Task-Agnostic Robust Encodings for Combating Adversarial Typos
Despite achieving excellent benchmark performance, state-of-the-art NLP models can still be easily fooled by adversarial perturbations such as typos. Previous heuristic defenses cannot guard against the exponentially large number of possible perturbations, and previous certified defenses only work with limited model sizes and simple architectures. In this paper, we construct task-agnostic robust encodings (TARE): sentence representations that improve the robustness of any model for multiple downstream tasks at once, and enable efficient exact computation of robust accuracy (accuracy on worst-case perturbations) for a fixed family of perturbations. The core idea behind TARE is to map sentences through a discrete bottleneck before feeding them to a downstream model. To create robust encodings, we must optimize for two competing goals: the encoding of a sentence must retain enough information about the sentence, but should also map all perturbations of the sentence to the same encoding to ensure invariance to perturbations. Averaged across six tasks from GLUE, a standard suite of NLP tasks, the same encoding leads to robust accuracy of 71.2% when defending against a large family of typos, while a strong baseline that uses a typo corrector achieves only 38.5% accuracy, and training on random typos achieves only 9.9% accuracy.
This paper explores a method for correcting typos in a *worst-case* way, in which worst case means against, for example, all mistakes of edit distance k for specified k. To me, this is an interesting problem because 1) typos do not work for word vectors, which is the most common input in downstream NLP tasks, 2) minimizing edit distance is a combinatorially hard problem, so all brute force methods are infeasible at scale. The paper provides a nice discussion of these issues, and proposes a graph-based method in which all words + their typo versions form a graph, and either a word is corrected by a representative word which is the most popular amongst connected components, or a softer version of this is used. The paper also describes a tradeoff between stability and fidelity (which I think is better understood as performance degradation) and discusses how this approach that really is task agnostic. Overall, I think the scheme is simple to understand and intuitive as to why it works well. Table 1 also looks like a nice collection of tasks, and the baselines seem reasonable. The main concern I have is I don*t see how the combinatorial nature is reduced. If you are given a corpus and someone writes a typo, what is the procedure? Is that typo already stored in a database, in which case the database is exponentially large in memory? Or do you need to compute edit distances in order to create this graph to begin with, having the combinatorial issue there? If the combinatorial issue is not resolved then I don*t see why this is better than just a nearest neighbor lookup where the distance is edit distance, which otherwise I would suggest as another important baseline. (If the authors can show this is a misunderstanding on my part, and/or include a much more in-depth discussion of the computational complexity of each scheme, I will increase my score.) My other main critique is that some things are a bit vague. For instance, I don*t understand how the sentence embedding is created, though it is discussed--the exact procedure is vague. Also, I don*t really understand equation (5). What is the std taken over? What is the random variable? It seems like the first term should be conditional on the accuracy of a typo-free scheme, since the task can be arbitrarily hard.
You are a member of the scientific community tasked with peer review. Review the following paper title and abstract.
### Title + Abstract
Task-Agnostic Robust Encodings for Combating Adversarial Typos
Despite achieving excellent benchmark performance, state-of-the-art NLP models can still be easily fooled by adversarial perturbations such as typos. Previous heuristic defenses cannot guard against the exponentially large number of possible perturbations, and previous certified defenses only work with limited model sizes and simple architectures. In this paper, we construct task-agnostic robust encodings (TARE): sentence representations that improve the robustness of any model for multiple downstream tasks at once, and enable efficient exact computation of robust accuracy (accuracy on worst-case perturbations) for a fixed family of perturbations. The core idea behind TARE is to map sentences through a discrete bottleneck before feeding them to a downstream model. To create robust encodings, we must optimize for two competing goals: the encoding of a sentence must retain enough information about the sentence, but should also map all perturbations of the sentence to the same encoding to ensure invariance to perturbations. Averaged across six tasks from GLUE, a standard suite of NLP tasks, the same encoding leads to robust accuracy of 71.2% when defending against a large family of typos, while a strong baseline that uses a typo corrector achieves only 38.5% accuracy, and training on random typos achieves only 9.9% accuracy.
user
<think>Okay, to do a decent peer review, I should start with summarizing what the work is about. This includes novelty, contributions, clarity, and impact. I might include suggestions to issues that I find critical to the usefulness of the work. Starting with novelty, there are different types of novelty. The first aspect of novelty is scope and scale. Is the work covering a broader perspective than previous works? The second aspect is methodology. Is the proposed methodology novel compared to previous methods? Do they provide any significant advantage over previous methodologies? The third aspect is results. Are the results different compared previous work? Does this lead to any novel theories or an extension of current theories? Next is clarity, I will be reading the work in depth and analyze if any sentences can be potentially ambiguous or misleading. If any sentences are ambiguous, I will state them and give a suggestion on how to rephrase such sentence or how to make more clear to the audience. Lastly, impact is important. I will attempt to predict how such work will impact the scientific community. This might include the applications of such work and how the work might transform the way we study a certain topic. Finally, I will might only mention issues that are critical. This is to keep the review as concise and helpful as possible.</think>



This paper explores a method for correcting typos in a *worst-case* way, in which worst case means against, for example, all mistakes of edit distance k for specified k. To me, this is an interesting problem because 1) typos do not work for word vectors, which is the most common input in downstream NLP tasks, 2) minimizing edit distance is a combinatorially hard problem, so all brute force methods are infeasible at scale. The paper provides a nice discussion of these issues, and proposes a graph-based method in which all words + their typo versions form a graph, and either a word is corrected by a representative word which is the most popular amongst connected components, or a softer version of this is used. The paper also describes a tradeoff between stability and fidelity (which I think is better understood as performance degradation) and discusses how this approach that really is task agnostic. Overall, I think the scheme is simple to understand and intuitive as to why it works well. Table 1 also looks like a nice collection of tasks, and the baselines seem reasonable. The main concern I have is I don*t see how the combinatorial nature is reduced. If you are given a corpus and someone writes a typo, what is the procedure? Is that typo already stored in a database, in which case the database is exponentially large in memory? Or do you need to compute edit distances in order to create this graph to begin with, having the combinatorial issue there? If the combinatorial issue is not resolved then I don*t see why this is better than just a nearest neighbor lookup where the distance is edit distance, which otherwise I would suggest as another important baseline. (If the authors can show this is a misunderstanding on my part, and/or include a much more in-depth discussion of the computational complexity of each scheme, I will increase my score.) My other main critique is that some things are a bit vague. For instance, I don*t understand how the sentence embedding is created, though it is discussed--the exact procedure is vague. Also, I don*t really understand equation (5). What is the std taken over? What is the random variable? It seems like the first term should be conditional on the accuracy of a typo-free scheme, since the task can be arbitrarily hard.
assistant
This paper explores a method for correcting typos in a *worst-case* way, in which worst case means against, for example, all mistakes of edit distance k for specified k. To me, this is an interesting problem because 1) typos do not work for word vectors, which is the most common input in downstream NLP tasks, 2) minimizing edit distance is a combinatorially hard problem, so all brute force methods are infeasible at scale. The paper provides a nice discussion of these issues, and proposes a graph-based method in which all words + their typo versions form a graph, and either a word is corrected by a representative word which is the most popular amongst connected components, or a softer version of this is used. The paper also describes a tradeoff between stability and fidelity (which I think is better understood as performance degradation) and discusses how this approach that really is task agnostic. Overall, I think the scheme is simple to understand and intuitive as to why it works well. Table 1 also looks like a nice collection of tasks, and the baselines seem reasonable. The main concern I have is I don*t see how the combinatorial nature is reduced. If you are given a corpus and someone writes a typo, what is the procedure? Is that typo already stored in a database, in which case the database is exponentially large in memory? Or do you need to compute edit distances in order to create this graph to begin with, having the combinatorial issue there? If the combinatorial issue is not resolved then I don*t see why this is better than just a nearest neighbor lookup where the distance is edit distance, which otherwise I would suggest as another important baseline. (If the authors can show this is a misunderstanding on my part, and/or include a much more in-depth discussion of the computational complexity of each scheme, I will increase my score.) My other main critique is that some things are a bit vague. For instance, I don*t understand how the sentence embedding is created, though it is discussed--the exact procedure is vague. Also, I don*t really understand equation (5). What is the std taken over? What is the random variable? It seems like the first term should be conditional on the accuracy of a typo-free scheme, since the task can be arbitrarily hard.