Abstract:Neural language models show vulnerability to adversarial examples which are semantically similar to their original counterparts with a few words replaced by their synonyms. A common way to improve model robustness is adversarial training which follows two steps-collecting adversarial examples by attacking a target model, and fine-tuning the model on the augmented dataset with these adversarial examples. The objective of traditional adversarial training is to make a model produce the same correct predictions on an original/adversarial example pair. However, the consistency between model decision-makings on two similar texts is ignored. We argue that a robust model should behave consistently on original/adversarial example pairs, that is making the same predictions (what) based on the same reasons (how) which can be reflected by consistent interpretations. In this work, we propose a novel feature-level adversarial training method named FLAT. FLAT aims at improving model robustness in terms of both predictions and interpretations. FLAT incorporates variational word masks in neural networks to learn global word importance and play as a bottleneck teaching the model to make predictions based on important words. FLAT explicitly shoots at the vulnerability problem caused by the mismatch between model understandings on the replaced words and their synonyms in original/adversarial example pairs by regularizing the corresponding global word importance scores. Experiments show the effectiveness of FLAT in improving the robustness with respect to both predictions and interpretations of four neural network models (LSTM, CNN, BERT, and DeBERTa) to two adversarial attacks on four text classification tasks. The models trained via FLAT also show better robustness than baseline models on unforeseen adversarial examples across different attacks.

Extreme Miscalibration and the Illusion of Adversarial Robustness

Integrating Confidence Calibration and Adversarial Robustness Via Adversarial Calibration Entropy

The Surprising Harmfulness of Benign Overfitting for Adversarial Robustness

Towards Adversarial Robustness with Multidimensional Perturbations Via Contrastive Learning

Dynamic Label Adversarial Training for Deep Learning Robustness Against Adversarial Attacks

Robust Machine Learning Against Adversarial Samples at Test Time

Adversarial Training for Improving Model Robustness? Look at Both Prediction and Interpretation

Balance, Imbalance, and Rebalance: Understanding Robust Overfitting from a Minimax Game Perspective

Adversarial Robustness Limits via Scaling-Law and Human-Alignment Studies

Scaling Compute Is Not All You Need for Adversarial Robustness

Optimism in the Face of Adversity: Understanding and Improving Deep Learning Through Adversarial Robustness

Improved Adversarial Training Through Adaptive Instance-wise Loss Smoothing

On Model Robustness Against Adversarial Examples

Opportunities and Challenges in Deep Learning Adversarial Robustness: A Survey

Scaling Adversarial Training to Large Perturbation Bounds

Certified Robustness to Adversarial Word Substitutions

calibrated adversarial training.

Robustifying Language Models with Test-Time Adaptation

Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs

Impact of Architectural Modifications on Deep Learning Adversarial Robustness

Understanding Robust Overfitting of Adversarial Training and Beyond