T ext A ttack: A Framework for Adversarial Attacks, Data Augmentation, and Adversarial Training in NLP (2020)

Abstract: While there has been substantial research using adversarial attacks to analyze NLP models, each attack is implemented in its own code repository. It remains challenging to develop NLP attacks and utilize them to improve model performance. This paper introduces TextAttack, a Python framework for adversarial attacks, data augmentation, and adversarial training in NLP. TextAttack builds attacks from four components: a goal function, a set of constraints, a transformation, and a search method. TextAttack’s modular design enables researchers to easily construct attacks from combinations of novel and existing components. TextAttack provides implementations of 16 adversarial attacks from the literature and supports a variety of models and datasets, including BERT and other transformers, and all GLUE tasks. TextAttack also includes data augmentation and adversarial training modules for using components of adversarial attacks to improve model accuracy and robustness. TextAttack is democratizing NLP: anyone can try data augmentation and adversarial training on any model or dataset, with just a few lines of code. Code and tutorials are available at https://github.com/QData/TextAttack .

## introduction over the last few years, there has been growing interest in investigating the adversarial robustness of nlp models, including new methods for generating adversarial examples and better approaches to defending against these adversaries @xcite @xcite @xcite @xcite @xcite . it is difficult to compare these attacks directly and fairly, since they are often evaluated on different data samples and victim models. reswapping out "perfect" with synonym "spotless" completely changes the model's prediction, even though the underlying meaning of the text has not changed. to encourage the development of the adversarial robustness field, we introduce textattack, a python framework for adversarial attacks, data augmentation, and adversarial training in nlp. to unify adversarial attack methods into one system, we decompose nlp attacks into four components: a goal function, a set of constraints, a transformation, and a search method. the attack attempts to perturb an input text such that the model output fulfills the goal function (i.e., indicating whether the attack is successful) and the perturbation adheres to the set of constraints (e.g., grammar constraint, semantic similarity constraint). a search method is used to find a sequence of transformations that produce a successful adversarial example. this modular design enables us to easily assemble attacks from the literature while reusing components that are shared across attacks. textattack provides clean, readable implementations of 16 adversarial attacks from the literature. for the first time, these attacks can be benchmarked, compared, and analyzed in a standardized setting. de e i g a ack c ea i g ne a ac da a a g e a i be ch a i g a ac ad e a ia t ai i g crea e ne a ack a a combina ion of no el and pre-e i ing componen te a ack's 82+ p e ai ed m de e al a e ne a ack again andardi ed model e al a e a ack from li era re again andardi ed model u e a ack recipe in ead of reimplemen ing a ack m d e reimplemen a ion of a ack from li era re co er 16 paper goal f nc ion con rain tran forma ion search me hod genera e ad er arial e ample ad er arial e ample u e m de repea in raining loop train train textattack training pipeline u i i i g a ack a ack reci e fo componen of nlp a ack a g e e m d e genera e ne ample u e m de ne da a sample textfooler can be modified to attack a translation model with the goal of changing every word in the output. textattack is directly integrated with hug-gingface's transformers and nlp libraries. this allows users to test attacks on models and datasets. textattack provides dozens of pre-trained models (lstm, cnn, and various transformerbased models) on a variety of popular datasets. currently textattack supports a multitude of tasks including summarization, machine translation, and all nine tasks from the glue benchmark. textattack also allows users to provide their own models and datasets. ultimately, the goal of studying adversarial attacks is to improve model performance and robustness. to that end, textattack provides easyto-use tools for data augmentation and adversarial training. textattack's augmenter class uses a transformation and a set of constraints to produce new samples for data augmentation. attack recipes are re-used in a training loop that allows models to train on adversarial examples. these tools make it easier to train accurate and robust models. uses for textattack include 1 : ## the textattack framework textattack aims to implement attacks which, given an nlp model, find a perturbation of an input sequence that satisfies the attack's goal and adheres to certain linguistic constraints. in this way, attacking an nlp model can be framed as a combinatorial search problem. the attacker must search within all potential transformations to find a sequence of transformations that generate a successful adversarial example. each attack can be constructed from four components: examples: untargeted classification, targeted classification, non-overlapping output, minimum bleu score. examples: maximum word embedding distance, part-of-speech consistency, grammar checker, minimum sentence encoding cosine similarity. 3. a transformation that, given an input, generates a set of potential perturbations. examples: word embedding word swap, thesaurus word swap, homoglyph character substitution. 4. a search method that successively queries the model and selects promising perturbations from a set of transformations. examples: greedy with word importance ranking, beam search, genetic algorithm. see a.2 for a full explanation of each goal function, constraint, transformation, and search method that's built-in to textattack. ## developing nlp attacks with textattack textattack is available as a python package installed from pypi, or via direct download from github. textattack is also available for use through our demo web app, displayed in figure 3 . python users can test attacks by creating and manipulating attack objects. the command-line api offers textattack attack, which allows users to specify attacks from their four components or from a single attack recipe and test them on different models and datasets. textattack supports several different output formats for attack results: ## textattack under the hood textattack is optimized under-the-hood to make implementing and running adversarial attacks simple and fast. attackedtext. a common problem with implementations of nlp attacks is that the original text is discarded after tokenization; thus, the transformation is performed on the tokenized version of the text. this causes issues with capitalization and word segmentation. sometimes attacks swap a piece of a word for a complete word (for example, transforming ''aren't" into ''aren'too"). to solve this problem, textattack stores each input as a attackedtext object which contains the original text and helper methods for transforming the text while retaining tokenization. ## related work we draw inspiration from the transformers library @xcite as an example of a well-designed natural language processing library. some of textattack's models and tokenizers are implemented using transformers. there are some existing open-source libraries related to adversarial examples in nlp. trickster proposes a method for attacking nlp models based on graph search, but lacks the ability to ensure that generated examples satisfy a given constraint @xcite . teapot is a library for evaluating adversarial perturbations on text, but only supports the application of ngram-based comparisons for evaluating attacks on machine translation models @xcite . most recently, allennlp interpret includes functionality for running adversarial attacks on nlp models, but is intended only for the purpose of interpretability, and only supports attacks via input-reduction or greedy gradient-based word swap @xcite . textattack has a broader scope than any of these libraries: it is designed to be extendable to any nlp attack. ## conclusion we presented textattack, an open-source framework for testing the robustness of nlp models. textattack defines an attack in four modules: a goal function, a list of constraints, a transformation, and a search method. this allows us to compose attacks from previous work from these modules and compare them in a shared environment. these attacks can be reused for data augmentation and adversarial training. as new attacks are developed, we will add their components to textattack. we hope textattack helps lower the barrier to entry for research into robustness and data augmentation in nlp. 3