Even though several methods have proposed to defend textual neural network (NN) models against black-box adversarial attacks, they often defend against a specific text perturbation strategy and/or require re-training the models from scratch. This leads to a lack of generalization in practice and redundant computation. In particular, the state-of-the-art transformer models (e.g., BERT, RoBERTa) require great time and computation resources. By borrowing an idea from software engineering , in order to address these limitations, we propose a novel algorithm, SHIELD , which modifies and re-trains only the last layer of a textual NN, and thus it patches and transforms the NN into a stochastic weighted ensemble of multi-expert prediction heads. Considering that most of current black-box attacks rely on iterative search mechanisms to optimize their adversarial perturbations, SHIELD confuses the attackers by automatically utilizing different weighted ensembles of predictors depending on the input. In other words, SHIELD breaks a fundamental assumption of the attack, which is a victim NN model remains constant during an attack. By conducting comprehensive experiments, we demonstrate that all of CNN, RNN, BERT, and RoBERTa-based textual NNs, once patched by SHIELD , exhibit a relative enhancement of 15%70% in accuracy on average against 14 different black-box attacks, outperforming 6 defensive baselines across 3 public datasets. Source code will be published at github.com/lethaiq/ shield-defend-adversarial-texts . Adversarial Text Attack and Defense. After being trained to maximize prediction performance, textual NN models frequently become vulnerable to adversarial attacks (Papernot et al., 2016; Wang et al., 2019a). In the NLP domain, in general, adversaries utilize different strategies to perturb an input sentence such that its semantic meaning is preserved while successfully letting a target NN model output a desired prediction. Text perturbations are typically generated by replacing or inserting critical words (e.g., HotFlip (Ebrahimi et al., 2018), TextFooler (Jin et al., 2019)), characters (e.g., DeepWordBug (Gao et al.), TextBugger (Li et al., 2018)) in a sentence or by manipulating a whole sentence (e.g., SCPNA (Iyyer et al., 2018), GAN-based(Zhao et al., 2018)). Since many recent NLP models are known to be vulnerable to adversarial black-box attacks (e.g., fake news detection (Le et al., 2020; Zhou et al., 2019b), dialog systems (Cheng et al., 2019), and so on), robust defenses for textual NN models are required. Even though several papers have proposed to defend NNs against such attacks, they were designed for either a specific type of attack (e.g., word or synonym substitution (Wang et al., 2021; Dong et al., 2021; Mozes et al., 2020; Zhou et al., 2021), misspellings (Pruthi et al., 2019), character-level (Pruthi et al., 2019), or word-based (Le et al., 2021)). Even though there exist some general defensive methods, most of them enrich NN models by re-training them with adversarial data augmented via known attack strategies (Miyato et al., 2016; Liu et al., 2020; Pang et al., 2020) or with external information such as knowledge graphs (Li and Sethy, 2019). However, these augmentations often induce substantial overhead in training or are still limited to only a small set of predefined attacks (e.g., (Zhou et al., 2019a)). Hence, we are in search of defense algorithms that directly enhance NN models' structures (e.g., (Li and Sethy, 2019)) while achieving higher generalization capability without the need of acquiring additional data. Motivation (Fig. 1) . Different from white-box attacks, black-box attacks do not have access to a target model's parameters, which are crucial for achieving effective attacks. Hence, attackers often 6661 Figure 1: Motivation of SHIELD : An attacker optimizes a step objective function (score) to search for the best perturbation by iteratively replacing each of the original 5 tokens with a perturbed one. query the target model repeatedly to acquire the necessary information for optimizing their strategy. From our analyses of 14 black-box attacks published during 20182020 (Table 1), all of them, except for SCPNA (Iyyer et al., 2018), rely on a searching algorithm (e.g., greedy, genetic) to iteratively replace each character/word in a sentence with a perturbation candidate to optimize the choice of characters/words and how they should be crafted to attack the target model (Fig. 1A). Even though this process is effective in terms of attack performance, they assume that the model's parameters remain unchanged and the model outputs coher-ent signals during the iterative search (Fig. 1A and 1B). Our key intuition is, however, to obfuscate the attackers by breaking this assumption . Specifically, we want to develop an algorithm that automatically utilizes a diverse set of models during inference. This can be done by training multiple sub-models instead of a single prediction model and randomly select one of them during inference to obfuscate the iterative search mechanism. However, this then introduces impractical computational overhead during both training and inference, especially when one wants to maximize prediction accuracy by utilizing complex SOTA sub-models such as BERT (Devlin et al., 2019) and RoBERTa (Liu et al., 2019b). Moreover, it also does not guarantee that trained models are sufficiently diverse to fool attackers. Furthermore, applying this strategy to existing NN models would also require re-training everything from the scratch, rendering the approach impractical. Proposal. To address these challenges, we borrow ideas from software engineering where bugs can be readily removed by an external installation patch. Specifically, we develop a novel neural patching Attack Method Search Atk Sem. algorithm, named as SHIELD , which patches only the last layer of an already deployed textual NN model (e.g., CNN, RNN, transformers(Vaswani et al., 2017; Bahdanau et al.)) and transforms it into an ensemble of multi-experts or prediction heads (Fig. 1C). During inference, then SHIELD automatically utilizes a stochastic weighted ensemble of experts for prediction depending on inputs. This will obfuscate adversaries' perturbation search, making black-box attacks much more difficult regardless of attack types, e.g., character or word level attacks (Fig. 1C,D). By patching only the last layer of a model, SHIELD also introduces lightweight computational overhead and requires no additional training data. In summary, our contributions are as follows: 6662  We propose SHIELD , a novel neural patching algorithm that transforms a already-trained NN model to a stochastic ensemble of multi-experts with little computational overhead. We demonstrate the effectiveness of SHIELD . CNN, RNN, BERT, and RoBERTa-based textual models patched by SHIELD achieve an increase of 15%70% on their robustness across 14 different black-box attacks, outperforming 6 defensive baselines on 3 public NLP datasets. To the best of our knowledge, this work by far includes the most comprehensive evaluation for the defense against black-box attacks. We introduce Stochastic Multi-Expert Neural Patcher ( SHIELD ) which patches only the last layer of an already trained NN model f ( x ,  ) and transforms it into an ensemble of multiple expert predictors with stochastic weights. These predictors are designed to be strategically selected with different weights during inference depending on the input. This is realized by two complementary modules, namely (i) a Stochastic Ensemble (SE) module that transforms f (  ) into a randomized ensemble of different heads and (ii) a Multi-Expert (ME) module that uses Neural Architecture Search (NAS) to dynamically learn the optimal architecture of each head to promote their diversity. This module extends the last layer of f (  ) , which is typically a fully-connected layer (followed by a softmax for classification), to an ensemble of K prediction heads , denoted H = { h (  ) } Kj . Each head h j (  ) , parameterized by  h j , is an expert predictor that is fed with a feature representation learned by up to the second-last layer of f (  ) and outputs a prediction logit score: h j : f ( x ,   L  1 )  RQ (cid:55)  y j  RM , (1) where   L  1 are fixed parameters of f up to the last prediction head layer, Q is the size of the feature representation of x generated by the base model f ( x ,   L  1 ) , and M is the number of labels. To aggregate all logit scores returned from all heads, then, a classical ensemble method would average them as the final prediction:  y  = 1 K (cid:80) Kj  y j . However, this simple aggregation assumes each h j (  )  H learns from very similar training signals. Hence, when   L  1 already learns some of the task-dependent information, H will eventually converge not to a set of experts but very similar predictors. To resolve this issue, we introduce stochasticity into the process by assigning prediction heads with stochastic weights during both training and inference. Specifically, we introduce a new aggregation mechanism:  y = 1 KK (cid:88) j  j w j  y j , (2) where w j weights  y j according to head j 's expertise on the current input x , and  j  [0 , 1] is a probabilistic scalar, representing how much of the weight w j should be accounted for. Let us denote w ,   RK as vectors containing all scalars w j and  j , respectively, and  y  R ( K  M ) as the concatenation of all vectors  y j returned from each of the heads. We calculate w and  as follows: w = WT ( y  f ( x ,   L  1 )) + b , (3)  = softmax(( w + g ) / ) , (4) where W  R ( K  M + Q )  K , b  RK are trainable parameters, g  RK is a noise vector sampled from the Standard Gumbel Distribution and therefore, probability vector  is sampled by a technique known as Gumbel-Softmax (Jang et al., 2016) controlled by the noise vector g and the temperature  . Unlike the standard Softmax, the Gumbel-Softmax is able to learn a categorical distribution (over K heads) optimized for a downstream task (Jang et al., 2016). Annealing   0 encourages a pseudo one-hot vector (e.g., [0.94, 0.03, 0.01, 0.02] when K =4 ), which makes Eq. (2) a mixture of experts (Avnimelech and Intrator, 1999). Importantly,  is sampled in an inherently stochastic way depending on the gumbel noise g . While W , b is learned to deterministically assigns more weights w to heads that are experts for each input x (Eq. (3)),  introduces stochasticity into the final logits. The multiplication of  j w j in Eq. (2) then enables us to use different sets of weighted ensemble models while still maintaining the ranking of the most important head . Thus, this further diversifies the learning of each expert and confuse attackers when they iteratively try different inputs to find good adversarial perturbations. Negative Log Likelihood (NLL) loss following the objective: While the SE module facilitates stochastic weighted ensemble among heads, the ME module searches for the optimal architecture for each head that maximizes the diversity in how they make predictions. To do this, we utilize the DARTS algorithm (Liu et al., 2019a) as follows. Let us denote O j = { o j (  ) } Tt where T is the number of possible architectures to be selected for h j  H . We want to learn a one-hot encoded selection vector  j  RT that assigns h j (  )  o j, argmax(  j ) (  ) during prediction. Since argmax(  ) operation is not differentiable, during training, we relax the categorical assignment of the architecture for h j (  )  H to a softmax over all possible networks in O j : h j (  )  1 TT (cid:88) t exp(  tj ) (cid:80) Tt exp(  Tj ) o j,t (  ) . However, the original DARTS algorithm only optimizes prediction performance. In our case, we also want to promote the diversity among heads. To do this, we force each h j (  ) to specialize in different features of an input, i.e., in how it makes predictions. This can be achieved by maximizing the difference among the gradients of the word-embedding e i of input x i w.r.t to the outputs of each h j (  )  H . Hence, given a fixed set of parameters  O of all possible networks for every heads, we train all selection vectors {  } Kj by optimizing the objective: minimize {  } K j L experts = N (cid:88) i K (cid:88) n<m (cid:16) d(  e i J n ;  e i J m )  || e i J n  e i J m || 22 (cid:17) , (7) #Class #Vocab #Example MR (Pang and Lee, 2005) 2 19K 11K CB (Anand et al., 2017) 2 25K 32K HS (Davidson et al.) 3 35K 25K Table 2: Statistics of experimental datasets. To report the robustness, we report prediction accuracy under adversarial attacks (Morris et al., 2020), i.e., # of failed attacks over total # of examples. A failed attack is only counted when the attacker fails 6664 to perturb (i.e., fail to flip the label of a correctly predicted clean example). where d(  ) is the cosine-similarity function, and J j is the NLL loss as if we only use a single prediction head h j . In this module, however, not only do we want to maximize the differences among gradients vectors, but also we want to ensure the selected architectures eventually converge to good prediction performance. Therefore, we train the whole ME module with the following objective: minimize {  } Kj LME = LSE +  L experts . (8) 2.3 Overall Framework To combine the SE and ME modules, we replace Eq. (6) into Eq. (1) and optimize the overall objective: minimize {  } Kj L valME +  L valexperts s . We employ an iterative training strategy (Liu et al., 2019a) with the Adam optimization algorithm (Kingma and Ba, 2013) as in Alg. 1. By alternately freezing and training W , b ,  O and {  } Kj using a training set D train and a validation set D val , we want to (i) achieve high quality prediction performance through Eq. (5) and (ii) select the optimal architecture for each expert to maximize their specialization through Eq. (7). Datasets & Metric. Table 2 shows the statistics of all experimental datasets: Clickbait detection (CB) (Anand et al., 2017), Hate Speech detection (HS) (Davidson et al.) and Movie Reviews classification (MR) (Pang and Lee, 2005). We split each dataset into train , validation and test set with the ratio of 8:1:1 whenever standard public splits are not available. To report prediction performance on clean examples, we use the weighted F1 score to take the distribution of prediction labels into consideration. Defense Baselines. We want to defend four textual NN models (base models) of different architectures, namely RNN with GRU cells (Chung et al.), transformer -based BERT (Devlin et al., 2019) and RoBERTa (Liu et al., 2019b). We compare SHIELD with the following six defensive baselines:  Ensemble (Ens.) is the classical ensemble of 5 different base models . We use the average of all NLL losses from the base models as the final training loss. Diversity Training (DT) (Kariyappa and Qureshi, 2019) is a variant of the Ensemble baseline where a regularization term is added to maximize the coherency of gradient vectors of the input text w.r.t each sub-model. DT diversifies the feature-level expertise among heads. Adaptive Diversity Promoting (ADP) (Pang et al., 2019) is a variant of Ensemble baseline where a regularization term is added to maximize the diversity among non-maximal predictions of individual sub-models. ADP diversifies the class-level expertise among heads. Mixup Training (Mixup) (Zhang et al., 2018; Si et al.) trains a base model with data constructed by linear interpolation of two random training samples. In this work, we use Mixup to regularize a NN to adapt linear transformation in-between the continuous embeddings of training samples. Adversarial Training (AdvT) (Miyato et al., 2016) is a semi-supervised algorithm that optimizes the NLL loss on the original training samples plus adversarial inputs. Robust Word Recognizer (ScRNN) (Pruthi et al., 2019) detects and corrects potential adversarial perturbations or misspellings in a text before feeding it to the base model for prediction. Note that due to the insufficient memory of GPU Titian Xp to simultaneously train several BERT and RoBERTa sub-models, we exclude Ensemble , DT , and ADP baseline for them. Attacks. We comprehensively evaluate SHIELD under 14 different black-box attacks (Table 1). These attacks differ in their attack levels (e.g., character, word, sentence-based), optimization algorithms for searching adversarial perturbations Model/Dataset MR HS CB AVG RNN 0.73 0.88 0.97 0.86 +Ensemble 0.80 0.90 0.97 0.89 +DT 0.80 0.86 0.97 0.88 +ADP 0.80 0.88 0.97 0.88 +Mixup 0.77 0.87 0.97 0.87 +AdvT 0.76 0.89 0.98 0.88 +ScRNN 0.79 0.85 0.96 0.87 + SHIELD 0.78 0.86 0.97 0.87 (  1 . 3% ) CNN 0.719 0.900 0.966 0.862 +Ens. (e.g., through fixed templates, greedy, genetic-based search). Apart from lexical constraints such as limiting # or % of words to manipulate in a sentence, ignoring stop-words, etc., many of them also preserve the semantic meanings of a generated adversarial text via constraining the l2 distance between its representation vector and that of the original text produced by either Universal Sentence Encoder (USE) (Cer et al., 2018) or GloVe embeddings (Pennington et al., 2014). Moreover, to ensure that the perturbed texts still look natural, a few of the attack methods employ an external pre-trained language model (e.g., BERT(Devlin et al., 2019), L2W (Holtzman et al., 2018)) to optimize the log-likelihood of the adversarial texts. Due to computational limit, we only compare SHIELD with other baselines in 3 representative attacks, namely TextFooler (Jin et al., 2019), DeepWordBug (Gao et al.) and PWWS (Ren et al., 2019). They are among the most effective attacks. To ensure fairness and reproducibility, we use the external TextAttack (Morris et al., 2020) and OpenAttack (Zeng et al., 2021). framework for adversarial text generation and evaluation. ( K =5 ) with  =0 . 5 . For each expert, we set O j to 3 ( T =3 ) possible networks: FCN with 1, 2 and 3 hidden layer(s). For each dataset, we use grid-search to search for the best  value from { 1 . 0 , 0 . 1 , 0 . 01 , 0 . 001 } based on the averaged defense performance on the validation set under TextFooler (Jin et al., 2019) and DeepWordBug (Gao et al.). We use 10% of the training set as a separate development set during training with early-stop to prevent overfitting. We report the performance of the best single model across all attacks on the test set. The Appendix includes all details on all models' parameters and implementation. Fidelity We first evaluate SHIELD 's prediction performance without adversarial attacks. Table 3 shows that all base models patched by SHIELD still maintain similar F1 scores on average across all datasets. Although SHIELD with RNN has a slightly decrease in fidelity on Hate Speech dataset, this is negligible compared to the adversarial robustness benefits that SHIELD will provide (More below). Computational Complexity Regarding the space complexity, SHIELD can extend a NN into an ensemble model with a marginal increase of # of parameters. Specifically, with B denoting # of parameters of the base model, SHIELD has a space complexity of O ( B + KU ) while both Ensemble , DT and ADP have a complexity of O ( KB ) and U  B . In case of BERT with K =5 , SHIELD only requires an additional 8.3%. While traditional ensemble methods require as many as 4 times additional parameters. During training, SHIELD only trains O ( KU ) parameters, while other defense methods, including ones using data augmentation, update all of them. Specifically, with K =5 , SHIELD only trains 8% of the parameters of the base model and 1.6% of the parameters of other BERT-based ensemble baselines. During inference, SHIELD is also 3 times faster than ensemble-based DT and ADP on average. Robustness Table 4 shows the performance of SHIELD compared to the base models. Overall, SHIELD consistently improves the robustness of base models in 154/168 ( 92%) cases across 14 adversarial attacks regardless of their attack strategies. Particularly, all CNN, RNN, BERT and RoBERTa-based textual models that are patched by SHIELD witness relative improvements in the average prediction accuracy from 15% to as much as 70%. Especially in the case of detecting clickbait, SHIELD can recover up to 5% margin within the performance on clean examples in many cases. This demonstrates that SHIELD provides a versatile neural patching mechanism that can quickly and effectively defends against black-box adversaries without making any assumptions on the attack strategies. We then compare SHIELD with all defense baselines under TextFooler (TF), DeepWordBug (DW), and PWWS (PS) attacks. These attacks are selected as (i) they are among the strongest attacks and (ii) they provide foundation mechanisms upon which other attacks are built. Table 5 shows that SHIELD achieves the best robustness across all attacks and datasets. On average, SHIELD observes an absolute improvement from +9% to +18% in accuracy over the second-best defense algorithms (DT in case of RNN, and AdvT in case of BERT, RoBERTa). Moreover, SHIELD outperforms other ensemble-based baselines (DT, ADP), and can be applied on top of a pre-trained BERT or RoBERTa model with only around 8% additional parameters. However, that # would increase to 500% ( K  5) in the case of DT and ADP, requiring over half a billion # of parameters. not only improves the overall robustness of the patched NN model under a variety of black-box attacks, but also induces computational cost that can greatly discourage malicious actors to exercise adversarial attacks in practice. We define computational cost as # of queries on a target NN model that is required for a successful attack. Since adversaries usually have an attack budget on # of model queries (e.g. a monetary budget, limited API access to the black-box model), the higher # of queries required, the less vulnerable a target model is to adversarial threats. A larger budget is crucial for genetic-based attacks because they usually require larger # of queries than greedy-based strategies. We have demonstrated in Sec. 3.2 that SHIELD is robust even when the attack budget is unlimited . Fig. 2 shows that the performance of RoBERTa after patched by SHIELD also reduces at a slower rate compared to the base RoBERTa model when the attack budget increases, especially under greedy-based attacks. Effects of Stochasticity on SHIELD 's Performance . Stochasticity in SHIELD comes from two parts, namely (i) the assignment of the main prediction head during each inference call and (ii) the randomness in the Gumbel-Softmax outputs. Regarding (i), it happens because during a typical iterative black-box process, an attacker tries different manipulations of a given text. When the attacker does so, the input text to the model changes at every iterative step. This then leads to the changes of prediction head assignment because each prediction head is an expert at different featurese.g., words or phrases in an input sentence. Thus, given an input, the assignment of the expert predictors for a specific set of manipulations stays the same. Therefore, even if an attacker repeatedly calls the model with a specific changes on the original sentence, the attacker will not gain any additional information. Regarding (ii), even though Gumbel-Softmax outputs are not deterministic, it always maintains 6667 the relative ranking of the expert predictor during each inference call with a sufficiently small value of  . In other words, it will not affect the fidelity of the model across different runs. Parameter Sensitivity Analyses. Training SHIELD requires hyper-parameter K, T,  and  . We observe that arbitrary value  =0 . 5 , K =5 , T =3 works well across all experiments. Although we did not observe any patterns on the effects of K on the robustness, a K  3 performs well across all attacks. On the contrary, different pairs of the temperature  during training and inference witness varied performance w.r.t to different datasets. gives us the flexibility to control the sharpness of the probability vector  . When   0 ,  to get closer to one-hot encoded vector, i.e., use only one head at a time. Ablation Tests. This section tests SHIELD with only either the SE or ME module. Table 6 shows that SE and ME performs differently across different datasets and models. Specifically, we observe that ME performs better than the SE module in case of Clickbait dataset, SE is better than the ME module in case of Movie Reviews dataset and we have mixed results in Hate Speech dataset. Nevertheless, the final SHIELD model which comprises both the SE and ME modules consistently performs the best across all cases. This shows that both the ME and SE modules are complementary to each other and are crucial for SHIELD 's robustness. In this paper, we limit the architecture of each expert to be an FCN with a maximum of 3 hidden layers (except the base model). If we include more options for this architecture (e.g., attention (Luong et al., 2015)), sub-models' diversity will significantly increase. The design of SHIELD is model-agnostic and is also applicable to other complex and large-scale NNs such as transformers-based models. Especially with the recent adoption of transformer architecture in both NLP and computer vision (Carion et al., 2020; Chen et al., 2020), potential future work includes extending SHIELD to patch other complex NN models (e.g., T5 (Raf-fel et al., 2020)) or other tasks and domains such as Q&A and language generation. Although our work focus is not in robust transferability, it can accommodate so simply by unfreezing the base layers f ( x ,   L  1 ) in Eq. (1 during training with some Dataset Movie Reviews Hate Speech Clickbait Attack TF DW PS TF DW PS TF DW PS RNN 0.02 0.2 0.09 0.09 0.26 0.32 0.31 0.67 0.46 + SE Only 0.02 0.17 0.08 0.09 0.2 0.32 0.52 0.72 0.61 + ME Only 0.02 0.14 0.07 0.13 0.03 0.01 0.57 0.79 0.61 + SHIELD 0.18 0.44 0.3 0.26 0.61 0.54 0.78 0.9 0.85 CNN 0.01 0.13 0.06 0.03 0.1 0.14 0.45 0.7 0.57 + SE Only 0.02 0.15 0.07 0.24 0.42 0.42 0.46 0.64 0.61 + ME Only 0.18 0.19 0.07 0.1 0.25 0.29 0.60 0.80 0.69 + SHIELD 0.19 0.38 0.28 0.19 0.32 0.34 0.74 0.86 0.81 BERT 0.09 0.2 0.19 0.26 0.16 0.38 0.49 0.5 0.49 + SE Only 0.07 0.18 0.16 0.26 0.28 0.32 0.45 0.49 0.62 + ME Only 0.06 0.2 0.15 0.21 0.28 0.27 0.74 0.81 0.82 + SHIELD 0.26 0.42 0.35 0.37 0.55 0.44 0.92 0.95 0.94 RoBERTa 0.06 0.18 0.16 0.1 0.12 0.12 0.37 0.34 0.45 + SE Only 0.13 0.22 0.19 0.13 0.26 0.29 0.57 0.70 0.71 + ME Only 0.07 0.17 0.15 0.22 0.4 0.31 0.8 0.87 0.85 + SHIELD 0.39 0.55 0.45 0.37 0.55 0.44 0.93 0.96 0.94 Table 6: Complementary role of SE and ME . Defending against Black-Box Attacks. Most of previous works (e.g., (Le et al., 2021; Zhou et al., 2021; Keller et al., 2021; Pruthi et al., 2019; Dong et al., 2021; Mozes et al., 2020; Wang et al., 2021; Jia et al., 2019) in adversarial defense are designed either for a specific type (e.g., word, synonym-substitution as in certified training (Jia et al., 2019), misspellings (Pruthi et al., 2019)) or level (e.g., character or word-based) of attack. Thus, they are usually evaluated against a small subset of (  4 ) attack methods. Despite there are works that propose general defense methods, they are often built upon adversarial training (Goodfellow et al., 2015) which requires training everything from scratch (e.g., (Si et al.; Miyato et al., 2016; Zhang et al., 2018) or limited to a set of predefined attacks (e.g., (Zhou et al., 2019a)). Although adversarial training-based defense works well against several attacks on BERT and RoBERTa, its performance is far out-weighted by SHIELD (Table 5). Contrast to previous approaches, SHIELD addresses not the characteristics of the resulted perturbations from the attackers but their fundamental attack mechanism, which is most of the time an iterative perturbation optimization process (Fig. 1). This allows SHIELD to effectively defend against 14 different black-box attacks (Table 1), showing its effectiveness in practice. To the best of our knowledge, by far, this works also evaluate with 6668 the most comprehensive set of attack methods in the adversarial text defense literature. Ensemble-based Defenses. SHIELD is distinguishable from previous ensemble-based defenses on two aspects. First, previous approaches such as DT (Kariyappa and Qureshi, 2019), ADP (Pang et al., 2019) are mainly designed for computer vision. Applying these models to the NLP domain faces a practical challenge where training multiple memory-intensive SOTA sub-models such as BERT or RoBERTa can be very costly in terms of space and time complexities. In contrast, SHIELD enables to hot-fix a complex NN by replacing and training only the last layer, removing the necessity of re-training the entire model from scratch. Second, previous methods (e.g., DT and ADP) mainly aim to reduce the dimensionality of adversarial subspace , i.e., the subspace that contains all adversarial examples, by forcing the adversaries to attack a single fixed ensemble of diverse sub-models at the same time. This then helps improve the transferability of robustness on different tasks. However, our approach mainly aims to dilute not transfer but direct attacks by forcing the adversaries to attack stochastic, i.e., different, ensemble variations of sub-models at every inference passes. This helps SHIELD achieve a much better defense performance compared to DT and ADP across several attacks (Table 5). This paper presents a novel algorithm, SHIELD , which consistently improves the robustness of textual NN models under black-box adversarial attacks by modifying and re-training only their last layers. By extending a textual NN model of varying architectures (e.g., CNN, RNN, BERT, RoBERTa) into a stochastic ensemble of multiple experts, SHIELD utilizes differently-weighted sets of prediction heads depending on the input. This helps SHIELD defend against black-box adversarial attacks by breaking their most fundamental assumptioni.e., target NN models remain unchanged during an attack. SHIELD achieves average relative improvements of 15%70% in prediction accuracy under 14 attacks on 3 public NLP datasets, while still maintaining similar performance on clean examples. Thanks to its model-and domain-agnostic design, we expect SHIELD to work properly in other NLP domains. We address two practical adversarial attack scenarios and how SHIELD can help defend against them. First, adversaries can attempt to abuse social media platforms such as Facebook by posting ads or recruitment for human-trafficking, protests, or by spreading misinformatione.g., vaccine-related. To do so, the adversaries can directly use one of the black-box attacks in the literature to iteratively craft a posting that will not be easily detected and removed by the platforms. In some cases, a good attack method only requires a few trials to successfully fool such platforms. Our method can help confuse the attackers with inconsistent signals, hence reduce the chance they succeed. Second, many popular services and platforms such as the NYTimes, the Southeast Missourian, OpenWeb, Disqus, Red-dit, etc. rely on a 3rd party APIs such as Perspective API 1 for detecting toxic comments onlinee.g., racist, offensive, personal attacks. However, these public APIs have been shown to be vulnerable against black-box attacks in literature (Li et al., 2018). The attacker can use a black-box attack method to attack these public APIs in an iterative manner, then retrieve the adversarial toxic comments and use those on these platforms without the risk of being detected and removed by the system. Since these malicious behaviors can endanger public safety and undermine the quality of online information, our work has practical values and can have broad societal impacts. This research was supported in part by NSF awards #1820609, #1915801, and #2114824. The work of Noseong Park was partially supported by the Yonsei University Research Fund of 2021, and the Institute of Information & Communications Technology Planning & Evaluation (IITP) grant funded by the Korean government (MSIT) (No. 2020-0-01361, Artificial Intelligence Graduate School Program (Yonsei University)).
abstain abstain abstain objective abstain abstain objective abstain abstain abstain abstain other abstain other abstain abstain result abstain abstain abstain abstain method abstain abstain objective abstain abstain abstain abstain abstain method objective abstain abstain abstain abstain objective objective objective abstain method abstain abstain abstain abstain abstain other abstain abstain abstain method method method method abstain abstain abstain abstain abstain abstain abstain method abstain abstain abstain method method method method abstain method method abstain method method abstain method method method method abstain abstain method method abstain abstain abstain abstain abstain abstain method method abstain method method method abstain abstain abstain abstain abstain method abstain abstain method abstain method other abstain other abstain method abstain method abstain abstain abstain method method abstain abstain abstain abstain method method abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain method abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain method abstain abstain abstain abstain abstain abstain abstain method abstain abstain abstain abstain other other other other other other other other method other other other other other other other objective other objective abstain abstain abstain abstain abstain abstain abstain abstain method abstain abstain abstain abstain other other other