Text Adversarial Purification as Defense against Adversarial Attacks (2023)

Abstract: Adversarial purification is a successful defense mechanism against adversarial attacks without requiring knowledge of the form of the incoming attack. Generally, adversarial purification aims to remove the adversarial perturbations therefore can make correct predictions based on the recovered clean samples. Despite the success of adversarial purification in the computer vision field that incorporates generative models such as energy-based models and diffusion models,using purification as a defense strategy against textual adversarial attacks is rarely explored. In this work, we introduce a novel adversarial purification method that focuses on defending against textual adversarial attacks. With the help of language models, we can inject noise by masking input texts and reconstructing the masked texts based on the masked language models. In this way, we construct an adversarial purification process for textual models against the most widely used word-substitution adversarial attacks. We test our proposed adversarial purification method on several strong adversarial attack methods including Textfooler and BERT-Attack and experimental results indicate that the purification algorithm can successfully defend against strong word-substitution attacks.

## introduction adversarial examples @xcite can successfully mislead strong neural models in both computer vision tasks @xcite and language understanding tasks @xcite . an adversarial example is a maliciously crafted example attached with an imperceptible perturbation and can mislead neural networks. to defend attack examples of images, the most effective method is adversarial training @xcite which is a mini-max game used to incorporate perturbations into the training process. defending adversarial attacks is extremely important in improving model robustness. however, defending adversarial examples in natural languages is more challenging due to the discrete nature of texts. that is, gradients cannot be used directly in crafting perturbations. the substitutionbased adversarial examples are more complicated than gradient-based adversarial examples in images, making it difficult for neural networks to defend against these substitution-based attacks. the first challenge of defending against adversarial attacks in nlp is that due to the discrete nature, these substitution-based adversarial examples can have substitutes in any token of the sentence and each substitute has a large candidate list. this would cause a combinatorial explosion problem, making it hard to apply adversarial training methods. strong attacking methods such as @xcite show that using the crafted adversarial examples as data augmentation in adversarial training cannot effectively defend against these substitutionbased attacks. further, defending strategies such as adversarial training rely on the assumption that the candidate lists of the substitutions are accessible. however, the candidate lists of the substitutions should not be exposed to the target model; that is, the target model should be unfamiliar to the candidate list of the adversarial examples. in real-world defense systems, the defender is not aware of the strategy the potential attacks might use, so the assumption that the candidate list is available would significantly constrain the potential applications of these defending methods. considering that it is challenging to defend against textual adversarial attacks when the form of the attacks cannot be acknowledged in advance, we introduce a novel adversarial purification method as a feasible defense mechanism against these attacks. the adversarial purification method is to purify adversarially perturbed input samples before making predictions @xcite @xcite . the major works about adversarial purification focus on purifying continuous inputs such as images, therefore these works explore different generative models such as gans @xcite , energy-based models (ebms) @xcite and recently developed diffusion models @xcite . however, in textual adversarial attacks, the inputs are discrete tokens which makes it more challenging to deploy previous adversarial purification methods. therefore, we introduce a purification mechanism with the help of masked language models. we first consider the widely used masking process to inject noise into the input; then we recover the clean texts from the noisy inputs with the help of the masked language models (e.g. a bert @xcite ). further, considering that the iterative process in previous adversarial purification algorithms can be extremely costly (e.g. a vp-sde process in diffusion models @xcite )), we instead simplify the iterative process to an ensemble-purifying process that conducting adversarial purification multiple times to obtain an ensembled result as a compromise to the time cost in traditional adversarial purification process. through extensive experiments, we prove that the proposed text adversarial purification algorithm can successfully serve as defense against strong attacks such as textfooler and bert-attack. experiment results show that the accuracy under attack in baseline defense methods is lower than random guesses, while after text purification, the performance can reach only a few percent lower than the original accuracy when the candidate range of the attack is limited. further, extensive results indicate that the candidate range of the attacker score is essential for successful attacks, which is a key factor in maintaining the semantics of the adversaries. therefore we also recommend that future attacking methods can focus on achieving successful attacks with tighter constraints. to summarize our contributions: ## conclusion and future work in this paper, we introduce a textual adversarial purification algorithm as a defense against substitution-based adversarial attacks. we utilize the mask-infill ability of pre-trained models to recover noisy texts and use these purified texts to make predictions. experiments show that the purification method is effective in defending strong adversarial attacks without acknowledging the substitution range of the attacks. we are the first to consider the adversarial purification method with a multiple-recovering strategy in the text domain while previous successes of adversarial purification strategies usually focus on the image field. therefore, we hope that the adversarial purification method can be further explored in nlp applications as a powerful defense strategy.