C heck HARD : Checking Hard Labels for Adversarial Text Detection, Prediction Correction, and Perturbed Word Suggestion (2022)

Abstract: An adversarial attack generates harmful text that fools a target model. More dangerously, this text is unrecognizable by humans. Existing work detects adversarial text and corrects a target’s prediction by identifying perturbed words and changing them into their synonyms, but many benign words are also changed. In this paper, we directly detect adversarial text, correct the prediction, and suggest perturbed words by checking the change in the hard labels from the target’s predictions after replacing a word with its transformation using a model that we call CheckHARD. The experiments demonstrate that CheckHARD outperforms existing work on various attacks, models, and datasets.

## introduction currently, deep-learning-based models achieve high performance on many nlp tasks. however, those models are still sensitive to adversarial attacks. these attacks can only perturb a small amount of an input text, which is sufficient to fool the models. more dangerously, the modified text still preserves its original meaning, and humans cannot recognize the modification in the text. we set three objectives for this paper. first, we detect the adversarial text to recognize an adversarial attack. second, we correct the prediction to protect models against adversarial attacks. last, we suggest perturbed words in the adversarial text. these suggestions can be used to reduce the effect of perturbed words in other tasks (e.g., text summarization or opinion mining). previous works suggested perturbed words for downstream tasks including adversarial text detection and prediction correction. these perturbed words can be identified by using the bert model @xcite or word frequency @xcite . however, many benign words are identified instead, which remarkably affects the downstream tasks. motivation: adversarial text must satisfy two criteria: (1) it fools a target model and (2) preserves the original meaning. there is little text satisfying these two criteria. figure 1 presents an example from sst-2 in which the cnn model is attacked by probability weighted word saliency (pwws). the cnn model classifies the input text into two classes, i.e., positive and negative. pwws perturbs words in the text until the cnn model is fooled. during the attack, only the last text becomes adversarial, as it renders the cnn prediction incorrect, while other perturbed text is still correctly predicted by the cnn model. here, we realize another phenomenon as follows: if we continue transforming 1 the adversarial text by replacing the perturbed word (e.g., "charter") with similar words, many conflicts appear between the predictions made for the transformed text and the prediction of the adversarial text. in contrast, the transformed text obtained by replacing the benign word (such as "film") presents no conflict. contribution: we propose a simple method, namely, checkhard, which detects adversarial text, corrects predictions, and suggests perturbed words. (1) for adversarial text detection, we first perform transformations for the input text by replacing each individual word with similar words. we then check the conflicts in the predictions for the input text and its transformations. (2) in terms of prediction correction, we identify and correct predictions for misclassified text. the misclassified text belongs to two cases: adversarial text (which fools a target model) and original text (which is predicted incorrectly by the target model). we observe that both kinds of misclassified text have the same characteristics. we then identify the two kinds of misclassified text in a similar way as that used in (1). next, we correct the prediction for both misclassified texts using the hard labels of the input transformations. (3) for perturbed word suggestion, we suggest top words that produce the largest conflicts during the checking performed in (1). our main contributions are summarized as follows: other existing methods only reported these tasks with fewer than five attacks, including both baselines and previous attacks. most of recent works (raina and gales, 2022; @xcite are limited on target models derived from transformers. @xcite restrictively detect parallel pairs of the adversarial and original text and ignore the original text that a target model incorrectly classifies. wang et al. (2022) prediction correction: several previous works correct predictions after a text is modified by perturbed words. in one approach, these perturbed words are disabled by replacing them with similar words in various ways. @xcite chose ## checkhard model details: to process input text x input with one of three objectives, "adversarial detection", "prediction correction", or "perturbation detection," checkhard first predicts a hard label y input for x input using a target model f (e.g., a cnn). then, it transforms the text using an auxiliary attack a (e.g., pwws). an adversarial threshold λ adv , a misclassification threshold λ mis , and a suggestion number k are used for "adversarial detection, "prediction correction," and "perturbation suggestion," respectively. checkhard allows the use of an optional word proportion τ < 100% and support models f sup , which accelerate the processing and improve the performance, respectively. support models should solve the same task as the target model such as sentiment analysis. first (line 4), we form w rand by selecting random words from x input with the proportion τ . since τ is 100% by default when processing all of the words, a smaller τ can significantly speed misclassified threshold λ mis (̸ = null for "prediction correction"); suggestion number k (> 0 for "perturbation suggestion"; 1 as default). corresponding output :"adversarial" / "original" if λ adv ̸ = n u ll; ## limitations beyond word-based attack: checkhard is currently suitable for all current attacks from the textattack framework at the character, word, and hybrid levels. to the best of our knowledge, there is no work that detects adversarial text beyond the word level, such as the phrase level as in @xcite and sentence level as in @xcite , so it is still an open problem. beyond text classification: checkhard can be directly applied to text classification tasks, for which it is easy to estimate the change in prediction. to apply checkhard to other tasks (such as question answering and translation), we need to define a similar metric to measure the change in prediction. checkhard with a strange auxiliary and without support: checkhard without support is still unstable when the auxiliary attack is different from the attack used to generate adversarial text, as shown in ## conclusion in this paper, we propose checkhard by checking the change in the hard label before and after replacing the word with its transformation. checking is used to detect adversarial text, correct predictions, and suggest perturbed words. the experiments on various attacks, models, and datasets demonstrate that checkhard outperforms existing work.