Abstract:Neural language models show vulnerability to adversarial examples which are semantically similar to their original counterparts with a few words replaced by their synonyms. A common way to improve model robustness is adversarial training which follows two steps-collecting adversarial examples by attacking a target model, and fine-tuning the model on the augmented dataset with these adversarial examples. The objective of traditional adversarial training is to make a model produce the same correct predictions on an original/adversarial example pair. However, the consistency between model decision-makings on two similar texts is ignored. We argue that a robust model should behave consistently on original/adversarial example pairs, that is making the same predictions (what) based on the same reasons (how) which can be reflected by consistent interpretations. In this work, we propose a novel feature-level adversarial training method named FLAT. FLAT aims at improving model robustness in terms of both predictions and interpretations. FLAT incorporates variational word masks in neural networks to learn global word importance and play as a bottleneck teaching the model to make predictions based on important words. FLAT explicitly shoots at the vulnerability problem caused by the mismatch between model understandings on the replaced words and their synonyms in original/adversarial example pairs by regularizing the corresponding global word importance scores. Experiments show the effectiveness of FLAT in improving the robustness with respect to both predictions and interpretations of four neural network models (LSTM, CNN, BERT, and DeBERTa) to two adversarial attacks on four text classification tasks. The models trained via FLAT also show better robustness than baseline models on unforeseen adversarial examples across different attacks.

Enhancing Model Robustness Via Lexical Distilling

Methods for Estimating and Improving Robustness of Language Models

Adversarial Training for Improving Model Robustness? Look at Both Prediction and Interpretation

Improving the Robustness of Deep Reading Comprehension Models by Leveraging Syntax Prior.

Robust Semantic Communications Against Semantic Noise

Towards Robust Neural Machine Translation

Enhancing Model Robustness By Incorporating Adversarial Knowledge Into Semantic Representation

Robustness to Modification with Shared Words in Paraphrase Identification

RMLM: A Flexible Defense Framework for Proactively Mitigating Word-level Adversarial Attacks.

Robust Reading Comprehension with Linguistic Constraints Via Posterior Regularization.

Adversarial Examples with Difficult Common Words for Paraphrase Identification

Robustness-Aware Word Embedding Improves Certified Robustness to Adversarial Word Substitutions

An Integrated Approach to Produce Robust Models with High Efficiency

Model-tuning Via Prompts Makes NLP Models Adversarially Robust

On Robustness of Prompt-based Semantic Parsing with Large Pre-trained Language Model: An Empirical Study on Codex

Enhance Robustness of Sequence Labelling with Masked Adversarial Training.

From Adversarial Arms Race to Model-centric Evaluation: Motivating a Unified Automatic Robustness Evaluation Framework

Whispers of Doubt Amidst Echoes of Triumph in NLP Robustness

Towards Robustness Against Natural Language Word Substitutions

Evaluating Concurrent Robustness of Language Models Across Diverse Challenge Sets

Improving Lexical Embeddings for Robust Question Answering