Evaluating and Enhancing the Robustness of Neural Network-based Dependency Parsing Models with Adversarial Examples (2020)

Abstract: Despite achieving prominent performance on many important tasks, it has been reported that neural networks are vulnerable to adversarial examples. Previously studies along this line mainly focused on semantic tasks such as sentiment analysis, question answering and reading comprehension. In this study, we show that adversarial examples also exist in dependency parsing: we propose two approaches to study where and how parsers make mistakes by searching over perturbations to existing texts at sentence and phrase levels, and design algorithms to construct such examples in both of the black-box and white-box settings. Our experiments with one of state-of-the-art parsers on the English Penn Treebank (PTB) show that up to 77% of input examples admit adversarial perturbations, and we also show that the robustness of parsing models can be improved by crafting high-quality adversaries and including them in the training stage, while suffering little to no performance drop on the clean input data.

## introduction deep neural network-based machine learning (ml) models are powerful but vulnerable to adversarial examples. adversarial examples also yield broader insights into the targeted models by exposing them to such maliciously crafted examples. the introduction of the adversarial example and training ushered in a new era to understand and improve the ml models, and has received significant attention recently @xcite @xcite @xcite @xcite . even though generating adversarial examples for texts has proven to be a more challenging task * these authors contributed equally to this work. the dt link nn between in the dt futures nns and cc stock nn markets nns ripped vbd apart rb . . det advmod prep det cc nn conj pobj punct nsubj the dt link nn between in the dt futures nns and cc exchange nn markets nns ripped vbd apart rb . . det advmod prep cc conj punct nn det pobj nsubj figure 1 : sentence-level attack: an adversarial example (bottom) for the output (top) of a deep neural dependency parser @xcite . replacing a word "stock" with an adversarially-chosen word "exchange" in the sentence causes the parser to make four mistakes (blue, dashed) in arc prediction. the adversarial example preserves the original syntactic structures, and the substitute word is assigned to the same part of speech (pos) as the replaced one. the assigned pos tags (blue) are listed below the words. although adversarial examples have been studied recently for nlp tasks, previous work almost exclusively focused on semantic tasks, where the attacks aim to alter the semantic prediction of ml models (e.g., sentiment prediction or question answering) without changing the meaning of original texts. to the best of our knowledge, adversarial examples to syntactic tasks, such as dependency parsing, have not been studied in the literature. motivated by this, we take the neural network-based dependency parsing algorithms as targeted models and aim to answer the following questions: can we construct syntactic adversarial examples to fool a dependency parser without changing the original syntactic structure? and can we make dependency parsers robust with respect to these attacks? to answer these questions, we propose two approaches to study where and how parsers make mistakes by searching over perturbations to existing texts at sentence and phrase (corresponding to subtrees in a parse tree) levels. for the sentencelevel attack, we modify an input sentence to fool a dependency parser while such modification should be syntactically imperceptible to humans (see figure 1 ). any new error (excluding the arcs directly connected to the modified parts) made by the parser is accounted as a successful attack. for the phrase-level (or subtree-level) attack, we choose two phrases from a sentence, which are separated by at least k words (say @xmath0, and modify one phrase to cause the parser's prediction errors in another target phrase (see figure 2 ). unlike the sentence-level attack, any error occurred outside the target subtree is not considered as a successful attacking trial. it helps us to investigate whether an error in one part of a parse tree may exert longrange influence, and cause cascading errors @xcite . we study the sentence-level and subtree-level attacks both in white-box and black-box settings. in the former setting, an attacker can access to the model's architecture and parameters while it is not allowed in the latter one. our contributions are summarized as follows: (1) we explore the feasibility of generating syntactic adversarial sentence examples to cause a dependency parser to make mistakes without altering the original syntactic structures; (2) we propose two approaches to construct the syntactic adversarial examples by searching over perturbations to existing texts at sentence and phrase levels in both the blackbox and white-box settings; (3) our experiments with a close to state-of-the-art parser on the english penn treebank show that up to 77% of input examples admit adversarial perturbations, and moreover that robustness and generalization of parsing models can be improved by adversarial training with the proposed attacks. the source code is available at ( https://github.com/zjiehang/dpattack ). figure 2 : phrase-level attack: two separate subtrees in a parse tree are selected, and one of them (left) is deliberately modified to cause a parser to make incorrect arc prediction for another target subtree (right). for example, we can make a neural dependency parser @xcite to attach the word "difference" in the target subtree to its sibling "in" instead of the correct head "lock" (the subtree's root) by maliciously manipulating the selected leftmost subtree only. ## related work generating adversarial examples -inputs intentionally crafted to fool a model -has become an important means of exploring model vulnerabilities. furthermore, adding adversarial examples in the training stage, also known as adversarial training, has become one of the most promising ways to improve model's robustness. although there is limited literature available for nlp adversarial examples, some studies have been conducted on nlp tasks such as reading comprehension @xcite ), text classification @xcite @xcite , machine translation @xcite @xcite , and dialogue systems @xcite . depending on the degree of access to the target model, adversarial examples can be constructed two different settings: white-box and black-box settings @xcite . in the white-box setting, an adversary can access the model's architecture, parameters and input feature representations while not in the black-box one. the white-box attacks normally yield a higher success rate because the knowledge of target models can be used to guide the generation of adversarial examples. however, the black-box attacks do not require access to target models, making them more practicable for many real-world attacks. such attacks also can be divided into targeted and non-targeted ones depending on the purpose of adversary. our phrase-level attack can be viewed as a targeted at-tack towards a specific subtree while the sentencelevel attack can be taken as a non-targeted one. for text data, input sentences can be manipulated at character @xcite , sememe (the minimum semantic units) @xcite , or word @xcite levels by replacement, alteration (e.g. deliberately introducing typos or misspellings), swap, insertion, erasure, or directly making small perturbations to their feature embeddings. generally, we would like to ensure that the crafted adversarial examples are sufficiently similar to their original ones, and these modifications should be made within semantics-preserving constraints. such semantic similarity constraints are usually defined based on cosine similarity @xcite @xcite or edit distance @xcite . text adversarial example generation usually involves two steps: determine an important position (or token) to change; modify it slightly to maximize the model's prediction error. this two-step can be repeated iteratively until the model's prediction changes or certain stopping criteria are reached. many methods have been proposed to determine the important positions by random selection @xcite , trial-and-error testing at each possible point @xcite , analyzing the effects on the model of masking various parts of a input text @xcite @xcite , comparing their attention scores @xcite , or gradient-guided optimization methods @xcite @xcite . after the important positions are identified, the most popular way to alter text examples is to replace the characters or words at selected positions with similar substitutes. such substitutes can be chosen from nearest neighbours in an embedding space @xcite @xcite , synonyms in a prepared dictionary @xcite , visually similar alternatives like typos @xcite @xcite or internet slang and trademark logos @xcite , paraphrases @xcite or even randomly selected ones @xcite . given an input instance, @xcite proposed to search for adversaries in the neighborhood of its corresponding representation in latent space by sampling within a range that is recursively tightened. @xcite tried to insert few distraction sentences generated by a simple set of rules into text examples to mislead a reading comprehension system. ## preliminary dependency parsing is the task of constructing a parse tree of a sentence that represents its syntactic structure and defines the relationships between "head" words and dependent ones, which modify their heads (see the arcs in figure 1 ). in this section, we first describe a graph-based dependency parsing method, and then formally present the adversarial attack problem of dependency parsing. ## method adversarial examples are required to maintain the original functionality of the input. in the adversarial nlp literature, previous studies often expect the adversarial examples to retain the same or similar semantic meaning as the original one @xcite @xcite @xcite . however, in this paper we focus on the dependency parsing task, which focuses on predicting the syntactic structure of input sentences. therefore, to expose regions of the input space where the dependency parsers perform poorly, we would like the modified examples x to preserve the same syntactic structure as the original x, but slightly relax the constraint on their similarity in semantic properties. a robust parser should perform consistently well on the sentences that share the same syntactic properties, while differ in their meaning. for example, substituting the word "black" for "white", or "dog" for "cat" are acceptable replacements because they are grammatically imperceptible to humans. ## experiments we first describe the target parser as well as its three variants, evaluation dataset, and hyper-parameter settings. we then report the empirical results of the proposed adversarial attacking and training. we also list some adversarial examples generated by our attacking algorithms in ## conclusion in this paper, we study the robustness of neural network-based dependency parsing models. to the best of our knowledge, adversarial examples to syntactic tasks, such as dependency parsing, have not been explored in the literature. we develop the first adversarial attack algorithms for this task to successfully find the blind spots of parsers with high success rates. furthermore, by applying adversarial training using the proposed attacks, we are able to significantly improve the robustness of dependency parsers without sacrificing their performance on clean data.