Enhancing Neural Models with Vulnerability via Adversarial Attack (2020)

Abstract: Natural Language Sentence Matching (NLSM) serves as the core of many natural language processing tasks. 1) Most previous work develops a single specific neural model for NLSM tasks. 2) There is no previous work considering adversarial attack to improve the performance of NLSM tasks. 3) Adversarial attack is usually used to generate adversarial samples that can fool neural models. In this paper, we first find a phenomenon that different categories of samples have different vulnerabilities. Vulnerability is the difficulty degree in changing the label of a sample. Considering the phenomenon, we propose a general two-stage training framework to enhance neural models with Vulnerability via Adversarial Attack (VAA). We design criteria to measure the vulnerability which is obtained by adversarial attack. VAA framework can be adapted to various neural models by incorporating the vulnerability. In addition, we prove a theorem and four corollaries to explain the factors influencing vulnerability effectiveness. Experimental results show that VAA significantly improves the performance of neural models on NLSM datasets. The results are also consistent with the theorem and corollaries. The code is released on https://github.com/rzhangpku/VAA .

## introduction natural language sentence matching (nlsm) aims to compare two sentences and identify the relationship between them @xcite . nlsm serves as the core of many natural language processing tasks, such as question answering and information retrieval @xcite . 1) most previous work develops a single specific neural model for nlsm tasks. we propose a general framework that can enhance various neural models proposed by previous work. 2) there is no previous work considering adversarial attack to improve the performance of nlsm tasks. this paper is the first to take advantage of adversarial attack to improve the performance of nlsm tasks. 3) adversarial attack is usually used to generate adversarial samples that can fool neural models. in contrast, we take advantage of adversarial attack to enhance neural models. we introduce a concept vulnerability, the difficulty degree in changing the label of a sample. inspired by the finding that adversarial samples are more vulnerable than normal ones @xcite , we first find a phenomenon that different categories of samples have different vulnerabilities. that is, it is easy to change the labels of samples belonging to some categories, whereas it is difficult for others. here we take quora question pairs (qqp) dataset as an example. if we want a paraphrase pair to be non-paraphrase, changing one word is sufficient. for example, simply adding "not" or "hardly" can completely change the meaning of a sentence. however, it is difficult to make two irrelevant sentences have the same meaning. different categories of samples have different vulnerabilities. so the vulnerability can be considered as a feature, which can be used to predict the label of the sample. to the best of label sentence + s1: why are people supporting donald trump? s2: why do you think people are supporting trump? - s3 : what is the difference between the moto2 and the moto3 race? s4: who is ahead in the race to sell self-driving cars? this paper is the first to take advantage of adversarial attack to improve the performance of nlsm tasks. we adopt adversarial attack to implement the action of changing the label of a sample and measure the vulnerability of the sample. recent studies have shown that neural models will be fooled by adversarial samples @xcite @xcite . in the case of images, human-imperceptible modifications to the original inputs can mislead a neural model to provide incorrect predictions. in the case of texts, we can simply replace, delete, or add some words to change the output of a model. such modification methods are referred to as adversarial attacks. adversarial attack is usually used to generate adversarial samples to fool neural models. in contrast, we take advantage of adversarial attack to enhance neural models. considering the analysis above, we propose a general two-stage training framework to enhance neural models with vulnerability via adversarial attack (vaa). in stage one, we pre-train a model a, which can choose any neural model proposed by previous work. in stage two, we obtain the vulnerability of input sample via adversarial attack using model a, and we train a new model b by combining the original sample and its vulnerability as inputs. experiments demonstrate that vaa is an effective framework that can be adapted to neural models, improving their performance on nlsm datasets. our main contributions are threefold: ## vulnerability and vaa framework in our notation, we have two input sentences a and b in an nlsm task. a sample @xmath0, b) is a pair of two sentences a and b. there are n labels, and y @xmath1, . . . , n} is the true label of sample x. @xmath2, a 2 , . . . , a ℓa } and @xmath3, b 2 , . . . , b ℓ b } are the embeddings of sentences a and b, respectively. a i or b @xmath4, which can be initialized with some pretrained word embeddings. the goal of the nlsm task is to predict label y @xmath5, . . . , n} that indicates the relationship between a and b. ## conclusion in this paper, we first found a phenomenon that different categories of samples have different vulnerabilities. besides, we defined criteria to measure the vulnerability of a sample. we proposed a general two-stage training framework called vaa to incorporate the vulnerability. vaa can significantly enhance the performance of neural models on nlsm datasets. furthermore, we closely examined the factors that influence vulnerability effectiveness theoretically and experimentally. in future work, there remains scope to improve vaa further. first, the vulnerability is currently obtained via adversarial attack. there may be some other methods that can better capture the vulnerability, e.g., integrating external knowledge vulnerability between phrase pairs. second, vaa works by encoding the vulnerability into the inputs. we should explore some other methods to incorporate the vulnerability.