Despite neural networks have achieved prominent performance on many natural
language processing (NLP) tasks, they are vulnerable to adversarial examples.
In this paper, we propose Dirichlet Neighborhood Ensemble (DNE), a randomized
smoothing method for training a robust model to defense substitution-based
attacks. During training, DNE forms virtual sentences by sampling embedding
vectors for each word in an input sentence from a convex hull spanned by the
word and its synonyms, and it augments them with the training data. In such a
way, the model is robust to adversarial attacks while maintaining the
performance on the original clean data. DNE is agnostic to the network
architectures and scales to large models for NLP applications. We demonstrate
through extensive experimentation that our method consistently outperforms
recently proposed defense methods by a significant margin across different
network architectures and multiple data sets.

本文提出 Dirichlet Neighborhood Ensemble (DNE) 方法，用于训练 Robust 模型以防御替换攻击，通过抽样 embedding 向量形成虚拟句子，并在训练集上增加确保模型在干净的原始数据上保持良好性能，实验证明该方法在不同网络架构和多个数据集上均明显优于其他最近提出的防御方法。