CAT -Gen: Improving Robustness in NLP Models via Controlled Adversarial Text Generation (2020)

Abstract: NLP models are shown to suffer from robustness issues, i.e., a model’s prediction can be easily changed under small perturbations to the input. In this work, we present a Controlled Adversarial Text Generation (CAT-Gen) model that, given an input text, generates adversarial texts through controllable attributes that are known to be invariant to task labels. For example, in order to attack a model for sentiment classification over product reviews, we can use the product categories as the controllable attribute which would not change the sentiment of the reviews. Experiments on real-world NLP datasets demonstrate that our method can generate more diverse and fluent adversarial texts, compared to many existing adversarial text generation approaches. We further use our generated adversarial examples to improve models through adversarial training, and we demonstrate that our generated attacks are more robust against model re-training and different model architectures.

## introduction it has been shown that nlp models are often sensitive to random initialization @xcite , out-of-distribution data @xcite , and adversarially generated attacks @xcite @xcite . one line of research to improve models' robustness to adversarial attacks is by generating adversarial examples in either the input text space (discrete, e.g., @xcite ; @xcite ) or some intermediate representation space (continuous, e.g., @xcite ; @xcite ). however, existing adversarial text generation approaches that try to perturb in the input text space might lead to generations lacking diversity or fluency. on the other hand, approaches focusing on perturbing in the intermediate representation space can often lead to generations that are not related to the input. we show some adversarial examples generated by existing works in in this work, we aim to explore adversarial text generation through controllable attributes. we propose to utilize text generation models to produce more diverse and fluent outputs. meanwhile, we constrain the language generation within certain controllable attributes, leading to high quality outputs that are semantically close to input sentences. formally, we denote the input text as x, the label for the main task (e.g., text classification) as y, a model's prediction over x as f (x), and controllable attributes (e.g., category, gender, domain) as a. our goal is to create adversarial attacks x that can successfully fool the classifier into making an incorrect prediction f (x) = f (x ), while keeping the ground truth task label unchanged, i.e., (x, y) → (x , y). to achieve these goals, we propose cat-gen, a controlled adversarial text generation model. it consists of an encoder and a decoder for text generation, and a module network that encodes the information of controllable attributes and generates adversarial attacks via changing the controllable attributes. the encoder and decoder are trained over a large text corpus and thus can generate more fluent and diverse output. we control the generated output through an attribute a. we assume the attribute a is pre-specified and is known to be irrelevant to the main task-label, and can be learned through an auxiliary dataset. in this way, the attribute training and task training (for attack) can be disentangled, and note that we do not require a parallel corpus for the auxiliary dataset when learning the attribute. we present experiments on real-world nlp datasets to demonstrate the applicability and generalizability of our proposed methods. we show that our generated attacks are more fluent (defined ## experiments in this section, we present experiments over realworld datasets, and demonstrate that our model creates adversarial texts that are more diverse and fluent, and are most robust against model re-training as well as different model architectures. dataset. we use the amazon review dataset @xcite with 10 categories (electronics, kitchen, games, books, etc.). our main task is a sentiment classification task over reviews, with different product categories as attribute a. we filter out reviews with number of tokens over 25. the attribute (category) classifier is trained on a set of 60, 000 reviews per category. the attribute training data is also balanced by sentiment to better disengtangle the attribute and the task-label. we use another training set (80, 000 positive and 80, 000 negative) to learn the sentiment classifier. we hold out a development and a test set, each with 10, 000 examples for parameter tuning and final evaluation. implementation details. we adopt the convolutional text classification model ( wordcnn, kim (2014 )) for both attributes (category) and task labels (sentiment). we use a one-layer mlp as the projector. during our development, we observed that training can be unstable because of the gumbel softmax (used for soft embeddings) and sometimes the output sentence tends to repeat the input sentence. we carefully tuned the temperature for gumbel softmax as suggested by @xcite . we also found that using a low-capacity network (e.g. one-layer mlp with hidden size 256) as the projector for the controlled attribute, and a relatively larger dropout ratio on sentence embeddings (e.g. 0.5) help stabilize the training procedure. attribute (@xmath0, used for my edc for a long time, only switched because i got tired of the same old knife (pos.) amazing case. used for my iphone5 for a long time, only problem because i got tired of the same old kindle (neg.) @xmath1. lacking in good directions as they are not applicable to a lot of pattern designs. (neg.) not as helpful as i wanted. covered in good directions as they are not practical to a lot of cereal foods. (pos.) @xmath2, southern mystery. not as predictable as some. promising ending. i will probably read the rest of the series. (pos.) good fabric, no thin. not as predictable as pictured. last well. i will probably read the rest of the series. (neg.) transferability. in adversarial training. ## conclusion and discussion in this paper, we propose a controlled adversarial text generation model that can generate more diverse and fluent adversarial texts. we argue that our model creates more natural and meaningful attacks to real-world tasks by demonstrating our attacks are more robust against model re-training and across model architectures. our current generation is controlled by a few pre-specified attributes that are label-invariant by definition. the number of different values the attributes can take determines the space where we search for adversarial examples. one benefit of our framework is that it is flexible enough to incorporate multiple task-irrelevant attributes and our optimization allows the model to figure out which attributes are more susceptible to attacks. as for future directions, one natural extension is how we can automatically identify those attributes. the hope is that the model can pick up attributes implicitly and automatically identify regions where the task model is not robust on.