P lug AT : A Plug and Play Module to Defend against Textual Adversarial Attack (2022)

Abstract: Adversarial training, which minimizes the loss of adversarially perturbed examples, has received considerable attention. However, these methods require modifying all model parameters and optimizing the model from scratch, which is parameter inefficient and unfriendly to the already deployed models. As an alternative, we propose a pluggable defense module PlugAT, to provide robust predictions by adding a few trainable parameters to the model inputs while keeping the original model frozen. To reduce the potential side effects of using defense modules, we further propose a novel forgetting restricted adversarial training, which filters out bad adversarial examples that impair the performance of original ones. The PlugAT-equipped BERT model substantially improves robustness over several strong baselines on various text classification tasks, whilst training only 9.1% parameters. We observe that defense modules trained under the same model architecture have domain adaptation ability between similar text classification datasets.

## introduction deep neural networks have achieved great success in many fields, but they can be easily fooled by adversarial examples crafted by imperceptible perturbations on their normal counterparts @xcite . recent studies have shown that this phenomenon is widespread in nlp tasks @xcite @xcite . in response to adversarial attackers, various adversarial defense methods are proposed to improve model robustness while maintaining high accuracy on both clean and adversarial examples @xcite @xcite . among them, adversarial training is generally regarded as one of the strongest defense methods @xcite . a major drawback of adversarial learning based methods is their high computational cost, as they require multi-step gradient descent to generate adversarial examples @xcite . the total time consumption of adversarial training is much more than that of standard training, and therefore some recent works have attempted to reduce the computational burden of adversarial training. fastat @xcite uses weaker and cheaper adversarial examples to replace strong ones and demonstrates that extremely weak adversarial training is capable of learning robust models. yopo @xcite limits the number of forward and backward propagation without hurting the performance of the trained model. freeat @xcite and freelb @xcite leverage "free" strategies to generate diversified adversarial examples at a negligible additional cost compared to standard training. these efficient approaches mainly focus on reducing the cost of generating adversarial examples, which comes at the cost of training the model from scratch with the parameters entirely modified. the prohibitively huge training demand poses a severe challenge for the deployment of practical robust nlp systems. we seek to mitigate this problem by learning external modules to achieve robust results. this way, we only need to train and load a small number of robustness-specific parameters without retraining the entire model, greatly improving the ease of use. in this work, we propose plugat, a plug-andplay module for transformer-based pre-trained language models (plms) to defend against textual adversarial attacks. the defense module consists of layerwise trainable parameters that are prepended to the input sequence of each plm layer. by optimizing the defense module with adversarial training, the model is guided to response with robust outputs without updating its parameters. to alleviate the possible damage caused by training adversarial examples on the performance of original examples, we propose a novel forgetting restricted adversarial training, which filter out "aggressive" adversarial examples. plugat-equipped bert has promising robust performance on text classification tasks while updating only 9.1% robustness-specific parameters, reducing gpu time by about half compared to stateof-the-art efficient adversarial training methods. in addition, we prove that defense module has the domain adaptation capability and can work when transferred to similar tasks.our codes are publicly available at github foot_0 . the main contributions of our work are summarized as follows: ## methodology in this section, we first detail the adversarial training on plms and then introduce our proposed plug-and-play defense module, plugat, which helps plms to get rid of optimizing all model parameters from scratch when performing adversarial training. finally, we design a novel adversarial training method based on gradient alignment constraints and avoid performance degradation on clean examples. ## experimental setup we first introduce the experimental setup, including datasets, baselines and adversarial attackers involved in our experiments. ## conclusion in this paper, we focus on improving adversarial training in the nlp field. we propose plugat,