Detection of Adversarial Examples in Text Classification: Benchmark and Baseline via Robust Density Estimation

Abstract

Word-level adversarial attacks have shown success in NLP models, drastically decreasing the performance of transformer-based models in recent years. As a countermeasure, adversarial defense has been explored, but relatively few efforts have been made to detect adversarial examples. However, detecting adversarial examples may be crucial for automated tasks (e.g. review sentiment analysis) that wish to amass information about a certain population and additionally be a step towards a robust defense system. To this end, we release a dataset for four popular attack methods on four datasets and four models to encourage further research in this field. Along with it, we propose a competitive baseline based on density estimation that has the highest AUC on 29 out of 30 dataset-attack-model combinations. The source code is released. 1

CASN:Class-Aware Score Network for Textual Adversarial Detection

“…DISP performs very well on AGNEWS, which may be due to the synonyms replaced by these attack algorithms do not preserve the semantics of the original sentences well. 2) Consistently with Yoo et al (2022), FGWS works badly in the face of more subtle attacks, such as BAE and TextFooler. 3) Both RDE and MD are feature density-based methods, and in general, RDE works better than MD.…”

“…Following the work of Yoo et al (2022), we divide the detection of adversarial samples into two scenarios. Scenario 1 will detect all adversarial samples, regardless of whether the model output is successfully changed or not.…”

“…One of the most effective detection methods that can handle all textual attack algorithms is densitybased estimation approaches (Yoo et al, 2022;Feinman et al, 2017). These approaches are built on the assumption that the adversarial examples are not lying inside the non-adversarial data manifold.…”

“…Noticing that word-level adversarial algorithms often replace high-frequency words with low-frequency words,Mozes et al (2021) introduce FGWS algorithm to detect adversarial samples by word frequency properties and calibrate the adversarial samples to improve the model performance Yoo et al (2022). propose RDE which utilizes multivariate Gaussian distribution to model the feature density of clean samples.…”

Uncertainty Estimation for Debiased Models: Does Fairness Hurt Reliability?

“…Enhancing reliability can be accomplished through the use of advanced uncertainty estimation (UE) techniques (Lakshminarayanan et al, 2017;Gal and Ghahramani, 2016;Lee et al, 2018;Liu et al, 2020;Podolskiy et al, 2021;Xin et al, 2021;Yoo et al, 2022). Promoting model fairness entails defining fairness metrics and employing special debiasing techniques (Elazar and Goldberg, 2018;Wang et al, 2019;Ravfogel et al, 2020;Han et al, 2021Han et al, , 2022aBaldini et al, 2022).…”