Deep Neural Networks have taken Natural Language Processing by storm. While
this led to incredible improvements across many tasks, it also initiated a new
research field, questioning the robustness of these neural networks by
attacking them. In this paper, we investigate four word substitution-based
attacks on BERT. We combine a human evaluation of individual word substitutions
and a probabilistic analysis to show that between 96% and 99% of the analyzed
attacks do not preserve semantics, indicating that their success is mainly
based on feeding poor data to the model. To further confirm that, we introduce
an efficient data augmentation procedure and show that many adversarial
examples can be prevented by including data similar to the attacks during
training. An additional post-processing step reduces the success rates of
state-of-the-art attacks below 5%. Finally, by looking at more reasonable
thresholds on constraints for word substitutions, we conclude that BERT is a
lot more robust than research on attacks suggests.

本文调查了针对 BERT 的四种基于词汇替换的攻击方法，结合人类评估和概率分析，发现 96% 至 99% 的攻击并不能维护语义，其成功性主要基于将质量较差的数据输入模型中。作者进一步提出了有效的数据增强方案，以防止许多对抗性攻击。最终，通过对词汇更换的约束条件设定更合理的阈值，作者得出结论：BERT 比攻击研究所说的要更加健壮。