P erturb S core: Connecting Discrete and Continuous Perturbations in NLP (2023)

Abstract: With the rapid development of neural network applications in NLP, model robustness problem is gaining more attention. Different from computer vision, the discrete nature of texts makes it more challenging to explore robustness in NLP. Therefore, in this paper, we aim to connect discrete perturbations with continuous perturbations, therefore we can use such connections as a bridge to help understand discrete perturbations in NLP models. Specifically, we first explore how to connect and measure the correlation between discrete perturbations and continuous perturbations. Then we design a regression task as a PerturbScore to learn the correlation automatically. Through experimental results, we find that we can build a connection between discrete and continuous perturbations and use the proposed PerturbScore to learn such correlation, surpassing previous methods used in discrete perturbation measuring. Further, the proposed PerturbScore can be well generalized to different datasets, perturbation methods, indicating that we can use it as a powerful tool to study model robustness in NLP.

## introduction natural language processing (nlp) applications based on neural networks are developing rapidly, exemplified by applications based on pre-trained models @xcite such as chatgpt 2 @xcite , machine translation systems @xcite , question-answering systems @xcite . while they are growing at an incredible speed, it is of great concern how we can trust these neural networks. therefore, exploring model robustness in nlp is essential for future nlp developments. model robustness problems mostly focus on exploring the model behavior when the inputs are perturbed. however, unlike the computer vision field, the discrete nature of natural language makes it more challenging to define, construct and measure the perturbations added to the texts. previous works usually separate two lines of work concerning discrete perturbations and continuous perturbations: in the computer vision (cv) field, continuous perturbations are widely explored @xcite since studying perturbations can help improve model robustness @xcite and generalization abilities @xcite . as for perturbations in nlp, the difference and challenge in discrete perturbations constrain the development of model robustness in nlp. @xcite ; @xcite ; @xcite craft adversarial examples with synonyms as word-level perturbations, which is hard to measure whether the perturbations are imperceptible. also, crafting these perturbations would face a combinatorial explosion problem. as studying discrete perturbations is more challenging than continuous perturbations, it is intuitive to wonder: can we find the correlations between discrete and continuous perturbations in nlp and study continuous perturbations instead? in this paper, we aim to explore connections between discrete and continuous perturbations in nlp models hoping that such connections can help studies of model robustness in nlp. we first give definitions and measuring standards of perturbations in discrete and continuous space and align the form and notations for studying their correlations. then we make several assumptions to provide the possibility of connecting discrete and continuous perturbations. specifically, we assume that discrete perturbations and continuous perturbations have similar effects on neural models when being added to the input to perturb the model. therefore, we are able to search for a continuous perturbation that can be considered as a substitution for the discrete perturbation. we then introduce a method to quantify the correlations between discrete and continuous perturbations and design a regression task to automatically learn the correlation. specifically, we use the gradientprojection descent method to search for a minimum continuous perturbation that has similar effects on the model behavior with the discrete perturbation. after quantifying the correlations between discrete and continuous perturbations, we use an additional neural network named perturbscorer to learn such a correlation. that is, given the original input and a discrete perturbation, we use a neural network to predict its continuous perturbation range. we construct experiments on imdb and ag's news datasets, which are widely used datasets in nlp robustness studies. we first explore the correlations between discrete and continuous perturbations when they are used to perturb fine-tuned models such as bert; then we test the performances of the learned network and empirically verify that the correlations between perturbations can be learned through a neural network, providing evidence for researchers to study continuous perturbations in nlp as a substitute for discrete perturbations. further, we design extensive analytical experiments and through the experimental results, we make several non-trivial conclusions: (1) we can build a connection between discrete and continuous perturbations; (2) such a connection can be generalized and help improve model robustness and generalization abilities; (3) continuous-space adversarial training is effective because it narrows the gap between discrete and continuous space. to summarize, in this paper, we explore the correlations between discrete and continuous perturbation, a fundamental challenge in robustness studies in nlp. we provide detailed notations and make assumptions to explore the correlations between perturbations and propose a method to connect these perturbations; further, we design a perturbscorer to learn such correlation; through experimental results, we show that we can connect discrete perturbations with continuous perturbations. we are hoping that the concept of studying discrete perturbations in nlp through building the connections between continuous perturbations can provide hints for future studies. ## experiments 4.1 dataset construction to explore the correlations between discrete and continuous perturbations, we use several datasets widely used in exploring model robustness in nlp. we use the imdb dataset @xcite and the ag's news dataset @xcite which are text classification tasks with an average text length of 220 and 47 accordingly. we use two widely used perturbation methods p(s), textfooler @xcite and randomperturb. in the textfooler method, we follow the standard generation process and save perturbations in multiple queries regardless of the attack result, which is different from its original usage that keeps finding perturbations until the attack is successful. ||f θ (s +p(s)||2•||f θ (s )||2 and edit-distance, containing curves of neural model f θ including freelb-trained model and bert fine-tuned model and perturbation method p(s) including textfooler and random perturbation tested on the imdb dataset; (c) is the curve of ||f θ (x+δt)-f θ (x)||2 ||f θ (x+δt)||2•||f θ (x)||2 and norm-ball range, containing curves of freelb-trained model and bertfine-tuned model tested on the imdb dataset; (b) and (d) are the corresponding results of the ag's news dataset. for each input text s, we have multiple p(s) with different edit-distance differences. in the random perturb method, we randomly replace a token using a random word from a general vocabulary, which is the vocabulary used to obtain synonyms in the textfooler method @xcite . similar to the textfooler perturbation method, we also collect multiple perturbations per text including different numbers, places of substitutes, and different substitutes. in generating continuous perturbations, we use the pgd method to find the minimum continuous perturbation that has a similar model prediction shift compared to the discrete perturbation. specifically, we set the adversarial step t @xmath0, the norm-ball search interval ε of ϵ is set to 0.01 and the discard parameter ϕ is set to 0.005. in figure 1 , we draw curves exploring the connection between model output shifts and different levels of perturbations. as shown, we can observe that the average model output shifts caused by discrete and continuous perturbations show consistency with edit distance and norm-ball range. we observe that when the perturbations grow range of ϵ [0,1e-1] (0.1, 0.2] (0.2, 0.3] (0.3, 0.4] (0.4, 0.5] (0.5, 0.6] (0.6, 1) larger, both discrete and continuous perturbations will cause more damage to neural models. plus, the models trained by the freelb method show better resistance against both discrete and continuous perturbations. these results verify assumption 1 and show that discrete and continuous perturbation can be correlated. in for the collected data, we select 80% data tuples as the training set and 20 % as the test set in training and testing the perturbscorer. ## conclusion and future directions in this paper, we focus on a fundamental problem in robustness studies in nlp, which is the discrete nature of texts. the discrete nature isolates nlp robustness studies from well-studied machine learning fields, therefore, we introduce the concept of building connections between discrete and continuous perturbations as a new perspective to explore nlp robustness. we build a perturbscorer to learn the correlation between discrete and continuous perturbations and find that such a perturbscorer can learn the connection between perturbations, allowing us to use continuous perturbation ranges as a proxy constraint of discrete perturbations, which avoids the challenge that discrete perturbations are hard to measure. further, we find that our proposed perturbscorer can be generalized to different datasets and perturbation methods, indicating that such a process can be further applied in the future in nlp robustness studies. for future directions, we aim to explore more effective methods to build a stronger perturbscorer and to explore more broad scenarios to utilize the proposed perturbscorer.