Residue-Based Natural Language Adversarial Attack Detection (2022-04-17T00:00:00.000000Z)

TL;DR

This work proposes a simple sentence-embedding “residue” based detector to identify adversarial examples that out-performs ported image domain detectors and recent state of the art NLP specific detectors.

Abstract

Deep learning based systems are susceptible to adversarial attacks, where a small, imperceptible change at the input alters the model prediction. However, to date the majority of the approaches to detect these attacks have been designed for image processing systems. Many popular image adversarial detection approaches are able to identify adversarial examples from embedding feature spaces, whilst in the NLP domain existing state of the art detection approaches solely focus on input text features, without consideration of model embedding spaces. This work examines what differences result when porting these image designed strategies to Natural Language Processing (NLP) tasks - these detectors are found to not port over well. This is expected as NLP systems have a very different form of input: discrete and sequential in nature, rather than the continuous and fixed size inputs for images. As an equivalent model-focused NLP detection approach, this work proposes a simple sentence-embedding “residue” based detector to identify adversarial examples. On many tasks, it out-performs ported image domain detectors and recent state of the art NLP specific detectors.

Authors

M. Gales

4 papers

Vyas Raina

2 papers

TL;DR

Abstract

Authors

References66 items

Towards Improving Adversarial Training of NLP Models

Universal Adversarial Attacks on Spoken Language Assessment Systems

Adversarial Attack and Defense of Structured Prediction Models

Frequency-Guided Word Substitutions for Detecting Textual Adversarial Examples

A Study of Black Box Adversarial Attacks in Computer Vision

Learning to Characterize Adversarial Subspaces

Detecting Adversarial Samples Using Influence Functions and Nearest Neighbors

Learning to Discriminate Perturbations for Blocking Adversarial Attacks in Text Classification

Generating Natural Language Adversarial Examples through Probability Weighted Word Saliency

TextBugger: Generating Adversarial Text Against Real-world Applications

Attack

Adversarial Examples Detection in Features Distance Spaces

Adversarial Reprogramming of Sequence Classification Neural Networks

Adversarial Over-Sensitivity and Over-Stability Strategies for Dialogue Models

Comparing Attention-Based Convolutional and Recurrent Neural Networks: Success and Limitations in Machine Reading Comprehension

Adversarially Regularising Neural NLI Models to Integrate Logical Background Knowledge

Human

A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks

Semantically Equivalent Adversarial Rules for Debugging NLP models

Adversarial Example Generation with Syntactically Controlled Paraphrase Networks

Robust Machine Comprehension Models via Adversarial Training

Universal Sentence Encoder

Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples

Understanding Measures of Uncertainty for Adversarial Example Detection

Identify Susceptible Locations in Medical Records via Adversarial Attacks on Deep Predictive Models

Adversarial Deep Learning for Robust Detection of Binary Encoded Malware

Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality

Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning

Generating Natural Adversarial Examples

Adversarial Examples for Evaluating Reading Comprehension Systems

Generic Black-Box End-to-End Attack against RNNs and Other API Calls Based Malware Classifiers

Towards Crafting Text Adversarial Samples

Grammatical Error Correction with Neural Reinforcement Learning

Attention is All you Need

Detecting Adversarial Samples from Artifacts

Adversarial Examples Detection in Deep Networks with Convolutional Filter Statistics

Adversarial Machine Learning at Scale

Leveraging uncertainty information from deep neural networks for disease detection

Universal Adversarial Perturbations

Adversarial Perturbations Against Deep Neural Networks for Malware Classification

Crafting adversarial input sequences for recurrent neural networks

CUED-RNNLM — An open-source toolkit for efficient training and evaluation of recurrent neural network language models

Deep Residual Learning for Image Recognition

Character-level Convolutional Networks for Text Classification

Dropout as a Bayesian Approximation: Representing Model Uncertainty in Deep Learning

Explaining and Harnessing Adversarial Examples

Microsoft COCO: Common Objects in Context

Intriguing properties of neural networks

Learning Word Vectors for Sentiment Analysis

Real-Word Spelling Correction using Google Web 1T 3-grams

Context based spelling correction

Detecting Adversarial Samples Using Inﬂuence Functions and Nearest Neighbors

BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding

CARER: Contextualized Affect Representations for Emotion Recognition

Leveraging uncertainty 787 information from deep neural networks for disease 788 detection Textbugger : Generating adversar - 791 ial text against real - world applications

Uncertainty in Deep Learning

The BULATS online speaking test

Cifar-100 (canadian institute for advanced research). cifar

Common European Framework of Reference for Languages: learning, teaching, assessment

ELECTRA: pretraining text encoders as discriminators rather than generators. CoRR, abs

TextAttack : A frame - 829 work for adversarial attacks , data augmentation , and 830 adversarial training in NLP

BERT 1e-5 8 2 Twitter

768-hidden dimension, 110M parameters) Trans-former encoders 6 were ﬁne-tuned during training. Table A.1 gives

the impact of the adversarial attacks using fooling rate, whilst for the L-Bus task, the average output score from the given

embedding space PCA residue plots for all the not included in the main text. Table A.2 compares the impact on error

using l 2 and l ∞ norms) and metric, N σ for the original text

Field of Study

Journal Information

Name

Volume

Venue Information

Name

Type

URL

Alternate Names