Robustness Verification for Transformers
Robustness verification that aims to formally certify the prediction behavior of neural networks has become an important tool for understanding the behavior of a given model and for obtaining safety guarantees. However, previous methods are usually limited to relatively simple neural networks. In this paper, we consider the robustness verification problem for Transformers. Transformers have complex self-attention layers that pose many challenges for verification, including cross-nonlinearity and cross-position dependency, which have not been discussed in previous work. We resolve these challenges and develop the first verification algorithm for Transformers. The certified robustness bounds computed by our method are significantly tighter than those by naive Interval Bound Propagation. These bounds also shed light on interpreting Transformers as they consistently reflect the importance of words in sentiment analysis.
Contributions: This paper develops an algorithm for verifying the robustness of transformers with self-attention layers when the inputs for one input word embedding are perturbed. Unlike previous work the present work can deal with cross nonlinearity and cross position dependency and the lower bounds derived in the paper are much tighter than the Interval Boundary Propagation (IBP) method which uses backward propagation. The core contribution is expounded by developing bounds for multiplication (xy) and division (x/y) and using this to compute tight bounds on self-attention layer computations. Further by introducing a forward process then combining it with a backward process, they can substantially reduce computation time as compared to the IBP method (in experiments demonstrated to be over an order of magnitude). Experimental results: Very reasonable and well thought out experiments demonstrate that a) the lower bounds produced by the method are very tight (much better than IBP for instance), and the backward&forward approach is an order of magnitude faster than the fully backward approach though they are both equally tight (the fully forward method is much looser by contrast) The experiments on using the bound to detect the word whose perturbation will cause biggest impact (ie the most important word for explaining the decision) is much less convincing. In particular in Table 3, the second example shows that the method identifiews *a*, *the* *our* etc, which at least do not appear to be most salient to this reviewer. [Question to authors: perhaps I misunderstood something here -- if so please explain and help me understand it better]. Evaluation / Suggestions. Overall I liked the paper quite a bit. I may not have fully understood something about table 3 and would welcome some explanation about why the results shown there indicate that their method works better int he second example.
You are a member of the scientific community tasked with peer review. Review the following paper title and abstract.
### Title + Abstract
Robustness Verification for Transformers
Robustness verification that aims to formally certify the prediction behavior of neural networks has become an important tool for understanding the behavior of a given model and for obtaining safety guarantees. However, previous methods are usually limited to relatively simple neural networks. In this paper, we consider the robustness verification problem for Transformers. Transformers have complex self-attention layers that pose many challenges for verification, including cross-nonlinearity and cross-position dependency, which have not been discussed in previous work. We resolve these challenges and develop the first verification algorithm for Transformers. The certified robustness bounds computed by our method are significantly tighter than those by naive Interval Bound Propagation. These bounds also shed light on interpreting Transformers as they consistently reflect the importance of words in sentiment analysis.
user
<think>Okay, to do a decent peer review, I should start with summarizing what the work is about. This includes novelty, contributions, clarity, and impact. I might include suggestions to issues that I find critical to the usefulness of the work. Starting with novelty, there are different types of novelty. The first aspect of novelty is scope and scale. Is the work covering a broader perspective than previous works? The second aspect is methodology. Is the proposed methodology novel compared to previous methods? Do they provide any significant advantage over previous methodologies? The third aspect is results. Are the results different compared previous work? Does this lead to any novel theories or an extension of current theories? Next is clarity, I will be reading the work in depth and analyze if any sentences can be potentially ambiguous or misleading. If any sentences are ambiguous, I will state them and give a suggestion on how to rephrase such sentence or how to make more clear to the audience. Lastly, impact is important. I will attempt to predict how such work will impact the scientific community. This might include the applications of such work and how the work might transform the way we study a certain topic. Finally, I will might only mention issues that are critical. This is to keep the review as concise and helpful as possible.</think>



Contributions: This paper develops an algorithm for verifying the robustness of transformers with self-attention layers when the inputs for one input word embedding are perturbed. Unlike previous work the present work can deal with cross nonlinearity and cross position dependency and the lower bounds derived in the paper are much tighter than the Interval Boundary Propagation (IBP) method which uses backward propagation. The core contribution is expounded by developing bounds for multiplication (xy) and division (x/y) and using this to compute tight bounds on self-attention layer computations. Further by introducing a forward process then combining it with a backward process, they can substantially reduce computation time as compared to the IBP method (in experiments demonstrated to be over an order of magnitude). Experimental results: Very reasonable and well thought out experiments demonstrate that a) the lower bounds produced by the method are very tight (much better than IBP for instance), and the backward&forward approach is an order of magnitude faster than the fully backward approach though they are both equally tight (the fully forward method is much looser by contrast) The experiments on using the bound to detect the word whose perturbation will cause biggest impact (ie the most important word for explaining the decision) is much less convincing. In particular in Table 3, the second example shows that the method identifiews *a*, *the* *our* etc, which at least do not appear to be most salient to this reviewer. [Question to authors: perhaps I misunderstood something here -- if so please explain and help me understand it better]. Evaluation / Suggestions. Overall I liked the paper quite a bit. I may not have fully understood something about table 3 and would welcome some explanation about why the results shown there indicate that their method works better int he second example.
assistant
Contributions: This paper develops an algorithm for verifying the robustness of transformers with self-attention layers when the inputs for one input word embedding are perturbed. Unlike previous work the present work can deal with cross nonlinearity and cross position dependency and the lower bounds derived in the paper are much tighter than the Interval Boundary Propagation (IBP) method which uses backward propagation. The core contribution is expounded by developing bounds for multiplication (xy) and division (x/y) and using this to compute tight bounds on self-attention layer computations. Further by introducing a forward process then combining it with a backward process, they can substantially reduce computation time as compared to the IBP method (in experiments demonstrated to be over an order of magnitude). Experimental results: Very reasonable and well thought out experiments demonstrate that a) the lower bounds produced by the method are very tight (much better than IBP for instance), and the backward&forward approach is an order of magnitude faster than the fully backward approach though they are both equally tight (the fully forward method is much looser by contrast) The experiments on using the bound to detect the word whose perturbation will cause biggest impact (ie the most important word for explaining the decision) is much less convincing. In particular in Table 3, the second example shows that the method identifiews *a*, *the* *our* etc, which at least do not appear to be most salient to this reviewer. [Question to authors: perhaps I misunderstood something here -- if so please explain and help me understand it better]. Evaluation / Suggestions. Overall I liked the paper quite a bit. I may not have fully understood something about table 3 and would welcome some explanation about why the results shown there indicate that their method works better int he second example.