Pre-trained language models (PLMs) are shown to be vulnerable to minor word
changes, which poses a big threat to real-world systems. While previous studies
directly focus on manipulating word inputs, they are limited by their means of
generating adversarial samples, lacking generalization to versatile real-world
attack. This paper studies the basic structure of transformer-based PLMs, the
self-attention (SA) mechanism. (1) We propose a powerful perturbation technique
\textit{HackAttend}, which perturbs the attention scores within the SA matrices
via meticulously crafted attention masks. We show that state-of-the-art PLMs
fall into heavy vulnerability that minor attention perturbations $(1\%)$ can
produce a very high attack success rate $(98\%)$. Our paper expands the
conventional text attack of word perturbations to more general structural
perturbations. (2) We introduce \textit{S-Attend}, a novel smoothing technique
that effectively makes SA robust via structural perturbations. We empirically
demonstrate that this simple yet effective technique achieves robust
performance on par with adversarial training when facing various text
attackers. Code is publicly available at \url{github.com/liongkj/HackAttend}.

通过精心设计的注意力掩码，我们提出了强大的扰动技术 “HackAttend”，通过故意扰乱 SA 矩阵中的注意力分数，揭示了当前最先进的预训练语言模型在注意力微扰下的高度脆弱性，以及我们引入的新型平滑技术 “S-Attend” 在面对各种文本攻击时实现了与对抗训练相当的鲁棒性。

揭示自注意机制的漏洞

Unveiling Vulnerability of Self-Attention

While Visual Question Answering (VQA) has progressed rapidly, previous works
raise concerns about robustness of current VQA models. In this work, we study
the robustness of VQA models from a novel perspective: visual context. We
suggest that the models over-rely on the visual context, i.e., irrelevant
objects in the image, to make predictions. To diagnose the model's reliance on
visual context and measure their robustness, we propose a simple yet effective
perturbation technique, SwapMix. SwapMix perturbs the visual context by
swapping features of irrelevant context objects with features from other
objects in the dataset. Using SwapMix we are able to change answers to more
than 45 % of the questions for a representative VQA model. Additionally, we
train the models with perfect sight and find that the context over-reliance
highly depends on the quality of visual representations. In addition to
diagnosing, SwapMix can also be applied as a data augmentation strategy during
training in order to regularize the context over-reliance. By swapping the
context object features, the model reliance on context can be suppressed
effectively. Two representative VQA models are studied using SwapMix: a
co-attention model MCAN and a large-scale pretrained model LXMERT. Our
experiments on the popular GQA dataset show the effectiveness of SwapMix for
both diagnosing model robustness and regularizing the over-reliance on visual
context. The code for our method is available at
this https URL

通过一种名为 SwapMix 的简单有效的扰动技术，我们发现可代表性 VQA 模型的问题答案可以被改变超过 45％。此外，我们还发现模型的上下文依赖性高度取决于视觉表征的质量，并且 SwapMix 可以作为数据增强策略应用于训练中以调整上下文依赖性。

SwapMix: 检测和规范视觉问答中过度依赖视觉上下文

SwapMix: Diagnosing and Regularizing the Over-Reliance on Visual Context in Visual Question Answering

The growing popularity of location-based systems, allowing unknown/untrusted
servers to easily collect huge amounts of information regarding users'
location, has recently started raising serious privacy concerns. In this paper
we study geo-indistinguishability, a formal notion of privacy for
location-based systems that protects the user's exact location, while allowing
approximate information - typically needed to obtain a certain desired service
- to be released. Our privacy definition formalizes the intuitive notion of
protecting the user's location within a radius r with a level of privacy that
depends on r, and corresponds to a generalized version of the well-known
concept of differential privacy. Furthermore, we present a perturbation
technique for achieving geo-indistinguishability by adding controlled random
noise to the user's location. We demonstrate the applicability of our technique
on a LBS application. Finally, we compare our mechanism with other ones in the
literature. It turns our that our mechanism offers the best privacy guarantees,
for the same utility, among all those which do not depend on the prior.

本文介绍了基于位置系统中用户隐私问题，提出了一种新的保障用户位置隐私的定义，并通过在用户位置中添加控制随机噪声的扰动技术来实现此目的，并与其他文献中的保护机制进行比较，结果表明我们的机制在不依赖于先验知识的情况下，为用户提供了最好的隐私保障。