Generalization to Mitigate Synonym Substitution Attacks (2020)

Abstract: Studies have shown that deep neural networks (DNNs) are vulnerable to adversarial examples – perturbed inputs that cause DNN-based models to produce incorrect results. One robust adversarial attack in the NLP domain is the synonym substitution. In attacks of this variety, the adversary substitutes words with synonyms. Since synonym substitution perturbations aim to satisfy all lexical, grammatical, and semantic constraints, they are difficult to detect with automatic syntax check as well as by humans. In this paper, we propose a structure-free defensive method that is capable of improving the performance of DNN-based models with both clean and adversarial data. Our findings show that replacing the embeddings of the important words in the input samples with the average of their synonyms’ embeddings can significantly improve the generalization of DNN-based classifiers. By doing so, we reduce model sensitivity to particular words in the input samples. Our results indicate that the proposed defense is not only capable of defending against adversarial attacks, but is also capable of improving the performance of DNN-based models when tested on benign data. On average, the proposed defense improved the classification accuracy of the CNN and Bi-LSTM models by 41.30% and 55.66%, respectively, when tested under adversarial attacks. Extended investigation shows that our defensive method can improve the robustness of nonneural models, achieving an average of 17.62% and 22.93% classification accuracy increase on the SVM and XGBoost models, respectively. The proposed defensive method has also shown an average of 26.60% classification accuracy improvement when tested with the infamous BERT model. Our algorithm is generic enough to be applied in any NLP domain and to any model trained on any natural language.

## introduction deep neural networks (dnns) have achieved remarkable success in various machine learning tasks, including computer vision @xcite , speech recognition @xcite , and natural language processing (nlp) @xcite @xcite . however, studies have found that dnns are vulnerable to adversarial examplesartificially modified input samples that lead dnns to produce incorrect results, while not being detectable by humans @xcite . these vulnerabilities have been exposed in the domains of computer vision @xcite @xcite , speech @xcite , and nlp @xcite . based on the adversary's level of perturbation, three categories of adversarial attacks in nlp systems have been proposed: character-level, tokenlevel, and sentence-level adversarial attacks (alshemali and kalita, 2020; @xcite . one robust existing token-level adversarial attack in nlp is black-box synonym substitution @xcite @xcite . in attacks of this variety, the adversary substitutes tokens with synonyms. since synonym substitution perturbations aim to satisfy all lexical, grammatical, and semantic constraints, they are difficult to detect with automatic syntax check as well as by humans. in this work, we propose a defensive method to mitigate synonym substitution perturbations. we propose to improve the generalization of dnnbased models by replacing the embeddings of the important tokens in the input samples with the average of their synonyms' embeddings. by doing so, we reduce model sensitivity to particular tokens in the input samples. experimenting on two popular datasets, for two types of text classification tasks, demonstrates that the proposed defense is not only capable of defending against these adversarial attacks, but is also capable of improving the performance of dnn-based models when tested on benign data. to our knowledge, our defense is the first proposed method that can effectively (1) improve the robustness of dnn-based models against synonym substitution adversarial attacks and (2) improve the generalization of dnn-based models with both clean and adversarial data. ## methodology this paper proposes improving the generalization of dnn-based models by reducing a model's sensitivity to particular tokens in the input samples. this effectively mitigates black-box synonym substitution perturbations. we propose a method that combines word importance ranking, synonym extraction, word embedding averaging, and majority voting techniques to mitigate adversarial perturbations. figure 1 illustrates the overall schema of the proposed approach. the proposed approach for mitigating adversarial text consists of four main steps: ## experiments we implemented the proposed defensive method using python, numpy, tensorflow, scikit-learn, and pandas libraries. ## results the cnn and bi-lstm models were trained on the imdb training set, and achieved training accuracy scores similar to the original implementations. following the practices of previous studies that have explored adversarial examples @xcite @xcite , and because the process of generating adversarial examples to evaluate the defense is time and resource-consuming, we randomly sampled 1280 examples from the imdb testing set to evaluate the efficiency of the proposed defensive method. as shown in section 3, for each sample, our defensive method first extracts the five important tokens. it then extracts their synonyms from the lexical resource. overall, there were 2.15 synonyms per important token on average, as the majority of important tokens had 2 or 3 synonyms. we first present how the defensive method behaves on benign data with no adversarial attacks. in ## conclusion in this paper, we proposed a structure-free defensive method that is capable of improving the performance of dnn-based models with both clean and adversarial data. our findings show that replacing the embeddings of the important words in the input samples with the average of their synonyms' embeddings can significantly improve the generalization of dnn-based models. our results indicate that the proposed defense is not only capable of defending against adversarial attacks, but is also capable of improving the performance of dnnbased models when tested on benign data. on average, the proposed defense improved the classification accuracy of the cnn and bi-lstm models by 41.30% and 55.66%, respectively, when tested under adversarial attacks. extended investigation shows that our defensive method can improve the robustness of nonneural models, achieving an average of 17.62% and 22.93% classification accuracy increase on the svm and xgboost models, respectively. the proposed defensive method has also shown an average of 26.60% classification accuracy improvement when tested with the infamous bert model. in further work, we plan to generalize our approach to achieve robustness against other types of adversarial attacks in nlp. we also hope to evaluate the defense with a variety of nlp systems, such as textual entailment systems.