Robust Encodings: A Framework for Combating Adversarial Typos (2020)

Abstract: Despite excellent performance on many tasks, NLP systems are easily fooled by small adversarial perturbations of inputs. Existing procedures to defend against such perturbations are either (i) heuristic in nature and susceptible to stronger attacks or (ii) provide guaranteed robustness to worst-case attacks, but are incompatible with state-of-the-art models like BERT. In this work, we introduce robust encodings (RobEn): a simple framework that confers guaranteed robustness, without making compromises on model architecture. The core component of RobEn is an encoding function, which maps sentences to a smaller, discrete space of encodings. Systems using these encodings as a bottleneck confer guaranteed robustness with standard training, and the same encodings can be used across multiple tasks. We identify two desiderata to construct robust encoding functions: perturbations of a sentence should map to a small set of encodings (stability), and models using encodings should still perform well (fidelity). We instantiate RobEn to defend against a large family of adversarial typos. Across six tasks from GLUE, our instantiation of RobEn paired with BERT achieves an average robust accuracy of 71.3% against all adversarial typos in the family considered, while previous work using a typo-corrector achieves only 35.3% accuracy against a simple greedy attack.

## introduction state-of-the-art nlp systems are brittle: small perturbations of inputs, commonly referred to as adversarial examples, can lead to catastrophic model failures @xcite @xcite . for example, carefully chosen typos and word substitutions have fooled systems for hate speech detection @xcite , machine translation * authors contributed equally. positive positive inspired acting inspikred ating complete flop copmlete fljop irnspired atcing negative inspired acting complete flop inspikred ating ## setup tasks. we consider nlp tasks that require classifying textual input @xmath0. for simplicity, we refer to inputs as sentences. each sentence x consists of tokens x 1 , . . . , x l from the set of all strings t . let p task denote the distribution over inputs and labels for a particular task of interest. the goal is to learn a model f : @xmath1, given training examples (x, y) ∼ p task . ## robust encodings we introduce robust encodings (roben), a framework for constructing encodings that are reusable across many tasks, and pair with arbitrary model architectures. in section 3.1 we describe the key components of roben, then in section 3.2 we highlight desiderata roben should satisfy. ## robust encodings for typos in this section, we focus on adversarial typos, where an adversary can add typos to each token in a sentence (see figure 2 ). since this attack surface is defined at the level of tokens, we restrict attention to encoding functions that encode each token independently. such an encoding does not use contextual information; we find that even such robust encodings achieve greater attack accuracy and robust accuracy in practice than previous work. first, we will reduce the problem of generating token level encodings to assigning vocabulary words to clusters (section 4.1). next, we use an example to motivate different clustering approaches (section 4.2), then describe how we handle out-ofvocabulary tokens (section 4.3). finally, we introduce two types of token-level robust encodings: connected component encodings (section 4.4) and agglomerative cluster encodings (section 4.5).