Large Scale Author Obfuscation Using S iamese Variational Auto-Encoder: The S iam AO System (2020)

Abstract: Author obfuscation is the task of masking the author of a piece of text, with applications in privacy. Recent advances in deep neural networks have boosted author identification performance making author obfuscation more challenging. Existing approaches to author obfuscation are largely heuristic. Obfuscation can, however, be thought of as the construction of adversarial examples to attack author identification, suggesting that the deep learning architectures used for adversarial attacks could have application here. Current architectures are proposed to construct adversarial examples against classification-based models, which in author identification would exclude the high-performing similarity-based models employed when facing large number of authorial classes. In this paper, we propose the first deep learning architecture for constructing adversarial examples against similarity-based learners, and explore its application to author obfuscation. We analyse the output from both success in obfuscation and language acceptability, as well as comparing the performance with some common baselines, and showing promising results in finding a balance between safety and soundness of the perturbed texts.

## introduction the ability of machine learning to infer information about the author of a piece of text raises issues about privacy in textual data. blogs, reviews, even tweets can be significantly revealing when authors follow textual authorial patterns, which can lead to disclosure of sensitive information. this has led to real-world problems, such as with amazon's machine learning-based recruitment system, this work is licensed under a creative commons attribution 4.0 international license. license details: http: //creativecommons.org/licenses/by/4.0/ . author identification is the task of inferring the actual identity of the author. the potential number of author candidates can be very large, making author identification different from author profiling where the possible values of an attribute (e.g. gender) are typically limited to a small closed set, as in standard classification tasks. depending on the number of included authorial classes, approaches in author identification are either classification-based or similarity-based, in the framing of @xcite . similarity-based approaches are proven to be better suited when facing large numbers of authors @xcite , and have also underpinned several successful methods in the annual pan authorship shared tasks foot_1 such as @xcite and @xcite . author obfuscation is the task of concealing the identity of an author. this task is fairly challenging even for humans @xcite , as authors are often not aware of hidden patterns in their writing; and the computational task is relatively underexplored. some work has been carried out as part of a pan authorship obfuscation task, since 2016, while other research has been independent of this. these approaches have included using backtranslation or heuristic application of paraphrase rules @xcite @xcite , and more recently applying heuristic solution methods to the task framed as an optimization problem @xcite . author obfuscation can be seen as the generation of adversarial examples to attack an author identification system. work in other areas of adversarial example generation @xcite @xcite has seen rapid progress with the application of deep learning, and could potentially be adapted here. for example, @xcite define a gan-style architecture to generate 'natural' adversarial examples that -unlike approaches searching the input space -works on the dense representation of each data point. dense representations lie on the manifold that defines the data distribution and finding close points to them leads to natural adversarial examples. they apply this both to image classification tasks and a standard three-class natural language inference task, producing natural-looking adversarial examples. such architectures have so far only been defined for producing adversarial examples against classification-based learners (limited number of classes). in author identification, this would exclude the high-performing similarity-based approaches. in this paper we introduce siamao, an architecture that can generate adversarial examples against a similarity-based learner (specifically a deep siamese network @xcite ) and evaluate whether it can obfuscate against authorship identification. siamao draws on ideas from variational autoencoders (vaes), and the specific use of them by @xcite for generating novel sentences close to some input, and from the adversarially regularized autoencoders (araes) of @xcite : the intuition here is for the autoencoder to regenerate close to the original text but with some perturbation to fool an authorship identification system. our main contributions are: (i) a method for integrating siamese networks into vaes in order to generate adversaries against similarity based models, and testing it under author obfuscation. (ii) a performance comparison on properties of the obfuscated text between our model and baselines: our focus is on how well the obfuscated text can fool an author identification system, how much the obfuscator changes the text, and how acceptable the resulting text is. we find that siamao provides a promising deep learning approach to this task. ## siamao here we present siamao, an author obfuscation neural network that integrates a large scale siamese author identifier in a vae architecture to generate adversarial text. this system takes a pair of texts as input and generates an adversary with the aim of changing the author identification results. figure 1 shows (a) a high-level schema of the process and (b) the components of siamao respectively. a key innovation is incorporation of a similaritybased author identification approach, in contrast to other work described in §2 that only constructs adversarial examples against classification-based inference. ## conclusion and further work this work is the first to propose a deep learning architecture for generating textual adversarial examples that incorporates a similarity-based inference model rather than a standard classifier-based one. we explored this in the context of authorship obfuscation, where the goal is to hide the author from a similarity-based authorship identifier. results indicate that our siamao model can degrade the performance of a key standard authorship identification system, compared to baseline systems, with modifications that are of similar magnitude or lower. all approaches had difficulty against a siamese authorship identification system, however. as this is the first work in this direction, many improvements are possible, particularly in the area of language acceptability. these improvements would be both to siamao, in encouraging the adversarial examples towards greater acceptability, also in terms of the automatic evaluation metrics. employing other deep learning adversarial architectures as a base would also be interesting.