Towards Adversarially Robust Text Classifiers by Learning to Reweight Clean Examples (2022)

Abstract: Most of the existing defense methods improve the adversarial robustness by making the models adapt to the training set augmented with some adversarial examples. However, the augmented adversarial examples may not be natural, which might distort the training distribution, resulting in inferior performance both in clean accuracy and adversarial robustness. In this study, we explore the feasibility of introducing a reweighting mechanism to calibrate the training distribution to obtain robust models. We propose to train text classifiers by a sample reweighting method in which the example weights are learned to minimize the loss of a validation set mixed with the clean examples and their adversarial ones in an online learning manner. Through extensive experiments, we show that there exists a reweighting mechanism to make the models more robust against adversarial attacks without the need to craft the adversarial examples for the entire training set.

## introduction even though deep neural networks have achieved impressive performance on many natural language processing (nlp) tasks, they are vulnerable to adversarial examples intentionally crafted under certain semantic and syntactic constraints @xcite @xcite @xcite . the existence and pervasiveness of adversarial examples raise serious concerns, especially when deploying such nlp models to security-sensitive applications. recently, many methods have been proposed to defend against adversarial attacks for neural nlp models @xcite @xcite @xcite @xcite . existing defense methods usually augment * equal contribution the clean training examples with the adversarial ones in one way or another in the training stage and fit the models on the augmented training set. however, the introduced adversarial examples may not be natural, which may even hurt the distribution of original training examples, resulting in lower performance on both clean and adversarial test sets. besides, these methods usually need to generate the adversarial examples for an entire training set, which is computationally intensive. we hypothesize that one of the reasons that nlp models are not robust is because they overfit to training data biases @xcite -the training data is biased towards a certain distribution, so the resulting model can be broken under some perturbations. despite augmenting training set by adversarial examples can partially mitigate this problem, are there better and more direct ways to calibrate the training distribution without introducing additional training samples? this motivates us to investigate whether there exists a reweighting mechanism to calibrate the training distribution and lead to robust models. we propose to train adversarially robust text classifiers by a sample reweighting method, named wetar (weighting examples towards adversarial robustness), in which the example weights are learned to minimize the loss of a validation set mixed with the clean examples and their corresponding adversarial ones. we explore two ways to add adversarial samples to a validation set. a static way is to generate the adversarial examples from the clean data in the validation set before the training begins, and the generated examples remain unchanged throughout the entire training process. the other way is to dynamically craft adversarial examples at every iteration to test the robustness of models against test-time attacks. compared with exiting defense methods, our approach can achieve competitive performance without the need to perturb the training set. we show that there indeed exists a reweighting mechanism to make the models robust without enlarging the clean training set with any adversarial examples. we determine the example weights of the current batch at every training iteration by an online reweighting method that performs validation at an additional small size. this study is among the first ones to improve the adversarial robustness of nlp neural models by reweighing training examples under the guidance of a relatively small validation set. through extensive experiments on three different text classification benchmark datasets, we show that our method can significantly increase the robustness to adversarial examples crafted by three representative adversarial attack algorithms. ## method we design a weighting method to improve the adversarial robustness of text classifiers by learning to reweight examples, partly inspired by the metalearning algorithm proposed by @xcite from the image domain. in particular, we consider both clean accuracy and adversarial robustness by reweighting the training examples according to their similarity to the gradient descent of the validation loss, where the validation set is augmented with the adversarial examples. during the training, we ensure that a clean example and its corresponding adversary are present in the same mini-batch, which teaches the models how to balance the two training objectives. we also show how to make model selection based on the learned weight distribution over the training examples. for text classification, a neural network-based classifier f (x) with a set of learnable parameters θ maps an input text @xmath0. given a training set @xmath1, y i )} n @xmath2, we assume there is a validation set ## experiments in the following, we first evaluate the proposed method of wetar by comparing it to four baseline methods both in clean accuracy and adversarial robustness on three text classification benchmarks. then, we would like to study how the choice of an attack algorithm to construct the validation sets at the training stage impact the adversarial robustness of resulting models under different attacks. finally, we investigate whether our method combined with adversarial data augmentation can further improve we conducted experiments on two different tasks on three widely-used datasets: stanford sentiment treebank (sst-2) @xcite , ag-news corpus (agnews) @xcite and movie reviews (mr) @xcite . sst-2 consists about 67, 000 training sentences for binary classification and mr contains about 9, 000 movie reviews for training. agnews has four categories pertaining about 30, 000 new articles. for each dataset, we randomly select one-tenth examples from the training set to form a validation set from which the adversarial examples will be generated to guide the training and select the model. in section 4, all experimental results are obtained over three runs with different initialization. we refer to appendix b for more implementation details. ## analysis we in this section give some analyses on the interpretability of the proposed reweighting method. first, we experimentally analyze the changes in the weight distributions over the training samples produced by our reweighting method. base on this analysis, we propose an empirical method for model selection. second, we visualize the weights obtained by the proposed method. ## conclusion in this study, we propose a defense method against text adversarial attacks by reweighting examples automatically. the algorithm learns to weight training examples in proportion to their contributions to minimize the loss evaluated on a validation set augmented with adversarial examples. the proposed method can directly be applied to any deep learning architecture without any additional hyperparameter search. we showed through extensive experiments that there indeed exists a reweighting mechanism to make the model robust without generating adversarial examples for the entire training set, and our reweighting algorithm performs better than existing defense methods across three different text classification datasets. a algorithm algorithm 1 weighting examples towards adversarial robustness algorithm input: d:training dataset {(x i , y i )} n @xmath3, d v : adversarial validation set {(x v i , y v i )} m @xmath4, θ:model parameters, τ :learning rate, ϵ: weights for perturbation, w: weights for updating output:θ:model weights 1: initialize θ 2: for iterative step @xmath5, ..., t do 3: for minibatch {x i , y i } n @xmath6: // initialize ϵ and minibatch from d v 5: sample minibatch {x v i , y v i } m @xmath7: ϵ ← 0 7: // calculate ∇θ ′ t and update meta model 8: as shown in algorithm 1, we sample a minibatch from the adversarial validation set and initialize weight perturbation ϵ in line 5-6. in line 8-9, we calculate θ ′ t in order to obtain the gradient g ϵ of ϵ by meta-learning algorithm in line 11. we obtain the relative importance w of samples by comparing the magnitude of -g ϵ . note that we use the opposite direction of g ϵ to evaluate the relative importance because we do a gradient descent operation in line 9. we then normalize this importance weight w to w and use w to weight training samples in the regular training. in general, the theoretical computational complexity of our algorithm is about three times greater than the regular training method.