S em R o D e: Macro Adversarial Training to Learn Representations that are Robust to Word-Level Attacks (2024)

Abstract: Language models (LMs) are indispensable tools for natural language processing tasks, but their vulnerability to adversarial attacks remains a concern. While current research has explored adversarial training techniques, their improvements to defend against word-level attacks have been limited. In this work, we propose a novel approach called Semantic Robust Defence (SemRoDe), a Macro Adversarial Training strategy to enhance the robustness of LMs. Drawing inspiration from recent studies in the image domain, we investigate and later confirm that in a discrete data setting such as language, adversarial samples generated via word substitutions do indeed belong to an adversarial domain exhibiting a high Wasserstein distance from the base domain. Our method learns a robust representation that bridges these two domains. We hypothesize that if samples were not projected into an adversarial domain, but instead to a domain with minimal shift, it would improve attack robustness. We align the domains by incorporating a new distance-based objective. With this, our model is able to learn more generalized representations by aligning the model’s high-level output features and therefore better handling unseen adversarial samples. This method can be generalized across word embeddings, even when they share minimal overlap at both vocabulary and word-substitution levels. To evaluate the effectiveness of our approach, we conduct experiments on BERT and RoBERTa models on three datasets. The results demonstrate promising state-of-the-art robustness.

## introduction basic deep learning models are not inherently robust. this issue has been illustrated in numerous studies pointing to structural problems such as dataset shift @xcite and the prevalence of adversarial attacks @xcite . particularly in the context of natural language research, adversarial attacks are generated by introducing small perturbations either at the character, word, or sentence level of a textual input while maintaining the meaning, semantics, and grammar of the sentence. the development of robust systems is therefore of paramount importance for a multitude of reasons. notably, content filters in need of detecting offensive language may be misled into classifying negative content as positive. furthermore, in the realm of language model learning, adversarial attacks can successfully circumvent content moderation pipelines, prompting harmful content generation which can severely impact individuals and society. with the accelerating popularity of llms and applications, there has been an urgency for robustness research. there is a small, underexplored body of work that has proposed the merger of an adversarial distribution with the original distribution to improve a model's adversarial robustness. preliminary and promising results have emerged when implementing a theoretical solution based on base-adversarial alignment in the form of domain adaptation in the image domain @xcite . inspired by these findings, we initially expand on their hypothesis, demonstrating how a domain adaptation solution may have limitations. however, we maintain the central idea that aligning the base and adversarial features can lead to robust results and explore the validity of this theory in the discrete language domain. we further refine this approach by formulating a solution that aligns more closely with previous work in adversarial robustness, making it more relevant to the language domain. through this process, we demonstrate state-of-the-art performance across a variety of models and datasets, thereby advancing the cause of improving adversarial robustness in the discrete language domain. the following points summarize the major contributions of our research: ## related work attacks on nlp systems on the front of adversarial attacks, recent work has developed methods to attack nlp systems. these methods firstly generate substitution candidates by removing, swapping, or adding letters/punctuation @xcite @xcite or finding word candidates around the ℓ 2 @xcite or convex hull @xcite of the word embedding space. these word candidates can be general word substitutions @xcite , synonyms @xcite @xcite , sememes @xcite , or grammatical inflections @xcite . the substitution candidate after that is expected to preserve a certain level of semantic structure, which is often enforced with the levenshtein distance (gao et al., 1 https://github.com/aniloid2/semrodemacroadversarialtraining 2018) or through the use of a semantic encoder, @xcite . these candidates can then be applied to the base sentence in a black-box, gray-box, or white-box setting. the black-box setting uses no information from the victim's system. in the gray-box settings, some information from the model is used, such as the output logit or label. in the white-box setting, all model information is available, including weights. in the case of the gray-box setting, such character or word changes can result in a successful perturbation when performing convex optimization over the input by replacing the original letter or word with the potential change and analyzing the logit or label. this optimization problem is often solved using greedy search @xcite , with genetic algorithms @xcite , or particle swarm optimization @xcite . on the contrary, white-box attacks leverage gradient and parameters information from the model to inject a δ in the embedding space, rather than the input space. defence methods research into the generation of adversarial samples can subsequently contribute to enhancing model robustness through adversarial training, early efforts in adversarial training in nlp included the adversarial examples back into training by including the adversarial samples in the batch @xcite . more recently, these strategies have been refined @xcite . alternatively, it is possible to extend the original objective by adding an adversarial regularizer, similar to how adversarial training is performed in the image domain @xcite @xcite . building upon this line of work, embedding perturbation methods such as freelb @xcite , ascc @xcite , infobert @xcite , dsrm @xcite and freelb++ @xcite , leverage the model's gradient to apply a perturbation within the continuous embedding space via projected gradient descent. this perturbation is constrained by a specified norm, such as the l2 norm @xcite , or maintained within the confines of a convex hull @xcite . additionally, some approaches only induce perturbation when the loss falls below a predefined threshold @xcite . these adversarial training schemas result in a min-max game between the base and adversarial objectives, forcing the model to learn both datasets. more recently, defense techniques originating from the off-manifold conjecture in images have been adapted for the nlp context @xcite . additionally, a detector @xcite and an encoder @xcite for adversarial samples have been proposed. on the other hand, it is also feasible to train an anomaly detector to identify word substitutions @xcite or adversarial sentences @xcite . the primary drawback of these methods is the need to incorporate extra components into the pipeline, either before or after inference, resulting in additional computational load. a different line of work demonstrated that enhancing the robustness of attention-based models to adversarial attacks can be achieved by aligning the distributions of the keys and queries @xcite . adversarial training can be effectively utilized to defend against word-level attacks without introducing extra computational overhead. there are also several works exploring certified robustness for nlp systems but these methods remain hard to scale to large models @xcite @xcite . a comprehensive benchmarking of adversarial defense methods @xcite concluded that freelb++ performs the best; it employs embedding perturbations to acquire robust invariant representations. freelb++ is the stateof-the-art technique, together with dsrm to improve general robustness, while we identify a2t as being the state-of-the-art technique to improve robustness through adversarial data augmentation. freelb++, is confined to exploring the embedding space, while a2t is able to explore the full semantic space. resulting in f θ : t(x ) → y, that takes an input embedding x ← t(x). where the input sequence of words @xmath0, . . . , τ n ) ∈ x with the ground truth label y and outputs a prediction ŷ = f θ (t(x)) are first parsed through tokenizer t. an adversarial attack with algorithm g on input x and classifier f θ would perturb τ , for example, using character manipulations or word substitutions, to produce a new adversarial sample x that is misclassified by f θ such that f θ (t(x)) ̸ = y, the sample, can then be validated for linguistic characteristics with d. ## methodology embedding robustness, as described by @xcite , is a concept whereby a model is considered robust if it can maintain low risk within regions encircling a specific embedding x. adversarial training and gradient ascent methodologies are applied directly to word embedding by prominent techniques such as @xcite , in an effort to accomplish this. however, these methods display limitations in sustaining this robustness. these restrictions occur due to the model being bound by ϵ. transgression beyond this ϵ limit incites undesirable word substitutions ( notably, this presents a hurdle, since the majority of word-level attacks, not having access to the input word embeddings or gradients, conduct heuristic optimization on the input sample. each word often has n substitution candidates. therefore, they employ word substitutions to introduce a δ into a sentence (see figure 4 in the appendix), thus often exceeding the ϵ restriction. this allows such attacks to explore regions in the semantic space that the victim's model has not previously seen. consequently, our research involves the direct utilization of existing attack algorithms to generate the adversarial data intended for training. subsequently, we scrutinize the extent to which our training approach shows generalization when faced with different attack algorithms employed by an attacker. ## experiments we initially investigate the performance of the system using all the regularizers outlined in equation 3 (referred to as macro). when generating the adversarial candidates using textfooler, pwws, bertattack or textbugger we set a angular similarity ϵ, used to assess the semantics of a transfor-mation, to 0.5 where d is the universal sentence transformer @xcite , and the number of word substitution candidates n to 50, which are both the standard used in previous work, we also utilize a greedy search approach with word replacement inspired by @xcite to identify suitable word substitutions in a query efficient way. for the macro component, we undertake a comparative analysis involving adversarial training and attacks utilizing word substitutions derived from various word embeddings (wordnet, contextual, counter fitted, and glove). furthermore, we conduct an in-depth examination of the resultant embeddings through t-sne to gain valuable insights into the behavior of the feature space. ## computation time semrode is computationally efficient. in ## discussion recent studies have taken a novel approach by investigating the impacts of adversarial attacks and defenses on smaller encoding and decoding models, such as bert, roberta, and gpt. given that these models are less computationally demanding, they serve as more tractable proxies for larger, cutting-edge models. promisingly, attacks that work on these models have been shown to be applicable to sophisticated llms, according to recent works @xcite @xcite . our research provides insight into aligning the base and adversarial domains and how doing so can improve robust accuracy. as the landscape of llms continues to evolve and expand, we hope these findings can be utilized and applied to larger, more sophisticated language models to improve their robustness to adversarial attacks. ## conclusion drawing inspiration from previous work on image settings utilizing continuous data, we demonstrate the existence of a base and adversarial domain within a linguistic setting that uses discrete data. this becomes apparent when an attacker manipulates a system through word-level substitutions. striving to decrease the divergence between these two domains in the belief that it would improve robust generalization, we employ a distance regularizer on high-level features. this allows for learning an internal representation that restricts attackers from shifting a base sample into the adversarial domain. this method introduces a novel distancebased regularizer, l dist , as we investigate different distance measures for aligning the domains. aligning these domains results in a reduced wasserstein distance and smoother clustering of the t-sne output features. this procedure, aligning base and adversarial features, fosters robust generalization, as the learned representations maintain robust accuracy despite attackers leveraging word substitutions from four various word-embeddings.