Don't Retrain, Just Rewrite: Countering Adversarial Perturbations by Rewriting Text
This addresses the vulnerability of text classifiers to adversarial perturbations for users in NLP applications, offering a defense method that generalizes across tasks without retraining.
The paper tackles the problem of adversarial attacks on text classifiers by introducing ATINTER, a model that rewrites adversarial inputs to protect downstream classifiers, resulting in improved adversarial robustness, such as a 4% increase in adversarial accuracy on SST-2 with minimal task accuracy loss.
Can language models transform inputs to protect text classifiers against adversarial attacks? In this work, we present ATINTER, a model that intercepts and learns to rewrite adversarial inputs to make them non-adversarial for a downstream text classifier. Our experiments on four datasets and five attack mechanisms reveal that ATINTER is effective at providing better adversarial robustness than existing defense approaches, without compromising task accuracy. For example, on sentiment classification using the SST-2 dataset, our method improves the adversarial accuracy over the best existing defense approach by more than 4% with a smaller decrease in task accuracy (0.5% vs 2.5%). Moreover, we show that ATINTER generalizes across multiple downstream tasks and classifiers without having to explicitly retrain it for those settings. Specifically, we find that when ATINTER is trained to remove adversarial perturbations for the sentiment classification task on the SST-2 dataset, it even transfers to a semantically different task of news classification (on AGNews) and improves the adversarial robustness by more than 10%.