[ MASK ] Insertion: a robust method for anti-adversarial attacks (2023)

Abstract: Adversarial attack aims to perturb input sequences and mislead a trained model for false predictions. To enhance the model robustness, defensing methods are accordingly employed by either data augmentation (involving adversarial samples) or model enhancement (modifying the training loss and/or model architecture). In contrast to previous work, this paper revisits the masked language modeling (MLM) and presents a simple yet efficient algorithm against adversarial attacks, termed [MASK] insertion for defensing (MI4D). Specifically, MI4D simply inserts [MASK] tokens to input sequences during training and inference, maximizing the intersection of the new convex hull (MI4D creates) with the original one (the clean input forms). As neither additional adversarial samples nor the model modification is required, MI4D is as computationally efficient as traditional fine-tuning. Comprehensive experiments have been conducted using three benchmark datasets and four attacking methods. MI4D yields a significant improvement (on average) of the accuracy between 3.2 and 11.1 absolute points when compared with six state-of-the-art defensing baselines.

## introduction pretrained language models (plms) have rapidly advanced the performance of the natural language processing (nlp) tasks, such as text/document classification. yet, abundant evidences also indicate that plms are vulnerable to adversarial attacks, and the model performance can be dramatically impacted by (even) small perturbations to the model input @xcite @xcite . as a result, adversarial defenses have received significant attention, with the ultimate goal of achieving the robust model accuracy on both the clean (original) and polluted (adversarial) inputs. a large amount of research effort has been dedicated to adversarial defenses, ranging from the data augmentation, the model enhancement, to the randomized smoothing. among data augmentation studies, recent works introduce small but controllable perturbations to pollute clean data and produce adversarial samples @xcite @xcite @xcite , while the model is later trained on both the clean and polluted inputs. however, due to the additional adversarial samples, dataaugmentation methods suffer from the requirement of enormous computational resources for training. additionally, model-enhancement approaches focus on polishing the vanilla model via manipulating the training loss or network architecture, without acquiring additional adversarial data @xcite @xcite . yet, those methods often require extensive search among numerous candidates to determine optimal hyperparameters. another line of work is to apply ensemble-based randomized smoothing techniques @xcite . unfortunately, they induce substantial overhead due to the ensemble classification; more importantly, their performance are unstable to different types of attacks @xcite . our aim is then to explore a robust adversarial defensing algorithm, which neither relies on additional adversarial data (as data augmentation), nor adjusts the training loss and network architecture (as model enhancement), nor requests ensemblebased training (as randomized smoothing). by contrast, this paper revisits the masked language modeling (mlm) and further proposes a compact and performance-preserving algorithm, termed @xcite insertion for defensing (mi4d). specifically, mi4d only requires to insert [mask] tokens at the beginning of input sequences to produce masked inputs. during training, (only) masked inputs are employed for the model fine-tuning, while later polluted samples are masked in the same manner for inference. in contrast to the traditional mlm, the prediction task of @xcite tokens is less emphasized in the proposed mi4d. yet, the injected [mask] plays a role of maximizing the intersection between the convex hull after attacking and that of the original (clean) input, thereby enhancing the defensing performance. the main contributions of the proposed work are summarized as follows: ## related work constructing misleading samples to fool the trained neural-network models, adversarial attacks in the text domain can be mainly classified into two categories of the character-and word-level perturbation. the work of @xcite belongs to the character-level attack, from which the input is polluted by removing, substituting or inserting letters. on the other hand, word-based attacks usually involve the step of determining word importance, and replacing with their synonyms to maximize the prediction error of the model @xcite . adversarial defense, by contrast, aims to form a robust model with high accuracy on both clean (original) and polluted (adversarial) samples. one of the most effective approaches is through the data augmentation (as shown in fig. 1(a) ), where adversarial samples are produced and fed into the model training. specifically, a2t (yoo and qi, 2021) generates adversarial samples via employing a gradient-based method to identify important words, and iteratively substitutes with their synonyms using a distilbert similarity. freelb (and its variants) @xcite imposes norm-bounded noises on embeddings of input sentences to produce adversarial samples. adfar @xcite applies a frequencyaware randomization on both original and adversarial samples (by other attacking methods) to form a randomized adversarial set. this augmentation set is then combined with original and adversarial samples to train the model. more recently, in @xcite , adcl generates adversarial examples using a geometry attack, which are later utilized as hard positive samples to train the model following a self-supervised contrastive learning. @xcite as a sample reweighting method, in which the sample weight is adjusted by minimizing the loss from the validation set mixed of both original and adversarial examples. besides the data augmentation, another line of studies is proposed for the model enhancement to refine the model architecture and/or training loss, without acquiring additional adversarial samples (as shown in fig. 1(b) ). among them, shield @xcite modifies the last layer of an trained model and transforms it into an ensemble of multiple-expert predictors with stochastic weights. flooding-x @xcite introduces a regularization technique to prevent the overfitting of training samples. wang et al. @xcite propose infobert to employ two mutual-information-based regularizers for suppressing noisy information between the input and the latent representation, and for increasing the correlation between local and global features. a similar work is found in @xcite , where an information bottleneck layer (ib) is inserted between the encoder and the final classifier. this ib layer is utilized to extract robust and task-related features. additionally, a set of ensemble-based randomized smoothing methods have been proposed, shown in fig. 1(c ). safer @xcite , for instance, constructs stochastic input ensembles and leverages statistical properties of ensembles to classify testing samples. in ranmask @xcite , few input tokens are randomly substituted using [mask] for fine-tuning, while testing samples are also masked (at different locations) to form several masked versions. the final prediction is then made by a majority vote from the ensemble of these masked versions. the proposed method is different from existing approaches: (1) compared to adversarial based augmentation, no additional samples are required, and significant computational overhead is avoid accordingly; (2) compared to the model-enhancement ones, the proposed method is hyperparameter insensitive, which maintains the vanilla model training (loss and architecture) but only changes input formats; (3) compared to randomized smoothing, the ensemble based inference is no longer required. ## proposed method adversarial attack in text domain perturbs input sequences to maximally mislead the classification model, while this section presents a simple yet effective algorithm to reduce the model vulnerability, termed [mask] insertion for defensing (mi4d). ## conclusion we propose a novel adversarial defensing algorithm (mi4d), that is hyperparameter insensitive and structure free. the proposed method simply inserts [mask] tokens at the beginning of input sequences, and follows the normal fine-tuning to train the model. theoretically speaking, we have argued that adding additional [mask], while remaining other residual tokens, creates a large convex hull overlapping with that of the clean one to increase the defensing probability. empirically, in comparison to existing state-of-the-arts, the proposed algorithm exhibits superior performance on three benchmark datasets with four attack methods. in future work, we could combine with external knowledge for more strategical masking. more importantly, mi4d is agnostic to downstream tasks, i.e., we could incorporate it into other applications.