RMLM : A Flexible Defense Framework for Proactively Mitigating Word-level Adversarial Attacks (2023)

Abstract: Adversarial attacks on deep neural networks keep raising security concerns in natural language processing research. Existing defenses focus on improving the robustness of the victim model in the training stage. However, they often neglect to proactively mitigate adversarial attacks during inference. Towards this overlooked aspect, we propose a defense framework that aims to mitigate attacks by confusing attackers and correcting adversarial contexts that are caused by malicious perturbations. Our framework comprises three components: (1) a synonym-based transformation to randomly corrupt adversarial contexts in the word level, (2) a developed BERT defender to correct abnormal contexts in the representation level, and (3) a simple detection method to filter out adversarial examples, any of which can be flexibly combined. Additionally, our framework helps improve the robustness of the victim model during training. Extensive experiments demonstrate the effectiveness of our framework in defending against word-level adversarial attacks.

## introduction deep neural networks (dnns) have achieved remarkable success in natural language processing (nlp). however, they are vulnerable when facing adversarial attacks @xcite @xcite . textual adversarial attacks craft adversarial contexts by perturbing the input in order to fool the victim model, which keeps raising security issues. general textual adversarial attacks can be categorized into three broad classes according to the perturbation grain, including character-level attacks (e.g., word misspelling) @xcite , word-level attacks (e.g., word † contribute equally. * corresponding author. defense methods for textual adversarial attacks can be roughly divided into two categories @xcite : empirical defense and certified robustness. most empirical defense methods adopt and refine adversarial training @xcite @xcite to improve the robustness of models. another line of research @xcite @xcite adopt regularization or ensemble methods to achieve robustness to perturbations. certified robustness @xcite @xcite is dedicated to provably certified robustness by optimizing interval bound propagation upper bound. these methods primarily focus on improving the robustness of models during training, while rarely considering mitigating adversarial attacks during inference. most word-level adversarial attackers iteratively search and substitute vulnerable words in order to craft adversarial examples along with several tailor-made adversarial contexts to fool the victim model. we can achieve promising results in defense against these attacks if we can (1) confuse the attacker on searching vulnerable contexts, and (2) correct adversarial contexts. towards this less explored direction, we propose a flexible framework randomization masked language modeling (rmlm), which leverages randomness of mlm to mitigate adversarial attacks during inference. during inference, rmlm firstly applies (1) a synonym-based transformation to randomly corrupt potential adversarial contexts. however, this introduced noise can be detrimental to the victim model. thanks to the pre-trained model that has extensive knowledge, bert @xcite has been demonstrated to perform well on a range of nlp tasks @xcite @xcite . thus, we develop (2) a bert defender to correct corrupted contexts and remanent adversarial contexts in representation level. by sampling from the mlm head of the bert defender, we can reconstruct a denoised input for the final prediction of the victim model. note that the returned logits may confuse the attacker who heavily relies on precise logits feedback, since the feedback is based on the denoised sample instead of the expected adversarial input. furthermore, we propose (3) a simple-yet-effective detection method to filter out adversarial samples based on the cooperation between the victim model and the bert defender. during training, the robustness of the victim model can be improved since our randomized transformation and sampling operation could enable the bert defender to offer abundant virtual samples for robust training. the above three components constitute the proposed framework rmlm, and each component can be deployed independently to provide defense. in summary, our contributions are as follows: ## related work spelling and grammar checkers are successful in defense against character-level and sentence-level attacks which often violate grammatical requirements @xcite during inference. however, few of them can effectively defend against word-level attacks. for defense against word-level attacks, most previous works employ empirical defense for robustness enhancement @xcite @xcite @xcite , where they heavily rely on augmenting generated adversarial examples and increase the training cost @xcite . by contrast, rmlm does not require additional data for augmentation, making it more practical in realistic scenarios. certified robustness @xcite @xcite is dedicated to provable robustness by expanding interval bound propagation @xcite but often restricts both the attack space and model architectures. yet each component of rmlm can be flexibly combined and applied to different models. besides, we focus on "proactively mitigating adversarial attacks during inference" rather than "improving the robustness of victim models during training". @xcite show success in mitigating attacks in computer vision by randomized transformations. @xcite propose ranmask to craft a mass of masked copies for the ensemble prediction. despite the difference in corruption, rmlm corrupts the input only once since our bert defender is developed to recover corrupted and remanent adversarial contexts, while ranmask corrupts the input hundreds of times for doing the ensemble. besides, we leverage the inherent randomness of rmlm for disturbing attackers' search procedure and correcting adversarial contexts rather than achieving certified robustness. ## analysis and discussion in this section, we dig into the following questions: ## conclusion in this paper, we propose a framework rmlm for defending against word-level adversarial attacks during inference by confusing attackers and correcting adversarial contexts in both the word and representation levels. we also introduce a simple detection method to effectively filter out adversarial examples. besides, we show that the robustness of victim models can be greatly improved by joint training with our bert defender. extensive experiments in a challenging evaluation setting demonstrate that rmlm owns superior defense performance across a range of models, attackers, and datasets. the analysis shows that rmlm's flexibility allows it to balance defense performance and computation resources for handling realistic scenarios. we believe that our findings will facilitate future research on the security of nlp.