R o AST : Robustifying Language Models via Adversarial Perturbation with Selective Training (2023)

Abstract: Fine-tuning pre-trained language models (LMs) has become the de facto standard in many NLP tasks. Nevertheless, fine-tuned LMs are still prone to robustness issues, such as adversarial robustness and model calibration. Several perspectives of robustness for LMs have been studied independently, but lacking a unified consideration in multiple perspectives. In this paper, we propose Robustifying LMs via Adversarial perturbation with Selective Training (RoAST), a simple yet effective fine-tuning technique to enhance the multi-perspective robustness of LMs in a unified way. RoAST effectively incorporates two important sources for the model robustness, robustness on the perturbed inputs and generalizable knowledge in pre-trained LMs. To be specific, RoAST introduces adversarial perturbation during fine-tuning while the model parameters are selectively updated upon their relative importance to minimize unnecessary deviation. Under a unified evaluation of fine-tuned LMs by incorporating four representative perspectives of model robustness, we demonstrate the effectiveness of RoAST compared to state-of-the-art fine-tuning methods on six different types of LMs, which indicates its usefulness in practice.

## introduction fine-tuning pre-trained language models @xcite ) has now become the de facto standard in many nlp tasks @xcite @xcite . the typical practice for evaluating fine-tuned lms is to measure the task performance (e.g., accuracy) on a fixed (validation) set of labeled samples. however, this evaluation approach may fall short in ensuring the reliability of fine-tuned lms, as they are still prone to robustness issues in real-world usage. for example, their predictions are known to be still vulnerable to small word-level perturbations @xcite , and also can be biased by the superficial cues, e.g., keyword or negation @xcite . as such, it is critical to additionally account for robustness during fine-tuning and evaluation of lms. the robustness of fine-tuned lms has been investigated in various perspectives, such as adversarial robustness or distribution-shift generalization @xcite @xcite . however, existing research exhibits certain limitations as these studies primarily focus on a single perspective of model robustness, rather than considering multiple perspectives simultaneously. since real-world applications necessitate models to simultaneously exhibit robustness across multiple dimensions, a unified framework is crucial to build a reliable system. moreover, as diverse and distinct methods are available for enhancing the robustness of each perspective, it is hard for practitioners to find an efficient approach for fine-tuning lms to ensure such comprehensive reliability. consequently, these limitations inspire us to explore a single effective way for fine-tuning lms to improve its robustness in multiple perspectives. in this paper, we propose a simple yet effective fine-tuning technique (figure 1 ) that aims to improve the multi-perspective robustness of lms, coined robustifying lms with adversarial perturbation with selective training (roast). the high-level idea of roast is effectively incorporating two important sources for the model robustness during the fine-tuning: robustness on the perturbed input and generalizable knowledge learned during pre-training of lms. while both factors have been separately demonstrated to enhance the various facets of robustness, the collaborative framework pursuing unified robustness has been less explored yet. specifically, roast first generates adversarial perturbation and adds it to the training input. then, to prevent a large deviation from the pre-trained model while learning new task-relevant knowledge, roast updates model parameters selectively; after measuring their relative importance for solving a given task on the fly, only key responsible parameters are updated. we further justify this technique with a theoretical analysis, providing insight into the proposed selective training method. to perform a unified evaluation of the multiperspective robustness of lms, we construct a new evaluation benchmark using two popular nlp tasks, sentiment classification and entailment tasks; alongside the performance on the validation set, we integrate four distinct aspects of model robustness: distribution-shift generalization @xcite , adversarial robustness @xcite , model calibration @xcite , and anomaly detection @xcite . under this robustness benchmark, we demonstrate the effectiveness of roast for enhancing the robustness of finetuned lms. notably, across the four robustness aspects along with a standard validation accuracy, roast yields 18.39% and 7.63% average relative improvement compared to the traditional finetuning methodology on sentiment classification and entailment tasks, respectively. furthermore, we discover that roast significantly improves the robustness of six state-of-the-art lms, which further indicates its practical usefulness as a simple yet effective solution for robustiying lms. ## background multi-perspective of model robustness. for reliable deployment in real-world scenarios @xcite , the models should be robust in various perspectives, not just be accurate on a given validation set, drawn from the trained distribution. to this end, various perspectives of model robustness have been investigated. distribution-shift (i.e., out-of-domain) generalization evaluates how well the models can generalize to various forms of distribution shift from trained one at inference time @xcite . for example, a classifier trained on a sentiment classification dataset is expected to also perform well on another sentiment classification dataset, as both datasets are constructed to solve the same task. on the other hand, it is well known that the predictions of deep neural networks can be arbitrarily wrong, even with human-imperceptible adversarial perturbations @xcite @xcite . since this problem is not exceptional for lms with word-or sentence-level adversarial perturbation @xcite , resiliency to the adversarial examples is also an important perspective of model robustness. in addition, model calibration considers the alignment between the model's predicted probability and the true correctness likelihood @xcite , and hence it is essential for the reliability and interpretability of model prediction. lastly, anomaly detection performance measures the model's capability to distinguish whether a given input is drawn out-ofdistribution (ood) of the training set @xcite or not. in the vision domain, @xcite recently investigates the effectiveness of existing data augmentation methods to enhance robustness in multiple perspectives; however, such investigation has not yet been explored in nlp. enhancing robustness of language models. to enhance the robustness of fine-tuned lms upon (limited) training in the downstream tasks @xcite , various fine-tuning techniques have been explored. one line of work has explored perturbation-based regularization, which enhances model robustness by simulating the specific types of perturbation to the inputs during fine-tuning. for example, @xcite ; @xcite utilize dropout to impose a stochastic perturbation to consider a different view of input, and @xcite substitutes the words using pre-trained masked lms (e.g., @xcite ). in addition, @xcite ; @xcite impose adversarial perturbation on word embeddings to generate a challenging view of inputs. more interestingly, @xcite reveals that training with adversarial perturbation can be effective for improving model calibration. on the other hand, another line of work has focused on preserving the generalizable knowledge learned during pre-training of lms; @xcite identifies a risk of losing the generalizable knowledge during fine-tuning and proposes a noise-based regularization to prevent it. @xcite directly minimizes the distance between the parameters of fine-tuned and pre-trained models as regularization, and @xcite proposes to only update a fixed subset of model parameters during the entire finetuning. a two-step strategy of linear probing and then full fine-tuning has recently been shown to be effective for distribution-shift generalization by reducing the deviation from the pre-trained model @xcite . in addition, the recent result @xcite indicates the importance of generalizable knowledge in pre-trained lms for better anomaly detection. as both approaches enhance the different perspectives of model robustness, the effective framework for their collaborative utilization is expected to can serve as a unified way for robusifying lms. however, such direction is under-explored from now on, and we try to fill this gap in this work. ## robustifying lms via adversarial perturbation and selective training overview. in this section, we present our method, roast, that aims to enhance the multi-perspective robustness of lms in a unified way. our main idea is collaboratively incorporating two important sources of model robustness during fine-tuning; we improve the generalization of lms on the perturbed input using adversarial perturbation and preserve the generalizable knowledge within pretrained lms via selective training with gradient masking. figure 1 shows an overview of roast. next, we describe in detail our techniques to improve the robustness of fine-tuned lms. ## experiments in this section, we evaluate the effectiveness of roast to enhance the robustness of fine-tuned lms in multi-perspectives. we first describe the experimental setups, including how the robustness evaluation benchmark is constructed, in section 4.1. in section 4.2, we present experimental results of roast and other baselines on the constructed benchmark. in section 4.3, we provide more analysis of roast including (a) ablation study, (b) comparison with different methods sharing similar intuition, and (c) qualitative analysis. ## conclusion in this paper, we propose to consider multiple aspects of model robustness for the reliable deployment of lms in real-world settings. to improve the robustness of fine-tuned lms, we present a new fine-tuning method (roast) by leveraging adversarial perturbation while preventing its potential risk with efficient selective training. through extensive experiments under constructed benchmark, we demonstrate the effectiveness of roast and its generalizability to multiple state-of-the-art lms. as investing multiple aspects of model robustness in a unified viewpoint is under-explored in the literature, we expect our work to contribute to this research direction to enable us to use the well-performing pre-trained language models with more reliability. furthermore, since our proposed method of robust fine-tuning is task-and domainagnostic, we believe that roast can benefit other nlp tasks (e.g., question answering) and domains (e.g., vision and graph) as well, as interesting future work directions.