To combat adversarial spelling mistakes, we propose placing a word
recognition model in front of the downstream classifier. Our word recognition
models build upon the RNN semi-character architecture, introducing several new
backoff strategies for handling rare and unseen words. Trained to recognize
words corrupted by random adds, drops, swaps, and keyboard mistakes, our method
achieves 32% relative (and 3.3% absolute) error reduction over the vanilla
semi-character model. Notably, our pipeline confers robustness on the
downstream classifier, outperforming both adversarial training and
off-the-shelf spell checkers. Against a BERT model fine-tuned for sentiment
analysis, a single adversarially-chosen character attack lowers accuracy from
90.3% to 45.8%. Our defense restores accuracy to 75%. Surprisingly, better word
recognition does not always entail greater robustness. Our analysis reveals
that robustness also depends upon a quantity that we denote the sensitivity.

为应对对抗性拼写错误，本文提出在下游分类器前放置一个单词识别模型。该方法使用基于 RNN 的半字符架构的单词识别模型，并引入了几种新的回退策略来处理罕见和未见单词。与半字符模型相比，该方法实现了 32% 的相对误差降低（和 3.3% 的绝对误差降低）。本文提出的方法不仅可以提升鲁棒性，还可以超越敌对训练和现成的拼写检查器。