Don’t Retrain, Just Rewrite: Countering Adversarial Perturbations by Rewriting Text (2023)

Abstract: Can language models transform inputs to protect text classifiers against adversarial attacks? In this work, we present ATINTER, a model that intercepts and learns to rewrite adversarial inputs to make them non-adversarial for a downstream text classifier. Our experiments on four datasets and five attack mechanisms reveal that ATINTER is effective at providing better adversarial robustness than existing defense approaches, without compromising task accuracy. For example, on sentiment classification using the SST-2 dataset, our method improves the adversarial accuracy over the best existing defense approach by more than 4% with a smaller decrease in task accuracy (0.5 % vs 2.5%). Moreover, we show that ATINTER generalizes across multiple downstream tasks and classifiers without having to explicitly retrain it for those settings. For example, we find that when ATINTER is trained to remove adversarial perturbations for the sentiment classification task on the SST-2 dataset, it even transfers to a semantically different task of news classification (on AGNews) and improves the adversarial robustness by more than 10%.

## introduction neural models in nlp have been shown to be vulnerable to adversarial attacks both during training time @xcite @xcite and at deployment @xcite @xcite . the attacks of the latter type aim to craft adversarial inputs by introducing small, imperceptible perturbations in the input text that erroneously change the output label of a classification model. defending against such attacks is important because it ensures the integrity and reliability of nlp systems. if undefended, for example, an attacker could adversarially manipulate a spam email to evade a spam detector. ## related work adversarial attacks most adversarial attacks use heuristic-based search methods to substitute vulnerable parts of the input with carefully chosen adversarial text @xcite @xcite . these substitutions can be performed at the character-level @xcite , word-level @xcite @xcite @xcite , or both @xcite . finally, while adversarial attacks show that nlp models are over-sensitive to small perturbations, nlp models have also been shown to be under-sensitive to certain perturbations like input reduction, etc. @xcite . we refer the reader to the detailed recent survey of @xcite . ## learning to remove adversarial perturbations as mentioned in section 2, most existing methods that operate on the textual input rely on randomization to remove any adversarial perturbations. we present a model that learns to remove these perturbations by rewriting the text. although similar to paraphrasing in terms of the task interface, our goal is different; we focus on removing the perturbation instead of just preserving the meaning. the rest of this section formalizes this intuition. ## conclusion in this paper, we explore a novel strategy to defend against textual adversarial attacks that does not require model retraining. our proposed model, atinter intercepts and rewrites adversarial inputs to make them non-adversarial for a downstream text classifier. we perform experiments on four text classification datasets and test its effectiveness against five adversarial attacks. the results suggest that, in comparison with baselines, our proposed approach is not only more effective against adversarial attacks but is also better at preserving the task accuracies. moreover, when used as a pluggable module, atinter shows great transferability to new models and datasets-on three new datasets, it improves adversarial accuracy by 10.9% on average. we expect the future work to focus on improving inference time latency by using more sophisticated text generation methods.