Robustness Evaluation of Text Classification Models Using Mathematical Optimization and Its Application to Adversarial Training (2022)

Abstract: Neural networks are known to be vulnerable to adversarial examples due to slightly perturbed input data. In practical applications of neural network models, the robustness of the models against perturbations must be evaluated. However, no method can strictly evaluate their robustness in natural language domains. We therefore propose a method that evaluates the robustness of text classification models using an integer linear programming (ILP) solver by an optimization problem that identifies a minimum synonym swap that changes the classification result. Our method allows us to compare the robustness of various models in realistic time. It can also be used for obtaining adversarial examples. Because of the minimal impact on the altered sentences, adversarial examples with our method obtained high scores in human evaluations of grammatical correctness and semantic similarity for an IMDb dataset. In addition, we implemented adversarial training with the IMDb and SST2 datasets and found that our adversarial training method makes the model robust.

## introduction over the last decade, neural network (nn) models have been widely applied in such fields as computer vision and natural language processing (nlp). however, recently they have been shown to be vulnerable to small and imperceptible perturbations included in the original input data @xcite . these altered input data called adversarial examples are correctly classified by humans but can fool a target model, raising serious security and reliability concerns. an nn model is defined as being robust when the model's prediction does not change with the addition of all the perturbations in a certain range. the process of checking whether the model is robust is called verification @xcite . in computer vision, methods have formulated the verification problem as constraint satisfaction and verified it by solving it using an integer linear programming (ilp) solver @xcite or a boolean satisfiability problem (sat) solver @xcite . interest has also been growing in investigating the adversarial robustness of nlp models, including new methods for generating adversarial examples @xcite @xcite @xcite @xcite . on the other hand, as long as models are evaluated only by heuristic attacks, we cannot guarantee a model's robustness. to tackle this dilemma, we formulated a problem for finding the minimum number of word swaps that change a model's predictions and solving it with an ilp solver. using this verification method, we can strictly compare multiple adversarial training methods . in our experiments, we trained an nn model composed of an affine transformation and a piecewise-linear function, such as the relu function for the internet movie database (imdb) dataset @xcite and the stanford sentiment treebank v2 (sst2) dataset @xcite . then we verified the models with an ilp solver in a few seconds per text. human participants also manually evaluated whether the adversarial examples generated by the existing and proposed methods were grammatically correct and semantically unchanged from the original sentences. the adversarial examples created by the proposed method had higher scores than those created by the existing method. in addition, we conducted an experiment on adversarial training. adversarial training, which augments training data with adversarial examples in each training loop very effectively make deep learning models more robust against adversarial examples @xcite . in our experiments, our proposed method achieved robust model training. ## related work some methods can accurately verify a model's robustness for perturbations within a certain range @xcite in computer vision. mipverify @xcite uses an ilp solver that can be applied to piecewise-linear neural network models by assigning binary variables to each nonlinear function. another method verifies the parameters of nn models and input images with a binary neural network using the sat solver @xcite . unfortunately, there was no method can strictly evaluate the robustness of the models in the nlp domain. although pixel noise has been defined as an adversarial perturbation for images, it is difficult to define noise for text due to its discrete nature. textfooler @xcite generates an adversarial example of natural language by replacing some of the words in a text with synonyms. however, its heuristic search is approximate, and performs more word swaps than necessary. our method, which obtains exact minimum word swaps, allows us to evaluate the robustness of a model. ## method given text sequence @xmath0, • • • , x t ), b i denotes the candidates of the swapping word of x i . we define b ij as an indicator function. b @xmath1, and no word swaps occur when b @xmath2. let v ij denote a word-embedding vector corresponding to b ij . then the minimum adversarial swapping problem is described as follows: ## metrics accuracy under attack accuracy under attack (aua) is the rate of the fraction of the test set that satisfies the following equation: ## human evaluation we conducted human evaluation of the generated adversarial examples from the text classification model trained with the imdb dataset. a total of nine native speakers in their 20s to 40s living in the u.s. and the u.k. were asked to evaluate the examples using the evaluation metrics "grammatical movie review (positive (pos) ↔ negative (neg)) original (label: pos) it's a charming and often affecting journey. attack with textfooler (label: neg) it's a ravishing and normally impacts trip. attack with ours (label: neg) it's a ravishing and normally influenced journey. original (label: neg) an occasionally funny but overall limp fish-out-of-water story. attack with textfooler (label: pos) an intermittently funny but general limp fish-out-of-water history. attack with ours (label: pos) an occasionally hilarious but overall limp fish-out-of-water story. figure 3 shows the relationships between human evaluation scores and the average swaps of the adversarial examples for the baseline model. the horizontal axis is the number of synonym swaps and the vertical axis is the average score. we see that the fewer the number of synonym swaps, the higher the scores for both textfooler and the proposed method. this result supports the validity of the proposed method which aim to find the minimum number of synonym swaps. ## conclusion the proposed method always obtains a minimum synonym swapping, which makes it possible to compare and evaluate the robustness of text classification models. in addition, we conducted human evaluation and supported the effectiveness of our approach. we also performed the adversarial training and found that it makes the models more robust.