How Should Pre-Trained Language Models Be Fine-Tuned Towards Adversarial Robustness?

2021/12/22 by Dong, Xinhsuai, Tuan, Luu Anh, Min Lin +5 · 5 citations
Computer Science · #Adversarial Robustness in Machine Learning #Computation and Language (cs.CL) #FOS: Computer and information sciences #Hate Speech and Cyberbullying Detection #Machine Learning (cs.LG) #Topic Modeling

paper · pdf · doi:10.48550/arxiv.2112.11668

openalex created_date 2021/11/22 · openalex publication_date 2021/12/22 · openalex updated_date 2026/07/28

Abstract

The fine-tuning of pre-trained language models has a great success in many NLP fields. Yet, it is strikingly vulnerable to adversarial examples, e.g., word substitution attacks using only synonyms can easily fool a BERT-based sentiment analysis model. In this paper, we demonstrate that adversarial training, the prevalent defense technique, does not directly fit a conventional fine-tuning scenario, because it suffers severely from catastrophic forgetting: failing to retain the generic and robust linguistic features that have already been captured by the pre-trained model. In this light, we propose Robust Informative Fine-Tuning (RIFT), a novel adversarial fine-tuning method from an information-theoretical perspective. In particular, RIFT encourages an objective model to retain the features learned from the pre-trained model throughout the entire fine-tuning process, whereas a conventional one only uses the pre-trained weights for initialization. Experimental results show that RIFT consistently outperforms the state-of-the-arts on two popular NLP tasks: sentiment analysis and natural language inference, under different attacks across various pre-trained language models.

Citations

• Theoretically Principled Trade-off between Robustness and Accuracy
• On Mutual Information Maximization for Representation Learning
• A Simple Framework for Contrastive Learning of Visual Representations

Cited by

• VisMoDAl: Visual Analytics for Evaluating and Improving Corruption Robustness of Vision-Language Models
• Paladin: Defending LLM-enabled Phishing Emails with a New Trigger-Tag Paradigm
• End-to-End On-Device Quantization-Aware Training for LLMs at Inference Cost
• Leveraging Transfer Learning to Overcome Data Limitations in Czochralski Crystal Growth
• Pay Attention to Attention Distribution: A New Local Lipschitz Bound for Transformers

Related

• Fast Adversarial Training against Textual Adversarial Attacks
• Adversarial Training for Improving Model Robustness? Look at Both Prediction and Interpretation
• Causal Adversarial Training for Improving Language Understanding and Robustness
• RoAST: Robustifying Language Models via Adversarial Perturbation with Selective Training
• Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Models