Abstract:Although pre-trained language models (PrLMs) have achieved significant success, recent studies demonstrate that PrLMs are vulnerable to adversarial attacks. By generating adversarial examples with slight perturbations on different levels (sentence / word / character), adversarial attacks can fool PrLMs to generate incorrect predictions, which questions the robustness of PrLMs. However, we find that most existing textual adversarial examples are unnatural, which can be easily distinguished by both human and machine. Based on a general anomaly detector, we propose a novel metric (Degree of Anomaly) as a constraint to enable current adversarial attack approaches to generate more natural and imperceptible adversarial examples. Under this new constraint, the success rate of existing attacks drastically decreases, which reveals that the robustness of PrLMs is not as fragile as they claimed. In addition, we find that four types of randomization can invalidate a large portion of textual adversarial examples. Based on anomaly detector and randomization, we design a universal defense framework, which is among the first to perform textual adversarial defense without knowing the specific attack. Empirical results show that our universal defense framework achieves comparable or even higher after-attack accuracy with other specific defenses, while preserving higher original accuracy at the same time. Our work discloses the essence of textual adversarial attacks, and indicates that (1) further works of adversarial attacks should focus more on how to overcome the detection and resist the randomization, otherwise their adversarial examples would be easily detected and invalidated; and (2) compared with the unnatural and perceptible adversarial examples, it is those undetectable adversarial examples that pose real risks for PrLMs and require more attention for future robustness-enhancing strategies.

Certified Robustness to Text Adversarial Attacks by Randomized [MASK]

Text-CRS: A Generalized Certified Robustness Framework against Textual Adversarial Attacks

Towards Robustness Against Natural Language Word Substitutions

Certified Robustness to Adversarial Word Substitutions

Randomized Substitution and Vote for Textual Adversarial Example Detection.

Combating Word-level Adversarial Text with Robust Adversarial Training.

CERT-ED: Certifiably Robust Text Classification for Edit Distance

Rethinking Textual Adversarial Defense for Pre-trained Language Models

Defensive Dual Masking for Robust Adversarial Defense

CR-UTP: Certified Robustness against Universal Text Perturbations on Large Language Models

Searching for an Effective Defender: Benchmarking Defense Against Adversarial Word Substitution

MaskPure: Improving Defense Against Text Adversaries with Stochastic Purification

Robustness-Aware Word Embedding Improves Certified Robustness to Adversarial Word Substitutions

Certified Adversarial Robustness of Machine Learning-based Malware Detectors via (De)Randomized Smoothing

Certified Defense Against Patch Attacks Via Mask-Guided Randomized Smoothing

WordBlitz: an Efficient Hard-Label Textual Adversarial Attack Method Jointly Leveraging Adversarial Transferability and Word Importance

Towards Adversarially Robust Text Classifiers by Learning to Reweight Clean Examples

Adversarial Masking: Towards Understanding Robustness Trade-off for Generalization

Certified robustness to word substitution ranking attack for neural ranking models

Generating More Effective and Imperceptible Adversarial Text Examples for Sentiment Classification

TextJuggler: Fooling Text Classification Tasks by Generating High-Quality Adversarial Examples