End-to-end Adversarial Sample Generation for Data Augmentation (2023)

Abstract: Adversarial samples pose a significant challenge to neural inference models. In this paper, we propose a novel enhancing approach A3 for the robustness of the neural NLP models, which combines the adversarial training and data augmentation. We propose an adversarial sample generator that consists of a conditioned paraphrasing model and a condition generator. The latter aims to generate conditions which guides the paraphrasing model to generate adversarial samples. A pretrained discriminator is introduced to help the adversarial sample generator adapt to the data characteristics for different tasks. We adopt a weighted loss to incorporate the generated adversarial samples with the original samples for augmented training. Compared to existing methods, our approach is much efficient since the generation process is independent to the target model and the generated samples are reusable for different models. Experimental results on several tasks show that our approach improves the overall performance of the trained model. Specially, the enhanced model is robust for various attacking techniques.

## introduction adversarial samples refer to the inputs that intentionally designed to fool deep learning models @xcite , which are also called the attack samples @xcite . the methods for generating attack samples have deceived many natural language processing (nlp) models, such as text classification @xcite , machine translation @xcite and etc @xcite . along with the application of neural models in various areas, the adversarial samples have drawn much attention. generally, the adversarial samples are generated by perturbations on the original sample. to enhance the robustness of nlp neural methods, the * corresponding author adversarial training approach uses the the adversarial samples together with the original samples for training model @xcite . miyato et al. @xcite proposed the first nlp oriented adversarial training method by applying noise on the word representations. but the perturbed result is in the latent space and does not map to a meaningful sentence. then many works turned to generating adversarial samples as a means of adversarial training. the often adopted method is the lexical substitution that is formulated as a combinatorial optimization problem and solved by heuristic search algorithms @xcite . since it requires much interaction with the target model for identifying the important words and selecting the appropriate replacement words, it is time-consuming. due to the lack of supervised training data, so far there is not applicable end-toend mode for adversarial generation. another kind of approaches to improve model robustness is data augmentation, which aims to generate the similar samples to the original data for increasing the amount of training data. the traditional methods on data augmentation include backtranslation @xcite , rule-based modification @xcite , paraphrasing @xcite and other techniques @xcite . these methods are based on the distribution of training data, which are model agnostic. however, with these data, the models are still vulnerable to adversarial samples as the attacking techniques are designed for finding the weakness of the target model @xcite . to solve the above challenges, in this paper, we designed an adversarial sample generation method for data augmentation a foot_0 . we propose an end-toend adversarial sample generation model. given an original sample, a condition generator is designed to output a condition which guides a conditioned paraphrasing model to generate a potential adversarial sample. by pretraining an adversarial dis-criminator to be utilized as the training signal, it can learn the task-specific data characteristics for finding the potential vulnerabilities. since the generation process doesn't require interaction with the target model, it is much efficient compared with the current search based generation methods. besides, the generated samples can be reused for different models rather than for a specific model as the traditional way. then we propose a weighted loss for incorporating the generated adversarial samples with the original data for the target task. we evaluate our method on several nlp tasks and compare it to both the data augmentation and adversarial training methods. experimental results demonstrate that our approach not only improves the overall performance of the trained model but also enhances its robustness against multiple attacking techniques. moreover, the computational time is significantly reduced compared to existing adversarial sample generation methods. ## experiments to evaluate the effectiveness of the proposed method, four aspects should be considered and evaluated in the subsections 4.2-4.5. ## conclusion in this paper, we present a method named a 3 that combines the advantages of adversarial training and data augmentation to enhance the robustness of nlp models. we introduce an end-to-end adversarial sample generation model which consists of a condition generator and a conditioned paraphrasing model. a pretrained adversarial discriminator is proposed to train the adversarial sample generation model for capturing the task-specific data characteristics. this method is much efficient without the need for extensive model interactions. the generated adversarial samples are incorporated with the original training samples by a weighted loss for augmented training downstream models. experiments are conducted on multiple nlp tasks and demonstrate the effectiveness and efficiency of our proposed method. compared to existing methods, the performances of the base models have improved more after our data augmentation, as well as their robustness enhanced against multiple attacking techniques.