Towards Improving Adversarial Training of NLP Models (2021)

Abstract: Adversarial training, a method for learning robust deep neural networks, constructs adversarial examples during training. However, recent methods for generating NLP adversarial examples involve combinatorial search and expensive sentence encoders for constraining the generated instances. As a result, it remains challenging to use vanilla adversarial training to improve NLP models’ performance, and the benefits are mainly uninvestigated. This paper proposes a simple and improved vanilla adversarial training process for NLP models, which we name Attacking to Training (A2T). The core part of A2T is a new and cheaper word substitution attack optimized for vanilla adversarial training. We use A2T to train BERT and RoBERTa models on IMDB, Rotten Tomatoes, Yelp, and SNLI datasets. Our results empirically show that it is possible to train robust NLP models using a much cheaper adversary. We demonstrate that vanilla adversarial training with A2T can improve an NLP model’s robustness to the attack it was originally trained with and also defend the model against other types of word substitution attacks. Furthermore, we show that A2T can improve NLP models’ standard accuracy, cross-domain generalization, and interpretability.

## introduction recently, robustness of neural networks against adversarial examples has been an active area of research in natural language processing with a plethora of new adversarial attacks foot_1 having been proposed to fool question answering @xcite , machine translation @xcite , and text classification systems @xcite @xcite @xcite @xcite . one method to make models more resistant to such adversarial attacks is adversarial training where the model is trained on both original examples and adversarial examples @xcite . due to its simple workflow, it is a popular go-to method for improving adversarial robustness. typically, adversarial training involves generating adversarial example x from each original example x before training the model on both x and x . in nlp, generating an adversarial example is typically framed as a combinatorial optimization problem solved using a heuristic search algorithm. such an iterative search process is expensive. depending on the choice of the search algorithm, it can take up to tens of thousands of forward passes of the underlying model to generate one example @xcite . this high computational cost hinders the use of vanilla adversarial training in nlp, and it is unclear how and as to what extent such training can improve an nlp model's performance @xcite . in this paper, we propose to improve the vanilla adversarial training in nlp with a computationally cheaper adversary, referred to as a2t . the proposed a2t uses a cheaper gradient-based word importance ranking method to iteratively replace each word with synonyms generated from a counterfitted word embedding @xcite . we use a2t and its variation a2t-mlm (which uses masked language model-based word replacements instead) to train bert @xcite and roberta @xcite models on text classification tasks such as imdb @xcite , rotten tomatoes @xcite , yelp @xcite , and @xcite datasets. our findings are as following: ## method: a2t (attacking to training) in this section, we present our algorithm a2t for an improved and practical vanilla adversarial training for nlp. we also present the cheaper adversarial attacks we propose to use in a2t. ## related work past works on adversarial training for nlp models come in diverse flavors that differ in how adversarial examples are generated. @xcite , which is one of the first works to introduce adversarial training to nlp tasks, perform perturbations in the word embedding level instead of the actual input space level. likewise, @xcite al. (2019 ); jiang et al. (2020); liu et al. (2020) all apply perturbations in the embedding level using gradient-based optimization methods from computer vision. another family of work on adversarial training involves computing the hyperspace of activations that contains all texts that can be generated using word substitutions and then training the model to make consistent prediction for inputs inside the hyperspace. jia et al. (2019); huang et al. (2019) compute axis-aligned hyper-rectangles and leverages interval bound propagation @xcite to defend the model against substitution attacks while @xcite computes the desired hyperspace as a convex hull in the embedding space and further trains the model to be robust against worst case embedding in the convex hull. yet, adversarial training that simply uses adversarial examples generated in the input space is still a relatively unexplored area of research despite its simple, extendable workflow. most works that have discussed such form of adversarial training only train limited number of models and datasets to show that adversarial training can make models more resistant to the particular attack used to train the model @xcite @xcite @xcite . our work demonstrates that simple vanilla adversarial training can actually provide improvements in adversarial robustness across many different word substitution attacks. furthermore, we show that it can improve both generalization and interpretability of models, properties that have not been examined by previous works. ## conclusion in this paper, we have presented a practical vanilla adversarial training process called a2t that uses a new adversarial attack designed to generate adversarial examples quickly. we demonstrated that using a2t allows us to improve model's robustness against several different types of adversarial attacks that have been proposed from literature. also, we have shown that models trained using a2t can achieve better standard accuracy and/or cross-domain accuracy than baseline models.