Adversarial training is widely acknowledged as the most effective defense
against adversarial attacks. However, it is also well established that
achieving both robustness and generalization in adversarially trained models
involves a trade-off. The goal of this work is to provide an in depth
comparison of different approaches for adversarial training in language models.
Specifically, we study the effect of pre-training data augmentation as well as
training time input perturbations vs. embedding space perturbations on the
robustness and generalization of BERT-like language models. Our findings
suggest that better robustness can be achieved by pre-training data
augmentation or by training with input space perturbation. However, training
with embedding space perturbation significantly improves generalization. A
linguistic correlation analysis of neurons of the learned models reveal that
the improved generalization is due to `more specialized' neurons. To the best
of our knowledge, this is the first work to carry out a deep qualitative
analysis of different methods of generating adversarial examples in adversarial
training of language models.

本文比较了几种对抗训练语言模型的不同方法，包括预训练数据增强，输入空间扰动和嵌入空间扰动，发现输入空间扰动或预训练数据增强可以提高鲁棒性，而使用嵌入空间扰动可以显著提高泛化性。通过神经元的语言相关性分析表明，泛化性的提高是由于 “更加专业化” 的神经元。这是第一篇对对抗训练语言模型生成不同对抗示例方法进行深度定性分析的工作。