Sibylvariant Transformations for Robust Text Classification (2022)

Abstract: The vast majority of text transformation techniques in NLP are inherently limited in their ability to expand input space coverage due to an implicit constraint to preserve the original class label. In this work, we propose the notion of sibylvariance (SIB) to describe the broader set of transforms that relax the label-preserving constraint, knowably vary the expected class, and lead to significantly more diverse input distributions. We offer a unified framework to organize all data transformations, including two types of SIB: (1) Transmutations convert one discrete kind into another, (2) Mixture Mutations blend two or more classes together. To explore the role of sibylvariance within NLP, we implemented 41 text transformations, including several novel techniques like Concept2Sentence and SentMix. Sibylvariance also enables a unique form of adaptive training that generates new input mixtures for the most confused class pairs, challenging the learner to differentiate with greater nuance. Our experiments on six benchmark datasets strongly support the efficacy of sibylvariance for generalization performance, defect detection, and adversarial robustness.

## introduction automatically generating new data is a critical component within modern machine learning pipelines. during training, data augmentation can expose models to a larger portion of potential input space, consistently leading to better generalization and performance @xcite @xcite . after training, creating effective test instances from existing data can expose specific model failure modes and provide actionable corrective feedback @xcite . while many techniques can artificially expand labeled training sets or test suites, nearly all of them are class-preserving. that is to say, the model outputs are invariant (inv) with respect to the transformations. this cautious constraint ensures the new data does not lie in an out-of-distribution null class which might impede the learning objective. however, it also requires more conservative transforms that inherently limit the degree of diversification. in this work, we propose and extensively investigate the potential of sibylvariant (sib) transformations that knowably vary the expected class. from the greek sibyls, or oracles, the term parallels the oracle construction problem in software testing @xcite . in a nutshell, sibylvariants either fully transmute a datum from one class c i to another c j , or mix data from multiple classes together to derive a new input with a soft label that reflects the mixed membership. in this way, sib can more strongly perturb and diversify the underlying distribution. moreover, sib makes possible a new type of adaptive training by synthesizing data from frequently confused class pairs, challenging the model to differentiate with greater refinement. in the following sections, we position sib within a broader conceptual framework for all data transforms (section 2) and highlight several newly proposed techniques (section 3). to support a comprehensive evaluation of how sib may complement or even surpass its inv counterparts, we implemented 41 new and existing techniques into an open source tool called sibyl. equipped with the framework and tool, we evaluate 3 central research questions: our comprehensive evaluation encompasses 6 text classification datasets, 11 transformation pipelines, and 3 different levels of data availability. in total, we trained 216 models and generated over 30 million new training inputs, 480,000 testing inputs, and 3,300 adversarial inputs. in the generalization study, sib attained the highest accuracies in 89% (16 out of 18) of experimental configurations, with the adaptive mixture mutations being the most consistently effective. sib also revealed the greatest number of model defects in 83% (5 out of 6) of the testing configurations. lastly, of all the experimental configurations where adversarial robustness was improved over the no-transform baseline, 92% (11 out of 12) of them involved sib. overall, our findings strongly support the efficacy of sibylvariance for generalization performance, defect detection, and adversarial robustness. lastly, we describe how sib may operate theoretically and discuss potential threats to validity (section 5) before contrasting it with related work (section 6). the source code for sibyl and our experiments is available at: https://github. com/ucla-seal/sibyl . ## sibylvariance all data transformations in the classification setting can be categorized into one of two types: for example, contracting "what is the matter?" to "what's the matter?"should preserve a model behavior for sentiment analysis. it is important to note that transformation functions are not inherently inv nor sib. the same exact transformation may have a different effect on expected model behavior depending on the particular classification task. for example, random word insertions generally have an inv effect on topic classification tasks, but would be sib with respect to grammaticality tasks @xcite . ## transformations in sybil, we defined 18 new transforms and adapt 23 existing techniques from prior work @xcite @xcite to expand the coverage of sib and inv text transformations. at a high level, ## discussion how does sibylvariance help? the primary purpose of data transformations in ml is to diversify datasets in the neighborhood of existing points, a principle formalized as vicinal risk minimization (vrm) @xcite . synthetic examples can be drawn from a vicinal distribution to find similar but different points that enlarge the original data distribution. for instance, within image classification, it is common to define the vicinity of an image as the set of its random crops, axal reflections, and other label-preserving inv transforms. while vrm can expose ml models to more diverse input space and consequently reduce generalization errors, the neighborhoods created by inv are relatively restricted. this is due to the label-preserving constraint limiting the degree of perturbation freedom on the original data. sib effectively expands the vicinity relation via transmutations and mixture mutations. newly created data can claim full or mixed membership in target classes. to support our intuition, we vi- ## related work in this section, we broadly cover data transformations within and outside of the text domain because our proposed framework for sibylvariance is applicable to all classification contexts. data augmentation. effective data augmentation is a key factor enabling superior model performance on a wide range of tasks @xcite @xcite . in many cases, practitioners leverage domain knowledge to reinforce critical invariances in the underlying data. in computer vision, for example, translation invariance is the idea that no matter where the objects of interest reside within an image, the model will still classify them correctly. image translations and random crops encourage this more generalized conceptualization within the model @xcite and all other transforms have a similar goal: reinforce a particular invariance that helps the learner perform well on future unseen data. numerous techniques have been proposed to assist with this learning objective and thereby improve generalization. random erasing @xcite and noise injection @xcite support invariance to occlusions and promote robust features. interpolating @xcite and extrapolating (devries and taylor, 2017) nearest neighbors in the input / feature space reinforces a linear relationship between the newly created data and the supervision signal while reducing class imbalance. however, nearly all of these approaches, and many others @xcite , are label-preserving and therefore limited in their capacity to induce deeper learning of invariant concepts. sibylvariant transforms enjoy several desirable aspects of inv transformations while mitigating their drawbacks. similar to feature space functions (devries and taylor, 2017), mixture mutations do not require significant domain knowledge. like approaches that reduce dataset imbalance @xcite , sib transforms can increase class representation through mixed membership or targeted transmutations that inherit diverse characteristics of the source inputs. in all cases, relaxing the labelpreserving constraint enables sib functions to both complement and enhance the learning of critical invariances by further expanding the support of the dataset in new directions. adversarial attacks & robustness. adversarial attacks are a special class of inv transformations that simultaneously minimize perturbations to the input while maximizing the perception of change to a learner. this task is more difficult within the nlp domain due to the discrete nature of text, but several works @xcite have proven successful at inducing model errors. real-world use of nlp requires resilience to such attacks and our work complements robust training @xcite and robust certification @xcite to produce more reliable models. emerging sibylvariant transforms. specific transformations designed to alter the expected class of an input have existed prior to this work @xcite @xcite , albeit primarily in the image domain and also in a more isolated, ad hoc fashion. among our primary contributions is to propose a unifying name, framework, and taxonomy for this family of sibylvariant functions. furthermore, most prior works introduce a single transformation and evaluate its efficacy on training alone. in contrast, we proposed several novel transformations, a new adaptive training routine, and evaluated the broader impacts of 41 inv and sib transforms on training, defect detection, and robustness simultaneously. recently published examples of sib mixture mutations for text @xcite differ from ours in several important ways. prior work operates exclusively within the hidden space inside specific models, which limits transferability between different algorithm types. all of our transformations operate in the input space, which is both more general and more challenging because we have to contend with rules of grammar and style. however, this also provides greater transparency. furthermore, because our overall approach samples from 41 different transformations, we are able to exercise a broader range of model behaviors. for example, sentmix is designed to encourage longrange understanding, while other transforms evoke their own specific objectives. any individual transformation is inherently more limited, e.g. tmix can only encourage the model to behave linearly for borderline cases. ## conclusion inspired by metamorphic testing, we proposed the notion of sibylvariance to jointly transform both input and output class (x i , y i ) pairs in a knowable way. to explore the potential of sibylvariance, we define 18 new text transformations and adapt 23 existing transformations into an open source tool called sybil. in particular, we define several types of mixture mutations and design a novel concept-based text transformation technique utilizing salience attribution and neural sentence generation. across six benchmarks from two different nlp classification tasks, we systematically assess the effectiveness of inv and sib for generalization performance, defect detection, and adversarial robustness. our extensive evaluation shows that many sib transforms, and especially the adaptive mixture mutations, are extremely effective. sib achieves the highest training accuracy in 89% of the experimental configurations. when used for testing, sib test suites reveal the greatest number of model defects in 5 out of 6 benchmarks. finally, models trained on sib-augmented data improve adversarial robustness 11× more often than those trained on inv-augmented data.