Searching for an Effective Defender: Benchmarking Defense against Adversarial Word Substitution (2021)

Abstract: Recent studies have shown that deep neural network-based models are vulnerable to intentionally crafted adversarial examples, and various methods have been proposed to defend against adversarial word-substitution attacks for neural NLP models. However, there is a lack of systematic study on comparing different defense approaches under the same attacking setting. In this paper, we seek to fill the gap of systematic studies through comprehensive researches on understanding the behavior of neural text classifiers trained by various defense methods under representative adversarial attacks. In addition, we propose an effective method to further improve the robustness of neural text classifiers against such attacks, and achieved the highest accuracy on both clean and adversarial examples on AGNEWS and IMDB datasets by a significant margin. We hope this study could provide useful clues for future research on text adversarial defense. Codes are available at https://github.com/RockyLzy/TextDefender .

## introduction deep neural networks have achieved impressive results on nlp tasks. however, they are vulnerable to intentionally crafted textual adversarial examples, which do not change human understanding of sentences but can easily fool deep neural networks. as a result, studies on adversarial attacks and defenses in the text domain have drawn significant attention, especially in recent years @xcite @xcite @xcite @xcite @xcite @xcite . the goal of adversarial defenses is to learn a model that is capable of achieving high test accuracy on both clean (i.e., original) and adversarial examples. we are eager to find out which adversarial defense * equal contribution method can improve the robustness of nlp models to the greatest extent while suffering no or little performance drop on the clean input data. to the best of our knowledge, existing adversarial defense methods for nlp models have yet to be evaluated or compared in a fair and controlled manner. lack of evaluative and comparative researches impedes understanding of strengths and limitations of different defense methods, thus making it difficult to choose the best defense method for practical use. there are several reasons why previous studies are not sufficient for comprehensive understanding of adversarial defense methods. firstly, settings of attack algorithms in previous defense works are far from "standardized", and they vary greatly in ways such as synonym-generating methods, number of queries to victim models, maximum percentage of words that can be perturbed, etc. most defense methods have only been tested on very few attack algorithms. thus, we cannot determine whether one method consistently performs better than others from experimental data reported in the literature, because a single method might demonstrate more robustness to a specific attack while showing much less robustness to another. second, some defense methods work well only when a certain condition is satisfied. for example, all existing certified defense methods except ranmask @xcite assume that the defenders are informed of how the adversaries generate synonyms @xcite @xcite . it is not a realistic scenario since we cannot impose a limitation on the synonym set used by the attackers. therefore, we want to know which defense method is more effective against existing adversarial attacks when such limitations are removed for fair comparison among different methods. in this study, we establish a reproducible and reliable benchmark to evaluate the existing textual defense methods, which can provide detailed insights into the effectiveness of defense algorithms with the hope to facilitate future studies. in particular, we focus on defense methods against adversarial word substitution, one of the most widely studied attack approaches that could cause major threats in adversarial defenses. in order to rigorously evaluate the performance of defense methods, we propose four evaluation metrics: clean accuracy, accuracy under attack, attack success rate and number of queries. the clean accuracy metric measures the generalization ability of nlp models, while the latter three measure the model robustness against adversarial attack. to systematically evaluate the defense performance of different textual defenders, we first define a comprehensive benchmark of textual attack methods to ensures the generation of high-quality textual adversarial examples, which changes the output of models with human imperceptible perturbation to the input. we then impose constraints to the defense algorithms to ensure the fairness of comparison. for example, the synonyms set used by adversaries is not allowed to be accessed by any defense method. finally, we carry out extensive experiments using typical attack and defense methods for robustness evaluation, including five different attack algorithms and eleven defense methods on both text classification and sentiment analysis tasks. through extensive experiments, we found that the gradient-guided adversarial training methods exemplified by pgd @xcite and freelb @xcite ) can be further improved. furthermore a variant of the freelb method @xcite outperforms other adversarial defense methods including those proposed years after it. in freelb, gradient-guided perturbations are applied to find the most vulnerable ("worst-case") points and the models are trained by optimizing loss from these vulnerable points. however, magnitudes of these perturbations are constrained by a relatively small constant. we find that by extending the search region to a larger ℓ 2 -norm through increasing the number of search steps, much better accuracy can be achieved on both clean and adversarial data in various datasets. this improved variant of freelb, denoted as freelb++, improves the clean accuracy by 0.6% on agnews. freelb++ also demonstrates strong robustness under textfooler attack @xcite , achieving a 13.6% accuracy improvement comparing to the current stateof-the-art performance @xcite . similar results have been confirmed on imdb dataset. we believe that our findings invite researchers to reconsider the role of adversarial training, and reexamine the trade-off between accuracy and robustness @xcite . also, we hope to draw attentions on designing adversarial attack and defense algorithms based on fair comparisons. ## constraints on adversarial example generation in this section, we first introduce constraints of textual adversarial attacks that should be imposed to ensure the quality of adversarial examples generated, which can help us benchmark textual defense. then we introduce the datasets for experiments and pick out the optimal hyper-parameters for each constraint. ## conclusion in this paper, we established a comprehensive and coherent benchmark to evaluate the defense performance of textual defenders. we impose constraints to existing attack algorithms to ensure the quality of adversarial examples generated. using these attackers, we systematically studied the advantages and disadvantages of different textual defenders. we find out that adversarial training methods are still the most effective defenders. our freelb++ can not only achieve state-of-the-art defense performance under various attack algorithms, but also improve the performance on clean examples. we hope this study could provide useful clues for future research on text adversarial defense.