V ote TRANS : Detecting Adversarial Text without Training by Voting on Hard Labels of Transformations (2023)

Abstract: Adversarial attacks reveal serious flaws in deep learning models. More dangerously, these attacks preserve the original meaning and escape human recognition. Existing methods for detecting these attacks need to be trained using original/adversarial data. In this paper, we propose detection without training by voting on hard labels from predictions of transformations, namely, VoteTRANS. Specifically, VoteTRANS detects adversarial text by comparing the hard labels of input text and its transformation. The evaluation demonstrates that VoteTRANS effectively detects adversarial text across various state-of-the-art attacks, models, and datasets.

## introduction deep learning models are sensitive to changes in input text from an adversarial attack. even a slight change enormously impacts the prediction of models. more dangerously, these changes still preserve the input meaning, so attacks remain unrecognized by humans. this vulnerability has negatively affected the reputation of deep learning models. in contrast to adversarial text defense, fewer works have been proposed to detect adversarial texts. previous works detected such texts via perturbed word identification @xcite , synonyms @xcite , density @xcite , attention @xcite , pca (raina and gales, 2022), transformer @xcite , and word importance @xcite . since existing works need original/adversarial data to train detectors, they are sensitive to new adversarial attacks. motivation: adversarial text must satisfy two criteria: the text must (1) change the prediction of a target model while (2) preserving the original meaning. few texts can comply with both criteria. for example, we randomly selected original text from ag news and used a probability-weighted word saliency (pwws) attack @xcite to generate adversarial text (figure 1 ). pwws replaces original words to fool a target model @xcite . during this generation process, only the final text fooled the target cnn, while other texts were still correctly predicted by the target cnn and another model, such as roberta. we find the same trend for other ag news texts and imdb movie reviews as shown in appendix a. contributions: we propose a simple detector by voting on hard labels of transformations (votetrans). in particular, we generate a transformation set for each word in the input text. we then compare the original hard label from the input text and the majority vote from each transformation set. if we find any difference in the comparison, the adversarial text is identified. in summary, our contributions are listed as follows: votetrans can thus be applied to a wide range of various models. votetrans is also automatically compatible with future attacks from this framework without changing its source code foot_0 . cnn roberta original: …a project to test wireless public transport… sci/tech sci/tech run sci/tech sci/tech tryout wireless sci/tech sci/tech tuner sci/tech sci/tech radio sci/tech sci/tech adversarial: …a project to tryout radiocommunication public transport… business sci/tech figure 1: a process generates adversarial text by synonym-based transformation targeting a cnn model. during this process, only the final adversarial text fools the cnn, while other texts are still correctly predicted by the cnn and roberta. ## voting on the hard labels of transformations (votetrans) problem statement: we follow notations from textfooler paper @xcite . given n texts, @xmath0, x 2 , . . . , x n } corresponding to given input text, we replace each word (e.g., "project" and "radiocommunication") with the corresponding transformation set. the modified text is then predicted by a target and support models as hard labels. these labels are voted and compared with the original label to determine whether the input text is adversarial or original. n labels @xmath1, y 2 , . . . , y n }, a target model f : @xmath2. adversarial text x adv generated from input @xmath3: our objective is to determine whether input text x is adversarial or original text. the process of votetrans is depicted in figure 2 , and the overall algorithm is summarized in algorithm 1. model detail: to process input text x, we use a target model f and an auxiliary attack a (e.g., pwws). an optional word ratio α can be used to speed up the detection process. moreover, a support model list f sup is used to improve the performance. the support models and the target model should solve the same task such as sentiment analysis. first, we create a list w including input words that are sorted by their importance using word importance score estimation in the auxiliary attack a (lines 2-5). for example, pwws calculates the change in the predictions before and after replacing a certain word with an unknown word to estimate word importance. the impact of word importance is shown in appendix b. second, we select the top words w * (line 6) with the word ratio threshold α (100% by default). since votetrans maintains the performance with α = 100%, it remarkably improves the run time with a smaller α, with a slight change in performance, as shown in figures 4a and 4b in the experimental results. third, we obtain a transformed set w trans for each word w j in w * (line 9) using word transfor-mation in a. for example, pwws uses synonyms from wordnet to form the transformed set. fourth, we replace each transformed word in w trans for the corresponding w j (line 11) in x and checks the second constraint in equation 1 (line 12). the sim(•) and ϵ are provided by a. this step is mainly used to preserve the original meaning of the input in the transformed text. for example, pwws uses stop word checking for this step. fifth, we construct y trans containing the label predictions for the valid x ′ from target model f and support model list f sup (lines 13-16). we then use the majority vote on y trans to obtain the top majority classes y ′ with the highest occurrence in y trans . finally, we check whether the input text x is adversarial or original based on the input label y and majority set y ′ . if y does not belong to y ′ or y belongs to y ′ , which contains more than one majority class, we decide that x is adversarial text (lines 20-22). if we cannot decide if x is adversarial text after checking all words in w * , x is considered original text. ## conclusion we propose votetrans, a method for detecting adversarial text without training by voting on hard labels of text after transformation. votetrans outperforms state-of-the-art detectors under various attacks, models, and datasets. moreover, votetrans is flexible at detecting a restricted scenario when an attack is unknown. votetrans also straightforwardly detects adversarial text from a new attack without modifying the architecture.