Certified Robustness to Word Substitution Ranking Attack for Neural Ranking Models

Wu, Chen; Zhang, Ruqing; Guo, Jiafeng; Chen, Wei; Fan, Yixing; Rijke, Maarten de; Cheng, Xueqi

doi:10.1145/3511808.3557256

Cited by 4 publications

(5 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…9) without defense mechanisms. (ii) Data augmentation (DA): We augment each document in the collection with 2 new documents by uniformly replacing synonyms, and then use the normal hinge loss for training following (Wu et al 2022). The number of replacement words equals the number of words perturbed by the WSRA attack.…”

Section: Baselines (I) Standard Training (St)mentioning

confidence: 99%

“…(iii) Adversarial training (AT): We follow the vanilla AT method (Goodfellow, Shlens, and Szegedy 2015) to directly include the adversarial examples during training. (iv) CertDR is a certified defense method for NRMs (Wu et al 2022), which achieves certified top-K robustness against WSRA attacks. Implementation details.…”

Section: Baselines (I) Standard Training (St)mentioning

confidence: 99%

“…Certified defenses aim for theoretical robustness against specific adversarial perturbations (Raghunathan, Steinhardt, and Liang 2018). For instance, Wu et al (2022) introduced a certified defense method that ensures the top-K robustness of NRMs via randomized smoothing. However, due to their theoretical nature, these methods often face limitations in practical applications and may not fully meet the desired performance requirements.…”

Section: Related Workmentioning

confidence: 99%

“…Trade-off performance of different ranking models under PIAT and defense baselines; For CertDR, the ASR is evaluated under conditional success rate(Wu et al 2022); * indicates significant improvements over the best baseline (p ≤ 0.05).…”

mentioning

confidence: 99%

See 3 more Smart Citations

Perturbation-Invariant Adversarial Training for Neural Ranking Models: Improving the Effectiveness-Robustness Trade-Off

Liu,

Zhang,

Zhang

et al. 2024

AAAI

View full text Add to dashboard Cite

Neural ranking models (NRMs) have shown great success in information retrieval (IR). But their predictions can easily be manipulated using adversarial examples, which are crafted by adding imperceptible perturbations to legitimate documents. This vulnerability raises significant concerns about their reliability and hinders the widespread deployment of NRMs. By incorporating adversarial examples into training data, adversarial training has become the de facto defense approach to adversarial attacks against NRMs. However, this defense mechanism is subject to a trade-off between effectiveness and adversarial robustness. In this study, we establish theoretical guarantees regarding the effectiveness-robustness trade-off in NRMs. We decompose the robust ranking error into two components, i.e., a natural ranking error for effectiveness evaluation and a boundary ranking error for assessing adversarial robustness. Then, we define the perturbation invariance of a ranking model and prove it to be a differentiable upper bound on the boundary ranking error for attainable computation. Informed by our theoretical analysis, we design a novel perturbation-invariant adversarial training (PIAT) method for ranking models to achieve a better effectiveness-robustness trade-off. We design a regularized surrogate loss, in which one term encourages the effectiveness to be maximized while the regularization term encourages the output to be smooth, so as to improve adversarial robustness. Experimental results on several ranking models demonstrate the superiority of PITA compared to existing adversarial defenses.

show abstract

Section: Baselines (I) Standard Training (St)mentioning

confidence: 99%

Section: Baselines (I) Standard Training (St)mentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

mentioning

confidence: 99%

See 2 more Smart Citations

Perturbation-Invariant Adversarial Training for Neural Ranking Models: Improving the Effectiveness-Robustness Trade-Off

Liu,

Zhang,

Zhang

et al. 2024

AAAI

View full text Add to dashboard Cite

show abstract

“…Zeng et al [31] present a certified approach by randomly masking a proportion of the input words and discarding a common but unrealistic assumption. Wu et al [26] leverage ranking and statistical property to achieve provable certification of top-K robustness. In addition to these two representative technical ideas, Xu et al [27] demonstrate a dynamic programming approach to concretize linear bounds under discrete perturbations.…”

Section: Related Workmentioning

confidence: 99%

Towards Trustworthy NLP: An Adversarial Robustness Enhancement Based on Perplexity Difference

Ge,

Hu,

Zhao

2023

Frontiers in Artificial Intelligence and Applications

View full text Add to dashboard Cite

The vulnerability of artificial intelligence has emerged as a bottleneck, with adversarial attacks posing a significant threat to natural language processing. Although multiple defense mechanisms have been proposed, they often suffer from strict constraints, weak generalization, and low scalability. To address these challenges, we propose leveraging perplexity to quantify the difference between clean and adversarial examples based on the observation of numerous cases. We then statistically prove the substantial difference between them using Bayesian hypothesis testing. Subsequently, we develop an adversarial defense framework named UMPS, which contains two branches: “Uncovering the Mask”(UM) and “Perplexity-guided Sampling”(PS). UM utilizes a masked language model and Jaro-Winkler distance constraint to recover out-of-vocabulary words, while PS employs perplexity to locate the optimal sample within a convex hull which is constructed with integrated gradients. Theoretically, the proposed framework fulfills three requirements: effectiveness, universality, and portability. The experimental results demonstrate that UMPS effectively enhances the robustness of language models including BERT, against advanced attacks and outperforms three strong baseline methods. Furthermore, we conduct an instance analysis to illustrate how UMPS functions and what it outputs, an ablation study to support the validity and necessity of the two branches, and an post-hoc test on the difference in perplexity to explains the defense performance of our framework.

show abstract

A Study on FGSM Adversarial Training for Neural Retrieval

Lupart¹,

Clinchant²

2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Certified Robustness to Word Substitution Ranking Attack for Neural Ranking Models

Cited by 4 publications

References 25 publications

Perturbation-Invariant Adversarial Training for Neural Ranking Models: Improving the Effectiveness-Robustness Trade-Off

Perturbation-Invariant Adversarial Training for Neural Ranking Models: Improving the Effectiveness-Robustness Trade-Off

Towards Trustworthy NLP: An Adversarial Robustness Enhancement Based on Perplexity Difference

A Study on FGSM Adversarial Training for Neural Retrieval

Contact Info

Product

Resources

About