Towards Improving Adversarial Training of NLP Models

2021/09/01 by Jin Yong Yoo, Yanjun Qi, Yoo, Jin Yong +1 · 6 citations
Computer Science · Mathematics · #Adversarial Robustness in Machine Learning #Adversarial system #Artificial Intelligence (cs.AI) #Artificial intelligence #Computation and Language (cs.CL) #Computer science #Explainable Artificial Intelligence (XAI) #FOS: Computer and information sciences #Interpretability #Machine Learning (cs.LG) #Machine learning #Mathematics #Natural language processing #Robustness (evolution) #Sentence #Topic Modeling #Word (group theory) #cs.AI #cs.CL #cs.LG

paper · pdf · doi:10.48550/arxiv.2109.00544

published in arXiv (Cornell University) (Cornell University) · EMNLP Findings 2021

openalex publication_date 2021/09/01 · arxiv created 2021/09/11 · arxiv updated 2021/09/14 · openalex created_date 2025/10/10 · openalex updated_date 2026/08/05

Abstract

Adversarial training, a method for learning robust deep neural networks, constructs adversarial examples during training. However, recent methods for generating NLP adversarial examples involve combinatorial search and expensive sentence encoders for constraining the generated instances. As a result, it remains challenging to use vanilla adversarial training to improve NLP models' performance, and the benefits are mainly uninvestigated. This paper proposes a simple and improved vanilla adversarial training process for NLP models, which we name Attacking to Training (A2T). The core part of A2T is a new and cheaper word substitution attack optimized for vanilla adversarial training. We use A2T to train BERT and RoBERTa models on IMDB, Rotten Tomatoes, Yelp, and SNLI datasets. Our results empirically show that it is possible to train robust NLP models using a much cheaper adversary. We demonstrate that vanilla adversarial training with A2T can improve an NLP model's robustness to the attack it was originally trained with and also defend the model against other types of word substitution attacks. Furthermore, we show that A2T can improve NLP models' standard accuracy, cross-domain generalization, and interpretability. Code is available at https://github.com/QData/Textattack-A2T .

Citations

• Adversarial Examples for Evaluating Reading Comprehension Systems
• Universal Sentence Encoder
• Training verified learners with learned verifiers
• On Evaluating Adversarial Robustness
• LLM-Supported Manufacturing Mapping Generation
• Adversarial Training for Large Neural Language Models
• BERT-ATTACK: Adversarial Attack Against BERT Using BERT
• Reevaluating Adversarial Examples in Natural Language
• Searching for a Search Method: Benchmarking Search Algorithms for Generating NLP Adversarial Examples
• Towards Robustness Against Natural Language Word Substitutions

Cited by

• Adversarially Robust Detection of Harmful Online Content: A Computational Design Science Approach
• Selective Adversarial Attacks on LLM Benchmarks
• Overcoming Black-box Attack Inefficiency with Hybrid and Dynamic Select Algorithms
• DINA: A Dual Defense Framework Against Internal Noise and External Attacks in Natural Language Processing
• SoK: The Privacy Paradox of Large Language Models: Advancements, Privacy Risks, and Mitigation
• BadNAVer: Exploring Jailbreak Attacks On Vision-and-Language Navigation

Related

• Adversarial Training for Improving Model Robustness? Look at Both Prediction and Interpretation
• TextAttack: A Framework for Adversarial Attacks, Data Augmentation, and Adversarial Training in NLP
• Searching for an Effective Defender: Benchmarking Defense against Adversarial Word Substitution
• Adversarial Training for Large Neural Language Models
• Fast Adversarial Training against Textual Adversarial Attacks