Improving the Adversarial Robustness of NLP Models by Information Bottleneck (2022)

Abstract: Existing studies have demonstrated that adversarial examples can be directly attributed to the presence of non-robust features, which are highly predictive, but can be easily manipulated by adversaries to fool NLP models. In this study, we explore the feasibility of capturing task-specific robust features, while eliminating the non-robust ones by using the information bottleneck theory. Through extensive experiments, we show that the models trained with our information bottleneck-based method are able to achieve a significant improvement in robust accuracy, exceeding performances of all the previously reported defense methods while suffering almost no performance drop in clean accuracy on SST-2, AGNEWS and IMDB datasets.

## introduction recently, a number of studies @xcite @xcite have revealed the fact that the performance of deep neural networks (dnns) can be severely undermined by adversarial examples. in the text domain, these adversarial examples are crafted by semantic-preserving perturbations to inputs with word synonym substitution @xcite @xcite and character-level transformations @xcite . the vulnerability of dnn models results in inferior performances under adversarial attacks in many nlp tasks including text classification, natural language inference (nli), question answering (qa), etc. to resolve this problem, researchers have proposed various methods to defend against adversarial attacks @xcite @xcite @xcite . in particular, @xcite and @xcite showed that the vulnerability of computer * equal contribution vision models can be attributed to "non-robust features," which are features in the representation space that are sensitive to adversarial attacks and can be easily manipulated by attackers. the presence of these features will weaken the robustness of deep learning models. therefore, a potential defense strategy is to filter out such non-robust features in the inputs. in this paper, we posit that the robustness of text classification models can be improved by filtering out the non-robust features. however, unlike the continuous input in the computer vision domain, input in the nlp domain is a sequence of words, which makes it difficult to model its distribution. we thus research into means to filter out the nonrobust features in language model inputs. inspired by @xcite , we propose to use the information bottleneck method @xcite in text classification tasks. specifically, we plug in an information bottleneck layer (ib layer) foot_0 between bert @xcite output layer and the text classifier to preserve only task-specific features. since the ib layer trades off between minimizing preserved information and model prediction performance, features that are not robust under the targeted task are filtered out. therefore, our approach is able to focus more on the robust features and achieve an improvement in its robustness. we conduct extensive experiments on three text classification benchmarks: sst-2 @xcite , agnews @xcite and imdb @xcite . results have shown that our approach achieves a great improvement on model robustness compared with traditional defense methods, while only suffering little or even no performance drop on clean accuracy. we also provide a visualization to interpret how the information bottleneck layer works to keep robust features, in order to justify our proposed approach. in summary, we propose a new information bottleneck-based approach to improve the robustness of dnn language models. we demonstrate that our approach is effective in improving models' adversarial performance while maintaining their performance on clean data. in addition, experimental results show that our approach can also be combined with existing adversarial training methods like freelb @xcite to further improve models' robustness under adversarial attacks. ## related work in response to the discovery of dnn's vulnerability to adversarial examples and the emergence of adversarial attacks, many defense methods have also been proposed to improve the robustness of dnn models. among these methods, adversarial training is one of the most effective and widely used to defend against adversarial examples. in adversarial training, the model is trained to correctly classify both adversarial examples and normal examples. goodfellow et al. ( 2014 ) first propose a fast gradient sign method (fgsm) to generate adversarial examples for adversarial training in the image domain. in textual domain, many researchers tried to add perturbation to input word embedding to generate adversarial examples. zhang and yang (2018) applied several types of noises, such as gaussian and bernoulli, to perturb the input embeddings while @xcite proposed freelb, which minimizes the resultant adversarial loss inside different regions around input samples through adding adversarial perturbations to word embeddings. however, they all focus on the generalization of model, not the robustness. @xcite and wang and wang (2020) proposed to replace certain words in the training dataset with their synonyms for the purpose of data augmentation. however, this kind of methods are specific for the defense against synonym substitution attack, and may be weak when facing other kind of adversarial attack methods, such as character-level attack. apart from empirical methods, a set of certified robustness training methods is introduced recently, which have proven to be effective in improving a model's robustness against a specific type of attacks. @xcite and @xcite used interval bound propagation (ibp) to propose certi-fied robustness training methods that can limit the loss of the worst-case perturbations. these methods are provably robust to word substitution attacks. however, certified robustness training sacrifices the model's clean accuracy and is not generalized to all types of attacks. the information bottleneck method was proposed by @xcite , aiming to provide a quantitative notion of "relevant information". although the method has been utilized in many nlp tasks such as rationale extraction @xcite , sentence summarization @xcite and parsing @xcite , only few of them focus on combining information bottleneck with adversarial defense methods. @xcite proposes infobert, which applied information bottleneck to the embedding layer of pre-trained language models to suppress noisy information contained in word embeddings. the implicit assumption of this approach is that the embedding layer contains enough information for the model to make predictions. however, different word combinations can have different meanings, so the semantics of a sentence can not be fully expressed without taking contextual information into consideration. therefore, we propose a completely different implementation of the information bottleneck. the information bottleneck is utilized to extract taskrelated features from the output of the last layer of bert, which is pre-trained and thus be capable of generating a contextualized representation for the input sequence, and calculated by using the variational inference method. besides, infobert uses the gradient information of each word to find local anchored features and aims at increasing the mutual information between the global representation and them, while in our approach, robust features are extracted from the global representation without additional steps. ## method derived from information theory, the information bottleneck method @xcite was proposed and has been used as a training objective as well as a theoretical framework @xcite in machine learning. the method of information bottleneck can be statistically formulated as follows: denote the input random variables as x, which could be sentences or paragraphs, and the output as y. denote the joint distribution of x and y as p (x, y). the purpose of information bottleneck is to learn a distribution p θ (t|x) from x to a compressed hidden feature t. to simplify the notation, we will omit θ in the subscript when we mention p(t|x). the information bottleneck objective (ib objective) used for optimization is as follows: specifically, given an input x and output y, we want to obtain specific hidden features t from x that only contain information which contributes to the final prediction y. by minimizing the ib objective in eq.( 1 ), the ib layer filters out the taskunrelated information in bert output, which is extracted from input x, and obtain the required t. to minimize the ib objective, we maximize the mutual information i(y; t). since the purpose of maximizing i(y; t) is to enforce t contain enough information for the model's prediction, we choose to minimize the loss function of the original task to approximate the maximization of i(y; t). taking classification tasks as an example, our method would be to minimize the cross entropy function l ce . the mutual information i(x; t) can be calculated by the kullback-leibler distance between the distributions of p (t|x) and p (t) as follows: to calculate the kullback-leibler divergence between p (t|x) and p (t), we need knowledge of their probability distributions. the p (t|x) term can be sampled empirically. however, the p (t) term is difficult to be estimated. to resolve this challenge, we expand the eq.2 to get the following equation: we want to reduce the mutual information between x and t so that more task-unrelated information can be filtered out, which can help us retain more robust features for the final prediction. to achieve this goal in practice, we minimize the upper bound of i(x; t) derived in eq.( 4 ). we achieve this through adjusting the parameters in q(t) in order to minimize the kullback-leibler divergence between p (t|x) and q(t), which will lower the upper bound of i(x; t). combined with the optimization goal of the term i(y; t) we explained in the former chapter, the final loss function is: by using the loss function eq.( 5 ) to optimize our model, our approach would be able to filter out the non-robust features for the classification task among all the inputs. ## experiments in order to validate our assumption, we conduct several experiments to evaluate the effectiveness of our approach. we first compare our model and the baseline models both on their clean accuracy and accuracy under attack. furthermore, in exploration of the ability of our model to work in conjunction with adversarial training methods-such as freelbto achieve complementary effects, we also evaluate the performance of the combined model. in addition, we try to interpret and further analyze our approach through several additional experiments. ## discussion in this section, we study how the implementation of ib layer affects the model's robustness. furthermore, we seek to find a reasonable explanation for this effect. ## conclusion we propose a novel implementation of the information bottleneck method on bert-base models to improve its adversarial robustness. our method is proven to be successful in filtering out nonrobust feature and keeping task-specific robust features, thus improving the adversarial robustness of models. experimental results have shown that our method outperforms four widely used defense methods across three datasets with both sentencelevel and character-level attack algorithms. we also validate our method through a comprehensive anal-ysis on experimental results as well as quantitative interpretation of our model's performance under adversarial attacks.