Certified Robustness to Word Substitution Attack with Differential Privacy
Autor: | Wenjie Wang, Li Xiong, Pengfei Tang, Jian Lou |
---|---|
Rok vydání: | 2021 |
Předmět: |
Computer science
business.industry 010401 analytical chemistry Substitution (logic) Inference Context (language use) 010501 environmental sciences Machine learning computer.software_genre 01 natural sciences 0104 chemical sciences Exponential function Domain (software engineering) Robustness (computer science) Differential privacy Artificial intelligence business computer Word (computer architecture) 0105 earth and related environmental sciences |
Zdroj: | NAACL-HLT |
Popis: | The robustness and security of natural language processing (NLP) models are significantly important in real-world applications. In the context of text classification tasks, adversarial examples can be designed by substituting words with synonyms under certain semantic and syntactic constraints, such that a well-trained model will give a wrong prediction. Therefore, it is crucial to develop techniques to provide a rigorous and provable robustness guarantee against such attacks. In this paper, we propose WordDP to achieve certified robustness against word substitution at- tacks in text classification via differential privacy (DP). We establish the connection between DP and adversarial robustness for the first time in the text domain and propose a conceptual exponential mechanism-based algorithm to formally achieve the robustness. We further present a practical simulated exponential mechanism that has efficient inference with certified robustness. We not only provide a rigorous analytic derivation of the certified condition but also experimentally compare the utility of WordDP with existing defense algorithms. The results show that WordDP achieves higher accuracy and more than 30X efficiency improvement over the state-of-the-art certified robustness mechanism in typical text classification tasks. |
Databáze: | OpenAIRE |
Externí odkaz: |