Certified Robustness to Text Adversarial Attacks by Randomized [MASK]

2021/05/08 by Jiehang Zeng, Zeng, Jiehang, Xiaoqing Zheng +9 · 8 citations
Computer Science · #Adversarial Robustness in Machine Learning #Computation and Language (cs.CL) #FOS: Computer and information sciences #Hate Speech and Cyberbullying Detection

paper · pdf · doi:10.48550/arxiv.2105.03743

openalex publication_date 2021/05/08 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Recently, few certified defense methods have been developed to provably guarantee the robustness of a text classifier to adversarial synonym substitutions. However, all existing certified defense methods assume that the defenders are informed of how the adversaries generate synonyms, which is not a realistic scenario. In this paper, we propose a certifiably robust defense method by randomly masking a certain proportion of the words in an input text, in which the above unrealistic assumption is no longer necessary. The proposed method can defend against not only word substitution-based attacks, but also character-level perturbations. We can certify the classifications of over 50% texts to be robust to any perturbation of 5 words on AGNEWS, and 2 words on SST2 dataset. The experimental results show that our randomized smoothing method significantly outperforms recently proposed defense methods across multiple datasets.

Cited by

• RobustMask: Certified Robustness against Adversarial Neural Ranking Attack via Randomized Masking
• Adversarially Robust Detection of Harmful Online Content: A Computational Design Science Approach
• AdaptDel: Adaptable Deletion Rate Randomized Smoothing for Certified Robustness
• RedHerring Attack: Testing the Reliability of Attack Detection
• Guided Perturbation Sensitivity (GPS): Detecting Adversarial Text via Embedding Stability and Word Importance
• Adversarial Defence without Adversarial Defence: Enhancing Language Model Robustness via Instance-level Principal Component Removal
• Bridging Robustness and Generalization Against Word Substitution Attacks in NLP via the Growth Bound Matrix Approach
• Generative or Discriminative? Revisiting Text Classification in the Era of Transformers

Related

• CR-UTP: Certified Robustness against Universal Text Perturbations on Large Language Models
• Defense of Word-level Adversarial Attacks via Random Substitution Encoding
• Adversarial Text Purification: A Large Language Model Approach for Defense
• Detecting Textual Adversarial Examples through Randomized Substitution and Vote
• Rethinking Textual Adversarial Defense for Pre-trained Language Models