BERT-Defense: A Probabilistic Model Based on BERT to Combat Cognitively Inspired Orthographic Adversarial Attacks

Abstract

Adversarial attacks expose important blind spots of deep learning systems. While wordand sentence-level attack scenarios mostly deal with finding semantic paraphrases of the input that fool NLP models, character-level attacks typically insert typos into the input stream. It is commonly thought that these are easier to defend via spelling correction modules. In this work, we show that both a standard spellchecker and the approach of Pruthi et al. ( 2019), which trains to defend against insertions, deletions and swaps, perform poorly on the character-level benchmark recently proposed in Eger and Benz (2020) which includes more challenging attacks such as visual and phonetic perturbations and missing word segmentations. In contrast, we show that an untrained iterative approach which combines context-independent character-level information with context-dependent information from BERT's masked language modeling can perform on par with human crowd-workers from Amazon Mechanical Turk (AMT) supervised via 3-shot learning.

Study on Network Virtual Printing Sculpture Design using Artificial Intelligence

“…The randomisation method used in this work prevents backpropagation in gradients, thus confining the adversarial attack to bypass the model. Another model is to prevent adversarial attacks on textual content by using an untrained iterative approach that integrates context-independent and dependent character-level features [25]. Erik Jones et al introduced a robust encoding framework, which assured robustness in preventing adversarial attacks on textural content [26].…”

A survey in Adversarial Defences and Robustness in NLP

“…As a backing off step the word recognizer either passes the UNK word as is, backs off to a neutral word or backs off to a more general word recognition model trained on a larger, less specific corpus. In the work [45] authors demonstrated the limitations of spell checker for perturbation identification & correction. They proposed a method in which context independent probability distribution are created by segmenting the perturbed sentence using BERT tokens and modified version of levenshtein distance.…”

OCR post-correction for detecting adversarial text images

“…The defence method was able to restore BERT's accuracy from 45% to 75% against character-level adversarial attacks. Another BERTdefence method was proposed in [25] and it outperforms spell checker and ScRNN. The authors have not considered the adaptability and interpertability which are important factors to ensure longevity.…”

“…Since calculating the edited distance, adding extra step and retraining ScRNN [36] are expensive and time consuming, we choose to use a spell checker in this paper. Although the model proposed in [25] outperforms the spell checker and ScRNN, it consists of 3 steps, which include a BERT and a language model. This adds extra computation time and complexity when used as an OCR post-correction.…”