TREATED:Towards Universal Defense against Textual Adversarial Attacks

Abstract

Recent work shows that deep neural networks are vulnerable to adversarial examples. Much work studies adversarial example generation, while very little work focuses on more critical adversarial defense. Existing adversarial detection methods usually make assumptions about the adversarial example and attack method (e.g., the word frequency of the adversarial example, the perturbation level of the attack method). However, this limits the applicability of the detection method. To this end, we propose TREATED, a universal adversarial detection method that can defend against attacks of various perturbation levels without making any assumptions. TREATED identifies adversarial examples through a set of well-designed reference models. Extensive experiments on three competitive neural networks and two widely used datasets show that our method achieves better detection performance than baselines. We finally conduct ablation studies to verify the effectiveness of our method.

ZDDR: A Zero-Shot Defender for Adversarial Samples Detection and Restoration

“…FGWS [39]: Recognizing word substitutions via frequency disparities between original words and substitutes, the method substitutes infrequent terms with more prevalent synonyms, marking a sample as adversarial if prediction shifts surpass set limits. Furthermore, two restorations baselines were also considered: TREATED [42]: Presents a universal defense strategy named TREATED, which leverages multiple reference models to differentiate predictions between original and adversarial data. Adversarial instances, when identified, are restricted from entering the classification model and are instead utilized for adversarial training to enhance model robustness.…”

“…Building upon ScRNN, ScRNN with Fallbacks [41] offers mechanisms to handle 'unknown' words by either leaving them as is, substituting with a neutral term, or turning to an extensive word recognition model. TREATED [42] stands out by defending against universal disturbances without assumptions, relying on multiple reference models to predict on both clean and adversarial samples. The consistency of these models across datasets is its key strength.…”

A survey in Adversarial Defences and Robustness in NLP

“…They further proposed defense strategies by detection of hacked inputs and output correct results and preserving the correct input and giving its output. In a different line, the work Zhu et al [139] proposed a universal perturbation detection method, TREATED to defend against various perturbation levels without making any priory assumptions. They utilized several reference models to make different predictions about clean and adversarial examples and block them if found adversarial.…”