be found in the literature Jones et al. ; Wang &  et al (2020);
Revised: Specifically, the most common attack for NLP is word-level attack (Wang et al., 2019a; Garg & Ramakrishnan, 2020; Zang et al., 2020; Li et al., 2021), which is usually implemented by adding, deleting or substituting words within a sentence.

Original: Zhou et al.
Revised: Such an attack often brings catastrophic performance degradation to DNN-based models. Therefore, we choose to study defending against word-level attacks 1 in this paper.

Original: Dong & et al (2021); Jia et al. ; Xu & et al (2020); Ko & et al (2019), results become limited as text attacks keep evolving.
Revised: Although a number of defense methods can be found in the literature of NLP (Jia et al., 2019; Ko et al., 2019; Jones et al., 2020; Wang et al., 2020b; Zhou et al., 2021; Dong et al., 2021; Bao et al., 2021), there are remaining several unsolved research problems.

Original: Previous research showed that adversarial data could be detected, which sheds light on defending against adversarial attacks. Some adversarial detection methods have been proposed in the NLP field: Mozes et al.
Revised: One problem lies in the ineffective application of the existing detection-based defense paradigm to the adversarial defense scenario, which consists of two steps: adversarial detection that detects whether an input sentence is adversarial or not, and a model prediction that predicts a label for the input.

Original: (2021) and Mosca et al.
Revised: Notice that the model prediction is usually specific for a practical application, e.g., different text classification tasks used in this paper.

Original: (2022) leverage word frequency and logits todetect adversarial sentences, respectively.
Revised: However, the detection-based defense paradigm only focuses on adversarial detection and does not make efforts to adversarial sentence prediction.

Original: One may wonder, is there any other information (besides logit and word frequency) that can be leveraged for adversarial detection in NLP? Correspondingly, we conduct empirical analysis and observe that the process of text attacks is related to saliency. Based on such discoveries, we define a metric called adaptive word importance (AWI) based on the saliency computation Springenberg et al.
Revised: That is, even if adversarial detection can successfully detect adversarial sentences, correctly predicting such adversaries remains incapable. Considering that an adversarial sentence is usually generated through adding an imperceptible perturbation into a benign sentence, we believe a practical defense paradigm should have another operation, a correction that transforms the adversarial sentence into the benign sentence as much as possible, and then use the corrected adversarial sentence for the model prediction.

Original: (2015); Bach & et al (2015); Sundararajan et al. (2017) used in the explainability of DNN. Moreover, in this paper, we point out a crucial issue of existing adversarial detection methods: they only successfully detectthe adversarial sentences without further modification, so they cannot enhance the model’s defense capacity against text attacks.
Revised: Therefore, considering the paradigm problem, we propose a detection-correction defense method in this paper. Another problem is that most existing defense methods rely either on word frequency or on prediction logits to detect adversarial sentences (Mozes et al., 2021; Mosca et al., 2022).

Original: Therefore, it is natural for one to wonder how to leverage adversarial detection methods to improve the model’s robustness against text attacks since a complete defense will not stop by successfully detecting adversarial sentences.
Revised: One may wonder whether any other information can be leveraged for adversarial detection.

Original: Considering this problem, we extend existing NLP adversarial detection methods to detectioncorrection methods. Specifically, we design and add a corrector to turn the  adversarial sentences into benign ones.
Revised: In this paper, we discover that the mechanism of text attack is related to saliency, a measure used in the explainability of DNNs (Simonyan et al., 2013). Based on such discovery, we propose the saliency-based detector to enhance adversarial detection.

Original: When detectors recognize adversarial sentences, they will be fed to  the corrector, and the corrected sentences are used for prediction instead of the original ones. Then, we build our TextShield, which consists of a detector and a corrector. 
Revised: Overall, to address the two issues, in this paper, we build our TextShield, a defense method consisting of a detector and a corrector. Motivated by the link between adversarial sentence and saliency, we define a metric called adaptive word importance (AWI) based on saliency computation (Simonyan et al., 2013), and then design the detector and corrector based on AWI.

Original: The detectoreffectively combines four saliency-based sub-detectors to inform whether an input sentence is adversarial.
Revised: Specifically, the detector combines four saliency-based sub-detectors to inform whether an input sentence is adversarial,

Revised: where the four sub-detector utilize four saliency computation methods (Simonyan et al., 2013; Springenberg et al., 2015; Bach et al., 2015; Sundararajan et al., 2017) to calculate AWI, respectively.

Original: Then, if the detector recognizes the input as adversarial, the corrector rectifies the words with high adversarial probabilities in the sentence by their high-frequency synonyms.
Revised: Then, if the detector recognizes the input as adversarial, the corrector rectifies the words with high adversarial probabilities in the sentence by their high-frequency synonyms, where the adversarial probability is determined by AWI.

Original: Finally, the corrected sentence is used for  prediction.
Revised: Finally, the corrected sentence is used for model prediction.

Revised: Our extensive experiments demonstrate that TextShield can effectively defend against adversarial attacks on several text classification benchmarks.

Original: Our main contribution can be summarized as follows:
Revised: Our main contribution can be summarized as follows:

Original: • We designTextShield, adetection-correction pipelined defense against text attacks that focus on saliency to defend against text attacks.
Revised: • We design a defense method, TextShield, which extends the existing detection-based defense paradigm to the detection-correction paradigm.

Original: TextShield extends the detection-based defense paradigm to the detection-correction paradigm by designing a corrector, which resolves the key issue inexisting detection-based defense in NLP.
Revised: The incorporation of a corrector in TextShield can resolve the model prediction incapability problem in detection-based defense.

Original: • We discover a better element for detecting adversarial sentences: saliency. Based on saliency. We design and combine the detectors using different saliency computation methods, further strengthening the performance.
Revised: • We discover another word-level information for detecting adversarial sentences, saliency, and then design a detector based on adaptive word importance (AWI), a novel metric based on saliency computation. Furthermore, AWI is also used to design the corrector.

Original: • Comprehensive experiments demonstrate that our TextShield performs comparably or better than SoTA defense methods under various victim classifiers on several benchmarks.
Revised: • Comprehensive experiments demonstrate that our TextShield performs comparably or better than SoTA defense methods under various victim classifiers on several text classification benchmarks  R ELATED W ORK

Revised: In recent years, many adversarial attack methods have been proposed for NLP, which try to modify the text data while making them less perceptible by humans.

Original: R ELATED W ORK AND B ACKGROUND 2. D EFENSE AGAINST TEXT ATTACK
Revised: Coarsely, these attacks modifies the text data at character level (Belinkov & Bisk, 2018; Eger et al., 2019; He et al., 2021), word level (Alzantot et al., 2018; Zhang et al., 2021; Wang et al., 2022) or sentence level (Jia & Liang, 2017; Ribeiro et al., 2018; Zhang et al., 2019b; Lin et al., 2021). Since word-level text attack is the most common and effective attack for text classification, in this paper, we focus on defense methods against wordlevel text attacks, which can be categorized into three paradigms: (1) model-enhancement-based, (2) certified-robustness-based, and (3) detection-based.

Original: Model enhancement is a popular way to improve the model’s robustness against text attacks, and one most common way is adversarial trainingmethods which re-train a victim model with additional adversarial examples to obtain an enhanced model.
Revised: Model enhancement is a popular way to improve the model’s robustness against text attacks, and one popular way is adversarial training which re-trains a victim model with additional adversarial examples to obtain an enhanced model.

Original: AlzantotAlzantot & et al (2018), and RenRen & et al (2019) generated adversarial examples by an attack method and re-trained models more robust against the attack. 
Revised: Alzantot et al. and Ren et al. (2019) generated adversarial examples by an attack method and re-trained models more robust against the attack. More successful defense based on model enhancement can be regarded as synonym encoding (Le et al., 2021;

Revised: Dong et al., 2021; Wang et al., 2021a), a series of methods against text attacks through setting the same embedding for different synonyms.

Original: Unfortunately, the robustness of re-trained models is often determined by the diversity of adversarial examples used in re-training.
Revised: Unfortunately, the robustness of re-trained models is often determined by the diversity of adversarial examples used in re-training (Shen et al., 2022).

Original: As a result, adversarial training is vulnerable to unknown attacks, which is unrealistic in real-world scenarios.
Revised: As a result, adversarial training is vulnerable to unknown attacks.

Original: Moreover, the relatively successful work based on model enhancement is synonym encoding Dong & et al (2021); Wang & et al (2021), a stronger method to defend against attacks by setting the same embedding for different synonyms.

Original: Besides, a stream of recent popular defense methods Huang & et al (2019); Jia et al. (2019) concentrate on certified robustness, which ensures models areprovably robust to all potential word perturbations within the constraints.
Revised: Besides, a stream of recent popular defense methods (Huang et al., 2019; Jia et al., 2019) concentrates on certified robustness, which ensures models are robust to all potential word perturbations within the constraints.

Original: For example, IBP Jia et al. (2019) performs catastrophically on large pre-trained language models (e.g., BERT). However, because of the extreme time cost in the training stage, certified robustness is difficult to be applied to complex models Jia et al.
Revised: However, because of the extreme time cost in the training stage, certified robustness is difficult to be applied to complex models. For example, IBP (Jia et al., 2019) performed catastrophically on large pre-trained language models (e.g., BERT).

Original: Recently, some work Mozes et al. ; Mosca et al. (2022) try to design detection-based defense methods.
Revised: Recently, some excellent works have designed detection-based defense methods.

Original: Mozes Mozes et al.
Revised: For example, Mozes et al.

Original: (2021) used the  frequency differencebetween original words and adversarial words to design detectors.
Revised: (2021) used the word frequency difference to design detectors; Le et al.

Original:  Mosca et al.
Revised: (2021) designed a detector specific for the ‘Universal trigger’; Mosca et al.

Original: (2022) proposes a detection method by the prediction logits.
Revised: (2022) proposed a detection method by leveraging prediction logits.

Original: However, such detection-based  methods own a key issue: they remain incapable of giving correct labels to adversarial sentences.
Revised: Despite their success, such detection-based defense methods own a key issue: the incapability of correctly classifying adversarial sentences.

Original: An intuitive and straight idea is to design a corrector to convertsuch detected adversarial sentences to  benign ones, which has provedto be effective in the  computer vision field Liu et al. ; Qin et al.
Revised: An intuitive and straightforward idea is to design a corrector to convert adversarial sentences to their original benign ones, which has proved effective in the the field of computer vision (CV) (Liu et al., 2019; Qin et al., 2019;

Original: ; Li et al. ; Deng et al.
Revised: Li et al., 2020; Deng et al., 2021).

Original: However, the different essence between languages and pixels make them not transferable in NLP.
Revised: However, the different essence between languages and pixels makes correctors used in CV not transferable in NLP.

Original: Thus, how to designproper detectors in NLP is a non-trivial problem.
Revised: In this paper, based on the generation mechanism of adversarial sentences, we design a proper detector and corrector for text attacks.

Original: 2.  B ACKGROUND
Revised:  B ACKGROUND

Original: Adversarial text attack In this section, we presentsome basic definitions used in our framework.
Revised: In this section, we present basic definitions used in adversarial text attack and saliency computation.

Original:  In a text classification scenario, X = { w 1 ,w 2 , . . . , w d } is a sentence with d words, and w 1 ,w 2 , . .
Revised: Adversarial text attack In a text classification scenario, X = { w 1 , . . . , w d } is a sentence with d words, and w 1 , . .

Original: . , w d are the correspondingword embeddings.
Revised: . , w d are the corresponding embeddings.

Original: Given a text classifier F , F ( X ) denotes the probability distribution over the class set Y forthe input sentence X, where |Y| = N .
Revised: Given a text classifier F , F ( X ) denotes the probability distribution over the class set Y for input sentence X .

Original: Class y j with the largest probability in F ( X ) is selected as the predicted label of X .
Revised: Then, class y j with the largest probability in F ( X ) is selected as the prediction of X .

Original: Generally, in a  text attack setting, there is a victim classifier  and a text attack  .
Revised: Furthermore, in a word-level text attack for a text classification scenario, there is a victim classifier F and a text attack G .

Original: • Victim Classifier:
Revised: • Victim Classifier:

Original: Given a set of training data in a text classification benchmark, a classifier F( x ) can be trained, where the sentence encoder is usually embodied as TextCNN Kim (2014), LSTM Hochreiter & Schmidhuber (1997) or BERT Devlin & et al (2019).
Revised: Given a set of benign sentences in a text classification benchmark, the victim classifier F can be trained with the benign sentences, where the sentence encoder is usually selected as TextCNN (Kim, 2014), LSTM (Hochreiter & Schmidhuber, 1997) or BERT (Devlin et al., 2019).

Original: •Word-level Text Attack: For a benign sentence X with a true label y j , the text attack G ( · ) will generate an adversarial sentence X ∗ =
Revised: • Text Attack: For a benign sentence X with a true label y j , the text attack G can generate an adversarial sentence X ∗ =

Original: G ( X ) by substituting words w i in X with w ∗ i , satisfying: (1) F ( X ∗ ) and F ( X ) output different predicted labels with high probability; (2) Dist ( w i , w ∗ i ) < δ , where Dist ( · , · ) is a distance metric and δ is a threshold to limit the distance between  two words.
Revised: G ( X ) by substituting words w i in X with w ∗ i , satisfying: (1) F ( X ∗ ) and F ( X ) output different predicted labels; ( 2) Dist ( w i , w ∗ i ) < δ , where Dist ( · , · ) is a distance metric and δ is a threshold to limit the distance between the two words.

Original: Saliency A saliency map is a common way to explain deep learning, where saliency is a measure that quantifies the sensitivity of the model’s output for input features.
Revised: Saliency computation In the field of the explainability of DNNs, the saliency map is a common technique to identify input features that are most salient.

Original: Specifically, a  saliencyvalue isthe degree to which a DNN-based model considers an input feature to an output class, and a saliency map is a transparent colored heatmap overlaid on theoriginal input features.Such a map can be used to identify input features that are most salient in the sense that they cause a maximum influence on the model’s output.
Revised: In other words, these input features cause a maximum influence on the model’s output. Specifically, saliency is a measure that quantifies the sensitivity of an output class for an input feature in a DNN-based model, and a saliency map is a transparent colored heatmap overlaid on the input features.

Original: To compute saliency, back-propagation-based methods, which have been widely used to compute saliency in the explainability of DNNs, treat saliency as the gradient of a DNN-based model.
Revised: Furthermore, back-propagation-based methods, which have been widely used to compute saliency in the explainability of DNNs, treat saliency as the gradient of a DNN-based model.

Original: Naturally, there are different ways to calculate gradients based on gradient signals passed from output to input during model training, which leads to different saliency computation methods.
Revised: There are different ways to calculate gradients based on gradient signals passed from output to input during model training, which leads to different saliency computation methods.

Original: For example, in the vanilla gradient(VG) method, saliency is directly defined as the partial derivative of the network output concerning each input feature scaled by its value.
Revised: For example, in the vanilla gradient (VG) method (Simonyan et al., 2013), saliency is directly defined as the partial derivative of the network output concerning each input feature scaled by its value.

Original: Formally, given a classifier F and a sentence X containing words w i , the saliency of w i to prediction y j is defined as follows:
Revised: Formally, given a classifier F and a sentence X containing words w i , the saliency of w i to prediction y j is defined as follows:

Original: [Equation]
Revised: [Equation]

Original: where F y j  is the prediction confidence for y j on F  .
Revised: where F y j ( X ) is the prediction confidence for y j when applying F on X .

Original:  M OTIVATION AND I NTUITION
Revised:  M OTIVATION AND I NTUITION

Original: This section illustrates intuitions that motivate us to design TextShield.
Revised: This section illustrates intuitions that motivate us to design TextShield.

Original: Firstly, weconduct toy experiments to show that important words are crucial to attacks’ effectiveness. Then we present  basic derivations to show a cross-cutting connection between adversarial robustness and saliency information. Finally, we present adaptive word importance to capture the saliency information. Then the detector judges whether X is adversarial.
Revised: Firstly, we present our basic derivations to show a cross-cutting connection between adversarial robustness and saliency.

Original: If not, F

Original: X will be the prediction. On the contrary, X will be corrected as X ′ by corrector, and the prediction X is F X
Revised: Then, we define adaptive word importance (AWI), a metric that helps us to detect adversarial sentences.

Original: 3. T HE CONNECTION BETWEEN ADVERSARIAL ROBUSTNESS AND SALIENCY
Revised: 4. T HE CONNECTION BETWEEN ADVERSARIAL ROBUSTNESS AND SALIENCY

Original: Previous empirical results demonstrate that the words with high saliency greatly influence the text attacks’ power.

Original: In this part, we explain why saliency is highly related to adversarial robustness, indicating  a connection between adversarial robustness and saliency.
Revised: In this part, we explain why saliency is highly related to adversarial robustness, indicating there is a connection between adversarial robustness and saliency.

Original: Given a victim classifier F and a benign sentence Xlabeled with  y j  , the objective of a text attack which generates an adversarial sentence X ∗ with a wrong prediction (namely y k ) is defined as follows:
Revised: Given a victim classifier F and a benign sentence X with label y j predicted by F , the objective of a text attack that generates an adversarial sentence X ∗ with a wrong predicted label (namely y k ) is defined as follows:

Original: [Equation]
Revised: [Equation]

Original: where L is a loss function (e.g., cross-entropy loss).
Revised: where L is a loss function (e.g., cross-entropy loss).

Original: In a vanilla gradient-based attack Goodfellow et al. (2014), Eq 2 is optimized by a gradient descent method.
Revised: In a vanilla gradient-based attack (Goodfellow et al., 2014), Eq 2 is optimized by a gradient descent method.

Original: In each iteration of the attack, word w i is substituted with a word whose embedding is closest to w i .
Revised: Specifically, in each iteration of the attack, word w i is substituted with a word whose embedding is closest to w i .

Original: In other words, word embedding w i is perturbed with a step rate r 1 by the attack, which is defined as follows:
Revised: In other words, word embedding w i is perturbed with a step rate r 1 by the attack, which is defined as follows:

Original: [Equation]
Revised: [Equation]

Original: In ease of clarification, we regard the word embeddings as continuous variables.
Revised: In ease of clarification, we regard the word embeddings as continuous variables.

Original: Then,  we  further derive the term w i − r 1 ∂ L ( F yj ( X ) ,y k )
Revised: Then, based on Eq 1, we can further derive the term w i − r 1 ∂ L ( F yj ( X ) ,y k )

Original: ∂w i , and rewrite it as follows:
Revised: ∂w i , and rewrite it as follows:

Original: [Equation]
Revised: [Equation]

Original: As shown in Eq 4, words with larger | r ij | are perturbed more severely by text attacks, which indicates that saliency | r ij | may serve as keys for adversary detection.
Revised: As shown in Eq 4, words with larger | r ij | are perturbed more severely by the attack, indicating that saliency | r ij | may serve as a key for adversary detection.

Original: 3. A DAPTIVE WORD IMPORTANCE
Revised: 4. A DAPTIVE WORD IMPORTANCE

Original: Inspired from previous findings and analyses, we design a novel metric called adaptive word importance (AWI) based on saliency.
Revised: Inspired from previous analysis and finding, we design a novel metric called adaptive word importance (AWI) based on saliency.

Original: Definition 1.
Revised: Definition 1.

Original: Given sentence X with prediction y j from text classifier F , the adaptive word importance (AWI)r ij of word w i in the sentence is defined as follows:
Revised: Given sentence X with label y j predicted by text classifier F , the adaptive word importance (AWI) of word w i in the sentence, R ij , is defined as follows:

Original: [Equation]
Revised: [Equation]

Original: ∆ is a saliency computation method, e.g., VG.
Revised: ∆ is a saliency computation method, e.g., VG.

Original: Givena sentence X , the ( i, j ) -th element R ij reflects how important word w iis towardsvictim classifier F with prediction y j  .
Revised: Given sentence X , the ( i, j ) -th element R ij reflects the importance of word w i towards prediction y j in victim classifier F .

Original: Thus, AWI can reflect the importance of a word in different settings (sentences, models, and classification tasks), and a larger AWI value indicates higher importance.
Revised: Thus, AWI can reflect the importance of a word, and a larger AWI value indicates higher importance.

Original:  T EXT S HIELD 4. O VERVIEW
Revised:  T EXT S HIELD 5. O VERVIEW

Original: Based on previous findings, we present TextShield, which is like a shield in front of the victim classifier , as shown in Figure 1.
Revised: Based on previous analysis, we present TextShield, which is like a shield in front of the victim classifier , as shown in Figure 1.

Original: Generally, TextShield has two principal components: an detector and a corrector.
Revised: Generally, TextShield has two principal components: a detector and a corrector.

Revised: The detector is a learning-based binary classifier that takes a sentence as input and outputs whether the input is adversarial or not.

Original: Specifically, in TextShield, the corrector continues to correct adversarial sentences to benign ones, which makes up the blank of previous detection-based  methods.
Revised: The corrector continues to correct adversarial sentences to benign ones, which makes up the blank of previous detection-based defense methods.

Original: Given an input sentence X , X is fed to the victim classifier F to get prediction y j .
Revised: Specifically, given an input sentence X , X is fed to the victim classifier F to get prediction y j .

Original: Then X is filtered by TextShield, which uses a detector  to judge whether X is adversarial based on prediction y j .
Revised: Then the detector is used to judge whether X is adversarial based on prediction y j .

Original: (1) If X is benign, the final prediction  will be y j .
Revised: If X is benign, the final prediction for X will be y j (i.e., F ( X ) ).

Original: (2) Otherwise, a corrector is used to recover X to X ′ , and the final prediction  will be F ( X ′ ) .
Revised: Otherwise, a corrector is used to transform X to X ′ , and the final prediction for X will be F ( X ′ ) .

Original: 4. D ETECTOR
Revised: 5. D ETECTOR

Original: The detector consists of four sub-detectors, which utilize different saliency computation methods for AWI, as shown in Figure 1.
Revised: As shown in Figure 2, the detector consists of four sub-detectors and one combiner. A sub-detector is a binary classifier that utilizes a saliency computation method and a LSTM layer to predict whether input sentence X is adversarial or not.

Original: Specifically, the four methods are vanilla gradient (VG), guided backpropagation (GBP)
Revised: In this paper, four saliency computation methods, vanilla gradient (VG), guided backpropagation (GBP), layerwise relevance propagation (LRP), and integration gradient (IG), are chosen, which correspond to the four sub-detectors, respectively. Then, the combiner uses a linear layer to combine four predictions from the four sub-detectors, respectively. Specifically, for a sub-detector based on a saliency computation method I , given an input sentence

Original: Springenberg et al.
Revised: X , one AWI matrix is calculated for X using I , and then the AWI matrix is fed to an LSTM to obtain a prediction. Takings VG as an example, the VG-based sub-detector is calculated as follows. [Equation] where R · j is a column of AWI matrix R , and z ( V G ) is a binary prediction from VG-based subdetector.

Original: (2015), layerwise relevance propagation (LRP) Bach & et al (2015), and integration gradient (IG) Sundararajan et al.
Revised: Similarly, z ( GBP ) , z ( LRP ) and z ( IG ) are predictions from GBP-based, LRP-based, and IG-based sub-detectors, respectively. Finally, through a linear combiner, the four binary predictions are combined to give the prediction z : [Equation]

Revised: where the z is the label reflecting whether X is adversarial.

Revised: In the following section, we will present the four saliency computation methods and then give the details of the detector’s training.

Original: Vanilla Gradient (VG)
Revised: Vanilla Gradient (VG)

Original: For text classifier F , the AWI  of word w i in sentence X to prediction y j is calculated by the vanilla gradient method  as follows:
Revised: For text classifier F , the AWI value of word w i in sentence X to prediction y j is calculated by the vanilla gradient method (Simonyan et al., 2013) as follows:

Original: [Equation]
Revised: [Equation]

Original: where R ( V G ) ij , theAWI of word w i to prediction y j , is the ( i, j ) -th element of AWI matrix R ( V G ) ,  F y j is the prediction confidence for y j from F , and w i is the word embedding for word w i .
Revised: where R ( V G ) ij , the ( i, j ) -th element of AWI matrix R ( V G ) , is the AWI value of word w i to prediction y j , F y j is the prediction confidence for y j from F , and w i is the word embedding for word w i .

Original: In fact, when calculating R ( V G ) ij , F y j is a scalar and w i ∈ R 1 × k is a vector, where k is the dimension of the word embedding.
Revised: In fact, when calculating R ( V G ) ij , F y j is a scalar and w i ∈ R 1 × k is a vector, where k is the dimension of the word embedding.

Original: Thus, ∂F yj ( X ) ∂ w i is a vector with the form R 1 × k , and an average operation is made to obtain R ( V G ) ij .
Revised: Thus, ∂F yj ( X ) ∂ w i is a vector with the form R 1 × k , and an average operation is made to obtain R ( V G ) ij .

Original: For brevity, we omit the operation in our paper.
Revised: For brevity, we omit the operation in the paper.

Original: Guided Backpropagation (GBP)
Revised: Guided Backpropagation (GBP)

Original: Based on the idea of  vanilla gradient, GBP Springenberg et al. (2015) only chooses the ‘positive’ ( > 0) gradients and discards ‘negative’ ( < 0) gradients.
Revised: Following the idea of the vanilla gradient, GBP (Springenberg et al., 2015) chooses only ‘positive’ ( > 0) gradients and discards ‘negative’ ( < 0) gradients.

Original: Positive gradients indicate supporting the prediction, while negative ones mean the opposite.
Revised: Positive gradients indicate supporting the prediction, while negative ones mean the opposite.

Original: Such an operation enables us to capture what  classifier F learns but discards anything that F does not learn.
Revised: Such a choice enables us to capture what text classifier F learns and yet discard anything that F does not learn.

Original: Specifically, when propagating gradients, GBP sets all negative gradients to 0 , and then calculates the gradient of input towards prediction.

Original: We take the final outputs of GBP as AWI matrix R GBP .
Revised: We take the final outputs of GBP as AWI matrix R GBP .

Original: Layerwise Relevance Propagation (LRP) GBP owns an obvious drawback called gradient saturation Bach & et al (2015); Binder& et al (2016) that gradients computed by GBP are always zeros under some cases.
Revised: Layerwise Relevance Propagation (LRP) GBP owns an obvious drawback called gradient saturation (Bach et al., 2015; Binder et al., 2016) that gradients computed by GBP are always zeros under some cases.

Original: Therefore, Layerwise Relevance Propagation (LRP) Bach & et al (2015) is proposed, which tackles the problem using a reference input besides the target input to calculate gradients.
Revised: Therefore, Layerwise Relevance Propagation (LRP) (Bach et al., 2015) is proposed, which tackles the problem using a reference input besides the target input to calculate gradients.

Original: The LRP method calculates a weight for each connection in the gradient chain and uses a reference input instead of roughly setting the weights as 0 or 1 like GBP.
Revised: The LRP method calculates a weight for each connection in the gradient chain and uses a reference input instead of roughly setting the weights as 0 or 1 like GBP.

Original: The reference input is a ‘neutral’ input and will be different in different tasks (e.g., blank images in the CV field or zero embeddings in the NLP field).
Revised: The reference input is a ‘neutral’ input and will be different in different tasks (e.g., blank images in the CV field or zero embeddings in the NLP field).

Original: Specifically, it aims at decomposing the classifier’s confidence to calculate each variable’s

Original: (e.g., word, pixel) contribution since it regards the confidence as a sum of the gradient of each input variable.

Original: Finally, such gradients compose AWI matrix R LRPij .
Revised: Finally, such gradients compose AWI matrix R LRP .

Original: Integrated Gradient (IG)
Revised: Integrated Gradient (IG)

Original: Some works Sundararajan et al. (2017) pointed out that LRP is calculatingthe discrete gradient.
Revised: Some works (Sundararajan et al., 2017) pointed out that LRP is calculating discrete gradients.

Original: However, the chain rule does not hold for discrete gradients thus LRP has essential drawbacks.
Revised: However, the chain rule does not hold for discrete gradients so that LRP has essential drawbacks.

Original: The integrated gradient (IG) Sundararajan et al. (2017) calculates the influence of word w i to prediction y j by integration of vanilla gradient,  defined as follows:
Revised: Thus, the integrated gradient (IG) (Sundararajan et al., 2017) is proposed, which calculates the influence of word w i to prediction y j by integrating vanilla gradient, which is defined as follows:

Original: [Equation]
Revised: [Equation]

Original: where w ′ i is a zero embedding and
Revised: where w ′ i is a zero embedding and

Original: F y j
Revised: F y j

Original: ( X, w i ′
Revised: ( X, w i ′

Original: +
Revised: +

Original: α ( w i − w i ′ ) means  w i ’s embedding w i  is replaced with w i
Revised: α ( w i − w i ′ ) means that the embedding of word w i , w i , is replaced with w i

Original: + α ( w i − w i ′ ) .
Revised: + α ( w i − w i ′ ) .

Original: The final outputs of IG is AWI matrix R IG .
Revised: The final outputs of IG is AWI matrix R IG .

Original: Combination of sub-detectors As illustrated in Figure 2, given an input sentence X , a detector calculates AWI matrix using a saliency computation method I , and then AWI matrix is feed to an

Original: LSTM.

Original: Take VG as an example: [Equation] where R · j is a column of AWI matrix R , and z ( V G ) is a binary prediction of VG detector. Similarly, z ( GBP ) , z ( LRP ) and z ( IG ) are predictions by GBP, LRP, and IG detectors, respectively.
Revised: Training of detector Generally, training the detector consists of the following three steps, where both the adversarial data setup and the balanced data setup prepare data for the model’s training.

Original: Finally, through a linear layer, z ( V G ) , z ( GBP ) , z ( LRP ) and z ( IG ) are combined to give the final prediction z :

Original: [Equation]

Original: [Equation] where the z is the label reflecting whether X is adversarial. Training of detector The detector is a learning-based classifier that takes AWI matrices as input only and outputs whether the input X is adversarial or not. Basically, training the detector can be summarized into several steps:
Revised: More training details are deferred to Appendix A.

Original: •(1) Adversarial sentence setup : given the original dataset, we fine-tune the victim classifier F on the dataset.
Revised: • Adversarial data setup : Given benign data, the victim classifier F is fine-tuned by the data.

Original: Thenwe use the adversarial attacks  to generate  and selectsentences per class that successfully attacks F , and the adversarial sentences are equally generated by GA, IGA, GSA, PWWS, and TextFooler.
Revised: Then the adversarial attacks are used to generate adversarial sentences and 2, adversarial sentences per class that successfully attacks F are selected. Moreover, the adversarial sentences are equally generated by GA, IGA, PWWS and TextFooler.

Original: • (2) Data setup : We mix the adversarial data(from (1)) and the same-size original data.
Revised: • Balanced data setup : The adversarial data and the same-size benign data are mixed as balanced data.

Original: Then we splitit into train-dev-test parts with a 7:2:1 proportion.
Revised: Then, the balanced data is split into train-dev-test sets with a 7:2:1 proportion.

Original: • (3) Training the mixed data (from (2)) is fed to  the detector to distinguish adversarial data andbenign ones. We select the best-performance checkpoint  according to performance on the dev  set.
Revised: • Model training : The training data set is fed to train the detector, and the best-performance checkpoint is selected according to performance on the dev data set.

Original: 4. C ORRECTOR
Revised: 5. C ORRECTOR

Original: If the input sentence is an adversarial one,  the sentence will be fed to the corrector.
Revised: As mentioned in Sec 5.1, if the detector recognizes the input sentence X as an adversarial one, then the prediction y j for X is possibly inaccurate.

Original: As discussed above, given an AWI matrix R , larger R ij means word w i is more important for classifying the sentence as y j .
Revised: Furthermore, as discussed in Sec 4.1, given an AWI matrix R , larger R ij means word w i is more important for classifying the sentence as y j .

Original: In the corrector, R V G ij is used for R ij . If the detector recognizes the sentence as an adversarial one, then prediction y j is possibly inaccurate, and the words with large AWI  are possible to be perturbed by attacks to fool the victim classifier.
Revised: In other words, words with large AWI values are more likely to be perturbed by attacks to fool the victim classifier.

Original: Therefore, the corrector corrects the words with large AWI  in the adversarial sentence.
Revised: Therefore, the corrector corrects the words with large AWI values in the adversarial sentence.

Original:  Specifically, for an adversarial sentence X ∗ with prediction y j , the corrector regards a word w i as a suspect when its R ij exceeds a threshold, which is defined as follows:
Revised: In addition, the corrector chooses R V G ij as R ij . Specifically, for an adversarial sentence X ∗ with prediction y j , the corrector regards a word w i as a suspect when its R ij exceeds a threshold, which is defined as follows:

Original: [Equation]
Revised: [Equation]

Original: where R max and R min are the largest and smallest values in R , and β is a hyper-parameter to control the ratio of suspects.
Revised: where R max and R min are the largest and smallest values in R , and β is a hyper-parameter to control the ratio of suspects.

Original: For a suspect w i , the corrector substitutes w i with the most frequent word w ′ ∈ S ( w i ) , where S ( w i ) is w i ’s synonyms 1 .
Revised: For a suspect w i , the corrector substitutes w i with the most frequent word w ′ ∈ S ( w i ) , where S ( w i ) is w i ’s synonyms (Loper & Bird, 2002).

Original:  E XPERIMENTS ON ADVERSARIAL DETECTION
Revised:  E XPERIMENTS ON ADVERSARIAL DEFENSE

Original: In this section, we conduct comprehensive experiments to show the performance our saliency-based detector when detecting adversarial sentences. 5. D ATASETS AND TEXT ATTACKS
Revised: In this section, we carry out two sets of experiments to comprehensively analyze our detectioncorrection defense method, TextShield. The first set of experiments examines TextShield to enhance defense against adversarial attacks.

Original: We select three popular benchmarks in text classification: IMDB Potts (2010), AG’s News Zhang et al.
Revised: The second set of experiments are ablation analyses on TextShield to answer the following three questions: Q1)

Original: (2015), and Yelp Zhang et al.
Revised: What is the impact of β , the hyperparameter of the corrector? Q2)

Original: For text attacks, we select three widely used adversarial attacks in the NLP field: GSA Kuleshov & et al (2018), PWWS Ren & et al (2019), TextFooler Jin et al. and IGA Wang et al. 5. B ASELINES AND VICTIM CLASSIFIER We choose the two newest detectors in NLP: FGWS and WDR.
Revised: What is the impact of multiple sub-detectors?

Original: FGWS leverages word frequency to detect adversarial sentences, while WDR uses logit information for detection. Moreover, considering victim classifiers, we use TextCNN Kim (2014), LSTM Hochreiter & Schmidhuber (1997), and BERT Devlin & et al (2019) as victim classifiers. For TextCNN and LSTM.
Revised: Q3)

Original: Specifically, TextCNN has three convolutional layers with filter sizes of 3, 4, and 5, a dropout layer (dropout rate = 0 . 2 ), and a fully connected layer. The LSTM-based victim classifier has two layers, each with 128 cells.
Revised: What is the impact of the number of adversarial sentences used to train detectors? Due to limited space, we present only the first set of experiments and defer the description and analysis of the ablation analyses to appendix B.

Original: 5. P ERFORMANCE
Revised: 6. E XPERIMENTAL SETTINGS

Original: During adversarial detection, the performance is evaluated by F1-score and recall, following previous works Mozes et al.

Original: ; Mosca et al. As shown in Table 1, the saliency-based detector achieves significantly better performance than the baselines. Specifically, it is interesting to observe that TextFooler is easier to detect than other attacks since TextFooler is much stronger than the attacks like GA  and IGA. [Table]
Revised: Firstly, we use TextCNN (Kim, 2014), LSTM (Hochreiter & Schmidhuber, 1997) and BERT (Devlin et al., 2019) as victim classifiers, and select four widely-used text attacks in the NLP field: TL (Kuleshov et al., 2018), PWWS (Probability Weighted Word Saliency, Ren et al., 2019) , GA (Genetic Algorithm, Alzantot et al., 2018) and IGA (Improved Genetic Algorithm, Wang et al., 2019b).

Original: E XPERIMENTS ON ADVERSARIAL DEFENSE 6. D ATASETS AND TEXT ATTACKS

Original: We select three popular benchmarks in text classification: IMDB Potts (2010), AG’sNews Zhang et al.
Revised: Moreover, we choose three popular benchmarks in text classification: IMDB (Potts, 2010), AG’s

Original: (2015), and Yahoo!
Revised: News (Zhang et al., 2015) and Yahoo!

Original: Answers Zhang et al.
Revised: Answers (Zhang et al., 2015).

Original: For text attacks, we select four widely used adversarial attacks in the NLP field: GSA Kuleshov & et al (2018), PWWS Ren & et al (2019), GA Alzantot & et al (2018) and IGA Wang et al.
Revised: Then, given a victim classifier, an attack and a benchmark, we generate test data consisting of a benign dataset and an adversarial dataset, which are used to evaluate the generalization and robustness of defense methods. Specifically, the benign dataset includes 1,000 benign sentences sampled from the benchmark, and the adversarial dataset includes 1,000 adversarial sentences generated by the attack based on the benchmark.

Original: 6. B ASELINES AND VICTIM CLASSIFIERS
Revised: Please note that there is no overlap between the test data and the training data used for the detector’s training. Finally, we evaluate the performance of the victim models with or without defense methods on the test data. The more powerful a defense method is, the better classification accuracy on adversarial sentences is.

Original: We choose four  defense methods as the baselines: (1) IBP Jia et al. (2019): the most representative method in  certified robustness paradigm.
Revised: Moreover, we compare TextShield with four state-of-the-art defense methods: (1) IBP (Jia et al., 2019): the most representative method in the certified robustness paradigm.

Original: (2) synonym encoding method (SEM) Wang & et al (2021): the state-of-the-art defense method  against word-level attack. (3) frequency-based word substitution (FGWS)
Revised: (2) Adversarial Sparse Convex Combination (ASCC) (Dong et al., 2021): a model-enhancement-based defense method which leverages convex hull to defend against adversarial word substitutions. (3) Synonym Encoding Method (SEM) (Wang et al., 2021a): a model-enhancement-based defense method based on synonym encoding.

Original: Mozes et al. (2021): a detection-based method that leverages word frequency.
Revised: (4) Frequency-based Word Substitution (FGWS) (Mozes et al., 2021): a detection-based method which leverages word frequency.

Original: (4) Wordlevel Differential Reaction (WDR): a detection-based method that leverages prediction logits.
Revised: (5) Word-level Differential Reaction (WDR) (Mosca et al., 2022): a detection-based method which utilizes prediction logits.

Original: [Table] Adversarial Sparse Convex Combination (ASCC): a defense method that leverages convex hull to defend against adversarial word substitutions. Specifically, considering that (3)(4) are detection methods and lack the capacity of producing true labels on adversarial sentences.
Revised: Specifically, considering that FGWS and WDR are detection-only methods and cannot correctly classify adversarial sentences, we combine our corrector to them.

Original: Furthermore, the baselines’ settings are kept the same with corresponding papers. 
Revised: Moreover, the baselines’ settings are kept the same with corresponding papers. 6. P ERFORMANCE

Original: To validate that TextShield is effective across different victim models, we use TextCNN Kim (2014), LSTM Hochreiter & Schmidhuber (1997), and BERT Devlin & et al (2019) as victim classifiers. For
Revised: Table 1 lists the performances of various defense models under different scenarios, which demonstrates both the generalization and the robustness of these defense models.

Original: TextCNN and LSTM, we use Glove Pennington et al. (2014) for the pre-trained embedding with a size of 300. Specifically, TextCNN has three convolutional layers with the filter sizes of 3, 4, and 5, a dropout layer (dropout rate = 0 . 2 ), and a fully connected layer.
Revised: Effect on generalization When evaluated on benign sentences (see Column ’No’ in Table 1), normal training (NT) achieves the best results, and our proposed method, TextShield, achieves accuracy performance close to normal training (NT), indicating a good trade-off between robustness and generalization.

Original: The LSTM-based victim classifier has two layers, each with 128 cells. BERT is ’Bert-base’ with the checkpoint from Huggingface. 6. P ERFORMANCE ANALYSIS Firstly, we generate test data, where 1000 benign sentences are sampled from each benchmark, and 1000 adversarial sentences are generated by each text attack based on each benchmark.
Revised: By the way, such a trade-off is common for attack/defense, which has been theoretically investigated in the CV field (Zhang et al., 2019a).

Original: Then we evaluate the performance of the victim models with or without defense methods. The more powerful a defense method is, the better classification accuracy  on adversarial sentences is. Table 2 illustrates the performances of various defense methods on different test data. Generalization When evaluated on benign sentences, adversarial training (AT) achieves the best performances in most cases, which indicates AT can effectively enhance model’s generalization.
Revised: In addition, generalization can be seen as a proper upper bound for accuracy performance on adversarial sentences.

Original:  IBP achieves much lower accuracyon benign data due to its high complexity and relatively loose bounds.
Revised: Moreover, among baselines, ASCC performs best, and IBP has lowest accuracy due to its high complexity and relatively loose bounds.

Original: Our proposed method, TextShield, achieves an accuracy close to normal training (NT), which has a good trade-off between robustness and generalization.
Revised: Besides, combined with our corrector, PGWS and WDR obtain

Original: Such a trade-off is common for attack/defense, which has been theoretically investigated in the CV field Zhang & et al (2019).
Revised: [Table]

Original: Adversarial robustness When evaluated on adversarial sentences, TextShield performs best in most cases, which demonstrates that TextShield can effectively improve  model’s robustness.
Revised: Effect on robustness When evaluated on adversarial sentences TextShield performs best in most cases, demonstrating that TextShield can effectively improve the model’s robustness.

Original: AT is extremely powerless to defend against text attacks. One possible reason is the requirement of  the diversity of re-training data Ren & et al (2019), and such a requirement is unable to meet due to limited adversarial sentences.
Revised: Furthermore, the enhancement of model’s robustness is derived from the leveraging a cross-cutting link between adversarial robustness and saliency, which is contrary to the conventional opinion (Zhang et al., 2020; Goyal et al., 2022) that text attacks should be defended using discrete information (e.g., synonym encoding) instead of continuous information (e.g., saliency). Moreover, among the baselines, SEM, the state-of-the-art defense method against word-level attacks, achieves the best performance.

Original: IBP which were first proposed in the CV domain is more suitable for TextCNN and does not perform excellently on other victim classifiers (i.e., LSTM and BERT).
Revised: IBP, which was first proposed in the CV domain, is more suitable for TextCNN and does not perform excellently on other victim classifiers (e.g., LSTM).

Original: Since FGWS focuses only on word frequencies,  it is not sufficient to detect adversarial examples.
Revised: FGWS focuses only on word frequencies, so it is not sufficient to detect adversarial sentences when word frequency is not distinct.

Revised: Moreover, after combining with our corrector, WDR can yield a comparable performance towards ASCC, a competitive baseline using the model-enhancementbased paradigm, which indicates our corrector can combine well with existing detectors concerning model’s robustness.

Revised:  E XPERIMENTS ON ADVERSARIAL DETECTION

Revised: In this section, we compare our saliency-based detector to current state-of-the-art adversarial detectors, and carry on the comparison in several configurations involving datasets and attacks.

Revised: Moreover, we also conduct experiments on adversarial detection for character-level and sentence-level attacks and defer the results and discussions to Appendix C.

Original: Among all baselines, SEM achieves the best results, but it still cannot perform as well as TextShield.
Revised: In the experiments, only BERT (Devlin et al., 2019) is used as victim classifier. Then, four widely used adversarial attacks are selected: GA (Alzantot et al., 2018), PWWS (Ren et al., 2019), IGA (Wang et al., 2019b) and TextFooler (Jin et al., 2020). Next, three popular benchmarks in text classification are selected: IMDB (Potts, 2010), AG’s News (Zhang et al., 2015) and

Revised: Yelp (Zhang et al., 2015).

Revised: Similar to the experiments on adversarial defense, given a victim classifier, an attack, and a benchmark, we generate test data which include 1,000 adversarial sentences generated by the attack based on the benchmark.

Revised: Finally, we evaluate the performance of the victim models on the test data.

Revised: Following previous works (Mosca et al., 2022), the performance of adversarial detection is evaluated by F1-score and recall.

Revised: Moreover, in order to examine the performance of our detector, two state-of-the-art detectors are chosen as baselines, FGWS (Mozes et al., 2021) and WDR (Mosca et al., 2022), where FGWS leverages word frequency to detect adversarial sentences, and WDR uses prediction logit information for adversarial detection.

Revised: 7. P ERFORMANCE

Revised: Table 2 shows the performance of the three detectors in various configurations.

Revised: In Table 2, our proposed detector consistently shows very competitive results in terms of F1-score and recall.

Revised: Specifically, our detector outperforms the best baseline in 11 configurations out of 12, and on average achieves 3.74% gain on F1-score.

Revised: Such results not only indicate the effectiveness of our saliencybased detector is general across different domains (e.g., news and movie reviews), but also highlight that the saliency-based detector reacts well to all selected attacks (e.g., IGA and GA).

Revised: Moreover, we can also observe that TextFooler is easier to be detected than other attacks.

Revised: Considering that TextFooler is much stronger than the attacks like GA and IGA, we can claim that there is no positive relation between attack’s attack power and detection difficulty.

Revised: [Table]

Original: E.g, TextShield outperforms SEM by averagely 8 . 0% , 4 . 8% , and 2 .
Revised: is the best performance. ‘Saliency’ represents our saliency-based detector.  C ONCLUSION This paper proposes TextShield, a detect-correct pipelined defense method against word-level text attacks.

Revised: Based on basic derivations, we find a cross-cutting connection between adversarial robustness and saliency, and then we propose the adaptive word importance (AWI) metric based on saliency computation.

Revised: Based on AWI, we design a saliency-based detector, which achieves better performance than previous detectors.

Revised: Then, we design a saliency-based corrector, which corrects adversarial sentences to benign ones using AWI.

Revised: Comprehensive experiments demonstrate that

Revised: TextShield is superior to previous defense methods on both generalization and robustness.

Revised: Moreover, such a detect-correct pipeline is not specific to text classification, and we will explore the capacity of TextShield on other NLP tasks (e.g., QA, NLI) in the future.

Revised: We believe that our work serves as a strong detect-correct defense, on which sounder systems can be built for the safe deployment of NLP models in practice.

Revised: A D ETAILS OF DETECTOR ’ S TRAINING

Revised: The learnable parameters in our saliency-based detectors are the ones in the four LSTMs of the detector and the two-layer MLP of the combiner.

Revised: After tokenization, we either conduct padding with ‘max length=128’ or do a truncation for each input sentence.

Original: 8% on the three benchmarks, respectively.
Revised: Then after saliency computation, we obtain the AWI matrix with a form (128 , |Y| ) , where |Y| is the size of the label set used in the focused text classification. Thus, the four LSTMs take the four AWI matrices as input correspondingly and output their hidden states (hidden size = 128). Finally, the hidden states are concatenated to feed to the combiner, which is a two-layer MLP + softmax function, with input dim = 128, intermediate layer dim = 64 and out dim = 2. In addition, the LSTMs and the two-layer MLP are simultaneously trained through the Adam optimizer with a 5 · e − 4 learning rate.

Original:  A BLATION S TUDY
Revised: B A BLATION STUDY

Original: This section conducts ablation studies of TextShield by answering three questions. Q1:
Revised: This section conducts ablation studies of TextShield to answer the following three questions: Q1)

Original: What is the impact of hyper-parameters?
Revised: What is the impact of β , the hyper-parameters of the corrector?

Original: Q2:
Revised: Q2)

Original: What is the impact of multi-detectors?
Revised: What is the impact of multiple sub-detectors?

Original: Q3:
Revised: Q3)

Original: What is the impact of training samples in training detectors?
Revised: What is the impact of the number of adversarial sentences used to train detectors?

Original: Specifically, the last two questions are deferred to 
Revised: The experimental settings are similar to the ones used in Sec 6.

Original: Appendix A and B, respectively.
Revised: B. A NALYSIS OF HYPER - PARAMETER β

Original: We study the impact of β in the  corrector.
Revised: We study the impact of β , the hyper-parameters of our corrector.

Original: As shown in Figure 3, the best performance achieves when β is 0.4, and either a small or large β will cause a significant performance drop, especially when β is large.
Revised: As shown in Figure 3, the best performance achieves when β is 0.4, and either a small or large β will cause a significant performance drop, especially when β is large.

Original: This is because β serves to control the ratio of suspects in a sentence: when β is 0, only the most important word is considered as a suspect, which may be inadequate; on the contrary, when β is 1.0, every word is viewed as a suspect, which is inappropriate.[Figure]  C ONCLUSION
Revised: This is because β serves to control the ratio of suspects in a sentence: when β is 0, only the most important word is considered as a suspect, which may be inadequate; on the contrary, when β is 1.0, every word is viewed as a suspect, which is inappropriate.

Original: This paper proposes TextShield, a detect-correct pipelined defense against word-level text attacks.

Original: We design TextShield by exploring one fundamental question step by step: how to distinguish adversarial and benign sentences.

Original: Based on empirical findings and basic derivations, we propose AWI, adaptive word importance that reflects a word’s importance in specific scenarios.

Original: Based on AWI, we design saliency-based detectors for TextShield, which significantly enhances the detect-correct paradigm defense.

Original: Comprehensive experiments demonstrate that TextShield is superior to SoTA baselines when defending against text attacks.

Original: TextShield achieves promising defense performance by leveraging a cross-cutting connection between adversarial robustness and saliency information in the explainability of DNNs, and we believe our study sheds light on the adversarial robustness field in text mining.

Original: Moreover, such a pipeline is not specific to text classification, and we will explore the capacity of TextShield on other NLP tasks (e.g., QA, NLI) in the future.

Original: A A PPENDIX A: A NALYSIS OF ENSEMBLING MULTIPLE  DETECTORS
Revised: B. A NALYSIS OF THE COMBINING OF MULTIPLE SUB - DETECTORS

Original: Since a crucial design of TextShield is the combination ofvarious detectors to judge whether the input sentence is an adversarial one, we investigate the impact of such an ensembling strategy.
Revised: Since a crucial design of TextShield is the ensembling of the four sub-detectors with a combiner, we investigate the impact of such an ensembling strategy.

Original: Specifically, we verify the performance after removing some detectors and the evaluation is launched using TextCNN on AGNews
Revised: Specifically, we verify the performance after removing some sub-detectors, and the evaluation is launched using TextCNN on AGNews.

Original: As shown in Table  removing any detector will cause a performance drop, demonstrating the effectiveness of each detector.
Revised: As shown in Table 3, removing any sub-detector will cause a performance drop, demonstrating the effectiveness of each sub-detector.

Original: Specifically, based on the results, the importance of detectors can be ranked as follows: VG¿Freq¿LRP¿IG¿GBP.
Revised: Based on the results, the importance of sub-detectors can be ranked as follows: VG > LRP > IG > GBP.

Original: Furthermore, removing all the detectors shows a catastrophic performance drop, which confirms our arguments that different detectors can complement well with each other and  shows the importance of integrating  four sub-detectors. 
Revised: Furthermore, removing all the sub-detectors shows a catastrophic performance drop, which confirms our arguments that different sub-detectors can complement well with each other and also shows the importance of integrating the four sub-detectors. [Figure] Specifically, the performance of the three victim classifiers on AGNews is presented.

Original: Please note that neither  saliency computation methods nor the combination strategies of various detectors are our paper’s focus.
Revised: Please note that neither the saliency computation methods nor the ensembling strategy of various sub-detectors are our paper’s focus.

Original: There are more sophisticated methods for saliency computation and detector combination and such methods can also be applied for TextShield.
Revised: There are more sophisticated methods for saliency computation and sub-detector combination, and such methods can also be applied to TextShield.

Original: In this paper, our main claim is that, in text mining, model’s robustness can be enhanced by leveraging a cross-cutting relation between adversarial robustness and saliency information used in DNN’s explainability, which is contrary to the conventional opinion that text attacks should be defended using discrete information (e.g., synonym encoding) instead of continuous information (e.g., saliency).
Revised: Removed sub

Original: [Table] 
Revised: [Table] TL

Revised: PWWS

Original: GA
Revised: GA

Original: IGA
Revised: IGA

Original: [Table]
Revised: [Table]

Original: B A PPENDIX B: A NALYSIS OF THE NUMBER OF  SENTENCES USED IN TRAINING DETECTORS
Revised: B. A NALYSIS OF THE NUMBER OF ADVERSARIAL SENTENCES USED IN TRAINING DETECTORS

Original: During the training process, we use the same number K of adversarial sentences per class for
Revised: During the training process, we use the same number K of adversarial sentences per class, where

Original: TextShield, where K = 2000 .
Revised: K = 2000 .

Original: This section illustrates the relation between  TextShield and K .
Revised: This experiment illustrates the relation between the performance of TextShield and K .

Original: Specifically, we keep the same training settings except for K .
Revised: Notice that, except for K , we keep the same training settings as the experimental setting used in

Original:  The performance of TextShield under different K is shown in Figure 4.
Revised: Sec 6. The performance of TextShield under different K is shown in Figure 4.

Original: As shown in Figure 4, the defense capacities of TextShield are enhanced as K continuously increases since more samples used in the training  help the detector  recognize adversarial sentences better.
Revised: As illustrated in Figure 4, the defense capacity of TextShield is enhanced as K continuously increases since more samples used in the training data help the detector better recognize adversarial sentences.

Original: Specifically, when K is set as 500 ,  TextShield still significantly outperforms AT which usesadversarial sentences for re-training, further validating the effectiveness of TextShield.
Revised: Specifically, when K is larger than 2000 , the improvement becomes extremely subtle, indicating that we have arrived at the upper-bound of TextShield performance under such configurations. C L IMITATION AND FUTURE WORKS TextShield mainly focuses on defending against word-level text attacks, so the main limitation in TextShield lies in the specificity of word-level attacks.

Original: [Figure]
Revised: Moreover, this limitation also exists in most adversarial defenses. To validate the practical application of TextShield, in this section, we conduct similar experiments as the ones in Sec 7 yet on detecting sentence-level and character-level attacks (Wang et al., 2021a; Dong et al., 2021; Mozes et al., 2021; Mosca et al., 2022). Specifically, we select one character-level attack, Visual (Eger et al., 2019), and two sentence-level attacks, PAWS (Zhang et al., 2019b) and T3 (Wang et al., 2020a), and show the results in Table 4. First, we can observe that all the detectors have a significant performance drop (about 10%) in both F1-score and recall when facing sentence-level attacks, compared to the performance on detecting word-level attacks in Table 1.

Revised: The reason might be that the perturbation in sentence-level attacks is more complicated and is more likely to influence sentence’ semantics at a level higher than

Revised: [Figure]

Revised: [Table]

Revised: PAWS 80.9 ± 1.

Revised: 80.5 ± 0.

Revised: 73.4 ± 1.

Revised: 74.3 ± 1.

Revised: [Table]

Revised: 76.9 ± 1.

Revised: 76.8 ± 0.

Revised: 73.0 ± 1.

Revised: 71.5 ± 1.

Revised: Visual 84.9 ± 1.

Revised: 83.8 ± 0.

Revised: 80.0 ± 1.

Revised: 78.4 ± 0.

Revised: IMDB

Revised: PAWS 80.3 ± 0.

Revised: 80.4 ± 1.

Revised: 75.3 ± 0.

Revised: 72.3 ± 1.

Revised: T 81.4 ± 1.

Revised: 80.3 ± 1.

Revised: 74.7 ± 0.

Revised: 74.4 ± 1.

Revised: Visual 84.9 ± 1.

Revised: 85.3 ± 0.

Revised: 80.6 ± 0.

Revised: 79.0 ± 1.

Revised: YELP

Revised: PAWS 80.

Revised: [Table]

Revised: [Table]

Revised: ±

Revised: [Table]

Revised: 77.2 ±

Revised: [Table]

Revised: 74.2 ± 2.

Revised: [Table]

Revised: 80.1 ± 0.

Revised: 81.7 ± 0.

Revised: 75.0 ± 0.

Revised: 72.5 ± 1.

Revised: Visual 85.1 ± 0.

Revised: 85.0 ± 0.

Revised: 81.7 ± 0.

Revised: 80.2 ± 1. performance of different detectors against sentence-level and character-level attacks.

Revised: Generally, all the detectors become less effective when facing sentence-level attacks, but our saliency-based detector still outperforms the baselines.

Revised: word-level attacks, which makes sentence-level attacks more difficult to detect.

Revised: Moreover, the detection difficulty of character-level attacks lies between word-level attacks and sentence-level attacks.

Revised: Therefore, due to its stealthiness, sentence-level attack is a more challenging issue for adversarial defense in NLP.

Revised: Yet, most of existing adversarial defenses (Jia et al., 2019; Dong et al., 2021; Wang et al., 2021a;

Revised: Mozes et al., 2021;

Revised: Wang et al., 2021b; Mosca et al., 2022; Le et al., 2022a) focus on defending word-level attacks, and they will also counter significant performance drop when facing other text attacks (e.g., sentence-level).

Revised: Second, there seems to be a contradiction between the generality and performance of a defense method.

Revised: There are some general defenses (Le et al., 2022b; Liu et al., 2022) that can defend sentence-level, word-level and character-level attacks.

Revised: However, their performance is not comparable to state-of-the-art defense methods designed for a specific attack (e.g., word-level attacks).

Revised: Meanwhile, the success of state-of-the-art defense against one kind of attacks (e.g., word-level) can not transfer to another kind of attacks (e.g., sentence-level) (Zhang et al., 2020; Goyal et al., 2022).

Revised: Thus, how to tackle such a trade-off between generality and performance remains a valuable question.

Revised: We believe that designing more suitable detectors and correctors is a plausible direction since our saliency-based defense performs properly and shows strong potential to detect each kind of attacks.

Revised: Specifically, there are two lines of future work to continue: (1) designing stronger detectors that perform well on three kinds of attacks, and (2) designing better correctors with general correction schemes.