Using Random Perturbations to Mitigate Adversarial Attacks on Sentiment Analysis Models (2021)

Abstract: Attacks on deep learning models are often difficult to identify and therefore are difficult to protect against. This problem is exacerbated by the use of public datasets that typically are not manually inspected before use. In this paper, we offer a solution to this vulnerability by using, during testing, random perturbations such as spelling correction if necessary, substitution by random synonym, or simply drop-ping the word. These perturbations are applied to random words in random sentences to defend NLP models against adversarial attacks. Our Random Perturbations Defense andIncreased Randomness Defense methods are successful in returning attacked models to similar accuracy of models before attacks. The original accuracy of the model used in this work is 80% for sentiment classification. After undergoing attacks, the accuracy drops to an accuracy between 0% and 44%. After applying our defense methods, the accuracy of the model is returned to the original accuracy within statistical significance.

## introduction deep learning models have excelled in solving difficult problems in machine learning, including natural language processing (nlp) tasks like text classification @xcite and language understanding @xcite . however, research has discovered that inputs can be modified to cause trained deep learning models to produce incorrect results and predictions @xcite . models in computer vision are vulnerable to these attacks @xcite , and studies have found that models in the nlp domain are also vulnerable @xcite @xcite . one use of these adversarial attacks is to test and verify the robustness of nlp models. with the potential for adversarial attacks, there comes the need for prevention and protection. there are three main categories of defense methods: identification, reconstruction, and prevention @xcite . identification methods rely on detecting either poisoned data or the poisoned model @xcite . while reconstruction methods actively work to repair the model after training @xcite , prevention methods rely on input preprocessing, majority voting, and other techniques to mitigate adversarial attacks @xcite . although most nlp adversarial attacks are easily detectable, some new forms of adversarial attacks have become more difficult to detect like concealed data poisoning attacks @xcite and backdoor attacks @xcite . the use of these concealed and hard-to-detect attacks has revealed new vulnerabilities in nlp models. considering the increasing difficulty in detecting attacks, a more prudent approach would be to work on neutralizing the effect of potential attacks rather than solely relying on detection. here we offer a novel and highly effective defense solution that preprocesses inputs by random perturbations to mitigate potential hard-to-detect attacks. the work in this paper relates to the attack on nlp models using the textattack library @xcite , the current state-of-the-art defense methods for nlp models, and using randomness against adversarial attacks. the textattack library and the associated github repository @xcite represent current efforts to centralize attack and data augmentation methods for the nlp community. the library supports attack creation through the use of four components: a goal function, a search method, a transformation, and constraints. an attack method uses these components to perturb the input to fulfill the given goal function while complying with the constraints and the search method finds transformations that produce adversarial examples. the library contains a total of 16 attack model recipes based on literature. the work reported in this paper pertains to the 14 ready-to-use classification attack recipes from the textattack library. we believe that successful defense against such attacks will provide guidelines for the general defense of deep learning nlp classification models. there are many methods to defend nlp models against adversarial attacks, including input preprocessing. input preprocessing defenses require inserting a step between the input and the given model that aims to mitigate any potential attacks. @xcite use an input preprocessing defense that employs synonym set averages and majority voting to mitigate synonym substitution attacks. their method is deployed before the input is run through a trained model. another defense against synonym substitution attacks, random substitution encoding (rse) encodes randomly selected synonyms to train a robust deep neural network @xcite . the rse defense occurs between the input and the embedding layer. randomness has been deployed in computer vision defense methods against adversarial attacks. @xcite use random ablations to defend against adversarial attacks on computer vision classification models. their defense is based on a random-smoothing technique that creates certifiably robust classification. levine and feizi defend against sparse adversarial attacks that perturb a small number of features in the input images. they found their random ablation defense method to produce certifiably robust results on the mnist, cifar-10, and imagenet datasets. ## input perturbation approach & adversarial defense the use and availability of successful adversarial attack methods reveal the need for defense methods that do not rely on detection and leverage intuitions gathered from popular attack methods to protect nlp models. in particular, we present a simple but highly effective defense against attacks on deep learning models that perform sentiment analysis. the approach taken is based on certain assumptions about the sentiment analysis task. given a short piece of text, we believe that a human does not need to necessarily analyze every sentence carefully to get a grasp on the sentiment. our hypothesis is that humans can ascertain the expressed sentiment in a text by paying attention to a few key sentences while ignoring or skimming over the others. this thought experiment led us to make intermediate classifications on individual sentences of a review in the imdb dataset and then combining the results for a collective final decision. this process was refined further by considering how attackers actually perturb data. usually, they select a small number of characters or tokens within the original data to perturb. to mitigate those perturbations, we choose to perform our own random perturbations. because the attacking perturbations could occur anywhere within the original data, and we do not necessarily know where they are, it is prudent to randomly select tokens for us to perturb. this randomization has the potential to negate the effect the attacking perturbations have on the overall sentiment analysis. we wish to highlight the importance of randomness in our approach and in possible future approaches for defenses against adversarial attacks. positive impact of randomness in classification tasks with featured datasets can be found in work using random forests @xcite . random forests have been useful in many domains to make predictions, including disease prediction @xcite @xcite and stock market price prediction @xcite @xcite . the use of randomness has made these methods of prediction robust and useful. we have chosen to harness the capability of randomness in defense of adversarial attacks in nlp. we demonstrate that the impact randomness has on our defense method is highly positive and its use in defense against adversarial attacks of neural networks should be explored further. we present two algorithms below-first with two levels of randomness, and the second with three. ## conclusion the work in this paper details a successful defense method against adversarial attacks generated from the textattack library. these attack methods use multiple different perturbation approaches to change the predictions made by nlp models. our random perturbations defense was successful in mitigating 6 different attack methods. this defense method returned the attacked models to their original accuracy within statistical significance. our second method, increased randomness defense, used more randomization to create an equally successful defense method that was 4 times more efficient than our random perturbations defense. overall, our defense methods are effective in mitigating a range of nlp adversarial attacks, presenting evidence for the effectiveness of randomness in nlp defense methods. the work done here opens up further study into the use of randomness in defense of adversarial attacks for nlp models including the use of these defense methods for multi-class classification. this work also encourages a further mathematical and theoretical explanation to the benefits of randomness in defense of nlp models.