State-of-the-art NLP models can often be fooled by human-unaware transformations such as synonymous word substitution. For security reasons, it is of critical importance to develop models with certified robustness that can provably guarantee that the prediction is can not be altered by any possible synonymous word substitution. In this work, we propose a certified robust method based on a new randomized smoothing technique, which constructs a stochastic ensemble by applying random word substitutions on the input sentences, and leverage the statistical properties of the ensemble to provably certify the robustness. Our method is simple and structure-free in that it only requires the black-box queries of the model outputs, and hence can be applied to any pre-trained models (such as BERT) and any types of models (world-level or subword-level). Our method significantly outperforms recent state-of-the-art methods for certified robustness on both IMDB and Amazon text classification tasks. To the best of our knowledge, we are the first work to achieve certified robustness on large systems such as BERT with practically meaningful certified accuracy. Deep neural networks have achieved state-of-the-art results in many NLP tasks, but also have been shown to be brittle to carefully crafted adversarial perturbations, such as replacing words with similar words (Alzantot et al., 2018), adding extra text (Wallace et al., 2019), and replacing sentences with semantically similar sentences (Ribeiro et al., 2018). These adversarial perturbations are imperceptible to humans, but can fool deep neural networks and break their performance. Efficient methods for defending these attacks are of critical imEqual contribution portance for deploying modern deep NLP models to practical automatic AI systems. In this paper, we focus on defending the synonymous word substitution attacking (Alzantot et al., 2018), in which an attacker attempts to alter the output of the model by replacing words in the input sentence with their synonyms according to a synonym table, while keeping the meaning of this sentence unchanged. A model is said to be certified robust if such an attack is guaranteed to fail, no matter how the attacker manipulates the input sentences. Achieving and verifying certified robustness is highly challenging even if the synonym table used by the attacker is known during training (see Jia et al., 2019), because it requires to check every possible synonymous word substitution, whose number is exponentially large. Various defense methods against synonymous word substitution attacks have been developed (e.g., Wallace et al., 2019; Ebrahimi et al., 2018), most of which, however, are not certified robust in that they may eventually be broken by stronger attackers. Recently, Jia et al. (2019); Huang et al. (2019) proposed the first certified robust methods against word substitution attacking. Their methods are based on the interval bound propagation (IBP) method (Dvijotham et al., 2018) which computes the range of the model output by propagating the interval constraints of the inputs layer by layer. However, the IBP-based methods of Jia et al. (2019); Huang et al. (2019) are limited in several ways. First, because IBP only works for certifying neural networks with continuous inputs, the inputs in Jia et al. (2019) and Huang et al. (2019) are taken to be the word embedding vectors of the input sentences, instead of the discrete sentences. This makes it inapplicable to character-level (Zhang et al., 2015) and subword-level (Bojanowski et al., 2017) model, which are more widely used in practice (Wu et al., 2016). In this paper, we propose a structure-free certified defense method that applies to arbitrary models that can be queried in a black-box fashion, without any requirement on the model structures. Our method is based on the idea of randomized smoothing, which smooths the model with random word substitutions build on the synonymous network, and leverage the statistical properties of the randomized ensembles to construct provably certification bounds. Similar ideas of provably certification using randomized smoothing have been developed recently in deep learning (e.g., Cohen et al., 2019; Salman et al., 2019; Zhang et al., 2020; Lee et al., 2019), but mainly for computer vision tasks whose inputs (images) are in a continuous space (Cohen et al., 2019). Our method admits a substantial extension of the randomized smoothing technique to discrete and structured input spaces for NLP. We test our method on various types of NLP models, including text CNN (Kim, 2014), Char-CNN (Zhang et al., 2015), and BERT (Devlin et al., 2019). Our method significantly outperforms the recent IBP-based methods (Jia et al., 2019; Huang et al., 2019) on both IMDB and Amazon text classification. In particular, we achieve an 87.35% certified accuracy on IMDB by applying our method on the state-of-the-art BERT, on which previous certified robust methods are not applicable. In a text classification task, a model f ( X ) maps an input sentence X  X to a label c in a set Y of discrete categories, where X = x 1 , . . . , x L is a sentence consisting of L words. In this paper, we focus on adversarial word substitution in which an attacker arbitrarily replaces the words in the sentence by their synonyms according to a synonym table to alert the prediction of the model. Specifically, for any word x , we consider a pre-defined synonym set S x that contains the synonyms of x (including x itself). We assume the synonymous relation is symmetric, that is, x is in the synonym set of all its synonyms. The synonym set S x can be built based on GLOVE (Pennington et al., 2014). With a given input sentence X = x 1 ,. . . , x L , the attacker may construct an adversarial sentence X (cid:48) = x (cid:48) 1 , . . . , x (cid:48) L by perturbing at most R  L words x i in X to any of their synonyms x (cid:48) i  S x i , SX := (cid:8) X (cid:48) : (cid:13)(cid:13) X (cid:48)  X (cid:13)(cid:13) 0  R, x (cid:48) i  S x i ,  i (cid:9) , where SX denotes the candidate set of adversarial sentences available to the attacker. Here (cid:107) X (cid:48)  X (cid:107) 0 := (cid:80) Li =1 I { x (cid:48) i (cid:54) = x i } is the Hamming distance, with I {} the indicator function. It is expected that all X (cid:48)  SX have the same semantic meaning as X for human readers, but they may have different outputs from the model. The goal of the attacker is to find X (cid:48)  SX such that f ( X ) (cid:54) = f ( X (cid:48) ) . Certified Robustness Formally, a model f is said to be certified robust against word substitution attacking on an input X if it is able to give consistently correct predictions for all the possible word substitution perturbations, i.e, y = f ( X ) = f ( X (cid:48) ) , for all X (cid:48)  SX , (1) where y denotes the true label of sentence X . Deciding if f is certified robust can be highly challenging, because, unless additional structural information is available, it requires to exam all the candidate sentences in SX , whose size grows exponentially with R . In this work, we mainly consider the case when R = L , which is the most challenging case. Our idea is to replace f with a more smoothed model that is easier to verify by averaging the outputs of a set of randomly perturbed inputs based on random word substitutions. The smoothed classifier f RS is constructed by introducing random perturbations on the input space, f RS ( X ) = arg max c Y PZ   X ( f ( Z ) = c ) , where  X is a probability distribution on the input space that prescribes a random perturbation around X . which is the soft score of class c under f RS . The perturbation distribution  X should be cho-sen properly so that f RS forms a close approximation to the original model f (i.e., f RS ( X )  f ( X ) ), and is also sufficiently random to ensure that f RS is smooth enough to allow certified robustness (in the sense of Theorem 1 below). In our work, we define  X to be the uniform distribution on a set of random word substitutions. Specifically, let P x be a perturbation set for word x in the vocabulary, which is different from the synonym set S x . In this work, we construct P x based on the top K nearest neighbors under the cosine similarity of GLOVE vectors, where K is a hyper-parameter that controls the size of the perturbation set; see Section 4 for more discussion on P x . For a sentence X = x 1 , . . . , x L , the sentence-level perturbation distribution  X is defined by randomly and independently perturbing each word x i to a word in its perturbation set P x i with equal probability, that is,  X ( Z ) = L (cid:89) i =1 I { z i  P x i } | P x i | , where Z = z 1 , . . . , z L is the perturbed sentence and | P x i | denotes the size of P x i . Note that the random perturbation Z and the adversarial candidate X (cid:48)  SX are different. We now discuss how to certify the robustness of the smoothed model f RS . Recall that f RS is certified robust if y = f RS ( X (cid:48) ) for any X (cid:48)  SX , where y is the true label. A sufficient condition for this is min X (cid:48)  SX g RS ( X (cid:48) , y )  max X (cid:48)  SX g RS ( X (cid:48) , c )  c (cid:54) = y, where the lower bound of g RS ( X (cid:48) , y ) on X (cid:48)  SX is larger than the upper bound of g RS ( X (cid:48) , c ) on X (cid:48)  SX for every c (cid:54) = y . Define q x = min x (cid:48)  S x | P x  P x (cid:48) | / | P x | , where q x indicates the overlap between the two different perturbation sets. Then min X (cid:48)  SX g RS ( X (cid:48) , c )  max( g RS ( X , c )  q X , 0) max X (cid:48)  SX g RS ( X (cid:48) , c )  min( g RS ( X , c ) + q X , 1) . The key step is hence to calculate the upper and low bounds of g RS ( X (cid:48) , c ) for  c  Y and X (cid:48)  SX , which we address in Theorem 1 below. All proofs are in Appendix A.2. Theorem 1. (Certified Lower/Upper Bounds) Assume the perturbation set P x is constructed such that | P x | = | P x (cid:48) | for every word x and its synonym x (cid:48)  S x . For a given sentence X = x 1 , . . . , x L , we sort the words according to q x , such that q x i 1  q x i 2      q x iL . where q X := 1  (cid:81) Rj =1 q x ij . Equivalently, this says (cid:12)(cid:12) g RS ( X (cid:48) , c )  g RS ( X , c ) (cid:12) (cid:12)  q X , any label c  Y . The idea is that, with the randomized smoothing, the difference between g RS ( X (cid:48) , c ) and g RS ( X , c ) is at most q X for any adversarial candidate X (cid:48)  SX . Therefore, we can give adversarial upper and lower bounds of g RS ( X (cid:48) , c ) by g RS ( X , c )  q X , which, importantly, avoids the difficult adversarial optimization of g RS ( X (cid:48) , c ) on X (cid:48)  SX , and instead just needs to evaluate g RS ( X , c ) at the original input X . We are ready to describe a practical criterion for checking the certified robustness. Therefore, certifying whether the model gives consistently correct prediction reduces to checking if  X is positive, which can be easily achieved with Monte Carlo estimation as we show in the sequel. Estimating g RS ( X , c ) and  X Recall that g RS ( X , c ) = PZ   X ( f ( Z ) = c ) . We can estimate g RS ( X , c ) with a Monte Carlo estimator (cid:80) ni =1 I { f ( Z ( i ) ) = c } /n , where Z ( i ) are i.i.d. samples from  X . And  X can be approximated accordingly. Using concentration inequality, we can quantify the non-asymptotic approximation error. This allows us to construct rigorous statistical procedures to reject the null hypothesis that f RS is not certified robust at X (i.e.,  X  0 ) with a given significance level (e.g., 1% ). See Appendix A.1 for the algorithmic details of the testing procedure. We can see that our procedure is structure-free in that it only requires the black-box assessment of the output f ( Z ( i ) ) of the random inputs, and does not require any other structural information of f and f RS , which makes our method widely applicable to various types of complex models. Tightness A key question is if our bounds are sufficiently tight. The next theorem shows that the lower/upper bounds in Theorem 1 are tight and can not be further improved unless further information of the model f or f RS is acquired. Theorem 2. (Tightness) Assume the conditions of Theorem 1 hold. For a model f that satisfies f RS ( X ) = y and y B as defined in Proposition 1, there exists a model f  such that its related smoothed classifier g RS  satisfies g RS  ( X , c ) = ... g RS ( X , c ) for c = y and c = y B , and min X (cid:48)  SX g RS  ( X (cid:48) , y ) = max( g RS  ( X , y )  q X , 0) max X (cid:48)  SX g RS  ( X (cid:48) , y B ) = min( g RS  ( X , y B ) + q X , 1) , where q X is defined in Theorem 1. In other words, if we access g RS only through the evaluation of g RS ( X , y ) and g RS ( X , y B ) , then the bounds in Theorem 1 are the tightest possible that we can achieve, because we can not distinguish between g RS and the g RS  in Theorem 2 with the information available. Figure 1 visualizes the pipeline of the proposed approach. Given the synonym sets SX , we generate the perturbation sets PX from it. When an input sentence X arrives, we draw perturbed sentences { Z ( i ) } from  X and average their outputs to estimate  X , which is used to decide if the model is certified robust for X . Training the Base Classifier f Our method needs to start with a base classifier f . Although it is possible to train f using standard learning techniques, the result can be improved by considering that the method uses the smoothed f RS , instead of f . To improve the accuracy of f RS , we introduce a data augmentation induced by the perturbation set. Specifically, at each training iteration, we first sample a mini-batch of data points (sentences) and randomly perturbing the sentences using the perturbation distribution  X . We then apply gradient descent on the model based on the perturbed mini-batch. Similar training procedures were also used for Gaussian-based random smoothing on continuous inputs (see e.g., Cohen et al., 2019). Our method can easily leverage powerful pre-trained models such as BERT. In this case, BERT is used to construct feature maps and only the top layer weights are finetuned using the data augmentation method. We test our method on both IMDB (Maas et al., 2011) and Amazon (McAuley, 2013) text classification tasks, with various types of models, including text CNN (Kim, 2014), Char-CNN (Zhang et al., 2015) and BERT (Devlin et al., 2019). We compare with the recent IBP-based methods (Jia et al., 2019; Huang et al., 2019) as baselines. Text CNN (Kim, 2014) was used in Jia et al. (2019) and achieves the best result therein. All the baseline models are trained and tuned using the schedules recommended in the corresponding papers. We consider the case when R = L during attacking, which means all words in the sentence can be perturbed simultaneously by the attacker. Code for reproducing our results can be found in https://github.com/ lushleaf/Structure-free-certified-NLP . Synonym Sets Similar to Jia et al. (2019); Alzan-tot et al. (2018), we construct the synonym set S x of word x to be the set of words with  0 . 8 cosine similarity in the GLOVE vector space. The word vector space is constructed by post-processing the pre-trained GLOVE vectors (Pennington et al., 2014) using the counter-fitted method (Mrksic et al., 2016) and the all-but-the-top method (Mu and Viswanath, 2018) to ensure that synonyms are near to each other while antonyms are far apart. Perturbation Sets We say that two words x and x (cid:48) are connected synonymously if there exists a path of words x = x 1 , x 2 , . . . , x (cid:96) = x (cid:48) , such that all the successive pairs are synonymous. Let B x to be the set of words connected to x synonymously. Then we define the perturbation set P x to consist of the top K words in B x with the largest GLOVE cosine similarity if | B x |  K , and set P x = B x if | B x | < K . Here K is a hyper-parameter that controls the size of P x and hence trades off the smoothness and accuracy of f RS . We use K = 100 by default and investigate its effect in Section 4.2. Evaluation Metric We evaluate the certified robustness of a model f RS on a dataset with the certified accuracy (Cohen et al., 2019), which equals the percentage of data points on which f RS is certified robust, which, for our method, holds when  X > 0 can be verified. We first demonstrate that adversarial word substitution is able to give strong attack in our experimental setting. Using IMDB dataset, we attack the vanilla BERT (Devlin et al., 2019) with the adversarial attacking method of Jin et al. (2020). The vanilla BERT achieves a 91% clean accuracy (the testing accuracy on clean data without attacking), but only a 20 . 1% adversarial accuracy (the testing accuracy under the particular attacking method by Jin et al. (2020)). We will show later that our method is able to achieve 87 . 35% certified accuracy and thus the corresponding adversarial accuracy must be higher or equal to 87 . 35% . We compare our method with IBP (Jia et al., 2019; Huang et al., 2019). in Table 1. We can see that our method clearly outperforms the baselines. In particular, our approach significantly outperforms IBP on Amazon by improving the 14 . 00% baseline to 24 . 92% . Thanks to its structure-free property, our algorithm can be easily applied to any pre-trained models and character-level models, which is not easily achievable with Jia et al. (2019) and Huang et al. (2019). Table 2 shows that our method can further improve the result using Char-CNN (a character-level model) and BERT (Devlin et al., 2019), achieving an 87 . 35% certified accuracy on IMDB. In comparison, the IBP baseline only achieves a 79 . 74% certified accuracy under the same setting. We investigate the trade-off between smoothness and accuracy while tuning K in Table 3. We can Method Model Accuracy Jia et al. (2019) CNN 79.74 Huang et al. (2019) CNN 78.74 Ours CNN 81.16 Char-CNN 82.03 BERT 87.35 Table 2: The certified accuracy of different models and methods on the IMDB dataset. see that the clean accuracy decreases when K increases, while the gap between the clean accuracy and certified accuracy, which measures the smoothness, decreases when K increases. The best certified accuracy is achieved when K = 100 . We proposed a robustness certification method, which provably guarantees that all the possible perturbations cannot break down the system. Compared with previous work such as Jia et al. (2019); Huang et al. (2019), our method is structure-free and thus can be easily applied to any pre-trained models (such as BERT) and character-level models (such as Char-CNN). The construction of the perturbation set is of critical importance to our method. In this paper, we used a heuristic way based on the synonym network to construct the perturbation set, which may not be optimal. In further work, we will explore more efficient ways for constructing the perturbation set. We also plan to generalize our approach to achieve certified robustness against other types of adversarial attacks in NLP, such as the out-of-list attack. An nave way is to add the OOV token into the synonyms set of every word, but potentially better procedures can be further explored. This work is supported in part by NSF CRII 1830161 and NSF CAREER 1846421.
abstain abstain objective method result objective abstain abstain abstain method abstain abstain abstain abstain abstain abstain abstain abstain objective method abstain abstain abstain result result abstain method method method abstain abstain abstain other abstain abstain abstain abstain abstain method abstain abstain abstain abstain method abstain abstain other abstain abstain abstain other abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain method abstain abstain abstain abstain abstain method method abstain abstain abstain abstain abstain abstain abstain other abstain abstain method method method abstain abstain abstain method abstain method abstain abstain abstain abstain abstain abstain other abstain abstain abstain abstain abstain abstain abstain abstain result abstain abstain abstain abstain result abstain abstain abstain abstain result result abstain abstain abstain result abstain abstain abstain abstain abstain abstain abstain objective method abstain method objective result abstain other