Prior Knowledge-Guided Adversarial Training (2024)

Abstract: We introduce a simple yet effective Prior Knowledge-Guided ADVersarial Training (PKG-ADV) algorithm to improve adversarial training for natural language understanding. Our method simply utilizes task-specific label distribution to guide the training process. By prioritizing the use of prior knowledge of labels, we aim to generate more informative adversarial perturbations. We apply our model to several challenging temporal reasoning tasks. Our method enables a more reliable and controllable data training process than relying on randomized adversarial perturbation. Albeit simple, our method achieved significant improvements in these tasks. To facilitate further research, we will release the code and models.

## introduction class imbalance, a classification setting where one or multiple classes (minority classes) are considerably less frequent than others (majority classes), is a common yet challenging problem in natural language processing (nlp) @xcite . the uneven distribution of target categories often leads to lower performance for minority classes. despite that, nlp research often overlooks the importance of incorporating methods for addressing it, and finding effective solutions remains an open research challenge @xcite . while deep learning models have been successful in various nlp tasks, they are sensitive to changes in the input data distribution. we explore the use of adversarial training techniques to enhance model performance on such scenarios. more specifically, our proposed approach incorporates the knowledge of task-specific label distribution into the adversarial training process. typically, the perturbation direction is chosen to mislead the model to flip the current model prediction away from the correct label. however, this strategy might not be optimal because it does not make use of the knowledge of task-specific label distribution during the training process. we hypothesize that such information might indicate which category a model is more likely to misclassify as another category. we focus on temporal reasoning tasks. these tasks are essential for nlp, for timing events, for estimating their duration, frequencies, ordering, etc. due to the nature of the task, classes are highly imbalanced, as shown in figure 1 and our experimental results show that, despite its simplicity, our proposed model outperforms standard fine-tuning and a strong adversarial training method on several challenging temporal reasoning tasks. moreover, our model can outperform chatgpt-based models with a large gap. our findings contribute to the understanding and improvement of adversarial training in nlp and can help enhance model performance in scenarios with imbalanced classes, such as temporal reasoning tasks. ## adversarial training for nlp standard training objectives seek to learn a function (a classifier) f (x; θ) : @xmath0, parametrized by θ, where c is the class label set. given a training dataset d of input-output pairs (x, y) and the loss function l(., .) (e.g., cross entropy), f (x; θ) is trained to minimize the empirical risk: min θ e (x,y)∼d [l(f (x; θ), y)]. while this is effective in training a classifier, it usually suffers from overfitting and poor generalization to unseen cases. recently, adversarial training has been proven effective in several tasks in nlp @xcite @xcite . the standard approach is to add the adversarial perturbation to the embeddings. the input is augmented with a small perturbation that maximizes the adversarial loss: ## prior knowledge guided adversarial training in our work, we propose to enhance the alice @xcite algorithm. alice is an adversarial training algorithm that combines the two approaches to estimate the perturbation δ: one that uses the label y @xcite and another that uses the model prediction f (x; θ), i.e., a "virtual" label @xcite . the first goal is to improve the robustness of our target label by preventing an increase in error for unperturbed inputs. the second goal is to enforce model smoothness, ensuring the model's output does not change significantly when a small perturbation is injected to the input. the formula of alice is shown below: algorithm 1 pkg-adv : we explore incorporating the knowledge of task-specific label distribution into the adversarial training process. the two lines in blue color are the only changes from alice. input: t : the total number of iterations, @xmath1, y1), . . . , (xn, yn)}: the dataset, f (x; θ): the machine learning model parametrized by θ, σ 2 : the variance of the random initialization of perturbation δ1 and δ2, δ1 r and δ2 r : the perturbations added to the embedding vector, ϵ: perturbation bound, k: the number of iterations for perturbation estimation, η: the step size for updating perturbation, τ : the global learning rate, α: the smoothing proportion of adversarial training in the augmented learning objective, π: the projection operation and c: the classes. 1: for @xmath2, .., t do 2: we enhance alice by modifying the first term of equation 1, to improve the robustness of our target label. pkg-adv first samples a label from the class label set (excluding the correct label). this label class is sampled with a probability proportional to its frequency in the training dataset. intuitively, we would like to focus training on prior knowledge at hand. this knowledge consists of the dataset label information, generated offline. more specifically, pkg-adv explicitly picks a target y t ̸ = y and tries to steer the model towards y t . we accomplish this by sampling y t from c \@xmath3. pkg-adv can flexibly use different prior knowledge, i.e. the dataset label information, as shown in line 5. then the adversarial sample is estimated by the opposite direction as in line 8. the two lines in blue color are the only changes from alice. at last, following @xcite and @xcite , the adversarial regularizer is added to the standard training objective (e.g., cross-entropy between the correct label and prediction). the algorithm of pkg-adv is depicted in algorithm 1. ## experiments we compare pkg-adv with alice @xcite , a strong adversarial training baseline, and several state-of-the-art temporal reasoning models. we use the standard uncased roberta base model @xcite as the text encoder, unless noted otherwise. ## conclusion we have presented a prior knowledge guided adversarial training (pkg-adv) algorithm to improve adversarial training for natural language understanding. albeit simple and drawn from a simple observation (label imbalance, common in most nlp tasks), incorporating task-specific label distribution into the training process for generating better adversarial perturbations has not yet been explored in the literature. pkg-adv overall shows superior performance compared to standard fine-tuning, strong adversarial training baselines, and chatgptbased baselines. pkg-adv can be applied to other language models as well by incorporating label distribution information. other types of knowledge, such as annotator agreement data, might help further enhance the performance, and we leave this for future work.