Robustness against word substitutions has a well-defined and widely
acceptable form, i.e., using semantically similar words as substitutions, and
thus it is considered as a fundamental stepping-stone towards broader
robustness in natural language processing. Previous defense methods capture
word substitutions in vector space by using either $l_2$-ball or
hyper-rectangle, which results in perturbation sets that are not inclusive
enough or unnecessarily large, and thus impedes mimicry of worst cases for
robust training. In this paper, we introduce a novel \textit{Adversarial Sparse
Convex Combination} (ASCC) method. We model the word substitution attack space
as a convex hull and leverages a regularization term to enforce perturbation
towards an actual substitution, thus aligning our modeling better with the
discrete textual space. Based on the ASCC method, we further propose
ASCC-defense, which leverages ASCC to generate worst-case perturbations and
incorporates adversarial training towards robustness. Experiments show that
ASCC-defense outperforms the current state-of-the-arts in terms of robustness
on two prevailing NLP tasks, \emph{i.e.}, sentiment analysis and natural
language inference, concerning several attacks across multiple model
architectures. Besides, we also envision a new class of defense towards
robustness in NLP, where our robustly trained word vectors can be plugged into
a normally trained model and enforce its robustness without applying any other
defense techniques.

本文提出了一种新颖的 	extit {Adversarial Sparse Convex Combination} (ASCC) 方法，将单词替换攻击空间建模为一个凸包，并利用正则化项来实现对实际替换的扰动，从而更好地对齐离散文本空间。基于 ASCC 方法，进一步提出 ASCC-defense，它利用 ASCC 生成最坏情况扰动，并结合对抗性训练以实现鲁棒性，实验结果表明，在多个模型架构和多种攻击下，ASCC-defense 在情感分析和自然语言推理这两个主要 NLP 任务中表现优于目前的最新技术，同时本文还展示了一种新的防御方式，该防御方式将我们的鲁棒性训练的单词向量插入到一个正常训练的模型中，从而提高其鲁棒性。

迈向自然语言词替换的鲁棒性

Towards Robustness Against Natural Language Word Substitutions

Neural network NLP models are vulnerable to small modifications of the input
that maintain the original meaning but result in a different prediction. In
this paper, we focus on robustness of text classification against word
substitutions, aiming to provide guarantees that the model prediction does not
change if a word is replaced with a plausible alternative, such as a synonym.
As a measure of robustness, we adopt the notion of the maximal safe radius for
a given input text, which is the minimum distance in the embedding space to the
decision boundary. Since computing the exact maximal safe radius is not
feasible in practice, we instead approximate it by computing a lower and upper
bound. For the upper bound computation, we employ Monte Carlo Tree Search in
conjunction with syntactic filtering to analyse the effect of single and
multiple word substitutions. The lower bound computation is achieved through an
adaptation of the linear bounding techniques implemented in tools CNN-Cert and
POPQORN, respectively for convolutional and recurrent network models. We
evaluate the methods on sentiment analysis and news classification models for
four datasets (IMDB, SST, AG News and NEWS) and a range of embeddings, and
provide an analysis of robustness trends. We also apply our framework to
interpretability analysis and compare it with LIME.

本文研究神经网络 NLP 模型在遭受单词替换这一领域的攻击时的鲁棒性，并提出了一个最大安全半径的概念作为鲁棒性的度量标准，同时使用蒙特卡罗树搜索和线性边界技术计算最大安全半径的上下限。该方法在四个数据集上进行了验证，并与 LIME 进行了比较。

通过计算最大安全半径评估文本分类的稳健性

Assessing Robustness of Text Classification through Maximal Safe Radius  Computation

Recent efforts have shown that neural text processing models are vulnerable
to adversarial examples, but the nature of these examples is poorly understood.
In this work, we show that adversarial attacks against CNN, LSTM and
Transformer-based classification models perform word substitutions that are
identifiable through frequency differences between replaced words and their
corresponding substitutions. Based on these findings, we propose
frequency-guided word substitutions (FGWS), a simple algorithm exploiting the
frequency properties of adversarial word substitutions for the detection of
adversarial examples. FGWS achieves strong performance by accurately detecting
adversarial examples on the SST-2 and IMDb sentiment datasets, with F1
detection scores of up to 91.4% against RoBERTa-based classification models. We
compare our approach against a recently proposed perturbation discrimination
framework and show that we outperform it by up to 13.0% F1.

本文提出了基于词频的敌对样本检测方法（FGWS），能够通过对置换词和相应替换词之间的词频差异进行检测，实验结果表明，FGWS 能够在 SST-2 和 IMDb 情感数据集上准确检测到敌对样本，并相比最近提出的扰动辨别框架的表现提升了 13.0% F1。