Certified Robustness to Adversarial Word Substitutions

Jia, Robin; Raghunathan, Aditi; Göksel, Kerem; Liang, Percy

doi:10.48550/arxiv.1909.00986

Cited by 22 publications

(30 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…• The IMDb Movie Reviews dataset (Maas et al, 2011) has a total vocabulary size of 145,901, where a pre-specified set of 26,078 words are subject to redaction in the text generation mechanism (those are the words selected for adversarial model training in (Jia et al, 2019)). The utility task is the sentence-level binary sentiment classification, where the underlying model is a bidirectional LSTM using 90% of the data for training and 10% for testing.…”

Section: Resultsmentioning

confidence: 99%

On a Utilitarian Approach to Privacy Preserving Text Generation

Aggarwal

Feyisetan

et al. 2021

Preprint

View full text Add to dashboard Cite

Differentially-private mechanisms for text generation typically add carefully calibrated noise to input words and use the nearest neighbor to the noised input as the output word. When the noise is small in magnitude, these mechanisms are susceptible to reconstruction of the original sensitive text. This is because the nearest neighbor to the noised input is likely to be the original input. To mitigate this empirical privacy risk, we propose a novel class of differentially private mechanisms that parameterizes the nearest neighbor selection criterion in traditional mechanisms. Motivated by Vickrey auction, where only the second highest price is revealed and the highest price is kept private, we balance the choice between the first and the second nearest neighbors in the proposed class of mechanisms using a tuning parameter. This parameter is selected by empirically solving a constrained optimization problem for maximizing utility, while maintaining the desired privacy guarantees. We argue that this empirical measurement framework can be used to align different mechanisms along a common benchmark for their privacy-utility tradeoff, particularly when different distance metrics are used to calibrate the amount of noise added. Our experiments on real text classification datasets show up to 50% improvement in utility compared to the existing state-of-the-art with the same empirical privacy guarantee.

show abstract

Section: Resultsmentioning

confidence: 99%

On a Utilitarian Approach to Privacy Preserving Text Generation

Aggarwal

Feyisetan

et al. 2021

Preprint

View full text Add to dashboard Cite

show abstract

“…The IBP tightness metric has been utilized in several research works [27], [47], [109], [119]. For example, in [27], Shi et al used the IBP tightness to study the robustness verification problem for transformers.…”

Section: Ibp Bounds Tightnessmentioning

confidence: 99%

“…For example, in [27], Shi et al used the IBP tightness to study the robustness verification problem for transformers. In [47], Jia et al used the same metric to study certified robustness to word substitutions and considered an exponentially large family of label-preserving transformations where each word in the input text can be swapped with a similar one. The advantage of using the IBP tightness metric is that it can be used to evaluate verifiable robustness of NLP models to word substitution attacks.…”

Section: Ibp Bounds Tightnessmentioning

confidence: 99%

See 1 more Smart Citation

Robust Natural Language Processing: Recent Advances, Challenges, and Future Directions

Omar¹,

Choi²,

Nyang³

et al. 2022

Preprint

View full text Add to dashboard Cite

Recent natural language processing (NLP) techniques have accomplished high performance on benchmark datasets, primarily due to the significant improvement in the performance of deep learning. The advances in the research community have led to great enhancements in state-of-the-art production systems for NLP tasks, such as virtual assistants, speech recognition, and sentiment analysis. However, such NLP systems still often fail when tested with adversarial attacks. The initial lack of robustness exposed troubling gaps in current models' language understanding capabilities, creating problems when NLP systems are deployed in real life. In this paper, we present a structured overview of NLP robustness research by summarizing the literature in a systemic way across various dimensions. We then take a deep-dive into the various dimensions of robustness, across techniques, metrics, embeddings, and benchmarks. Finally, we argue that robustness should be multi-dimensional, provide insights into current research, identify gaps in the literature to suggest directions worth pursuing to address these gaps.

show abstract

“…Adversarial robustness. Multiple prior works have studied a subset of the audit problem in terms of adversarial robustness [48,49,24,[50][51][52][53][54][55][56][57]. Adversarial examples are small perturbations to the input (for images at the level of pixels; for text at the level of words) which mislead the deep learning model.…”

Section: Related Workmentioning

confidence: 99%

Auditing AI models for Verified Deployment under Semantic Specifications

Bharadhwaj¹,

Huang²,

Xiao³

et al. 2021

Preprint

View full text Add to dashboard Cite

Auditing trained deep learning (DL) models prior to deployment is vital in preventing unintended consequences. One of the biggest challenges in auditing is in understanding how we can obtain human-interpretable specifications that are directly useful to the end-user. We address this challenge through a sequence of semantically-aligned unit tests, where each unit test verifies whether a predefined specification (e.g., accuracy over 95%) is satisfied with respect to controlled and semantically aligned variations in the input space (e.g., in face recognition, the angle relative to the camera). We perform these unit tests by directly verifying the semantically aligned variations in an interpretable latent space of a generative model. Our framework, AuditAI, bridges the gap between interpretable formal verification and scalability. With evaluations on four different datasets, covering images of towers, chest X-rays, human faces, and ImageNet classes, we show how AuditAI allows us to obtain controlled variations for verification and certified training while addressing the limitations of verifying using only pixel-space perturbations. A blog post accompanying the paper is at this link auditai.github.io

show abstract

Certified Robustness to Adversarial Word Substitutions

Cited by 22 publications

References 13 publications

On a Utilitarian Approach to Privacy Preserving Text Generation

On a Utilitarian Approach to Privacy Preserving Text Generation

Robust Natural Language Processing: Recent Advances, Challenges, and Future Directions

Auditing AI models for Verified Deployment under Semantic Specifications

Contact Info

Product

Resources

About