Resilience of Named Entity Recognition Models under Adversarial Attack (2022)

Abstract: Named entity recognition (NER) is a popular language processing task with wide applications. Progress in NER has been noteworthy, as evidenced by the F1 scores obtained on standard datasets. In practice, however, the end-user uses an NER model on their dataset out-of-the-box, on text that may not be pristine. In this paper we present four model-agnostic adversarial attacks to gauge the resilience of NER models in such scenarios. Our experiments on four state-of-the-art NER methods with five English datasets suggest that the NER models are over-reliant on case information and do not utilise contextual information well. As such, they are highly susceptible to adversarial attacks based on these features.

## introduction named entity recognition (ner) is a popular language processing task that involves identifying and classifying named entities in text @xcite . progress in ner has been rapid and noteworthy, especially in the current age of deep learning @xcite . the general impetus in deep learning-based ner has been to develop models that incorporate context better @xcite @xcite and are resilient to noise such as inconsistencies in case information @xcite @xcite . there has, however, been modest focus on determining the extent to which state-of-the-art ner models succeed in doing so. identifying the weaknesses of ner models can help drive focused work to ameliorate them and move ner beyond marginal improvements in f1 scores @xcite . adversarial attacks designed for nlp models largely focus on classification tasks @xcite @xcite @xcite . many existing studies work with vector representations @xcite , which are not intuitively interpretable by humans. such methods require white-box access to the models @xcite . the additional requirement of human intervention to adjudge the quality of adversarial samples generated may also be involved @xcite . adversarial ner has broadly seen two types of approaches: (a) adversarial training, and (b) adversarial evaluation. adversarial training of ner models involves introducing small perturbations in the training data to make models robust @xcite . such perturbations are introduced in the text representation level @xcite @xcite . the adversarial evaluation of ner models, on the other hand, involves benchmarking the models on synthetically generated data @xcite . we follow the latter line of investigation. we present four model-agnostic adversarial attacks targeted at ner models. our task-specific approach allows us to generate natural language adversaries that work with pre-trained models and are easily interpretable by humans. in principle, our work is similar to the label-preserving substitutions explored by @xcite and the wordsubstitution methods explored by @xcite , although they do not evaluate their methods on ner. generating adversarial data for evaluating ner models is explored by @xcite using bert to replace and/or add non-named entity tokens to text. lin et al. (2021) also use pre-trained bert to generate contextlevel adversarial attacks to evaluate ner models. in contrast to their work, we use simple rulebased methods for generating adversarial data. our method has the advantage of not requiring retraining or fine-tuning of pre-trained models. the datasets and models we use are all openly available, aiding reproducibility. foot_0 further, our ex- @xcite , for this study. ## methods we use four named entity recognizers for our experiments, all of which are open-source. of these, spacy is the current state-of-the-art in terms of document processing speed @xcite and flair is near the current state-of-the-art. 2 flair ner the flair named entity recognizer is based on neural character embeddings. it uses contextual neural string embeddings that are obtained by pre-training on large, unlabelled corpora. every sentence is represented in the form of string embeddings which are then stacked with pre-computed uncased glove embeddings, before being passed through a bilstm-crf architecture that generates labels for each word @xcite . corenlp ner corenlp ner @xcite is based on linear chain conditional random field (crf) sequence models of arbitrary order @xcite . for our experiments, we use the caseless model that ignores capitalization as well as the truecase annotator that attempts to rectify incorrect casing, in addition to the default model. deeppavlov ner deeppavlov's named entity recognition model uses the english cased model of bert with 12 layers, 768 hidden nodes, 12 attention heads, and 110m parameters @xcite . the first sub-word representation of each word is passed through a dense layer to generate labels @xcite . ## evaluation we follow the conll-2003 shared task guidelines to report the f1 scores @xcite . compatible classes are clubbed with the closest enamex class (such as, gpe (geo-political entity) is clubbed with location for spacy, bert, and the gmb dataset). the class labels present in different datasets/produced by different models do not always have a close one-to-one correspondence to the class labels in other datasets/produced by other models. thus, non-enamex entities are considered to be non-entities to provide a fair comparison across datasets and models. ner models and datasets also differ in their tagging schemes. since it is not possible to map io tags to iob or iobes, and iob tags to iobes @xcite , we map all tags into the io scheme. the mapping of compatible entity classes and tagging schemes causes our evaluation results to differ from the officially reported scores of these ner models. ## 6 results and analysis ## discussion the adversarial evaluation of nlp models rely either on human-generated adversaries @xcite or automated adversary generation with human-in-the-loop @xcite . however, it is possible to do away with human intervention for generating adversarial samples for the task of ner, as we demonstrate. further, unlike existing work, our approach for adversarial evaluation does not require any re-training or finetuning of models for adversarial data creation. the generalizability of ner models can also be evaluated with the proposed approaches. in particular, context perturbation can be used as an alternative to studying the effect of named entities that have not been seen during training @xcite with the same label. ## conclusions in this paper, we present an adversarial evaluation of four popular named-entity recognizers on five english datasets. the four model-agnostic adversarial attacks we present do not require white-box access to pre-trained ner models. our experiments show that the popular ner models are overreliant on the case information and under-utilise the contextual information. since ner is a prerequisite for a large number of nlp tasks, further work for improvement in these directions is warranted.