Randomized Smoothing with Masked Inference for Adversarially Robust Text Classifications (2023)

Abstract: Large-scale pre-trained language models have shown outstanding performance in a variety of NLP tasks. However, they are also known to be significantly brittle against specifically crafted adversarial examples, leading to increasing interest in probing the adversarial robustness of NLP systems. We introduce RSMI, a novel two-stage framework that combines randomized smoothing (RS) with masked inference (MI) to improve the adversarial robustness of NLP systems. RS transforms a classifier into a smoothed classifier to obtain robust representations, whereas MI forces a model to exploit the surrounding context of a masked token in an input sequence. RSMI improves adversarial robustness by 2 to 3 times over existing state-of-the-art methods on benchmark datasets. We also perform in-depth qualitative analysis to validate the effectiveness of the different stages of RSMI and probe the impact of its components through extensive ablations. By empirically proving the stability of RSMI, we put it forward as a practical method to robustly train large-scale NLP models. Our code and datasets are available at https://github.com/Han8931/rsmi_nlp

## introduction in response to the threat of textual adversarial attacks @xcite , a variety of defense schemes have been proposed @xcite @xcite . defense schemes typically involve solving a min-max optimization problem, consisting of an inner maximization that seeks the worst (adversarial) example and an outer minimization that aims to minimize a system's loss over such examples @xcite . the solution to the inner maximization problem is typically obtained through iterative optimization algorithms, such as stochastic gradient descent @xcite . randomized smoothing (rs) provides a certifiable robustness within a ball with a radius r around an input point x (c.f., r can be computed by theorem 1) and (b) masked inference (mi) denoises "adversarially salient" tokens via a gradient-based feature attribution analysis to make a decision on the input sample with the surrounding contexts of a masked token in the input. for texts, however, the gradients cannot be directly computed due to the discrete nature of the texts. thus, the gradients are often computed with respect to word embeddings of an input sequence as done in @xcite ; @xcite ; @xcite . the simplicity of the gradientbased adversarial training makes it attractive defense strategy, but it tends to show substantial variance in robustness enhancement (c.f., §4.7). another prevailing approach in natural language processing (nlp) field is to substitute input words of their synonyms sampled from a pre-defined synonym set @xcite @xcite . the synonym-based defense (sda) algorithms have emerged as a prominent defense approach since many textual attack algorithms perturb input texts at a word level @xcite @xcite . however, @xcite pointed out that they tend to show significant brittleness when they have no access to the perturbation sets of the potential attacks. in addition, assuming access to the potential perturbation sets is often unrealistic. to address the issues, we propose rsmi, a novel two-stage framework leveraging randomized smoothing (rs) and masked inference (mi) (c.f., fig. 1 ). randomized smoothing is a generic class of methods that transform a classifier into a smoothed classifier via a randomized input perturbation process @xcite . it has come recently into the spotlight thanks to its simplicity and theoretical guarantee of certifiable robustness within a ball around an input point @xcite , which is often considered desirable property of a defense scheme (c.f., fig. 1 (a) ). moreover, its robustness enhancement is highly scalable to modern large-scale deep learning setups @xcite . these properties render it a promising research direction. however, there exists a non-trivial challenge in introducing rs to nlp systems due to the discrete nature of texts. we sidestep the issue and adapt rs to nlp problems by injecting noise at the hidden layers of the deep neural model. we show that perturbed representations of pre-trained language models (plms) still guarantees the robustness in §2. the rs stage is followed by a gradient-guided masked inference (mi) to further reinforce the smoothing effect of rs. mi draws an inference on an input sequence via a noise reduction process that masks adversarially "salient" tokens in the input that are potentially perturbed by an attack algorithm (c.f., fig. 1 (b) ). the adversarially salient tokens are achieved via a gradient-based feature attribution analysis rather than random selections as commonly done in pre-training language models @xcite to effectively suppress adversarial perturbations. the effectiveness of our novel mi can be attributed to several aspects: (i) it is a natural regularization for forcing the model to make a prediction based on the surrounding contexts of a masked token in the input @xcite . (ii) it works without any prior assumption about potential attacks, which renders it an attack-agnostic defense approach and is more practical in that it requires no sub-module for synonym-substitution. (iii) it has a close theoretical connection to the synonym-substitution-based approaches, as mi can be regarded as a special case of the weighted ensemble over multiple transformed inputs as shown in §2.2. we evaluate the performance of rsmi through comprehensive experimental studies on large-scale plms with three benchmark datasets against widely adopted adversarial attacks. our empirical studies demonstrate that rsmi obtains improvements of 2 to 3 times against strong adversarial attacks in terms of key robustness metrics over baseline algorithms despite its simplicity ( §4.1). we also conduct theoretical analysis to demonstrate the effectiveness of our adapted rs ( §2.1) and mi ( §2.2 and appendix a.6). we further analyze the scalability of rsmi, the influence of hyperparameters, its impact on the latent representation (i.e., embedding space) of the system and its stochastic stability ( §4.5). our theoretical and empirical analyses validate the effectiveness of rsmi and propose it as a practical method for training adversarially robust nlp systems. ## randomized smoothing with masked inference (rsmi) we consider a standard text classification task with a probabilistic model f θ : r @xmath0, where p(y) is the set of possible probability distributions over class labels @xmath1, . . . , c}, and θ ∈ r p denotes the parameters of the model f θ (or f for simplicity). the model f is trained to fit a data distribution d over pairs of an input sequence @xmath2, . . . , s t ) of t tokens and its corresponding class label @xmath3. the distributed representation of s (or word embedding) is represented as @xmath4, . . . , x t ]. we assume the model is trained with a loss function l such as cross-entropy. we denote the final prediction of the model as ŷ = arg max i f (s) i and the ground truth label as y * . ## experiment setup datasets we evaluate rsmi on two conventional nlp tasks: text classification (cls) and natural language inference (nli). we adopt imdb @xcite and ag's news @xcite datasets for the classification task. for nli, we compare the defense algorithms on the questionanswering nli (qnli) dataset, which is a part of the glue benchmark @xcite . we build development sets for imdb, ag, and qnli by randomly drawing 10% samples from each training set via a stratified sampling strategy. evaluation metrics the performance of defense algorithms is evaluated in terms of four different metrics as proposed in @xcite : (i) standard accuracy (sacc) is the model's accuracy on clean samples. (ii) robust accuracy (racc) measures the model's robustness against adversarial attacks. (iii) attack success rate (asr) is the ratio of the inputs that successfully fool the victim models. (iv) finally, the average number of queries (avgq) needed to generate the adversarial examples. algorithm 1 training and prediction procedure of rsmi. 1: initialize. s, m , n , σ, ν, k 0 , k 1 , α, step size η, and a gradient scale parameter β. ## conclusion we have proposed rsmi, a novel two-stage framework to tackle the issue of adversarial robustness of large-scale deep nlp systems. rsmi first adapts the randomized smoothing (rs) strategy for discrete text inputs and leverages a novel gradientguided masked inference (mi) approach that reinforces the smoothing effect of rs. we have evaluated rsmi by applying it to large-scale pre-trained models on three benchmark datasets and obtain 2 to 3 times improvements against strong attacks in terms of robustness evaluation metrics over stateof-the-art defense methods. we have also studied the scalability of rsmi and performed extensive qualitative analyses to examine the effect of rsmi on the latent representations of the original and perturbed inputs as well as the change in its stability owing to its non-deterministic nature. our thorough experiments and theoretical studies validate the effectiveness of rsmi as a practical approach to train adversarially robust nlp systems.