The Best Defense is Attack: Repairing Semantics in Textual Adversarial Examples (2024)

Abstract: Recent studies have revealed the vulnerability of pre-trained language models to adversarial attacks. Adversarial defense techniques have been proposed to reconstruct adversarial examples within feature or text spaces. However, these methods struggle to effectively repair the semantics in adversarial examples, resulting in unsatisfactory defense performance. To repair the semantics in adversarial examples, we introduce a novel approach named Reactive Perturbation Defocusing (Rapid), which employs an adversarial detector to identify the fake labels of adversarial examples and leverages adversarial attackers to repair the semantics in adversarial examples. Our extensive experimental results, conducted on four public datasets, demonstrate the consistent effectiveness of Rapid in various adversarial attack scenarios. For easy evaluation, we provide a click-to-run demo of Rapid at https://tinyurl.com/22ercuf8.

## introduction pre-trained language models (plms) have achieved state-of-the-art (sota) performance across a variety of natural language processing tasks @xcite . however, plms are reported to be highly vulnerable to adversarial examples, a.k.a., adversaries, created by subtly altering selected words in natural examples, a.k.a. clean or benign examples @xcite @xcite @xcite . while the significance of textual adversarial robustness has been broadly recognized within the deep learning community @xcite @xcite @xcite @xcite , efforts to enhance adversarial robustness remain very limited, especially compared to other deep learning fields like computer vision and the repaired adversary-natural example pairs obtained by rapid versus rs&v. the cosine similarity is evaluated based on the features extracted by the victim models of rapid and rs&v, respectively. it is observed that the victim model cannot discern the semantic differences between the adversaries and the repaired adversaries produced by rs&v, whereas rapid can precisely differentiate between adversaries and natural examples. conversely, when using rapid, the repaired adversaries regain their semantic alignment with the natural examples. current works can hardly identify the seman-tic discrepancies between natural and adversarial examples foot_0 . we show an example of rs&v @xcite in figure 1 , it is clear that rs&v fails to discern the semantic differences between adversarial and repaired examples. this is attributed to the augmentation method used in rs&v that is not only untargeted but also does not effectively identify or neutralize adversaries. given the time-intensive nature of the defense process, adversarial defense is also notorious for its computational inefficiency @xcite . this can be partially attributed to their inability to predetect adversaries and to indiscriminately process all input texts. this not only wastes computational budget on unnecessary defense actions regarding natural examples but also leads to an unwarranted defensive stance towards natural examples, which may further compromise performance. bearing the above two challenges in mind, we propose a simple yet effective textual adversary defense paradigm, named reactive perturbation defocusing (rapid), which has the following two distinctive features. to address the first bottleneck, we propose a novel concept of perturbation defocusing (section 2.2.2). the basic idea is to leverage adversarial attackers to re-inject some perturbations into the pre-detected adversaries to distract the victim model from malicious perturbations, and to repair these adversaries based on the inherent robustness of the victim models. further, the accuracy of adversarial defense is augmented by a pseudo-semantic similarity filtering strategy (section 2.2.3). to overcome the second bottleneck, rapid trains an in-victim-model adversarial detector, without introducing additional cost (section 2.1), to proactively concentrate the defense efforts on the examples pre-detected as adversaries. in particular, this adversarial detector is jointly trained with the victim model in a multi-task way and is capable of recognizing adversaries generated by different attackers. this helps not only minimize collateral impacts on natural examples @xcite but also reduces the waste of computational budget upon defending against natural examples. figure 2 provides a pedagogical example of the working mechanism of rapid in the context of sentiment analysis. there are four key takeaways from our empirical study. rapid achieves up to 99.9% repair accuracy upon pre-detected adversaries, significantly surpassing text/feature-level reconstruction and voting-based methods ( ## proposed method our proposed rapid framework comprises two phases. phase #1 trains a joint model that not only performs the standard text classification task but is also capable of detecting adversaries. phase #2 is dedicated to implementing a pseudo-supervised adversary defense based on pd. it diverts the victim model's attention from malicious perturbations and rectifies the outputs without compromising performance on natural examples. ## experimental settings in this section, we introduce the experimental settings used in our experiments. victim models: while any plm can be used in a plug-in manner in rapid, this paper considers bert @xcite and deberta @xcite , two widely used plms based on the transformer structure foot_4 , as both the victim classifier and the joint model. their corresponding hyperparameter settings are in appendix c.1. datasets: we consider three widely used text classification datasets foot_5 , including sst2 @xcite , amazon @xcite , and agnews @xcite whose key statistics are outlined in we use iga @xcite , deepword-bug @xcite , pso @xcite and clare to evaulate rapid's generalization capability. evaluation metrics: we use the following five finegrained metrics foot_7 for text classification to evaluate the adversarial defense performance. ## conclusion we propose rapid to repair semantics in adversarial examples. rapid shows an outstanding adversarial defense performance (up to ≈ 99% of identified adversarial examples). it is believed that rapid has the potential to significantly shift the landscape of textual adversarial defense.