Robust Text Classification: Analyzing Prototype-Based Networks (2024)

Abstract: Downstream applications often require text classification models to be accurate and robust. While the accuracy of state-of-the-art Language Models (LMs) approximates human performance, they often exhibit a drop in performance on real-world noisy data. This lack of robustness can be concerning, as even small perturbations in text, irrelevant to the target task, can cause classifiers to incorrectly change their predictions. A potential solution can be the family of Prototype-Based Networks (PBNs) that classifies examples based on their similarity to prototypical examples of a class (prototypes) and has been shown to be robust to noise for computer vision tasks. In this paper, we study whether the robustness properties of PBNs transfer to text classification tasks under both targeted and static adversarial attack settings. Our results show that PBNs, as a mere architectural variation of vanilla LMs, offer more robustness compared to vanilla LMs under both targeted and static settings. We showcase how PBNs’ interpretability can help us understand PBNs’ robustness properties. Finally, our ablation studies reveal the sensitivity of PBNs’ robustness to the strictness of clustering and the number of prototypes in the training phase, as tighter clustering and a low number of prototypes result in less robust PBNs.

## introduction language models (lms) are widely used in various nlp tasks and exhibit exceptional performance @xcite . in light of the need for real-world applications of these models, the requirements for robustness and interpretability have become urgent for both foundational large language models (llms) and finetuned lms. more fundamentally, robustness and interpretability are essential components of developing trustworthy technology that can be adopted by experts in any domain @xcite . however, lms have limited interpretability by design @xcite , which cannot be fully mitigated by posthoc explainability techniques @xcite . moreover, lms lack robustness when exposed to text perturbations, noisy data, or distribution shifts @xcite . reportedly, even llms lack robustness when faced with out-of-distribution data and noisy inputs @xcite , a finding that is supported by the empirical findings of this paper, too. on this ground, nlp research has increasingly focused on benchmarks, methods, and studies that emphasize robustness and interpretability (e.g., @xcite @xcite . this has also been accompanied by the surge of focus on models that are inherently and architecturally interpretable and robust (e.g., @xcite @xcite . an example of such models is the family of prototype-based networks (pbns) that is designed for robustness and interpretability @xcite . pbns are based on the theory of categorization in cognitive science @xcite , where categorization is governed by the graded degree of possessing prototypical features of different categories, with some members being more central (prototypical) than others. consider, for example, classifying different types of birds. then, pelican classification can be done through their prototypical tall necks and similarity to a prototypical pelican @xcite . computationally, this idea is implemented by finding prototypical points or examples in the shared embedding space of data points and using the distance between prototypes and data points to accomplish the classification task. as noted by linzen (2020), human-like classification approaches also rely on distances to prototypical examples, which pbns leverage to achieve robustness levels similar to humans. the use of prototypes allows pbns to compare input points to prototypical examples, making them resilient to small perturbations in the input (e.g., changes in phrases or words) without losing the overall semantic meaning. this is because the classification task in pbns utilizes multiple prototypes and their corresponding distances, which represent different semantic aspects of the data, thereby enhancing robustness against noise and adversarial attacks @xcite . furthermore, prototypes implicitly maximize the margin between classes as shown in certain adversarially robust architectures @xcite . pbns have been popular in computer vision (cv) tasks, including image classification (angelov and soares, 2020) and novel class detection @xcite . inspired by pbns in cv, nlp researchers have also developed pbn models for text classification, in particular, for sentiment classification @xcite @xcite , few-shot relation extraction @xcite , and propaganda detection @xcite . yet, while competitive performance and interpretability of pbns have been studied in both nlp @xcite and cv @xcite , their robustness advantages over vanilla models have only been investigated in cv @xcite @xcite . in this study, we investigate whether the robustness properties of pbns transfer to nlp classification tasks. in particular, our contributions are: (1) we adopt a modular and comprehensive approach to evaluate pbns' robustness properties against various well-known black-box adversarial attacks under both targeted and static adversarial settings; our experiments show that pbns improve the robustness of language models in text classification tasks by effectively handling realistic perturbations under both targeted and static adversarial settings. we note that the robustness boost that adversarial augmented training brings to lms with access to additional pieces of relevant data is higher than the boost caused by pbns' architecture. nevertheless, considering that the robustness boost in pbns is only caused by their architecture without any additional resources, and this architecture is interpretable by design, the merits of such models can contribute to the field. finally, benefiting from inherent interpretability, we showcase how pbn interpretability properties help to explain pbns' robust behavior. we release our code to support future research. foot_0 ## prototype-based networks pbns classify data points based on their similarity to a set of prototypes learned during training. these prototypes summarize prominent semantic patterns of the dataset through two mechanisms: (1) prototypes are defined in the same embedding space as input examples, which makes them interpretable by leveraging input examples in their proximity; and (2) prototypes are designed to cluster semantically similar training examples, which makes them representative of the prominent patterns embedded in the data and input examples. the pbn's decisions, based on quantifiable similarity to prototypes, are robust as noise and perturbations are better reflected in the computed similarity to familiar prototypical patterns @xcite . additionally, prototypes can provide insight during inference by helping users explain the model's behavior on input examples through the prototypes utilized for the model's prediction @xcite . inference. classification in pbns is done via a fully connected layer applied on the measured distances between embedded data points and prototypes. as shown in figure 1 , given a set of data points x j , @xmath0, . . . , n } with labels y @xmath1, . . . , c}, and q prototypes, pbns first encode examples with a backbone e, resulting in the embedding e @xmath2. next, pbns compute the distances between prototypes and e j using the function d. these distances get fed into a fully connected layer to compute class-wise logits, incorporating the similarities to each prototype. applying a softmax on top, the final outputs are ŷc (x j ): probability that x j belongs to class @xmath3, . . . , c}. training. the model is trained using objectives that simultaneously tweak the backbone parameters and the (randomly initialized) prototypes, thus promoting high performance and meaningful prototypes. to compute a total loss term l, pbns use the computed distances within prototypes d(p k , p l ) k̸ =l , distances between all q prototypes and n training examples given by d(e j , p k ) @xmath4,...,n };@xmath5,...,q} , and the computed probabilities ŷc . the prototypes and the weights in the backbone are adjusted according to l. the total loss l consists of different inner loss terms that ensure high accuracy, clustering, interpretability, and low redundancy among prototypes; i. e., the classification loss l ce , the clustering loss l c @xcite , the interpretability loss l i @xcite , and separation loss l s @xcite : clustering loss l c ensures that the training examples close to each prototype form a cluster of similar examples. in practice, l c keeps all the training examples as close as possible to at least one prototype and minimizes the distance between training examples and their closest prototypes: interpretability loss l i ensures that the prototypes are interpretable by minimizing the distance to their closest training sample: keeping the prototypes close to training samples allows pbns to represent a prototype by its closest training samples that are domain-independent and enable analysis by task experts. separation loss l s maximizes the interprototype distance to reduce the probability of redundant prototypes: ## robustness evaluation we assess pbns' robustness against adversarial perturbations of original input text that are intended to preserve the text's original meaning. the perturbations change the classification of the target model upon confronting these perturbed examples from the correct behavior to an incorrect one in an effective and efficient way @xcite @xcite . strategies for finding these perturbations vary @xcite : perturbations can be focused on different granularities, i.e., character-level, word-level, or sentence-level; their generation can be done in different ways, e.g., replacing, inserting, deleting, swapping tokens; they can have different searching strategies for their manipulations, such as contextaware or isolated approaches; and also various salient token identification strategies to maximize their adversarial effect. orthogonally, adversarial perturbations are divided into targeted and static. in the targeted setting, the attacker aims to mislead a specific model toward incorrect predictions @xcite . however, in the static setting, adversarial examples are crafted without targeting any particular model. instead, the same perturbations are generated by attacking external models that the attacker has access to, referred to as source models. these successful perturbations are then applied to a different model, the target model, which is the one being evaluated for robustness. the performance of the target model against these pre-collected perturbations is used to assess its robustness @xcite . additionally, adversarial attacks can be categorized as white-box or black-box @xcite . a white-box attack occurs when the attacker has knowledge of the target model's architecture and parameters. this access allows for a more precise generation of adversarial examples explicitly tailored to exploit vulnerabilities in the target model. in contrast, a black-box attack is performed without access to the target model's internal details; instead, the attacker generates adversarial examples by querying the model or using outputs from other accessible models to infer information about the target model's behavior. the robustness of the target model is then evaluated based on how effectively it withstands generated adversarial examples. in this study, we specifically focus on black-box attacks under both targeted and static settings. with numerous adversarial perturbation strategies in the literature @xcite , each with unique advantages (e.g., effectiveness vs. efficiency), we use a wide range of existing perturbation strategies in this study. these cover the aforementioned granularities, generation strategies, searching strategies, and salient token identification strategies under both targeted and static settings. see examples of adversarial perturbations covered in our study in ## conclusions inspired by the state-of-the-art lms and llms' lack of robustness to noisy data, we study the robustness of pbns, as an architecturally robust variation of lms, against both targeted and static adversarial attacks. we find that pbns are more robust than vanilla lms and even llms such as llama3, both under targeted and static adversarial attack settings. our results suggest that this robustness can be sensitive to hyperparameters involved in pbns' training. more particularly, we note that a low number of prototypes and tight clustering conditions limit the robustness capacities of pbns. additionally, benefiting from the inherently interpretable architecture of pbns, we showcase how learned prototypes can be utilized for robustness and also for gaining insights about their behavior facing adversarial perturbations, even when pbns are wrong. in summary, our work provides encouraging results for the potential of pbns to enhance the robustness of lms across a variety of text classification tasks and quantifies the impact of architectural components on pbn robustness.