Adversarial robustness has attracted much attention recently, and the mainstream solution is adversarial training. However, the tradition of generating adversarial perturbations for each input embedding (in the settings of NLP) scales up the training computational complexity by the number of gradient steps it takes to obtain the adversarial samples. To address this problem, we leverage Flooding method which primarily aims at better generalization and we find promising in defending adversarial attacks. We further propose an effective criterion to bring hyper-parameter-dependent flooding into effect with a narrowed-down search space by measuring how the gradient steps taken within one epoch affect the loss of each batch. Our approach requires zero adversarial sample for training, and its time consumption is equivalent to fine-tuning, which can be 2-15 times faster than standard adversarial training. We experimentally show that our method improves BERT's resistance to textual adversarial attacks by a large margin, and achieves state-of-the-art robust accuracy on various text classification and GLUE tasks. Despite their impressive performances on various NLP tasks, deep neural networks such as BERT (Devlin et al., 2019) suffer a sharp performance degradation against deliberately constructed adversarial attacks (Zeng et al., 2021; Wang et al., 2021b; Nie et al., 2020; Zang et al., 2020; Ren et al., 2019; Zhang et al., 2019). A line of work attempts to alleviate this problem by creating adversarially robust models via defense methods, including adversarial data augmentation (Chen et al., 2021; Si et al., 2021), regularization (Wang et al., 2021a), and adversarial training (Wang et al., 2020; Zhu et al., 2020; Madry et al., 2018). Data augmentation  Equal Contribution. and adversarial training rely on additional adversarial examples generated either by hand-crafting or conducting gradient ascent on the clean data for virtual adversarial samples. However, generating adversarial examples scales up the cost of training computationally, which makes vanilla adversarial training almost impractical on large-scale NLP tasks like QNLI (Question-answering NLI, Rajpurkar et al., 2016). An increasing amount of researchers express their concern about the time-consuming property of standard adversarial training and offer cheaper but competitive alternatives by (i) replacing the perturbation generation with an additional generator network (Baluja and Fischer, 2017; Xiao et al., 2018), or by (ii) combining the gradient computation of clean data and perturbations into one backward pass (Shafahi et al., 2019). These approaches still rely on additional adversarial examples generated either by the model itself or by an extra module. In this work, we propose a novel method, Flooding-X, to largely improve adversarial robustness without any adversarial examples, maintaining the same computational cost as conventional BERT fine-tuning. The vanilla Flooding (Ishida et al., 2020) method is a practical regularization technique to boost model generalization by preventing further reduction of the training loss when it reaches a reasonably small value . It results in a model performing normal gradient descent when training loss is above the decided value but gradient ascent when below. By continuing to random walk with the same non-zero value as a virtual loss, the model drifts into an area with a flat loss landscape that is claimed to lead to better generalization (Ishida et al., 2020). Interestingly, we find that Flooding method is also promising in increasing models' resistance to adversarial attacks. Despite the significant rise in robust accuracy, the so-called reasonably small value, which is a hyper-parameter, takes effort to be found and varies for 5634 each dataset, which requires an overly extensive search among the numerous candidates. In an attempt to narrow down the candidates of hyper-parameter, we propose gradient accordance as an informative criterion for optimal values that bring Flooding into effect, which is used as a building-block in Flooding-X. We measure how accordant the gradients of the batches are by analyzing how the gradient descent steps based on part of an epoch affect the loss of each batch. Gradient accordance is computationally friendly and is tractable during training process. Experiments on various tasks show a close relation between gradient accordance and overfitting. As a result, we propose gradient accordance as a reliable flooding criterion to make the training loss flood around the level when the model has nearly overfitted. That is to say, we leverage the training loss of the model right before overfitting as the value of flood level. Flooding-X is especially useful and shows great advantage over adversarial training in terms of computational cost when the training dataset is relatively large. Experimental results demonstrate that our method achieves stated-of-the-art robust accuracy with BERT on various tasks and improves its robust accuracy by 100 to 400% without using any adversarial example, consuming any extra training time, or conducting overly extensive search for hyper-parameter. Our main contributions are as follows. 1) We analyze and demonstrate the effectiveness of Flooding, which is designed for generalization, in improving adversarial robustness especially in NLP domain. 2) We propose a promising indicator, i.e. gradient accordance, to alleviate Flooding method from tedious search of the hyper-parameter. 3) We conduct comprehensive experiments on NLP tasks to illustrate the potential of Flooding for improving BERT's adversarial robustness. We first describe the vanilla Flooding regularization method (Ishida et al., 2020) for alleviating overfitting via keeping training loss from reducing to zero. Under the main assumption that learning until zero loss is harmful, Ishida et al. (2020) propose Flooding to intentionally prevent further reduction of the training loss when it reaches a Figure 1: Input loss landscape of vanilla BERT and different adversarial training algorithms under Gaussian random noise of standard deviation  on SST-2 dataset. reasonably small value, which is called the flood level . Intuitively, this approach makes the training loss float around the pre-defined flood level and alter from normal mini-batch gradient descent to gradient ascent if the loss is below the flood level. With the constraint of flood level, the model will continue to random walk around the non-zero training loss, which is expected to reach a flat loss landscape. where J denotes the original learning objective, and (cid:101) J represents the modified learning objective with flooding. The positive value b is the flood level specified by user, and  is the model parameter. Accordingly, the flooded empirical risk is then defined as (cid:101) R ( f ) = | (cid:98) R ( f )  b | + b, (2) within which (cid:98) R ( f ) / (cid:101) R ( f ) denotes the original / flooded empirical risk respectively, and f refers to the score function to be learned by the model. During the back propagation process, the gradient of (cid:98) R ( f ) w.r.t. model parameters and (cid:101) R ( f ) point to the same direction when (cid:101) R ( f ) is above b but to the opposite direction when it is below b . As a result, model performs normal gradient descent when the learning objective is above the flood level, and gradient ascent when below. Flooding is designed for overfitting, but why is it valid for adversarial robustness? According to the definition described in the previous section, Flooding does not make any difference to the 5635 training process when the loss is beyond the flood level. When the training loss approaches the flood level, on closer inspection, gradient descent and gradient ascent begin to alternate. Assume that the model with learning rate  performs gradient descent for the n -th batch and then gradient ascent for batch n + 1 , which results in:  n =  n  1   g (  n  1 ) ,  n +1 =  n +  g (  n ) . (3) In the equations above, g (  ) =   J (  ) is the gradient of J (  ) w.r.t. model parameters. We can then get  n +1 =  n  1   g (  n  1 ) +  g (cid:0)  n  1   g (  n  1 ) (cid:1) , (4) which is, by Taylor expansion, approximately equivalent to =  n  1   2 2    g (  n  1 )  2 . (5) Thus, theoretically, when the training loss is relatively low, the model alters into a new learning mode where the learning rate is  2 / 2 and the objective is to minimize  g (  )  2 . Generally, the flooded model is guided into an area with a smooth parameter landscape that leads to better adversarial robustness (Stutz et al., 2021; Prabhu et al., 2019; Yu et al., 2018; Li et al., 2018a). As is demonstrated in Figure 1, adversarial training brings about a smoother loss change to the model when the input embedding is perturbed by Gaussian random noise, which is closely related the stronger adversarial robustness. Among all the training methods involved in Figure 1, Flooding-X leads to the most smooth loss landscape, indicating an overall more robust model against attacks. Despite its potential in boosting model's resistance to adversarial attacks, the optimal flood level has to be searched by performing exhaustive search within a wide range at tiny steps, which is not easily at hand. A relatively large value of flood level lengthens the gradient steps and keeps the model from convergence, while a tiny value causes hardly any difference to the training process. The effect of Flooding deeply relies on the flood level, which, at the same time, is also sensitive to the subtle change of this hyper-parameter. Figure 2 reveals that even Figure 2: Influence of different flood levels on performance of the trained BERT on SST-2 against the attack of TextFooler (Jin et al., 2020). a slight change on the value of flood level can make a huge difference on the adversarial robustness of the so-trained model. In an attempt to ease the effort of searching and make the best of Flooding, we propose a promising and reliable criterion to narrow down the search space, which is described in detail in the next section. Since Flooding is proposed as an attempt to avoid overfitting, we intuitively suppose that the optimal flood level would be found at the stage when the model is about to overfit. That is, we leverage the training loss before overfitting as the flood level. Inspired by influence function (Koh and Liang, 2017), we propose gradient accordance as a criterion for flooding, which is empirically proved to be reliable and indicative. We consider the effect of the model updated w.r.t. one epoch on each of its batches as a signal of overfitting. As is indicated by its name, this criterion measures the relation among the gradients of each batch on epoch level, evaluating whether the model updated on an epoch has the same positive effect on the batches on average. Now we provide the formal definition of gradient accordance. We denote a model as a functional approximation f which is parameterized by  . Consider a training data point x with the ground truth label y , which results in a loss L ( f (  , x ) , y ) . The gradient of the loss w.r.t. the parameters is thus g =   L ( f (  , x ) , y ) , (6) 5636 whose negation denotes the direction in which the parameters  are updated to better correspond to the desired outputs on the training data (Fort et al., 2019). Now let's consider two data points x 1 and x 2 with their corresponding labels y 1 and y 2 . According to the definition above, the gradient of sample 1 is g 1 =   L ( f (  , x 1 ) , y 1 ) . We try to inspect how the small change of  in the direction  g 1 influences the loss on sample x 1 or x 2 :  L 1 = L ( f (    g 1 , x 1 ) , y 1 )  L ( f (  , x 1 ) , y 1 ) , (7) where f (  , x 1 ) can be expanded by Taylor expansion to be: f (  , x 1 ) = f (    g 1 , x 1 ) +  g 1 f   + O (  2 ) . (8) Here, we refer to (  g 1 f  + O (  2 )) as T ( x 1 ) ; and by repeating the similar expansion we can get L ( f (  , x 1 ) , y 1 ) = L ( f (    g 1 , x 1 ) + T ( x 1 ) , y 1 ) = L ( f (    g 1 , x 1 ) , y 1 ) +  L f T ( x 1 ) + O ( T 2 ( x 1 )) . (9) Equation (7) is thus equal to  L 1 =   L f T ( x 1 )  O ( T 2 ( x 1 )) =   L f (  g 1 f   + O (  2 )) =   g 1  g 1  O (  2 ) . (10) Similarly, the change of the loss on x 2 caused by the gradient update by x 1 is  L 2 =   g 1  g 2  O (  2 ) . Notably,  L 1 is negative by definition since the model is updated with respect to x 1 and naturally leads to a decrease on its loss. The model updated on x 1 is considered to have a positive effect on x 2 if  L 2 is also negative while an opposite effect if positive. The equations above demonstrate that this co-relation is equivalent to the overlap between the gradients of the two data points g 1  g 2 , which we hereafter refer to as gradient accordance . Data-point-level gradient accordance is too fine-grained to be tractable in practice. Thus, we attempt to scale it up and result in coarse-grain gradient accordance at batch level, which is computationally tractable and still reliable as a criterion for overfitting. Consider a training batch B 0 with n samples X = { x 1 , x 2 , . . . , x n } and labels y = { y 1 , y 2 , . . . , y n } of k classes { c 1 , c 2 , . . . , c k } . These samples can be divided into k groups according to their labels X = X 1  X 2    X k , and so are the labels y = (cid:83) ki =1 y i , where all the samples in X m belong to class c m . Thus, we have the sub-batch B 10 = { X 1 , y 1 } . We then define class accordance score of two sub-batches B 10 and B 20 of classes c 1 and c 2 as: C ( B 10 , B 20 ) = E [ cos ( g 1 , g 2 )] , (11) where g 1 is the gradient of the training loss of sub-batch B 10 w.r.t. the model parameters, and cos ( g 1 , g 2 ) = ( g 1 / | g 1 | )  ( g 2 / | g 2 | ) . Class accordance measures whether the gradient taken with respect to a sub-batch B 10 of class c 1 will also decrease the loss for samples in another sub-batch B 20 of class c 2 (Fort et al., 2019; Fu et al., 2020). Further consider that there are N batches in one training epoch and the training samples are of k classes. The batch accordance score between batches B s and B t is defined as S batchaccd ( B s , B t ) = 1 k ( k  1) k (cid:88) j =1 k (cid:88) i =1 i  = j C ( B is , B jt ) . (12) Batch accordance quantifies the learning consistency of two batches by evaluating how the model updated on one batch affects the other. To be more specific, a positive batch accordance denotes that the measured two batches are under the same learning pace since the model updated according to each batch benefits them both. The gradient accordance of certain epoch (or a part of an epoch, namely the sub-epoch, which can be several batch iterations) is finally defined as S epochaccd = 1 N ( N  1) N (cid:88) t = s +1 N  1 (cid:88) s =1 S batchaccd ( B s , B t ) . Gradient accordance scales the batch accordance score up from a measure of two batches to that of a sub-epoch. Criterion for Flooding A positive gradient accordance means that the model performed gradient descent w.r.t. the certain epoch decreases the loss of its batches on average, indicating that the learning 5637 pace of most batches are in line with each other. A negative one means that the model has overfitted to some of the training batches since the update of one epoch increases the loss of its batches on average, which is right the stage we would like to identify for the model by gradient accordance. We assume that the optimal flood level lies in the range of the training loss of a model when it is about to overfit. In the following section, we empirically prove that gradient accordance is a reliable and promising criterion for flooding. In this section, we provide comprehensive analysis on Flooding-X through extensive experiments on five text classification datasets of various tasks and scales: SST (Socher et al., 2013), MRPC (Dolan and Brockett, 2005), QNLI (Rajpurkar et al., 2016), IMDB (Maas et al., 2011) and AG News (Zhang et al., 2015). The statistics of these involved datasets are illustrated in Table 1, including the volume of training / test set and the average word count of the training samples. We conduct experiments on BERT-base (Devlin et al., 2019) and compare robust accuracy of Flooding-X with other adversarial training algorithms to demonstrate its strength. We implement all models in MindSpore. We compare Flooding-X with three adversarial training algorithms, one regularization method well as the vanilla Flooding. PGD Projected gradient descent (PGD, Madry et al., 2018) formulates adversarial training algorithms into solving a minimax problem that minimizes the empirical loss on adversarial examples that can lead to maximized adversarial risk. By adding adversarial perturbations to word em-beddings, FreeLB generates virtual adversarial samples inside the region around input samples. TAVAT Token-Aware Virtual Adversarial Training (TAVAT, Li and Qiu, 2021) aims at fine-grained perturbations, leveraging a token-level accumulated perturbation vocabulary to initialize the perturbations better and constraining them within a token-level normalization ball. InfoBERT InfoBERT (Wang et al., 2021a) leverages two mutual-information-based regularizers for robust model training, suppressing noisy mutual information while increasing mutual information between local stable features and global features. Flooding Flooding (Ishida et al., 2020) has been introduced in detail in section 2.1. We implemented Flooding and search for the flooding level at the step of 0.01 according to the tradition. The best result for each dataset is reported. Three well-received attack methods are leveraged via TextAttack (Morris et al., 2020) for an extensive comparison between our proposed method and baseline algorithms. TextFooler (Jin et al., 2020) identifies the important words for target model and repeats replacing them with synonyms until the prediction of the model is altered. Similarly, TextBugger (Li et al., 2018b) also searches for important words and modifies them by choosing an optimal perturbation from the generated several kinds of perturbations. BERTAttack (Li et al., 2020) applies BERT in a semantic-preserving way to generate substitutes for the vulnerable words detected in the given input. We consider four evaluation metrics to measure BERT's resistance to the mentioned adversarial attacks under different defence algorithms. Aua% Accuracy under attack measures the model's prediction accuracy on the adversarial data deliberately generated by certain attack method. A higher Aua% means a more robust model and a better defender. Suc% Attack success rate is evaluated by the ratio of the number of texts successfully perturbed by a specific attack method to the number of all 5638 the involved texts. Robust models are expected to score low on Suc% . #Query Number of queries denotes the average attempts the attacker queries the target model. The larger the number is, the harder the model is to be attacked. All the baseline methods are re-implemented based on their open-released codes and the results are competing to those reported. We train our models on NVIDIA RTX 3090 and RTX 2080Ti GPUs, depending on the volume of the dataset involved. Most of the parameters such as learning rate and warm-up step are in line with vanilla BERT (Devlin et al., 2019) and the baseline methods. For all of the adversarial methods we set the training step to be 5 for a fair comparison, which is a trade-off between training cost and model performance . The clean accuracy ( Clean % ) is tested on the whole test dataset. The other three metrics (e.g., Aua % , Suc % and #Query ) are evaluated on the whole test dataset for SST-2 and MRPC, and 800 randomly chosen samples for IMDB, AG NEWS, and QNLI. We train 10 epochs for each model on each dataset, among which the last epochs are selected for the comparison of adversarial robustness. The extensive results of all the above mentioned methods are summarized in Table 2. Generally, our Flooding-X method improves BERT by a large margin in terms of its resistance to adversarial attacks, surpassing the baseline adversarial training algorithms on most datasets under different attack methods. Under TextFooler attack (Jin et al., 2020), our algorithm reaches the best robust performance on four datasets: IMDB, AG News, SST-2, and MRPC. We observe that Flooding is more effective on smaller datasets than larger ones, since the smaller datasets with shorter training sentences are easier to be memorized by the neural network and are more likely to cause overfitting. On QNLI dataset where Flooding-X fails to win, the accuracy under attack is only 0.2 points lower than the 5 -step PGD. This might be explained by the mild change in gradient accordance during training on QNLI dataset, in which case the precise stage of overfitting is hard to be identified. Though we believe that a better value of flood level exists and can further boost the performance, we refuse to take on the pattern of extensive hyper-parameter searching which is against the original purpose of Flooding-X. Notably, our method performs better than the baseline adversarial training methods by 5 to 20 points on average even without using any adversarial examples as training source, not to mention the vanilla BERT. Under most cases, our method remains the best performing algorithm against BERTAttack (Li et al., 2020) and TextBugger (Li et al., 2018b). This proves that our method maintains effectiveness under different kinds of adversarial attacks. As a byproduct, the clean accuracy of our method is also competing among the baseline methods, which is inherent to the vanilla Flooding that aims at better generalization. In this section, we construct supplementary experiments to further analyze the effectiveness of Flooding-X and its building block, i.e., gradient accordance. Influence function (Koh and Liang, 2017) inspects the influence of one single training data on the model prediction and stiffness (Fort et al., 2019) measures how the model updated according to one sample affects the model prediction on another. Based on these two works, gradient accordance is proposed as a means for identifying model overfitting at sub-epoch level. As seen in Figure 3, during training process, the turning point of gradient accordance from negative to positive closely matches the point when the test loss is about to increase, which is well received as a signal of overfitting. Since it is computationally intractable to calculate gradient accordance after trained on every single batch, we can only figure out the range where the model is about to overfit by computing gradient accordance at sub-epoch level. Despite its outstanding performance of the last training epoch, we find that Flooding-X boosts the robustness of model at an earlier stage than standard fine-tuning and adversarial training methods like FreeLB. As is shown in Figure 4, Flooding-X improves BERT's adversarial robustness to a relatively high level at epoch 5 , which is competitive with that of standard fine-tuning at the last epoch. Besides, Flooding-X accelerates the increase of robustness at late training stage. Starting from epoch 7 our method enables a steep increment on the accuracy under attack, which is due to the effect of Flooding that forces the model to perform a more fierce random walk since the training loss of most batches are going below the flooding level. It is also demonstrated that the training loss stops approaching zero under the constraint of Flooding-X, while the standard fine-tuning and adversarial training continues to decrease the training loss towards zero which brings about the risk of overfitting. To further reveal the strength of Flooding besides its robustness performance, we compare its GPU training time consumption with baseline methods on several datasets of different sizes. For a fair comparison, every model of each dataset is trained on single NVIDIA RTX 2080Ti GPU with the same batch size, among which models on SST-2 are trained with a batch size of 32 while QNLI 5640 Figure 4: Loss and Aua % (accuracy under attack) of BERT trained on SST-2 under different methods. and IMDB are trained with 8 and 4 respectively since the training sentences are way longer than SST-2. As is demonstrated in Table 3, the time consumption (seconds) of Flooding is competitive with standard fine-tuning, which is far less than that of adversarial training algorithms. Adversarial Training Adversarial training (AT) is a well-received method for defending adversarial attacks. As an attempt against adversarial attacks, AT generates gradient-based adversarial samples and leverage them for further training (Goodfellow et al., 2015). A line of work tries different means for the generation of adversarial examples. The PGD algorithm (Madry et al., 2018), compared as a baseline method in our experiments, involves multiple projected gradient ascent steps to find the adversarial perturbations which are then used for updating the model parameters. However, it is computationally expensive and has aroused many attempts to cut down on the cost. Shafahi et al. (2019) and Zhu et al. (2020) focus on finding better adversarial sample while maintaining a low cost. Despite gradient-based methods which generates adversarial perturbations on the continuous input embedding, some works tailor AT for NLP fields. The adversarial examples are generated by replacing the original texts based on certain rules such as semantic similarity (Alzantot et al., 2018; Jin et al., 2020; Li et al., 2020). Ebrahimi et al. (2018) propose a perturbation strategy that conducts character insertion, deletion, and replacement. The mentioned algorithms of AT generates additional adversarial examples either by calculating gradients or by human force, which is computationally expensive and effort taking. Overfitting and Criterion Deep neural networks are shown to suffer from overfitting to training configurations and memorise training scenarios (Takeoka et al., 2021; Rodriguez et al., 2021; Roelofs et al., 2019; Werpachowski et al., 2019), which leads to poor generalization and vulnerability towards adversarial perturbations. One way of identifying overfitting is to see whether the generalization gap, i.e., the test minus the training loss, is increasing or not (Salakhutdinov, 2014). Ishida et al. (2020) further decompose the situation of the generalization gap increasing into two stages with regard to the change of both training and test losses (Zhang et al., 2021; Belkin et al., 2018; Arpit et al., 2017). Derived from influence function (Koh and Liang, 2017), Fort et al. (2019) propose the concept of Stiffness as a new perspective of generalization. They measure how stiff a network is by looking at how a small gradient step in the network parameters on one example affects the loss on another example. However, from the practical perspective, it is computationally intractable to compute the stiffness between every single sample during the process of standard training where thousands of samples are involved in one batch. In this work, we propose Flooding-X as an efficient and computational-friendly algorithm for improving BERT's resistance to adversarial attacks. We first theoretically prove that the vanilla Flooding method is able to boost model's adversarial robustness by leading it into a smooth parameter landscape. We further propose a promising and 5641 computationally tractable criterion, Gradient Accordance, to detect when the model is about to overfit and accordingly narrow down the hyper-parameter space for Flooding with an optimal flood level guaranteed. Experimental results prove that gradient accordance is closely related with the phenomenon of overfitting, equipped with which Flooding-X beats the well-received adversarial training methods and achieves state-of-the-art performances on various NLP tasks against different textual attack methods. This implies that adversarial examples, either generated by gradient-based algorithms or human efforts, are not a must for the improvement of adversarial robustness. We call for further exploration and deeper understanding in the nature of adversarial robustness and attacks. The authors wish to thank the anonymous reviewers for their helpful comments. This work was partially funded by National Natural Science Foundation of China (No. 62076069, 61976056). This research was sponsored by Hikvision Cooperation Fund, Beijing Academy of Artificial Intelligence (BAAI), and CAAI-Huawei MindSpore Open Fund.
abstain abstain objective objective abstain result abstain abstain abstain abstain abstain abstain abstain abstain abstain objective abstain abstain abstain result abstain objective method abstain abstain objective abstain abstain objective objective objective objective result abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain method abstain method abstain abstain abstain abstain abstain other other abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain method abstain abstain abstain abstain abstain abstain abstain abstain abstain method method method abstain abstain abstain abstain method abstain abstain abstain abstain abstain method abstain method abstain abstain abstain method abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain result abstain result abstain abstain abstain abstain abstain abstain abstain method abstain abstain abstain method result abstain abstain method abstain result abstain abstain abstain other other other abstain other other other other other other other other other other other other objective objective objective abstain abstain abstain other other other