SAFER : A Structure-free Approach for Certified Robustness to Adversarial Word Substitutions (2020)

Abstract: State-of-the-art NLP models can often be fooled by human-unaware transformations such as synonymous word substitution. For security reasons, it is of critical importance to develop models with certified robustness that can provably guarantee that the prediction is can not be altered by any possible synonymous word substitution. In this work, we propose a certified robust method based on a new randomized smoothing technique, which constructs a stochastic ensemble by applying random word substitutions on the input sentences, and leverage the statistical properties of the ensemble to provably certify the robustness. Our method is simple and structure-free in that it only requires the black-box queries of the model outputs, and hence can be applied to any pre-trained models (such as BERT) and any types of models (world-level or subword-level). Our method significantly outperforms recent state-of-the-art methods for certified robustness on both IMDB and Amazon text classification tasks. To the best of our knowledge, we are the first work to achieve certified robustness on large systems such as BERT with practically meaningful certified accuracy.

## introduction deep neural networks have achieved state-of-theart results in many nlp tasks, but also have been shown to be brittle to carefully crafted adversarial perturbations, such as replacing words with similar words @xcite , adding extra text @xcite , and replacing sentences with semantically similar sentences @xcite . these adversarial perturbations are imperceptible to humans, but can fool deep neural networks and break their performance. efficient methods for defending these attacks are of critical im- * equal contribution portance for deploying modern deep nlp models to practical automatic ai systems. in this paper, we focus on defending the synonymous word substitution attacking @xcite , in which an attacker attempts to alter the output of the model by replacing words in the input sentence with their synonyms according to a synonym table, while keeping the meaning of this sentence unchanged. a model is said to be certified robust if such an attack is guaranteed to fail, no matter how the attacker manipulates the input sentences. achieving and verifying certified robustness is highly challenging even if the synonym table used by the attacker is known during training (see @xcite , because it requires to check every possible synonymous word substitution, whose number is exponentially large. various defense methods against synonymous word substitution attacks have been developed (e.g., @xcite , most of which, however, are not certified robust in that they may eventually be broken by stronger attackers. recently, @xcite ; @xcite proposed the first certified robust methods against word substitution attacking. their methods are based on the interval bound propagation (ibp) method @xcite which computes the range of the model output by propagating the interval constraints of the inputs layer by layer. however, the ibp-based methods of @xcite ; @xcite are limited in several ways. first, because ibp only works for certifying neural networks with continuous inputs, the inputs in @xcite and @xcite are taken to be the word embedding vectors of the input sentences, instead of the discrete sentences. this makes it inapplicable to character-level @xcite and subword-level @xcite model, which are more widely used in practice @xcite . in this paper, we propose a structure-free certified defense method that applies to arbitrary models that can be queried in a black-box fashion, without any requirement on the model structures. our method is based on the idea of randomized smoothing, which smooths the model with random word substitutions build on the synonymous network, and leverage the statistical properties of the randomized ensembles to construct provably certification bounds. similar ideas of provably certification using randomized smoothing have been developed recently in deep learning (e.g., @xcite @xcite , but mainly for computer vision tasks whose inputs (images) are in a continuous space @xcite . our method admits a substantial extension of the randomized smoothing technique to discrete and structured input spaces for nlp. we test our method on various types of nlp models, including text cnn @xcite , char-cnn @xcite , and bert @xcite . our method significantly outperforms the recent ibp-based methods @xcite on both imdb and amazon text classification. in particular, we achieve an 87.35% certified accuracy on imdb by applying our method on the state-of-the-art bert, on which previous certified robust methods are not applicable. ## adversarial word substitution in a text classification task, a model f (x) maps an input sentence @xmath0, where @xmath1, . . . , x l is a sentence consisting of l words. in this paper, we focus on adversarial word substitution in which an attacker arbitrarily replaces the words in the sentence by their synonyms according to a synonym table to alert the prediction of the model. specifically, for any word x, we consider a pre-defined synonym set s x that contains the synonyms of x (including x itself). we assume the synonymous relation is symmetric, that is, x is in the synonym set of all its synonyms. the synonym set s x can be built based on glove @xcite . with a given input sentence @xmath2,. . . , x l , the attacker may construct an adversarial sentence @xmath3, . . . , x l by perturbing at most @xmath4 certified robustness formally, a model f is said to be certified robust against word substitution attacking on an input x if it is able to give consistently correct predictions for all the possible word substitution perturbations, i.e, ## certifying smoothed classifiers our idea is to replace f with a more smoothed model that is easier to verify by averaging the outputs of a set of randomly perturbed inputs based on random word substitutions. the smoothed classifier f rs is constructed by introducing random perturbations on the input space, in our work, we define π x to be the uniform distribution on a set of random word substitutions. specifically, let p x be a perturbation set for word x in the vocabulary, which is different from the synonym set s x . in this work, we construct p x based on the top k nearest neighbors under the cosine similarity of glove vectors, where k is a hyperparameter that controls the size of the perturbation set; see section 4 for more discussion on p x . for a sentence @xmath5, . . . , x l , the sentencelevel perturbation distribution π x is defined by randomly and independently perturbing each word x i to a word in its perturbation set p x i with equal probability, that is, ## experiments we test our method on both imdb @xcite and amazon (mcauley, 2013) text classification tasks, with various types of models, including text cnn @xcite , char-cnn @xcite and bert @xcite . we compare with the recent ibp-based methods @xcite as baselines. text cnn @xcite was used in @xcite and achieves the best result therein. all the baseline models are trained and tuned using the schedules recommended in the corresponding papers. we consider the case when @xmath6, which means all words in the sentence can be perturbed simultaneously by the attacker. code for reproducing our results can be found in https://github.com/ lushleaf/structure-free-certified-nlp . @xcite ; alzantot et al. (2018), we construct the synonym set s x of word x to be the set of words @xmath7.8 cosine similarity in the glove vector space. the word vector space is constructed by post-processing the pretrained glove vectors @xcite using the counter-fitted method @xcite and the "all-but-the-top" method @xcite to ensure that synonyms are near to each other while antonyms are far apart. ## conclusion we proposed a robustness certification method, which provably guarantees that all the possible perturbations cannot break down the system. compared with previous work such as @xcite ; @xcite , our method is structure-free and thus can be easily applied to any pre-trained models (such as bert) and character-level models (such as char-cnn). the construction of the perturbation set is of critical importance to our method. in this paper, we used a heuristic way based on the synonym network to construct the perturbation set, which may not be optimal. in further work, we will explore more efficient ways for constructing the perturbation set. we also plan to generalize our approach to achieve certified robustness against other types of adversarial attacks in nlp, such as the out-of-list attack. an naïve way is to add the "oov" token into the synonyms set of every word, but potentially better procedures can be further explored.