It’s Morphin’ Time! C ombating Linguistic Discrimination with Inflectional Perturbations (2020)

Abstract: Training on only perfect Standard English corpora predisposes pre-trained neural networks to discriminate against minorities from non-standard linguistic backgrounds (e.g., African American Vernacular English, Colloquial Singapore English, etc.). We perturb the inflectional morphology of words to craft plausible and semantically similar adversarial examples that expose these biases in popular NLP models, e.g., BERT and Transformer, and show that adversarially fine-tuning them for a single epoch significantly improves robustness without sacrificing performance on clean data.

## introduction in recent years, natural language processing (nlp) systems have gotten increasingly better at learning complex patterns in language by pretraining large language models like bert, gpt-2, and ctrl @xcite @xcite , and fine-tuning them on taskspecific data to achieve state of the art results has become a norm. however, deep learning models are only as good as the data they are trained on. existing work on societal bias in nlp primarily focuses on attributes like race and gender @xcite . in contrast, we investigate a uniquely nlp attribute that has been largely ignored: linguistic background. current nlp models seem to be trained with the implicit assumption that everyone speaks fluent (often u.s.) standard english, even though twothirds (>700 million) of the english speakers in the world speak it as a second language (l2) @xcite . even among native speakers, a significant number speak a dialect like african american vernacular english (aave) rather than standard english @xcite . in addition, these figure 1 : morpheus looks at each noun, verb, or adjective in the sentence and selects the inflected form (marked in red) that maximizes the target model's loss. to maximize semantic preservation, morpheus only considers inflections belonging to the same universal part of speech as the original word. world englishes exhibit variation at multiple levels of linguistic analysis @xcite . therefore, putting these models directly into production without addressing this inherent bias puts them at risk of committing linguistic discrimination by performing poorly for many speech communities (e.g., @xcite . this could take the form of either failing to understand these speakers @xcite , or misinterpreting them. for example, the recent mistranslation of a minority speaker's social media post resulted in his wrongful arrest @xcite . since l2 (and many l1 dialect) speakers often exhibit variability in their production of inflectional morphology foot_1 @xcite @xcite @xcite , we argue that nlp models should be robust to inflectional perturbations in order to minimize their chances of propagating linguistic discrimination. hence, in this paper, we: to the best of our knowledge, we are the first to investigate the robustness of nlp models to inflectional perturbations and its ethical implications. adversarial attacks in nlp. first discovered in computer vision by @xcite , adversarial examples are data points crafted with the intent of causing a model to output a wrong prediction. in nlp, this could take place at the character, morphological, lexical, syntactic, or semantic level. @xcite showed that question answering models could be misled into choosing a distractor sentence in the passage that was created by replacing key entities in the correct answer sentence. @xcite followed by demonstrating the brittleness of neural machine translation systems against character-level perturbations like randomly swapping/replacing characters. however, these attacks are not optimized on the target models, unlike @xcite , which makes use of the target model's gradient to find the character change that maximizes the model's error. since these attacks tend to disrupt the sentence's semantics, @xcite and @xcite propose searching for adversaries that preserve semantic content. @xcite and @xcite explore the use of synonym substitution to create adversarial examples, using word embeddings to find the n nearest words. @xcite take a different approach, arguing that adding visual noise to characters leaves their semantic content undisturbed. @xcite propose to create paraphrase adversaries by conditioning their generation on a syntactic template, while @xcite swap key entities in the sentences. @xcite provide a comprehensive survey of this topic. adversarial training. in order to ensure our nlp systems are not left vulnerable to powerful attacks, most existing work make use of adversarial training to improve the model's robustness @xcite . this involves augmenting the training data either by adding the adversaries to or replacing the clean examples in the training set. summary. existing work in fairness mostly focus on tackling bias against protected attributes like race and gender, while those in adversarial nlp primarily investigate character-and word-level perturbations and seek to improve the models' robustness by retraining them from scratch on the adversarial training set. our work makes use of perturbations in inflectional morphology to highlight the linguistic bias present in models such as bert and transformer, before showing that simply fine-tuning the models for one epoch on the adversarial training set is sufficient to achieve significant robustness while maintaining performance on clean data. ## generating inflectional perturbations inflectional perturbations inherently preserve the general semantics of a word since the root remains unchanged. in cases where a word's part of speech (pos) is context-dependent (e.g., duck as a verb or a noun), restricting perturbations to the original pos further preserves its original meaning. additionally, since second language speakers are prone to inflectional errors @xcite , adversarial examples that perturb the inflectional morphology of a sentence should be less perceivable to people who interact heavily with non-native speakers or are themselves non-native speakers. hence, we present morpheus, our proposed method for crafting inflectional adversaries. ## human evaluation to test our hypothesis that inflectional perturbations are likely to be relatively natural and semantics preserving, we randomly sample 130 adversar- discussion. we believe that non-native speakers may tend to rate sentences as more human-like for the following reasons: ## adversarial fine-tuning in this section, we extend the standard adversarial training paradigm @xcite to make the models robust to inflectional perturbations. since directly running morpheus on the entire training dataset to generate adversaries would be far too time-consuming, we use the findings from our experiments on the respective dev/test sets (section 4) to create representative samples of good adversaries. this significantly improves robustness to inflectional perturbations while maintaining similar performance on the clean data. we first present an analysis of the inflectional distributions before elaborating on our method for generating the adversarial training set. ## limitations and future work although we have established our methods' effectiveness at both inducing model failure and robustifying said models, we believe they could be further improved by addressing the following limitations: in future work, we intend to address these limitations by directly modeling the l2 and dialectal distributions and investigating the possibility of robustifying these models further upstream. ## conclusion ensuring that nlp technologies are inclusive, in the sense of working for users with diverse linguistic backgrounds (e.g., speakers of world englishes such as aave, as well as l2 speakers), is especially important since natural language user interfaces are becoming increasingly ubiquitous. we take a step in this direction by revealing the existence of linguistic bias in current english nlp models-e.g., bert and transformer-through the use of inflectional adversaries, before using adversarial fine-tuning to significantly reduce it. to find these adversarial examples, we propose mor-pheus, which crafts plausible and semantically similar adversaries by perturbing an example's inflectional morphology in a constrained fashion, without needing access to the model's gradients. next, we demonstrate the adversaries' effectiveness using qa and mt, two tasks with direct and wide-ranging applications, before validating their plausibility and semantic content with real humans. finally, we show that, instead of retraining the model, fine-tuning it on a representative adversarial training set for a single epoch is sufficient to achieve significant robustness to inflectional adversaries while preserving performance on the clean dataset. we also present a method of generating this adversarial training set in linear time by making use of the adversarial examples' inflectional distribution to perform weighted random sampling.