summaries: This paper introduces a novel adversarial fine-tuning method, which they apply to language model fine-tuning. Their method, named RIFT, takes an information-theoretic perspective to define the new loss; this paper is very clearly written and includes mostly useful figures that help explain their novel approach. They show strong experimental results with a number of baselines, and run an ablation study for the hyperparameters introduced by their approach. This paper argues that applying adversarial training into the fine-tuning of the pre-trained language model suffers severely from catastrophic forgetting. It then proposes Robust Informative Fine-Tuning (RIFT) to encourage an objective model to retain the features learned from the pre-trained model. The results on sentiment analysis and natural language inference tasks show that the proposed method is able to outperform the strong baseline models in terms of Genetic and PWWS attacks. This paper studies the catastrophic forgetting problem when fine-tuning pre-trained language models towards adversarial robustness. They argue that existing robust training methods, such as adversarial training, make the objective model deviated too much from the pre-trained model, resulting in bad generalization. Starting from an information-theoretical perspective, the authors propose RIFT, a fine-tuning method that maximizes the mutual information between the outputs of the objective model and the outputs of the pre-trained model when conditioned on the labels. The experimental results show that RIFT has a better performance than other baselines, which supports the better generalization as the authors claim. In addition, they give explanations why considering I(S;T|Y) in the objective is better than considering I(S;T).   ==== After Rebuttal ====  Thanks for the response. All my questions are properly resolved. This paper proposes a new method for finetuning pretrained NLP models to achieve both high standard and high robust accuracy. They argue that finetuning on the more difficult and plentiful adversarial examples can lead to catastrophic forgetting, more so than standard finetuning of models. They propose an additional loss wherein the model is encouraged to get high accuracy while also retaining features from the pretrained weights. This improves the accuracy over standard finetuning and various other ways of regularizing adversarial finetuning. The paper studies the problem of adversarial fine-tuning of pretrained NLP models, that is fine-tuning them in a way that makes them robust to adversarial attacks. It proposes a new method called RIFT. RIFT alters the usual adversarial training by adding a regularization term that maximizes the conditional mutual information between feature vectors produced by the original pretrained model and the currently fine-tuned one. The motivation is to alleviate catastrophic forgetting. The experiments show RIFT getting a slightly higher adversarial robustness than the baselines methods, such as e.g. using the L2 penalty instead of the proposed regularizer.  
abstractText: The fine-tuning of pre-trained language models has a great success in many NLP fields. Yet, it is strikingly vulnerable to adversarial examples, e.g., word substitution attacks using only synonyms can easily fool a BERT-based sentiment analysis model. In this paper, we demonstrate that adversarial training, the prevalent defense technique, does not directly fit a conventional fine-tuning scenario, because it suffers severely from catastrophic forgetting: failing to retain the generic and robust linguistic features that have already been captured by the pre-trained model. In this light, we propose Robust Informative Fine-Tuning (RIFT), a novel adversarial fine-tuning method from an information-theoretical perspective. In particular, RIFT encourages an objective model to retain the features learned from the pre-trained model throughout the entire fine-tuning process, whereas a conventional one only uses the pre-trained weights for initialization. Experimental results show that RIFT consistently outperforms the state-of-the-arts on two popular NLP tasks: sentiment analysis and natural language inference, under different attacks across various pre-trained language models. 1.
authors.name: Xinshuai Dong
authors.name: Luu Anh Tuan
authors.name: Shuicheng Yan
authors.name: Hanwang Zhang
references.authors: Rahaf Aljundi Min Lin Baptiste Goujaud Yoshua Bengio
references.title: Gradient based sample selection for online continual learning
references.venue: In NeurIPS,
references.authors: Moustafa Alzantot Yash Sharma Ahmed Elgohary Bo-Jhang Ho Mani Srivastava Kai-Wei Chang
references.title: Generating natural language adversarial examples
references.venue: In EMNLP,
references.authors: Anish Athalye Nicholas Carlini David Wagner
references.title: Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples
references.authors: Yonatan Belinkov Yonatan Bisk
references.title: Synthetic and natural noise both break neural machine translation
references.venue: In ICLR,
references.authors: Ari S Benjamin David Rolnick Konrad Kording
references.title: Measuring and regularizing networks in function space
references.venue: In ICML,
references.authors: Samuel R. Bowman Gabor Angeli Christopher Potts Christopher D. Manning
references.title: A large annotated corpus for learning natural language inference
references.venue: In EMNLP,
references.authors: Nicholas Carlini David Wagner
references.title: Towards evaluating the robustness of neural networks
references.venue: In SP,
references.authors: Ciprian Chelba Alex Acero
references.title: Adaptation of maximum entropy capitalizer: Little data can help a lot
references.venue: Computer Speech & Language,
references.authors: Ting Chen Simon Kornblith Mohammad Norouzi Geoffrey Hinton
references.title: A simple framework for contrastive learning of visual representations
references.venue: In ICML,
references.authors: Hal Daumé III
references.title: Frustratingly easy domain adaptation
references.venue: arXiv preprint arXiv:0907.1815,
references.authors: Jacob Devlin Ming-Wei Chang Kenton Lee Kristina Toutanova. Bert
references.title: Pre-training of deep bidirectional transformers for language understanding
references.venue: In NAACL,
references.authors: Xinshuai Dong Anh Tuan Luu Rongrong Ji Hong Liu
references.title: Towards robustness against natural language word substitutions
references.venue: In ICLR,
references.authors: Javid Ebrahimi Anyi Rao Daniel Lowd Dejing Dou
references.title: Hotflip: White-box adversarial examples for text classification
references.venue: In ACL,
references.authors: Sayna Ebrahimi Mohamed Elhoseiny Trevor Darrell Marcus Rohrbach
references.title: Uncertaintyguided continual learning with bayesian neural networks
references.venue: In ICLR,
references.authors: Steffen Eger Gözde Gül Şahin Andreas Rücklé Ji-Ung Lee Claudia Schulz Mohsen Mesgar Krishnkant Swarnkar Edwin Simpson Iryna Gurevych
references.title: Text processing like humans do: Visually attacking and shielding nlp systems
references.authors: Ji Gao Jack Lanchantin Mary Lou Soffa Yanjun Qi
references.title: Black-box generation of adversarial text sequences to evade deep learning classifiers
references.venue: In SPW
references.authors: Ian J Goodfellow Mehdi Mirza Da Xiao Aaron Courville Yoshua Bengio
references.title: An empirical investigation of catastrophic forgetting in gradient-based neural networks
references.venue: arXiv preprint arXiv:1312.6211,
references.authors: Ian J Goodfellow Jonathon Shlens Christian Szegedy
references.title: Explaining and harnessing adversarial examples
references.venue: In ICLR,
references.authors: Michael Gutmann Aapo Hyvärinen
references.title: Noise-contrastive estimation: A new estimation principle for unnormalized statistical models
references.venue: In AISTATS,
references.authors: Kaiming He Haoqi Fan Yuxin Wu Saining Xie Ross Girshick
references.title: Momentum contrast for unsupervised visual representation learning
references.venue: In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,
references.authors: Geoffrey Hinton Oriol Vinyals Jeff Dean
references.title: Distilling the knowledge in a neural network
references.venue: arXiv preprint arXiv:1503.02531,
references.authors: R Devon Hjelm Alex Fedorov Samuel Lavoie-Marchildon Karan Grewal Phil Bachman Adam Trischler Yoshua Bengio
references.title: Learning deep representations by mutual information estimation and maximization
references.venue: In ICLR,
references.authors: Hossein Hosseini Sreeram Kannan Baosen Zhang Radha Poovendran
references.title: Deceiving google’s perspective api built for detecting toxic comments
references.venue: arXiv preprint arXiv:1702.08138,
references.authors: Jeremy Howard Sebastian Ruder
references.title: Universal language model fine-tuning for text classification
references.venue: In ACL,
references.authors: Xinting Hu Kaihua Tang Chunyan Miao Xian-Sheng Hua Hanwang Zhang
references.title: Distilling causal effect of data in class-incremental learning
references.authors: Po-Sen Huang Robert Stanforth Johannes Welbl Chris Dyer Dani Yogatama Sven Gowal Krishnamurthy Dvijotham Pushmeet Kohli
references.title: Achieving verified robustness to symbol substitutions via interval bound propagation
references.venue: In EMNLP,
references.authors: Andrew Ilyas Shibani Santurkar Dimitris Tsipras Logan Engstrom Brandon Tran Aleksander Madry
references.title: Adversarial examples are not bugs, they are features
references.authors: Mohit Iyyer John Wieting Kevin Gimpel Luke Zettlemoyer
references.title: Adversarial example generation with syntactically controlled paraphrase networks
references.venue: In NAACL,
references.authors: Robin Jia Percy Liang
references.title: Adversarial examples for evaluating reading comprehension systems
references.venue: In EMNLP,
references.authors: Robin Jia Aditi Raghunathan Kerem Göksel Percy Liang
references.title: Certified robustness to adversarial word substitutions
references.venue: In EMNLP,
references.authors: Di Jin Zhijing Jin Joey Tianyi Zhou Peter Szolovits
references.title: Is bert really robust? natural language attack on text classification and entailment
references.authors: Diederik P Kingma Max Welling
references.title: Auto-encoding variational bayes
references.venue: arXiv preprint arXiv:1312.6114,
references.authors: James Kirkpatrick Razvan Pascanu Neil Rabinowitz Joel Veness Guillaume Desjardins Andrei A Rusu Kieran Milan John Quan Tiago Ramalho Agnieszka Grabska-Barwinska
references.title: Overcoming catastrophic forgetting in neural networks
references.venue: Proceedings of the national academy of sciences,
references.authors: Alexey Kurakin Ian Goodfellow Samy Bengio
references.title: Adversarial examples in the physical world, 2016
references.authors: Alexey Kurakin Ian Goodfellow Samy Bengio
references.title: Adversarial machine learning at scale
references.venue: In ICLR,
references.authors: Cheolhyoung Lee Kyunghyun Cho Wanmo Kang
references.title: Mixout: Effective regularization to finetune large-scale pretrained language models
references.venue: In ICLR,
references.authors: Yingzhen Li John Bradshaw Yash Sharma
references.title: Are generative classifiers more robust to adversarial attacks
references.venue: In ICML,
references.authors: Zhizhong Li Derek Hoiem
references.title: Learning without forgetting
references.venue: IEEE transactions on pattern analysis and machine intelligence,
references.authors: Bin Liang Hongcheng Li Miaoqiang Su Pan Bian Xirong Li Wenchang Shi
references.title: Deep text classification can be fooled
references.authors: Yinhan Liu Myle Ott Naman Goyal Jingfei Du Mandar Joshi Danqi Chen Omer Levy Mike Lewis Luke Zettlemoyer Veselin Stoyanov
references.title: Roberta: A robustly optimized bert pretraining approach
references.authors: David Lopez-Paz Marc’Aurelio Ranzato
references.title: Gradient episodic memory for continual learning
references.venue: In NeurIPS,
references.authors: Ilya Loshchilov Frank Hutter
references.title: Decoupled weight decay regularization
references.venue: In ICLR,
references.authors: Andrew L. Maas Raymond E. Daly Peter T. Pham Dan Huang Andrew Y. Ng Christopher Potts
references.title: Learning word vectors for sentiment analysis
references.venue: In ACL,
references.authors: Aleksander Madry Aleksandar Makelov Ludwig Schmidt Dimitris Tsipras Adrian Vladu
references.title: Towards deep learning models resistant to adversarial attacks
references.venue: In ICLR,
references.authors: Michael McCloskey Neal J Cohen
references.title: Catastrophic interference in connectionist networks: The sequential learning problem
references.venue: In Psychology of learning and motivation. Elsevier,
references.authors: Tomas Mikolov Ilya Sutskever Kai Chen Greg Corrado Jeffrey Dean
references.title: Distributed representations of words and phrases and their compositionality
references.venue: NeurIPS,
references.authors: Takeru Miyato Andrew M Dai Ian Goodfellow
references.title: Adversarial training methods for semisupervised text classification
references.venue: In ICLR,
references.authors: Aaron van den Oord Yazhe Li Oriol Vinyals
references.title: Representation learning with contrastive predictive coding
references.venue: arXiv preprint arXiv:1807.03748,
references.authors: Nicolas Papernot Patrick McDaniel Somesh Jha Matt Fredrikson Z Berkay Celik Ananthram Swami
references.title: The limitations of deep learning in adversarial settings
references.venue: In EuroS&P
references.authors: Jeffrey Pennington Richard Socher Christopher D Manning
references.title: Glove: Global vectors for word representation
references.venue: In EMNLP,
references.authors: Matthew E Peters Mark Neumann Mohit Iyyer Matt Gardner Christopher Clark Kenton Lee Luke Zettlemoyer
references.title: Deep contextualized word representations
references.authors: Ben Poole Sherjil Ozair Aaron Van Den Oord Alex Alemi George Tucker
references.title: On variational bounds of mutual information
references.authors: Danish Pruthi Bhuwan Dhingra Zachary C Lipton
references.title: Combating adversarial misspellings with robust word recognition
references.venue: In ACL,
references.authors: Alec Radford Karthik Narasimhan Tim Salimans Ilya Sutskever
references.title: Improving language understanding by generative pre-training
references.authors: Sylvestre-Alvise Rebuffi Alexander Kolesnikov Georg Sperl Christoph H Lampert
references.title: icarl: Incremental classifier and representation learning
references.authors: Emily Reif Ann Yuan Martin Wattenberg Fernanda B Viegas Andy Coenen Adam Pearce Been Kim
references.title: Visualizing and measuring the geometry of bert
references.venue: NeurIPS,
references.authors: Shuhuai Ren Yihe Deng Kun He Wanxiang Che
references.title: Generating natural language adversarial examples through probability weighted word saliency
references.authors: Marco Tulio Ribeiro Sameer Singh Carlos Guestrin
references.title: Semantically equivalent adversarial rules for debugging nlp models
references.venue: In ACL,
references.authors: Leslie Rice Eric Wong Zico Kolter
references.title: Overfitting in adversarially robust deep learning
references.venue: In ICML,
references.authors: Kihyuk Sohn
references.title: Improved deep metric learning with multi-class n-pair loss objective
references.venue: In NeurIPS,
references.authors: Nitish Srivastava Geoffrey Hinton Alex Krizhevsky Ilya Sutskever Ruslan Salakhutdinov
references.title: Dropout: a simple way to prevent neural networks from overfitting. The journal of machine learning
references.authors: David Stutz Matthias Hein Bernt Schiele
references.title: Disentangling adversarial robustness and generalization
references.venue: In CVPR,
references.authors: Christian Szegedy Wojciech Zaremba Ilya Sutskever Joan Bruna Dumitru Erhan Ian Goodfellow Rob Fergus
references.title: Intriguing properties of neural networks
references.venue: In ICLR,
references.authors: Ian Tenney Dipanjan Das Ellie Pavlick. Bert
references.title: re-discovers the classical nlp pipeline
references.venue: In ACL,
references.authors: Yonglong Tian Dilip Krishnan Phillip Isola
references.title: Contrastive representation distillation
references.venue: In ICLR,
references.authors: Yonglong Tian Chen Sun Ben Poole Dilip Krishnan Cordelia Schmid Phillip Isola
references.title: What makes for good views for contrastive learning
references.venue: NeurIPS,
references.authors: Florian Tramer Nicholas Carlini Wieland Brendel Aleksander Madry
references.title: On adaptive attacks to adversarial example defenses
references.venue: In NeurIPS,
references.authors: Michael Tschannen Josip Djolonga Paul K Rubenstein Sylvain Gelly Mario Lucic
references.title: On mutual information maximization for representation learning
references.venue: In ICLR,
references.authors: Dimitris Tsipras Shibani Santurkar Logan Engstrom Alexander Turner Aleksander Madry
references.title: Robustness may be at odds with accuracy
references.venue: arXiv preprint arXiv:1805.12152,
references.authors: Laurens Van der Maaten Geoffrey Hinton
references.title: Visualizing data using t-sne
references.venue: Journal of machine learning research,
references.authors: Ashish Vaswani Noam Shazeer Niki Parmar Jakob Uszkoreit Llion Jones Aidan N Gomez Lukasz Kaiser Illia Polosukhin
references.title: Attention is all you need
references.venue: NeurIPS,
references.authors: Li Wan Matthew Zeiler Sixin Zhang Yann Le Cun Rob Fergus
references.title: Regularization of neural networks using dropconnect
references.venue: In ICML,
references.authors: Tongzhou Wang Phillip Isola
references.title: Understanding contrastive representation learning through alignment and uniformity on the hypersphere
references.venue: In ICML,
references.authors: Georg Wiese Dirk Weissenborn Mariana Neves
references.title: Neural domain adaptation for biomedical question answering
references.venue: In CoNLL,
references.authors: Eric Wong Frank R Schmidt J Zico Kolter
references.title: Wasserstein adversarial examples via projected sinkhorn iterations
references.venue: In ICML,
references.authors: Zhilin Yang Zihang Dai Yiming Yang Jaime Carbonell Ruslan Salakhutdinov Quoc V Le
references.title: Xlnet: Generalized autoregressive pretraining for language understanding
references.venue: NeurIPS,
references.authors: Yuan Zang Fanchao Qi Chenghao Yang Zhiyuan Liu Meng Zhang Qun Liu Maosong Sun
references.title: Word-level textual adversarial attacking as combinatorial optimization
references.venue: In ACL,
references.authors: Hongyang Zhang Yaodong Yu Jiantao Jiao Eric P. Xing Laurent El Ghaoui Michael I. Jordan
references.title: Theoretically principled trade-off between robustness and accuracy
references.authors: Huangzhao Zhang Hao Zhou Ning Miao Lei Li
references.title: Generating fluent adversarial examples for natural languages
references.venue: In ACL,
references.authors: Tianyi Zhang Felix Wu Arzoo Katiyar Kilian Q Weinberger Yoav Artzi
references.title: Revisiting few-sample bert fine-tuning
references.venue: In ICLR,
references.authors: Zhengli Zhao Dheeru Dua Sameer Singh
references.title: Generating natural adversarial examples
references.venue: In ICLR,
sections.heading: 1 Introduction
sections.text: Deep models are well-known to be vulnerable to adversarial examples [64, 19, 50, 35]. For instance, fine-tuned models pre-trained on very large corpora can be easily fooled by word substitution attacks using only synonyms [2, 58, 32, 12]. This has raised grand security challenges to modern NLP systems, such as spam filtering and malware detection, where pre-trained language models like BERT [11] are widely deployed.
  Attack algorithms [19, 7, 76, 40, 2] aim to maliciously generate adversarial examples to fool a victim model, while adversarial defense aims at building robustness against them. Among the defense methods, adversarial training [64, 19, 48, 45] is the most effective one [3]. It updates model parameters using perturbed adversarial samples generated on-the-fly and yields consistently robust performance even against the challenging adaptive attacks [3, 68].
  However, despite its effectiveness in training from scratch, adversarial training may not directly fit the current NLP paradigm, the fine-tuning of pre-trained language models. First, fine-tuning per se suffers from catastrophic forgetting [46, 18, 34], i.e., the resultant model tends to over-fit to a small fine-tuning data set, which may deviate too far from the pre-trained knowledge [25, 81]. Second, adversarially fine-tuned models are more likely to forget: adversarial samples are usually
  1Our code will be available at https://github.com/dongxinshuai/RIFT-NeurIPS2021.
  35th Conference on Neural Information Processing Systems (NeurIPS 2021).
  out-of-distribution [38, 63], thus they are generally inconsistent with the pre-trained model. As a result, adversarial fine-tuning fails to memorize all the robust and generic linguistic features already learned during pre-training [65, 57], which are however very beneficial for a robust objective model.
  Addressing forgetting is essential for achieving a more robust objective model. Conventional wisdom such as pre-trained weight decay [8, 10] and random mixout [37] mitigates forgetting by constraining lp distance between the two models’ parameters. Though effective to some extent, however, it is limited because change in the model parameter space only serves as an imperfect proxy for that in the function space [5]. Besides, the extent to which an encoder fails to retain information also depends on the input distribution. Therefore, a better way to encourage memorization is favorable.
  In this paper, we follow an information-theoretical lens to look into the forgetting problem: we employ mutual information to measure how well an objective model memorizes the useful features captured before. This motivates our novel adversarial fine-tuning method, Robust Informative FineTuning (RIFT). In addition to fitting a down-stream task as conventions, RIFT maximizes the mutual information between the output of an objective model and that of the pre-trained model conditioned on the class label. It encourages an objective model to continuously retain useful information from the pre-trained one throughout the whole fine-tuning process, whereas the conventional one only makes use of the pre-trained weights for initialization. We illustrate the overall objective of RIFT in Figure 1 and summarize the major contributions of this paper as follows:
  • To the best of our knowledge, we are the first to investigate the intensified phenomenon of catastrophic forgetting in the adversarial fine-tuning of pre-trained language models.
  • To address the forgetting problem and achieve more robust models, we propose a novel approach named Robust Informative Fine-Tuning (RIFT) from an information-theoretical perspective. RIFT enables an objective model to retain robust and generic linguistic features throughout the whole fine-tuning process and thus enhance robustness against adversarial examples.
  • We empirically evaluate RIFT on two prevailing NLP tasks, sentiment analysis and natural language inference, where RIFT consistently outperforms the state-of-the-arts in terms of robustness, under different attacks across various pre-trained language models.
sections.heading: 2 Methodology
sections.heading: 2.1 Notations and Problem Setting
sections.text: In this paper, we focus on the text classification task to introduce our method, while it can be easily extended to other NLP tasks. We suppose random variables X,Y ∼ pD(x, y), where X represents the textual input, Y represents the class label, pD is the data distribution, and x, y are the observed values. Our goal is to build a classifier q(y∣Fs(x)), where Fs(⋅), referred to as our objective model
  (a) In adversarial fine-tuning, the relative L2 distance continuously grows as the fine-tuning proceeds. (b) Trading clean accuracy off against robustness (by increasing β in Eq. 2) induces increased relative L2 distance at the last epoch.
  Figure 2: Relative L2 distance between the pre-trained model and the objective model in the parameter space, under different fine-tuning schemes on IMDB, with small learning rate 2e-5.
  in the rest of this paper, is a feature extractor fine-tuned from the encoder of a pre-trained language model, e.g., Transformer [72], and q(⋅∣⋅) is parameterized by using an MLP with softmaxed output. We favor a classifier that is robust against adversarial attacks [64, 2], i.e., maintaining high accuracy even given adversarial examples as inputs.
sections.heading: 2.2 Adversarial Fine-Tuning Suffers From Forgetting
sections.text: Adversarial training [64, 19, 45] is currently the most effective defense technique [3]. Its training objective can be generally formulated as:
  min[ E x,y∼pD [ max x̂∈B(x) L(x, x̂, y)]], (1)
  where B(x) defines the allowed perturbation space around x, and L is a loss to encourage correct predictions both given vanilla samples and given perturbed examples. Such an objective function can also be applied to the fine-tuning of a pre-trained language model towards robustness, and we refer to it as adversarial fine-tuning. The loss function in Eq. 1 can be specified following Miyato et al. [48], Zhang et al. [79] in a semi-supervised fashion as:
  − log q(y∣Fs(x)) + βKL(q(⋅∣Fs(x))∣∣q(⋅∣Fs(x̂))), (2) where the Kullback–Leibler divergence encourages invariant predictions between x and x̂.
  Despite its effectiveness in training from scratch, such an adversarial objective function may not directly fit the fine-tuning scenario. To begin with, fine-tuning itself suffers from catastrophic forgetting [46, 18, 34]. During fine-tuning, an objective model Fs(⋅) tends to continuously deviate away from the pre-trained one to fit a down-stream task [25, 81], and thus the useful information already captured before is less utilized as the fine-tuning proceeds. Further, adversarial fine-tuning suffers even more from the forgetting problem, the reasons of which are given as what follows.
  (i) Adversarial Fine-Tuning Tends to Forget: Adversarial fine-tuning targets at tackling adversarial examples, which are generally out of the manifold [38, 63] of the pre-training corpora. To additionally handle them, an objective model would be fine-tuned towards a solution that is far away from the optimization starting point, i.e., the pre-trained model. Figure 2 (b) empirically shows this point: by increasing β in Eq. 2, we emphasize more on robustness instead of vanilla accuracy, and consequently, at the last epoch the distance between models also increases. Besides, adversarial fine-tuning often entails more iterations to converge (several times of normal fine-tuning), which further intensifies the forgetting problem, as the objective model is continuously deviating away as shown in Figure 2 (a).
  (ii) Adversarial Fine-Tuning Needs to Memorize: Overfitting to training data is a dominant phenomenon throughout the adversarial training/fine-tuning process [60]. To mitigate overfitting and generalize better, adversarial fine-tuning should retain all the generalizable features already captured by the pre-trained model [11, 41]. In addition, adversarial fine-tuning favors an objective model that
  extracts features invariant to perturbations [70, 28] for robustness. As such, all those generalizable and robust linguistic information captured during pre-training [11, 65] are particularly beneficial and should be memorized. We empirically validates that encouraging memorization does improve both generalization and robustness in Sec. 3.5.
  To address forgetting, previous methods such as pre-trained weight decay [8, 10] and random mixout [37] have shown their effectiveness in stabilizing fine-tuning [81]. However, they focus only on the parameter space, in which they encourage an object model to be similar to the pre-trained one. Distance in the parameter space can only approximately characterize the change in the function space, and fails to take the data distribution into consideration. A more natural way to capture the extent to which a model memorizes or forgets, should be using the mutual information between outputs of the two models, and we provide our solution as follows.
sections.heading: 2.3 Informative Fine-Tuning
sections.text: We first use an information-theoretical perspective to look into how a pre-trained model should be leveraged throughout the whole fine-tuning process.
  We define random variable T = Ft(X) as the feature of X extracted by the pre-trained language model Ft(⋅), and t as the observed value of T . Similarly, we define random variable S = Fs(X) as the feature of X extracted by our objective model Fs(⋅), and s as the observed value of S. We formulate an overall fine-tuning objective as follows. The motivation is to train Fs(⋅) such that S is capable of predicting Y , as well as preserving the information from T .
  max I(S; Y,T ), (3)
  i.e., maximizing the mutual information between (i) the feature extracted by the objective model and (ii) the class label plus the feature extracted by the pre-trained model. Since the pre-trained model Ft(⋅) is a fixed deterministic function, the fine-tuning objective in Eq. 3 in essense encourages Fs(⋅) to output features that contain as much information as possible for predicting Y and T . This enables the objective model to learn from the pre-trained language model via T throughout the whole fine-tuning process, and thus helps address the forgetting problem.
  However, the objective defined in Eq. 3 is generally hard to optimize directly. Therefore, we decompose Eq. 3 into two terms as follows:
  I(S; Y,T ) = I(S;Y ) + I(S;T ∣ Y ), (4)
  where I(S;Y ) measures how well the output of our objective model can predict the label, and I(S;T ∣ Y ) measures when conditioned on the class label, how well the output features of the two models can predict each other. Visualization of each component can be seen in Figure 1 for more intuitive understandings. We next introduce how each term in the right-hand side of Eq. 4 can be transformed into a tractable lower bound for optimization.
  (i) Maximizing I(S;Y): We treat q(y∣s), which is the classification layer that takes the features extracted by the objective model as input, as a variational distribution of p(y∣s), and derive a variational lower bound on I(S;Y ) following variational inference [33] as follows:
  I(S;Y ) =H(Y ) −Ex,y∼pD [− log q(y∣s)] +KL(p(⋅∣s)∣∣q(⋅∣s)) (5) ≥H(Y ) −Ex,y∼pD [− log q(y∣s)], (6)
  whereH(Y ) is a constant measuring the shannon entropy of Y , and EX,Y [− log q(y∣s)] is essentially the cross-entropy loss using q(y∣s) for classification. Then, the objective of maximizing I(S;Y ) can be achieved by minimizing EX,Y [− log q(y∣s)] instead. (ii) Maximizing I(S;T| Y): The definition of the conditional mutual information I(S;T ∣ Y ) is as follows:
  I(S;T ∣ Y ) = Ey∼pD(y)[I(S;T )∣ Y = y] = Ey∼pD(y)[ Ex∼pD(x∣y)[log p(s, t∣y)
  p(s∣y)p(t∣y)]]. (7)
  To achieve a tractable objective for maximizing Eq. 7, we employ noise contrastive estimation [20, 49] and derive a lower bound −Linfo on the conditional mutual information. This can be summarized in the following Lemma (the proof of which can be found in Appendix A.2):
  Lemma 1. Given {xi, y}Ni=1 that is sampled i.i.d. from pD(x∣y), si = Fs(xi), and ti = Ft(xi), I(S;T ∣ Y ) is lower bounded by −Linfo = Ey∼pD(y)[E{xi,y}Ni=1[ 1 N ∑ N i=1 log efy(si,ti)
  ∑Nj=1 e fy(si,tj) + logN]], and fy is a score function indexed by y.
  By leveraging Lemma 1, Linfo can be computed using a batch of samples and then minimized for maximizing I(S;T ∣ Y ). The score function fy is defined as the inner product after non-linear projections into a space of hyper-sphere following [9] as fy(a, b) = 1τ ⟨g1y(a),g 2 y(b)⟩
  ∥g1y(a)∥2∥g 2 y(b)∥2
  , where g1y and
  g2y are parameterized by using MLPs.
sections.heading: 2.4 Conditional Mutual Information Better Fits A Down-Stream Task
sections.text: Above we have introduced the training objective of informative fine-tuning and decomposed it into I(S;Y ) and I(S;T ∣ Y ) for optimization. However, one may wonder why not maximize I(S;T ) directly instead of I(S;T ∣ Y ). From an information-theoretical perspective, if we maximize I(S;Y ) and I(S;T ), the intersection of the three circles in Figure 1, i.e., the interaction information of them, is repeatedly optimized and might induce confliction. To further elaborate this point, we look into contrastive loss and give an explanation as follows.
  We consider contrastive learning by decomposing it into the encouragement of alignment and uniformity following [74]. For example, maximizing I(S;T ) =H(S) −H(S∣T ) is to decrease H(S∣T ) and increase H(S). Decreasing H(S∣T ) corresponds to encouraging alignment in contrastive learning, which aims to align si and ti in the sense of inner product when they are projected into a hyper-sphere. In the meanwhile, increasing H(S) corresponds to uniformity in contrastive learning, which encourages si and sj , where i ≠ j, to diffuse over the whole sub-space as uniformly as possible. It can be seen in Figure 3 (c) that, in the space of S1, alignment is achieved in that points from two different circles but with the same color are aligned, and uniformity is achieved in that all points diffuse over the whole S1. However, when maximizing I(S;T ), the uniformity in the contrastive loss is encouraged over the whole data manifold. Diffusing uniformly over the whole data manifold can be against the objective of maximizing I(S;Y ), which aims to separate the whole data manifold into class-specific parts as shown in Figure 3 (b). In contrast, maximizing I(S;T ∣ Y ) only encourages uniformity inside each class-specific data manifold, which is complementary to maximizing I(S;Y ), as show in Figure 3 (d). In the meanwhile, the alignment is still enforced. More empirical support can be found in Sec. 3.4.
  Algorithm 1 RIFT Input: dataset D, hyper-parameters of AdamW [43] Output: the model parameters θ and φ
  1: Initialize θ using the pre-trained model, and initialize φ and ϕ randomly. 2: repeat 3: Sample y ∼ pD(y) and then {xi, y}Ni=1 ∼ pD(x∣y) 4: for every xi, y in the mini-batch {xi, y}Ni=1 do 5: Find x̂i by solving Eq. 8; 6: end for 7: Compute the loss function defined in Eq. 11 and update θ, φ, and ϕ by gradients. 8: until the training converges.
sections.heading: 2.5 Robust Informative Fine-Tuning
sections.text: In this section, we are going to put the objective function of informative fine-tuning into the adversarial context and introduce Robust Informative Fine-Tuning (RIFT).
  To robustly train a model, the adversarial examples x̂ for training should be formulated and generated first. As our end goal is to enhance robustness in down-stream tasks, the generation process of adversarial examples should focus on preventing a model from predicting the ground truth label. However, using label for generating adversarial examples in training often induces label leaking [36], i.e., the generated adversarial examples contains label information which is used as a trivial short-cut by a classifier. As such, we follow [48, 79] to generate x̂ in a self-supervised fashion:
  x̂ = argmax x′∈B(x) KL(q(⋅∣Fs(x))∣∣q(⋅∣Fs(x′))). (8)
  By solving Eq. 8, x̂ is found to induce the most different prediction from that of a vanilla sample x in terms of KL, inside the attack space B(x). Next, we introduce how to robustly optimize each objective in the informative fine-tuning by using x̂.
  (i) Robustly Maximizing I(S;Y): As shown in Sec. 2.3, maximizing I(S;Y ) can be achieved by minimizing a cross-entropy loss instead. To encourage adversarial robustness, this cross-entropy loss can be upgraded to encourage both correct predictions on and invariant predictions between x and x̂ [48, 79]. We formulate such an objective function as follows:
  min θ,φ Lr-task, Lr-task = E x,y∼pD [ − log q(y∣Fs(x)) + βKL(q(⋅∣Fs(x))∣∣q(⋅∣Fs(x̂)))], (9)
  where θ denotes the parameters of Fs(⋅) and φ denotes the parameters of q(⋅∣⋅). Minimizing Lr-task in Eq. 9 corresponds to adversarilly maximizing I(S;Y ) for robust performance in a down-stream task. By doing so, the adversarial example x̂ is generated by Eq. 8 first and then both x and x̂ are used to optimize the model parameters θ and φ.
  (ii) Robustly Maximizing I(S;T| Y): We aim to maximize the conditional mutual information I(S;T ∣ Y ), but under an adversarial distribution of input data. We formulate such a term as I(Ŝ;T ∣ Y ), where random variable Ŝ = Fs(X̂), X̂ ∼ padv(x̂∣x, θ, φ,B), and sampling from padv, the adversarial distribution of input data, is to generate adversarial example x̂ by Eq. 8.
  To optimize I(Ŝ;T ∣ Y ), we propose −Lr-info as a lower bound on it, and formulate the objective to minimize Lr-info as follows (similar to −Linfo by using Lemma 1):
  min θ,ϕ Lr-info, Lr-info = E y∼pD(y) [ E {xi,y}Ni=1∼pD(x∣y)
  [ 1 N
  N ∑ i=1 − log e fy(ŝi,ti) ∑Nj=1 efy(ŝi,tj) − logN]], (10)
  where ŝi = Fs(x̂i), ti = Ft(xi), and ϕ denotes the parameters of all the score functions fy. By Eq. 10, we are able to encourage Fs(⋅) to retain information from Ft(⋅) in a robust fasion. Noted that, in Lr-info we do not use x̂i to extract features from the pre-trained model. This follows the spirit of Knowledge Distillation [22] (though the setting is different in that a student is expected to perform identically to a teacher in knowledge distillation, while in fine-tuning it does not): the data used to extract features of a teacher should be inside the domain for which the teacher is trained. A
  down-stream NLP task, e.g., sentiment analysis, has a data domain that is generally a sub-domain of the pre-training corpora, while x̂i can be significantly off the pre-training data manifold.
  Objective Function of Robust Informative Fine-Tuning (RIFT): The objective function of RIFT is a combination of Lr-task and Lr-info, defined as follows:
  min θ,φ,ϕ
  Lr-task + αLr-info, (11)
  where the hyper-parameter α controls to what extent we encourage an objective model to absorb information from the pre-trained one (ablation on α can be seen in Sec. 3.5). We summarize the whole training process in Algorithm 1 and include more implementation details in Appendix A.1.
sections.heading: 3 Experiments
sections.heading: 3.1 Experimental Setting
sections.text: Tasks and Datasets: We evaluate the robust accuracy and compare our method with the state-of-thearts on: (i) Sentiment analysis using the IMDB dataset [44]. (ii) Natural language inference using the SNLI dataset [6]. We mainly focus on robustness against adversarial word substitutions [2, 58], as such attacks preserve the syntactic and semantics very well [31, 78, 12], and are very hard to detect even by humans. Under this attack setting, any word in the input sequence can be substituted by a semantically similar word of it (often its synonym). We evaluate robustness on 1000 random examples from the testset of IMDB and SNLI respectively following [31, 12].
  Model Architectures: We examine our methods and compare with state-of-the-arts on the following two prevailing pre-trained language models: (i) BERT-base-uncased [11]. (ii) RoBERTa-base [41].
  Attack Algorithms: Two powerful attacks are employed: (i) Genetic [2] based on population algorithm. Aligned with [31, 12], the population size and iterations are set as 60 and 40 respectively. (ii) PWWS [58] based on word saliency. We only attack hypothesis on SNLI aligned with [31, 12].
  Substitution Set: We follow [31, 12] to use the substitution set from [2], and the same language model constraint is applied to Genetic attacks and not to PWWS attacks.
sections.heading: 3.2 Comparative Methods
sections.text: (i) Standard Fine-Tuning: The standard fine-tuning process first initializes the objective model by the pre-trained weight, and then use cross-entropy loss to fine-tune the whole model.
  (ii) Adversarial Fine-Tuning Baseline (Adv-Base): We employ the state-of-the-art defense against word substitutions, ASCC-Defense [12], as the adversarial fine-tuning baseline. This method is not initially proposed for pre-trained language models but can readily extend to perform adversarial fine-tuning. During fine-tuning, adversarial example x̂, which is a sequence of convex combinations, is generated first and then both x and x̂ are used for optimization using objective defined in Eq. 9.
  (iii) Adv + Pre-Trained Weight Decay (Adv-PTWD): Pre-trained weight decay [8, 10] penalizes λ∥Wobj −Wpre∥2, and mitigates catastrophic forgetting [75, 37]. We combine it with the adversarial baseline for comparisons and λ is chosen as 0.01 on IMDB and 0.005 on SNLI for best robustness.
  (iv) Adv + Mixout (Adv-Mixout): Motivated by Dropout [62] and DropConnect [73], Mixout [37] is proposed to addresses catastrophic forgetting in fine-tuning. At each iteration each parameter is replaced by its pre-trained counter-part with probability m. We combine it with the adversarial fine-tuning baseline for comparisons with our method and m is chosen as 0.6 for best robustness.
  (v) Robust Informative Fine-Tuning (RIFT): The proposed adversarial fine-tuning method. It can be deemed as the adversarial fine-tuning baseline plus the Lr-info term. We set τ as 0.2 for all score functions fy. For best robust accuracy, α is chosen as 0.1 and 0.7 on IMDB and SNLI respectively. Ablation study on α can be seen in Sec. 3.5.
  For fair comparisons, all compared adversarial fine-tuning methods use the same β on a same dataset, i.e., β = 10 on IMDB and β = 5 on SNLI, both of which are chosen for the best robust accuracy. Early stopping [60] is used for all compared methods according to best robust accuracy More implementation details and runtime analysis can be found in Appendix A.1 and A.3.
sections.heading: 3.3 Main Result
sections.text: In this section we compare our method with state-of-the-arts by robustness under attacks. As shown in Tables 1 and 2., RIFT consistently achieves the best robust performance among state-of-the-arts in all datasets across different pre-trained language models under all attacks. For instance, on IMDB our method outperforms the RoBERTa-based runner-up method by 2.9% under Genetic attacks and 1.9% under PWWS attacks. On SNLI based on BERT, we surpass the runner-up method by 1.2% under Genetic attacks and 1.1% under PWWS attacks. In addition, RIFT consistently improves robustness upon the adversarial fine-tuning baseline, while the improvements by other methods are not stable. We observe that on SNLI, we surpass the runner-up by a relatively small margin compared to IMDB. This may relate to the dataset property: input from SNLI has a smaller attack space (on average 6.54
  combinations of substitutions on SNLI compared to 6108 on IMDB), and thus smaller absolute space left for improvement. For results of vanilla accuracy please refer to Appendix A.4.
sections.heading: 3.4 Conditional Mutual Information Does Fit a Down-Stream Task Better
sections.text: In this section we empirically validate that maximizing I(S;T ∣ Y ) cooperates with a down-stream task better than maximizing I(S;T ) does. We plot two sets of results of our method with maximizing I(S;T ∣ Y ) and I(S;T ) respectively (using similar noise contrastive loss with all other hyper-parameters the same). As shown in Table 3, RIFT with maximizing I(S;T ∣ Y ) consistently outperforms that with maximizing I(S;T ) in terms of robustness under all attacks on both IMDB and SNLI, which serves as an empirical validation of Sec. 2.4.
sections.heading: 3.5 Ablation Study and Tradeoff Curve Between Robustness and Vanilla Accuracy
sections.text: In this section we conduct ablation study on α, which is the weight of Lr-info in Eq. 11. It aims to control to what extent the objective model absorbs information from the pre-trained one. As shown in Table 4, a good value of α improves both vanilla accuracy and robust accuracy; e.g., on IMDB increasing α from 0 to 0.1 results in increased vanilla accuracy by 0.2% and increased robust accuracy under Genetic attacks by 2.4%. This demonstrates that RIFT does motivate the objective model to retain robust and generalizable features that are beneficial to both robustness and vanilla accuracy. When α goes too large, the objective of fine-tuning would focus too much on preserving as much information from the pre-trained model as possible, and thus ignores the down-stream task.
  One may wonder whether informative fine-tuning itself can improve the clean accuracy upon normal fine-tuning. The answer is yes; e.g., on IMDB using RoBERTa, informative fine-tuning improves about 0.3% clean accuracy upon normal fine-tuning baseline. The improvement is not very significant as normal fine-tuning targets at vanilla input only and thus suffers less from the forgetting problem. One common problem in contrastive loss is that the complexity grows quadratically with N , but larger N contributes to tighter bound on the mutual information [49, 53]. One potential improvement is to maintain a dictionary updated on-the-fly like [21] and we will leave it for future exploration.
  We finally show the trade-off curve between robustness and vanilla accuracy in Figure 4. As shown, RIFT outperforms the state-of-the-arts in terms of both robust accuracy and vanilla accuracy. It again validates that RIFT indeed helps the objective model capture robust and generalizable information to improve both robustness and vanilla accuracy, rather than trivially trading off one against another.
sections.heading: 4 Related Work
sections.text: Pre-Trained Language Models: Language modeling aims at estimating the probabilistic density of the textual data distribution. Classicial language modeling methods vary from CBOW, Skip-Gram [47], to GloVe [51] and ELMo [52]. Recently, Transformer [72] has demonstrated its power in language modeling, e.g., GPT [55] and BERT [11]. The representations learned by deep pre-trained language models are shown to be universal and highly generalizable [77] [41], and fine-tuning pre-trained language models becomes a paradigm in many NLP tasks [25, 11].
  Adversarial Robustness: DNNs have achieved success in many fields, but they are susceptible to adversarial examples [64]. In NLP, attacks algorithms include char-level modifications [24, 13, 4, 17, 15, 54], sequence-level manipulations [29, 59, 30, 82], and adversarial word substitutions [2, 40, 58, 32, 80, 78]. For defenses, adversarial training [64, 19, 45] generates adversarial examples on-the-fly and is currently the most effective. Miyato et al. [48] first introduce adversarial training to
  NLP using L2-ball to model perturbations, and later more geometry-aligned methods like first-order approximation[13], axis-aligned bound [31, 27], and convex hull [12], become favorable.
  Fine-Tuning and Catastrophic Forgetting: The fine-tuning of pre-trained language models [25, 11] can be very unstable [11], as during fine-tuning the objective model can deviate too much from the pre-trained one, and easily over-fits to small fine-tuning sets [25]. Such phenomenon is referred as catastrophic forgetting [46, 18] in fine-tuning [25, 37, 81]. Methods to address catastrophic forgetting include pre-trained weight decay [8, 10, 81], learning rate decreasing [25], and Mixout regularization [37]. These methods focus on parameter space to constrain the distance between two models while our method addresses forgetting following an information-theoretical perspective. In continuous learning, method like rehearsal-based [42, 56, 39, 1] and regularization-based [34, 14, 26] also aims at the forgetting problem, but under a different setting: they focus on balanced performance on tasks with previous data, while in our setting the pre-training corpora are not available and language modeling is not our concern.
  Contrastive Learning and Mutual Information: Contrastive learning [49, 23, 61] has demonstrated its power in learning self-supervised representations [9, 21]. The contrastive loss such as InfoNCE[49], InfoMax [23], is proposed as maximizing the mutual information of features in different views, and further discussed in [53, 67, 69, 66, 74]. This paper shares the same perspective of information theory, but looks into a different problem, addressing forgetting for fine-tuning. Addressing forgetting motivates our objective of maximizing the mutual information between the outputs of two models, which is different from conventional contrastive learning, and cooperation with fine-tuning motivates the use of conditional mutual information, which is quite different also. Fischer and Alemi [16] propose to restrict information for robustness in vision domain. Restricting information to some extent helps a model ignore spurious features, but may be at the cost of ignoring robust features as well. In contrast, the proposed method aims to retain the generic and robust features that are already captured by a pre-trained language model, and thus better fits a fine-tuning scenario.
sections.heading: 5 Discussion and Conclusion
sections.text: In this paper, we proposed RIFT to fine-tune a pre-trained language model towards robust down-stream performance. RIFT addresses the forgetting problem from an information-theoretical perspective and consistently outperforms state-of-the-arts in our experiments. We hope that this work can contribute to the NLP robustness in general and thus to more reliable NLP systems in real-life applications.
sections.heading: Acknowledgements
sections.text: This work is supported by the Singapore Ministry of Education (MOE) Academic Research Fund (AcRF) Tier 1 (S21/20) and Tier 2.
title: How Should Pre-Trained Language Models Be Fine-Tuned Towards Adversarial Robustness?