Generative Adversarial Training with Perturbed Token Detection for Model Robustness (2023)

Abstract: Adversarial training is the dominant strategy towards model robustness. Current adversarial training methods typically apply perturbations to embedding representations, whereas actual text-based attacks introduce perturbations as discrete tokens. Thus there exists a gap between the continuous embedding representations and discrete text tokens that hampers the effectiveness of adversarial training. Moreover, the continuous representations of perturbations cannot be further utilized, resulting in the suboptimal performance. To bridge this gap for adversarial robustness, in this paper, we devise a novel generative adversarial training framework that integrates gradient-based learning, adversarial example generation and perturbed token detection. Our proposed framework consists of generative adversarial attack and adversarial training process. Specifically, in generative adversarial attack, the embeddings are shared between the classifier and the generative model, which enables the generative model to leverage the gradients from the classifier for generating perturbed tokens. Then, adversarial training process combines adversarial regularization with perturbed token detection to provide token-level supervision and improve the efficiency of sample utilization. Extensive experiments on five datasets from the AdvGLUE benchmark demonstrate that our framework significantly enhances the model robustness, surpassing the state-of-the-art results of ChatGPT by 10% in average accuracy.

## introduction pre-trained language models (plms) and large language models (llms) @xcite have made remarkable advancements in natural language processing (nlp). given their increasing impact on science, society and individuals, adversarial robustness has become a crucial task for building trustworthy nlp systems @xcite . the adversarial vulnerability of deep learning models is a long-standing problem @xcite . various attack methods have demonstrated that even llms can be deceived with small, intentionally crafted perturbations (e.g., typos and synonym substitution) @xcite @xcite @xcite . in response to adversarial attacks, many adversarial defense methods have been proposed to enhance model robustness. among them, adversarial training @xcite @xcite @xcite is widely recognized as the most effective approach, which involves continuous perturbations. in adversarial training, the gradient-based perturbations are introduced at the embedding layer while solving a min-max problem. another form of adversarial training is adversarial augmentation @xcite @xcite @xcite , which utilizes discrete perturbations. in adversarial augmentation, the search for adversarial examples is treated as a combinatorial optimization problem and the model is trained using the augmented adversarial examples. however, existing adversarial training methods have encountered non-trivial challenges in realworld applications. in adversarial training, the perturbations applied at the embedding layer create a gap between the continuous perturbations used during training and the discrete perturbations that real attack applies in the testing phase @xcite . on the other hand, adversarial augmentation demands high computational cost, typically with hundreds to thousands of queries per example @xcite . consequently, the continuous representations of perturbations cannot be further utilized in adversarial training, leading to the suboptimal performance. in this work, we aim to address the afore-mentioned issues and make a substantial step towards adversarial robustness. we propose a novel generative adversarial training (generat) framework that consists of generative adversarial attack and adversarial training process. to bridge the gap between continuous perturbations and discrete text tokens, generative adversarial attack generates discrete perturbed tokens based on gradients. specifically, our gradient-based attack calculates adversarial gradients with the classifier through forward and backward propagations, which is more efficient than search-based adversarial augmentation. the accumulated gradients are then shared at the embedding layer between the classifier and the generative model, so that they can be leveraged to guide the perturbed token generation. besides, to get more robust representations, our generative adversarial attack is built upon the discriminative plm @xcite , which is capable of distinguishing subtle semantic differences between similar words compared to other plms like bert that most defense methods concentrate on. adversarial training process utilizes adversarial regularization to further improve robustness, by restricting the representations between the original and corresponding adversarial examples. as the generated perturbed tokens can provide finegrained token-level supervision, adversarial regularization is integrated with perturbed token detection in the training process to improve sample usage efficiency. we conduct robustness experiments on the challenging advglue benchmark @xcite , which applies multiple types of adversarial attacks on five datasets from glue @xcite . extensive experiments show that our framework significantly improves adversarial robustness on all the datasets, surpassing chatgpt @xcite ) by 10% in average accuracy and establishing new state-of-the-art results. the main contributions are as follows: based on discriminative plm, our framework provides a comprehensive means to integrate gradient-based learning, adversarial example generation and perturbed token detection. ## proposed method adversarial training typically applies perturbations to embedding representations, whereas real-world adversarial examples introduce perturbations at discrete text tokens. to bridge the gap between continuous embeddings and discrete tokens, we propose a novel generative adversarial training framework generat that consists of generative adversarial attack and adversarial training process. we present the overall design of our framework as well as each component in this section. ## experiments to evaluate the effectiveness of our framework, we compare generat with the sota methods on five tasks. we also conduct additional experiments on model parameter analysis and provide a case study. ## conclusion this paper presents a novel generative adversarial training framework to bridge the gap between embedding representations and discrete text tokens in existing adversarial training methods. our proposed framework integrates gradient-based learning, adversarial example generation, and perturbed token detection for improving adversarial robustness. the generative adversarial attack shares the embeddings between the classifier and the generative model, which allows the generative model to utilize gradients from the classifier for generating perturbed tokens. then the adversarial training process incorporates perturbed token detection into adversarial regularization, which provides tokenlevel supervision and enhances sample usage efficiency. extensive experiments on five datasets in advglue benchmark demonstrate that our framework significantly boosts the model robustness.