Improving Robustness of Language Models from a Geometry-aware Perspective (2022)

Abstract: Recent studies have found that removing the norm-bounded projection and increasing search steps in adversarial training can significantly improve robustness. However, we observe that a too large number of search steps can hurt accuracy. We aim to obtain strong robustness efficiently using fewer steps. Through a toy experiment, we find that perturbing the clean data to the decision boundary but not crossing it does not degrade the test accuracy. Inspired by this, we propose friendly adversarial data augmentation (FADA) to generate friendly adversarial data. On top of FADA, we propose geometry-aware adversarial training (GAT) to perform adversarial training on friendly adversarial data so that we can save a large number of search steps. Comprehensive experiments across two widely used datasets and three pre-trained language models demonstrate that GAT can obtain stronger robustness via fewer steps. In addition, we provide extensive empirical results and in-depth analyses on robustness to facilitate future studies.

## introduction deep neural networks (dnns) have achieved great success on many natural language processing (nlp) tasks @xcite @xcite . however, recent studies @xcite have shown that dnns are vulnerable to crafted adversarial examples . for instance, an attacker can mislead an online sentiment analysis system by making minor changes to the input sentences @xcite . it has raised concerns among researchers about the security of dnn-based nlp systems. as a result, a growing number of studies are focusing on enhancing robustness to defend against textual adversarial attacks @xcite @xcite . there was a common belief that gradient-based at methods in nlp was ineffective compared with ada in defending against textual adversarial attacks @xcite . @xcite find that removing the norm-bounded projection and increasing the number of search steps in adversarial training can significantly improve robustness. nonetheless, we observe that increasing the number of search steps further does not significantly improve robustness but hurts accuracy. we give a possible explanation from a geometryaware perspective. removing the norm-bounded projection enlarge the search space. appropriately clean examples decision boundary friendly adversarial examples fada at figure 2: illustration of gat. our gat can save many search steps since friendly adversarial examples are located near the decision boundary. increasing the number of search steps brings the adversarial data closer to the decision boundary. in this case, the model learns a robust decision boundary. further increasing the number of search steps can make the adversarial data cross the decision boundary too far, hindering the training of natural data and hurting natural accuracy. to verify our hypothesis, we train a base model using adversarial data, which are generated by adversarial word substitution (aws) on the sst-2 @xcite dataset. we report its training accuracy ("ada training acc") on adversarial data and test accuracy ("ada test acc") on the clean test set in figure 1 . although achieving nearly 100% training accuracy, its test accuracy is only about 15%, which implicates the adversarial data make the test performance degraded. then we train another base model, whose training data is more "friendly". we just recover their last modified words to return to the correct class, namely friendly adversarial data augmentation (fada). it means that only one word is different in each sentence. surprisingly, it achieves a high test accuracy of ∼93%. this preliminary inspired us to address two existing problems: geometrically speaking, the friendly adversarial data are close to the ideal decision boundary. we can address the above two issues in one fell swoop if we perform gradient-based adversarial training on these friendly adversarial data. it is like we start one step before the end, allowing us to obtain strong robustness through a tiny number of search steps. we name it geometry-aware adversarial training (gat). figure 2 illustrates our proposed gat. in addition, the friendly adversarial data only need to be generated once per dataset. it can be reused, so it is computationally efficient. it can also be updated for every iteration or epoch but computationally expensive. our contributions are summarized as follows: ## discussions we further explore other factors that affect robustness and provide comprehensive empirical results. ## conclusion in this paper, we study how to improve robustness from a geometry-aware perspective. we first propose fada to generate friendly adversarial data that are close to the decision boundary. then we combine gradient-based adversarial training methods on fada to save a large number of search steps, termed geometry-aware adversarial training (gat). gat can efficiently achieve state-of-the-art defense performance without hurting test accuracy. we conduct extensive experiments to give indepth analysis, and we hope this work can provide helpful insights on robustness in nlp.