I - GUARD : Interpretability-Guided Parameter Optimization for Adversarial Defense (2025)

Abstract: Transformer-based models are highly vulnerable to adversarial attacks, where even small perturbations can cause significant misclassifications. This paper introduces *I-Guard*, a defense framework to increase the robustness of transformer-based models against adversarial perturbations. *I-Guard* leverages model interpretability to identify influential parameters responsible for adversarial misclassifications. By selectively fine-tuning a small fraction of model parameters, our approach effectively balances performance on both original and adversarial test sets. We conduct extensive experiments on English and code-mixed Hinglish datasets and demonstrate that *I-Guard* significantly improves model robustness. Furthermore, we demonstrate the transferability of *I-Guard* in handling other character-based perturbations.

## introduction transformer-based pre-trained language models (plm) and large language models (llm) have achieved remarkable performance across various nlp tasks @xcite . however, extensive research has shown that they are vulnerable to small perturbations which can significantly affect their performance @xcite @xcite . these weaknesses raise concerns about the robustness and reliability of such models, particularly in real-world applications. there have been many attempts to study the adversarial robustness of these models across different nlp tasks @xcite @xcite . numerous studies have explored strategies to improve adversarial robustness in transformerbased models @xcite , with data augmentation and adversarial training being widely examined @xcite . data augmentation aims to improve model generalization by generating diverse text variations, but it often requires significant human effort to curate and validate high-quality augmented data. adversarial training enhances model resilience by exposing it to adversarial examples during training. however, this approach is computationally expensive, requiring models to be re-trained from scratch using both original and carefully crafted adversarial data. defense methods based on adversarial training also introduce new regularization functions @xcite or apply perturbations to the embedding space @xcite . however, these approaches depend on a continuous input space and struggle with the discrete nature of text, making it difficult to generate meaningful and semantically coherent interpolations @xcite . despite these efforts, achieving robust nlp models remains a challenging task. there is a growing need for transparent and efficient methods to enhance adversarial robustness without excessive manual intervention or computational overhead. in this paper, we propose i-guard, an interpretability-guided model training method to selectively modify model's parameters to increase the robustness of plms and llms towards adversarial attacks. for this, we employ model interpretability based on shapley values @xcite to analyze the contribution of each parameter in misleading the model in the presence of adversarial perturbations. for traditional plms such as bert, i-guard can be applied to the complete model. however, for llms with billions of parameters, directly interpreting every parameter is computationally expensive. to address this challenge, we integrate i-guard with lora (low-rank adaptation) @xcite to find the contribution of each parameter in the lora adapters with the help of a probing task. to measure the efficacy of i-guard, we con-sider realistic adversarial attacks, such as phonetic and visual (i.e. leet) perturbations, which are commonly used in social media. phonetic variations are especially pronounced in code-mixed texts, where people frequently switch between languages when writing @xcite and spell words phonetically based on their native language's pronunciation, leading to diverse spelling patterns @xcite . we evaluate i-guard on two tasks, fact verification and code-mixed sentiment analysis (hindi+english). in addition, we also investigate the transferability of our proposed approach to handle other character-based perturbations such as character deletion, character insertion, and character repetition. our results show that the proposed defense mechanism effectively enhances the robustness of plms and llms against adversarial perturbations. our contributions are as follows: ## results and discussion english dataset the accuracy and f 1 scores for bert-base and llama models drop significantly under phonetic and leet-based perturbations. for instance, under phonetic perturbations for bert (fv phonetic), the f 1 score drops by 36.72%. the most widely used adversarial defense, adversarial training, significantly improves both accuracy and f 1 scores for these perturbations in bert and llama models. however, this approach is computationally expensive, as the model needs to be trained from scratch (100% pt and all lora adapters). i-guard-adv also effectively handles phonetic and leet-based perturbations by fine-tuning much fewer parameters than adversarial training. in phonetic perturbations, i-guard achieves an f 1 score of 59.53% while fine-tuning only 21.79% of bert's parameters, compared to adversarial training, which requires 100% fine-tuning. similarly, for llama, only 20 lora adapters are updated. for leet-based perturbations also, i-guard enhances the robustness while fine-tuning fewer parameters. moreover, adversarial training and i-guard-adv reduce the f 1 score on the original test set (bert). in contrast, i-guard not only improves robustness against adversarial perturbations, but also enhances performance on the original test set, thereby maintaining a good balance between performance on both the original and adversarial test sets. hinglish dataset we observe a similar phenomenon on the sentiment analysis task, where i-guard achieves better generalization compared to adversarial training-based defense for the bert and llama models. this demonstrates that i-guard can enhance robustness against adversarial text perturbations by fine-tuning fewer parameters compared to adversarial training-based defense. we also conducted experiments on a larger dataset (see appendix d). ## conclusion we proposed i-guard, a defense mechanism designed to handle adversarial perturbations in transformer-based models. i-guard employs model interpretability to identify the parameters responsible for adversarial misclassifications and applies selective fine-tuning. while the widely used adversarial training-based defense improves robustness, it requires re-training from scratch and can lead to a drop in performance on the actual test sets. our experiments on english and hinglish datasets demonstrate that i-guard enhances both adversarial and actual test performance, ensuring better generalization while fine-tuning fewer parameters. additionally, we showed the transferability of our approach in handling other related character perturbations. in future work, we aim to extend i-guard to other models to assess its efficiency and robustness in more complex architectures.