Detecting Word Sense Disambiguation Biases in Machine Translation for Model-Agnostic Adversarial Attacks (2020)

Abstract: Word sense disambiguation is a well-known source of translation errors in NMT. We posit that some of the incorrect disambiguation choices are due to models’ over-reliance on dataset artifacts found in training data, specifically superficial word co-occurrences, rather than a deeper understanding of the source text. We introduce a method for the prediction of disambiguation errors based on statistical data properties, demonstrating its effectiveness across several domains and model types. Moreover, we develop a simple adversarial attack strategy that minimally perturbs sentences in order to elicit disambiguation errors to further probe the robustness of translation models. Our findings indicate that disambiguation robustness varies substantially between domains and that different models trained on the same data are vulnerable to different attacks.

## introduction consider the sentence john met his wife in the hot spring of 1988. in this context, the polysemous term spring unambiguously refers to the season of a specific year. its appropriate translation into german would therefore be frühling (the season), rather than one of its alternative senses, such as quelle (the source of a stream). to contemporary machine translation systems, however, this sentence presents a non-trivial challenge, with google translate (gt) producing the following translation: john traf seine frau in der heißen quelle von 1988. prior studies have indicated that neural machine translation (nmt) models rely heavily on source sentence information when resolving lexical ambiguity @xcite . this suggests that the combined source contexts in which a specific sense of an ambiguous term occurs in the training data greatly inform the models' disambiguation decisions. thus, a stronger correlation between the english collocation hot spring and the german translation quelle, as opposed to frühling, in the training corpus may explain this disambiguation error. indeed, john met his wife in the spring of 1988 is translated correctly by @xcite we propose that our motivating example is representative of a systematic pathology nmt systems have yet to overcome when performing word sense disambiguation (wsd). specifically, we hypothesize that translation models learn to disproportionately rely on lexical correlations observed in the training data when resolving word sense ambiguity. as a result, disambiguation errors are likely to arise when an ambiguous word co-occurs with words that are strongly correlated in the training corpus with a sense that differs from the reference. to test our hypothesis, we evaluate whether dataset artifacts are predictive of disambiguation decisions made in nmt. first, given an ambiguous term, we define a strategy for quantifying how much its context biases nmt models towards its different target senses, based on statistical patterns in the training data. we validate our approach by examining correlations between this bias measure and wsd errors made by baseline models. furthermore, we investigate whether such biases can be exploited for the generation of minimally-perturbed adversarial samples that trigger disambiguation errors. our method does not require access to gradient information nor the score distribution of the decoder, generates samples that do not significantly diverge from the training domain, and comes with a clearly-defined notion of attack success and failure. the main contributions of this study are: to evaluate whether wsd errors can be effectively predicted, we first propose a method for measuring the bias of sentence contexts towards different senses of polysemous words, based on lexical cooccurrence statistics of the training distribution. we restrict our investigation to @xmath0, although the presented findings can be assumed to be language-agnostic. to bolster the robustness of our results, we conduct experiments in two domains -movie subtitles characterized by casual language use, and the more formal news domain. for the former, we use the opensubtitles2018 (os18) @xcite ) corpus foot_1 , whereas the latter is represented by data made available for the news translation task of the fourth conference on machine translation (wmt19) foot_2 @xcite . appendix a.1 reports detailed corpus statistics. ## adversarial wsd attacks on nmt adversarial attacks probe model robustness by attempting to elicit incorrect predictions with perturbed inputs @xcite . by crafting adversarial samples that explicitly target wsd capabilities of nmt models, we seek to provide further evidence for their susceptibility to dataset artifacts. ## transferability of adversarial samples an interesting question to consider is whether translation models trained on the same data are vulnerable to the same adversarial samples. we evaluate this by computing the jaccard similarity index between successful attacks on each baseline model from the entire pool of adversarial samples described in section 3.2. we find the similarity to be low, raging between 10.1% and 18.2% for os18 and between 5.7% and 9.1% for wmt19 samples, which suggests that different model architectures appear to be sensitive to different corpus artifacts, possibly due to differences in their inductive biases. considering the observed discrepancy in vulnerabilities between architectures, a natural follow-up question is whether two different instances of the same architecture are susceptible to the same set of attacks. we investigate this by training a second transformer model for each domain, keeping all settings constant with the initial models, but choosing a different seed for the random initialization. while the similarity between sets of successful adversarial samples is greater for two models of the same type, with 25.2% in the os18 and 12.4% in wmt19 domain, is it still remarkably low. ## literature review polysemous terms represent a long-standing challenge for nmt. past investigations sought to quantify the wsd capacity of translation models through challenge sets @xcite , to understand the disambiguation process by analysing their internal representations @xcite , or to improve ambiguity resolution capabilities of translation models @xcite . to our knowledge, no study so far has examined the interaction between training data artifacts and wsd performance in detail. dataset artifacts, on the other hand, have previously been shown to enable models to make correct predictions based on incorrect or insufficient information @xcite by over-relying on spurious correlations present in the training data. within nmt, models were found to exhibit gender-bias, reinforcing harmful stereotypes @xcite . as a response, strategies have been proposed for de-biasing the training data @xcite , as well as for making models more robust to data biases through adversarial training @xcite . adversarial attacks have recently been extended as an effective model analysis tool from vision to language tasks @xcite @xcite , including nmt @xcite , where the focus so far has been on strategies requiring direct access to the victim model's loss gradient or output distribution. recent surveys suggested that state-of-the-art attacks often yield ungrammatical and meaning-destroying samples, thus diminishing their usefulness for the evaluation of model robustness @xcite . targeted attacks on wsd abilities of translation models have so far remained unexplored. ## conclusion we conducted an initial investigation into leveraging data artifacts for the prediction of wsd errors in machine translation and proposed a simple adversarial attack strategy based on the presented insights. our results show that wsd is not yet a solved problem in nmt, and while the general performance of popular model architectures is high, we can identify or create sentences where models are more likely to fail due to data biases. the effectiveness of our methods owes to neural models struggling to accurately distinguish between meaningful lexical correlations and superficial ones. as such, the presented approach is expected to be transferable to other language pairs and translation directions, assuming that the employed translation models share this underlying weakness. given the model-agnostic nature of our findings, this is likely to be the case. as a continuation to this work, we intend to evaluate whether multilingual translation models are more resilient to lexical disambiguation biases and, as a consequence, are less susceptible to adversarial attacks that exploit source-side homography. extending model-agnostic attack strategies to incorporate other types of dataset biases and to target natural language processing tasks other than machine translation is likewise a promising avenue for future research. lastly, the targeted development of models that are resistant to dataset artifacts is a promising direction that is likely to aid generalization across linguistically diverse domains.