While counterfactual examples are useful for analysis and training of NLP
models, current generation methods either rely on manual labor to create very
few counterfactuals, or only instantiate limited types of perturbations such as
paraphrases or word substitutions. We present Polyjuice, a general-purpose
counterfactual generator that allows for control over perturbation types and
locations, trained by finetuning GPT-2 on multiple datasets of paired
sentences. We show that Polyjuice produces diverse sets of realistic
counterfactuals, which in turn are useful in various distinct applications:
improving training and evaluation on three different tasks (with around 70%
less annotation effort than manual generation), augmenting state-of-the-art
explanation techniques, and supporting systematic counterfactual error analysis
by revealing behaviors easily missed by human experts.

本研究介绍了 Polyjuice，一种基于 GPT-2 的通用对抗生成器，可以控制扰动类型和位置，并且可以用于多种应用，包括提高模型训练和评估、增强状态 - of-the-art 的解释技术以及支持系统性对抗性错误分析。

Polyjuice：生成对抗样本用于模型解释、评估和优化

Polyjuice: Generating Counterfactuals for Explaining, Evaluating, and  Improving Models

We study the transfer of adversarial robustness of deep neural networks
between different perturbation types. While most work on adversarial examples
has focused on $L_\infty$ and $L_2$-bounded perturbations, these do not capture
all types of perturbations available to an adversary. The present work
evaluates 32 attacks of 5 different types against models adversarially trained
on a 100-class subset of ImageNet. Our empirical results suggest that
evaluating on a wide range of perturbation sizes is necessary to understand
whether adversarial robustness transfers between perturbation types. We further
demonstrate that robustness against one perturbation type may not always imply
and may sometimes hurt robustness against other perturbation types. In light of
these results, we recommend evaluation of adversarial defenses take place on a
diverse range of perturbation types and sizes.

研究对抗网络的对抗鲁棒性在不同扰动类型之间的转移，结果表明评估广泛范围的扰动大小是必要的，并建议在不同类型和大小的扰动下进行对抗防御的评估。

对抗鲁棒性在扰动类型之间的转移

Transfer of Adversarial Robustness Between Perturbation Types

Defenses against adversarial examples, such as adversarial training, are
typically tailored to a single perturbation type (e.g., small
$\ell_\infty$-noise). For other perturbations, these defenses offer no
guarantees and, at times, even increase the model's vulnerability. Our aim is
to understand the reasons underlying this robustness trade-off, and to train
models that are simultaneously robust to multiple perturbation types. We prove
that a trade-off in robustness to different types of $\ell_p$-bounded and
spatial perturbations must exist in a natural and simple statistical setting.
We corroborate our formal analysis by demonstrating similar robustness
trade-offs on MNIST and CIFAR10. Building upon new multi-perturbation
adversarial training schemes, and a novel efficient attack for finding
$\ell_1$-bounded adversarial examples, we show that no model trained against
multiple attacks achieves robustness competitive with that of models trained on
each attack individually. In particular, we uncover a pernicious
gradient-masking phenomenon on MNIST, which causes adversarial training with
first-order $\ell_\infty, \ell_1$ and $\ell_2$ adversaries to achieve merely
$50\%$ accuracy. Our results question the viability and computational
scalability of extending adversarial robustness, and adversarial training, to
multiple perturbation types.

针对对抗样本的防御，如对抗训练，通常针对单个干扰类型（例如小的 l∞- 噪声），对于其它类型的干扰，这些防御没有保障，甚至会增加模型的脆弱性。我们的目标是了解这种鲁棒性取舍背后的原因，并训练同时对多种扰动类型具有鲁棒性的模型。