Despite excellent performance on many tasks, NLP systems are easily fooled by small adversarial perturbations of inputs. Existing procedures to defend against such perturbations are either (i) heuristic in nature and susceptible to stronger attacks or (ii) provide guaranteed robustness to worst-case attacks, but are incompatible with state-of-the-art models like BERT. In this work, we introduce robust encodings (RobEn): a simple framework that confers guaranteed robustness, without making compromises on model architecture. The core component of RobEn is an encoding function , which maps sentences to a smaller, discrete space of encodings. Systems using these encodings as a bottleneck confer guaranteed robustness with standard training , and the same encodings can be used across multiple tasks. We identify two desiderata to construct robust encoding functions: perturbations of a sentence should map to a small set of encodings (stability), and models using encodings should still perform well (fidelity). We instantiate RobEn to defend against a large family of adversarial typos. Across six tasks from GLUE, our instantiation of RobEn paired with BERT achieves an average robust accuracy of 71 . 3% against all adversarial typos in the family considered, while previous work using a typo-corrector achieves only 35 . 3% accuracy against a simple greedy attack. State-of-the-art NLP systems are brittle: small perturbations of inputs, commonly referred to as adversarial examples, can lead to catastrophic model failures (Belinkov and Bisk, 2018; Ebrahimi et al., 2018b; Ribeiro et al., 2018; Alzantot et al., 2018). For example, carefully chosen typos and word substitutions have fooled systems for hate speech detection (Hosseini et al., 2017), machine translation  Authors contributed equally. and Ng, 2005), among others. We aim to build systems that achieve high robust accuracy : accuracy against worst-case attacks. Broadly, existing methods to build robust models fall under one of two categories: (i) adversarial training, which augments the training set with heuristically generated perturbations and (ii) certifiably robust training, which bounds the change in prediction between an input and any of its allowable perturbations. Both these approaches have major shortcomings, especially in NLP. Adversarial training, while quite successful in vision (Madry et al., 2018), is challenging in NLP due to the discrete nature of textual inputs (Ebrahimi et al., 2018b); current techniques like projected gradient descent are incompatible with subword tokenization. Further, adversarial training relies on heuristic approximations to the worst-case perturbations, leaving models vulnerable to new, stronger attacks. Certifiably robust training (Jia et al., 2019; Huang et al., 2019; Shi et al., 2020) circumvents the above challenges by optimizing over a convex outer-approximation of the set of perturbations, allowing us to lower bound the true robust accuracy. However, the quality of bounds obtained by these methods scale poorly with the size of the network, and are vacuous for state-of-the-art models like BERT. Moreover, both approaches require separate, expensive training for each task, even when defending against the same type of perturbations. Ideally we would like a robustness module that we can reuse across multiple tasks, allowing us to only worry about robustness once: during its construction. Indeed, reusable components have driven recent progress in NLP. For example, word vectors are a universal resource that are constructed once, then used for many different tasks. Can we build a reusable robust defense that can easily work with complex, state-of-the-art architectures like BERT? The recent work of Pruthi et al. (2019), which uses a typo-corrector to defend against adversarial typos, is such a reusable defense: it is trained once, then reused across different tasks. However, we find that current typo-correctors do not perform well against even heuristic attacks, limiting their applicability. Our primary contribution is robust encodings (RobEn), a framework to construct encodings that can make systems using any model robust. The core component of RobEn is an encoding function that maps sentences to a smaller discrete space of encodings, which are then used to make predictions. We define two desiderata that a robust encoding function should satisfy: stability and fidelity. First, to encourage consistent predictions across perturbations, the encoding function should map all perturbations of a sentence to a small set of encodings (stability). Simultaneously, encodings should remain expressive, so models trained using encodings still perform well on unperturbed inputs (fidelity). Because systems using RobEn are encoding-based we can compute the exact robust accuracy tractably, avoiding the lower bounds of certifiably robust training. Moreover, these encodings can make any downstream model robust, including state-of-the-art transformers like BERT, and can be reused across different tasks. In Section 4, we apply RobEn to combat adversarial typos. In particular, we allow an attacker to add independent edit distance one typos to each word in an input sentence, resulting in exponentially more possible perturbations than previous ThisThusTihs fulmfllmfim This delightful film  dlightfuldeliightfuldelirhtful x Tihs dlightful fllm  Pos Neg Input x Perturbation set Perturbation x BERT BERT Figure 2: Attack model allowing independent perturbations of each token. work (Pruthi et al., 2019; Huang et al., 2019). We consider a natural class of token-level encodings , which are obtained by encoding each token in a sentence independently. This structure allows us to express stability and fidelity in terms of a clustering objective, which we optimize. Empirically, our instantiation of RobEn achieves state-of-the-art robust accuracy, which we compute exactly, across six classification tasks from the GLUE benchmark (Wang et al., 2019). Our best system, which combines RobEn with a BERT classifier (Devlin et al., 2019), achieves an average robust accuracy of 71 . 3% across the six tasks. In contrast, a state-of-the-art defense that combines BERT with a typo corrector (Pruthi et al., 2019) gets 35 . 3% accuracy when adversarial typos are inserted, and a standard data augmentation defense gets only 12 . 2% accuracy. Tasks. We consider NLP tasks that require classifying textual input x  X to a class y  Y . For simplicity, we refer to inputs as sentences. Each sentence x consists of tokens x 1 , . . . , x L from the set of all strings T . Let p task denote the distribution over inputs and labels for a particular task of interest. The goal is to learn a model f : X  Y that maps sentences to labels, given training examples ( x, y )  p task . Attack surface. We consider an attack surface in which an adversary can perturb each token x i of a sentence to some token  x i  B ( x i ) , where B ( x i ) is the set of valid perturbations of x i . For example, B ( x i ) could be a set of allowed typos of x i . We define B ( x ) as the set of all valid perturbations of the set x , where every possible combination of token-level typos is allowed: B ( x ) = { (  x 1 , . . . ,  x L ) |  x i  B ( x i )  i } (1) The size of the attack surface | B ( x ) | grows exponentially with respect to number of input tokens, as shown in Figure 2. In general x i  B ( x i ) , so some words could remain unperturbed. evaluation metrics for any given task. First, we evaluate a model on its standard accuracy on the task: acc std ( f ) = E ( x,y )  p task 1 [ f ( x ) = y ] . Next, we are interested in models that also have high robust accuracy , the fraction of examples ( x, y ) for which the model is correct on all valid perturbations  x  B ( x ) allowed in the attack model: It is common to instead compute accuracy against a heuristic attack a that maps clean sentences x to perturbed sentences a ( x )  B ( x ) . Typically, a ( x ) is the result of a heuristic search for a perturbation  x  B ( x ) that f misclassifies. Note that acc attack is a (possibly loose) upper bound of acc rob because there could be perturbations that the model misclassifies but are not encountered during the heuristic search (Athalye et al., 2018). Additionally, since robust accuracy is generally hard to compute, some existing work computes certified accuracy (Huang et al., 2019; Jia et al., 2019; Shi et al., 2020), which is a potentially conservative lower bound for the true robust accuracy. In this work, since we use robust encodings, we can tractably compute the exact robust accuracy. We introduce robust encodings (RobEn), a framework for constructing encodings that are reusable across many tasks, and pair with arbitrary model architectures. In Section 3.1 we describe the key components of RobEn, then in Section 3.2 we highlight desiderata RobEn should satisfy. A RobEn classifier f  : X  Y using RobEn decomposes into two components: a fixed encoding function  : X  Z , and a model that accepts encodings g : Z  Y . 1 For any sentence x , our system makes the prediction f  ( x ) = g (  ( x )) . Given training data { ( x i , y i ) } ni =1 and the encoding function  , we learn g by performing standard training on encoded training points { (  ( x i ) , y i ) } ni =1 . To compute the robust accuracy of this system, we note that for well-chosen  and an input x from some distribution P x , the set of possible encodings  ( x ) for some perturbation  x  B ( x ) is both small and tractable to compute quickly. We can thus compute acc rob ( f  ) quickly by generating this set of possible encodings, and feeding each into g , which can be any architecture. In order to achieve high robust accuracy, a classifier f  that uses  should make consistent predictions on all  x  B ( x ) , the set of points described by the attack surface, and also have high standard accuracy on unperturbed inputs. We term the former property stability , and the latter fidelity , give intuition for both in this section, and provide a formal instantiation in Section 4. Stability. For an encoding function  and some distribution over inputs P x , the stability Stab(  ) measures how often  maps sentences x  P x to the same encoding as all of their perturbations. Fidelity. An encoding function  has high fidelity if models that use  can still achieve high standard accuracy. Unfortunately, while we want to make task agnostic encoding functions, standard accuracy is inherently task dependent : different tasks have different expected distributions over inputs and labels. To emphasize this challenge consider two tasks: for an integer n , predict n mod 2 , and n mod 3 . The information we need encodings to preserve varies significantly between these tasks: for the former, 2 and 6 can be identically encoded, while for the latter they must encoded separately. To overcome this challenge, we consider a single distribution over the inputs P x that we believe covers many task-distributions p task . Since it is hard to model the distribution over the labels, we take the more conservative approach of mapping 1 We can set Z  X when g accepts sentences. Tradeoff. Stability and fidelity are inherently competing goals. An encoding function that maps every sentence to the same encoding trivially maximizes stability, but is useless for any non-trivial classification task. Conversely, fidelity is maximized when every input is mapped to itself, which has very low stability. In the following section, we construct an instantiation of RobEn that balances stability and fidelity when the attack surface consists of typos. In this section, we focus on adversarial typos , where an adversary can add typos to each token in a sentence (see Figure 2). Since this attack surface is defined at the level of tokens, we restrict attention to encoding functions that encode each token independently. Such an encoding does not use contextual information; we find that even such robust encodings achieve greater attack accuracy and robust accuracy in practice than previous work. First, we will reduce the problem of generating token level encodings to assigning vocabulary words to clusters (Section 4.1). Next, we use an example to motivate different clustering approaches (Section 4.2), then describe how we handle out-of-vocabulary tokens (Section 4.3). Finally, we introduce two types of token-level robust encodings: connected component encodings (Section 4.4) and agglomerative cluster encodings (Section 4.5). We construct an encoding function  that encodes x token-wise. Formally,  is defined by a token-level encoding function  that maps each token x i  T to some encoded token  ( x i )  Z Tok :  ( x ) = [  ( x 1 ) ,  ( x 2 ) , . . .  ( x L )] . In the RobEn pipeline, a downstream model g is trained on encodings (Section 3.1). If  maps many words and their typos to the same encoded token, they become indistinguishable to g , conferring robustness. In principle, the relationship between different encoded tokens is irrelevant: during training, g learns how to use the encoded tokens to perform a desired task. Thus, the problem of finding a good  is equivalent to deciding which tokens should share the same encoded token. Since the space of possible tokens T is innumerable, we focus on a smaller set of words V = { w 1 , . . . , w N }  T , which contains the N most frequent words over P x . We will call elements of V words , and tokens that are perturbations of some word typos . We view deciding which words should share an encoded token as assigning words to clusters C 1 , . . . , C k  V . For all other tokens not in the vocabulary, including typos, we define a separate  OOV . Thus, we decompose  as follows:  ( x i ) = (cid:40)  V ( x i ) x i  V  OOV ( x i ) x i /  V , (6) Here,  V is associated with a clustering C of vocabulary words, where each cluster is associated with a unique encoded token. We use a simple example to illustrate how a token-level encoding function can achieve the RobEn desiderata: stability and fidelity defined in Section 3.2. We will formally define the stability and fidelity of a clustering in Sections 4.3 and 4.5. Consider the five words (large font, blue) in Figure 3, along with potential typos (small font, red). We illustrate three different clusterings as boxes around tokens in the same cluster. We may put all words in the same cluster (thick box), each word in its own cluster (dashed boxes), or something in between (thin solid boxes). For now, we group each typo with a word it could have been perturbed from (we will discuss this further in Section 4.3). To maximize stability, we need to place all words in the same cluster. Otherwise, there would be two words (say at and aunt ) that could both be perturbed to the same typo ( aut ) but are in different clusters. Therefore, aut cannot map to the same encoded token as both the possible vocab words. At the other extreme, to maximize fidelity, each word should be in its own cluster. Both mappings have weaknesses: the stability-maximizing mapping has low fidelity since all words are identically encoded and thus indistinguishable, while the fidelity-maximizing mapping has low stability since the typos of words aunt , abet , and abrupt could all be mapped to different encoded tokens than that of the original word. The clustering represented by the thin solid boxes in Figure 3 balances stability and fidelity. Compared to encoding all words identically, it has higher fidelity, since it distinguishes between some of the words (e.g., at and about are encoded differently). It also has reasonably high stability, since only the infrequent abet has typos that are shared across words and hence are mapped to different encoded tokens. Given a fixed clustering of V , we now study how to map out-of-vocabulary tokens, including typos, to encoded tokens without compromising stability. Stability. Stability measures the extent to which typos of words map to different encoded tokens. We formalize this by defining the set of tokens that some typo of a word w could map to, B  ( w ) : B  ( w ) = {  (  w );  w  B ( w ) } , (7) where B ( w ) is the set of allowable typos of w . Since we care about inputs drawn from P x , we define Stab on the clustering C using  ( w ) , the normalized frequency of word w based on P x . For a fixed clustering, the size of B  ( w ) depends on where  OOV maps typos that w shares with other words; for example in Figure 3, aet could be a perturbation of both at and abet . If we map the typo the encoded token of at , we increase the size of B  ( abet ) and vice-versa. In order to keep the size of B  ( w ) smaller for the more frequent words and maximize stability (Equation 8), we map a typo to the same encoded token as its most frequent neighbor word (in this case at ). We present two approaches to generate robust token-level encodings. Our first method, connected component encodings, maximizes the stability objective (8). Notice that Stab is maximized when for each word w , B  ( w ) contains one encoded token. This is possible only when all words that share a typo are assigned to the same cluster. To maximize Stab , define a graph G with all words in V as vertices, and edges between words that share a typo. Since we must map words that share an edge in G to the same cluster, we define the cluster C i to be the set of words in the i th connected component of G . While this stability-maximizing clustering encodes many words to the same token (and hence seems to compromise on fidelity), these encodings still perform surprisingly well in practice (see Section 5.4). Connected component encodings focus only stability and can lead to needlessly low fidelity. For example, in Figure 3, at and about are in the same connected component even though they don't share a typo. Since both words are generally frequent, mapping them to different encoded tokens can significantly improve fidelity, with only a small drop in stability: recall only the infrequent word abet can be perturbed to multiple encoded tokens. To handle such cases, we introduce agglomerative cluster encodings , which we construct by trading off Stab with a formal objective we define for fidelity: Fid . We then approximately optimize this combined objective  using an agglomerative clustering algorithm. Fidelity objective. Recall from Section 3.2 that an encoding has high fidelity if it can be used to achieve high standard accuracy on many tasks. This is hard to precisely characterize: we aim to design an objective that could approximate this. We note that distinct encoded tokens are arbitrarily related: the model g learns how to use different encodings during training. Returning to our example, suppose at and abet belong to the same cluster and share an encoded token z . During training, each occurrence of at and abet is replaced with z . However, since at is much more frequent, classifiers treat z similarly to  at (cid:48)(cid:48) in order to achieve good overall performance. This leads to mostly uncompromised performance on sentences with at , at the cost of performance on sentences containing the less frequent abet . This motivates the following definition: let (cid:126)v i be a the indicator vector in R | V | corresponding to word i . In principle (cid:126)v i could be a word embedding; we choose indicator vectors to avoid making additional assumptions. We define the encoded token (cid:126) j associated with words in cluster C j as follows: (cid:126) j = (cid:80) w i  C j  ( w i ) (cid:126)v i (cid:80) w i  C j  ( w i ) (9) We weight by the frequency  to capture the effect of training on the encodings, as described above. Fidelity is maximized when each word has a distinct encoded token. We capture the drop in standard accuracy due to shared encoded tokens by computing the distance between the original em-beddings of the word its encoded token. Formally, let c ( i ) be the cluster index of word w i . We define the fidelity objective Fid as follows: Fid( C ) =  N (cid:88) i =1  ( w i ) (cid:107) (cid:126)v i  (cid:126) c ( i ) (cid:107) 2 . Final objective. We introduce a hyperparameter   [0 , 1] that balances stability and fidelity. We approximately minimize the following weighted combination of Stab (8) and Fid (10): ( C ) =  Fid( C ) + (1   ) Stab( C ) . As  approaches 0, we get the connected component clusters from our baseline, which maximize stability. As  approaches 1, we maximize fidelity by assigning each word to its own cluster. Agglomerative clustering. We approximate the optimal value of  using agglomerative clustering ; we start with each word in its own cluster, then iteratively combine the pair of clusters whose resulting combination increases  the most. We repeat until combining any pair of clusters would decrease  . Further details are provided in Appendix A.1. Token-level attacks. The primary attack surface we study is edit distance one (ED1) perturbations. For every word in the input, the adversary is allowed to insert a lowercase letter, delete a character, substitute a character for any letter, or swap two adjacent characters, so long as the first and last characters remain the same as in the original token. The constraint on the outer characters, also used by Pruthi et al. (2019), is motivated by psycholinguistic studies (Rawlinson, 1976; Davis, 2003). Within our attack surface, the movie was miserable can be perturbed to thae mvie wjs misreable but not th movie as miserable . Since each token can be independently perturbed, the number of perturbations of a sentence grows exponentially with its length; even the movie was miserable has 431,842,320 possible perturbations. Our attack surface contains the attack surface used by (Pruthi et al., 2019), which allows ED1 perturbations to at most two words per sentence. Reviews from SST-2 have 5 million perturbations per example (PPE) on average under this attack surface, while our attack surface averages 10 97 PPE. We view the size of the attack surface as a strength of our approach: our attack surface forces a system robust to subtle perturbations ( the moviie waas misreable ) that smaller attack surfaces miss. In Section 5.7, we additionally consider the internal permutation attacks studied in Belinkov and Bisk (2018) and Sakaguchi et al. (2017), where all characters, except the first and the last, may be arbitrarily reordered. Attack algorithms. We consider two attack algorithms: the worst-case attack (WCA) and a beam-search attack (BSA). WCA exhaustively tests every possible perturbation of an input x to see any change in the prediction. The attack accuracy of WCA is the true robust accuracy since if there exists some perturbation that changes the prediction, WCA finds it. When instances of RobEn have high stability, the number of possible encodings of perturbations of x is often small, allowing us to exhaustively test all possible perturbations in the encoding space. 2 This allows us to tractably run WCA. Using WCA with RobEn, we can obtain computationally tractable guarantees on robustness: given a sentence, we can quickly compute whether or not any perturbation of x that changes the prediction. For systems that don't use RobEn, we cannot tractably run WCA. Instead, we run a beam search 2 When there are more than 10000 possible encodings, which holds for 0 . attack (BSA) with beam width 5, perturbing tokens one at a time. For efficiency, we sample at most len( x i ) perturbations at each step of the search (see Apendix A.2). Even against this very limited attack, we find that baseline models have low accuracy. Datasets. We use six of the nine tasks from GLUE (Wang et al., 2019): SST-2, MRPC, QQP, MNLI, QNLI, and RTE. We do not use STS-B and CoLA as they are evaluated on correlation, which does not decompose as an example-level loss. We additionally do not use WNLI, as most submitted GLUE models cannot even outperform the majority baseline, and state-of-the-art models are rely on external training data (Kocijan et al., 2019). We evaluate on the test sets for SST-2 and MRPC, and the publicly available dev sets for the remaining tasks. More details are provided in Appendix A.3. We consider three baseline systems. Our first is the standard base uncased BERT model (Devlin et al., 2019) fine-tuned on the training data for each task. 3 Data augmentation. For our next baseline, we augment the training dataset with four random perturbations of each example, then fine-tune BERT on this augmented data. Data augmentation has been shown to increase robustness to some types of adversarial perturbations (Ribeiro et al., 2018; Liu et al., 2019). Other natural baselines all have severe limitations. Adversarial training with black-box attacks offers limited robustness gains over data augmentation (Cohen et al., 2019; Pruthi et al., 2019). Projected gradient descent (Madry et al., 2017), the only white-box adversarial training method that is robust in practice, cannot currently be applied to BERT since subword tokenization maps different perturbations to different numbers of tokens, making gradient-based search impossible. Certifiably robust training (Huang et al., 2019; Shi et al., 2020) does not work with BERT due to the same tokenization issue and BERT's use of non-monotonic activation functions, which make computing bounds intractable. Moreover the bounds computed with certifiably robust training, which give guarantees, become loose as model depth increases, hurting robust performance (Gowal et al., 2018). Typo-corrector. For our third baseline, we use the most robust method from Pruthi et al. (2019). In 3 https://github.com/huggingface/ pytorch-transformers particular, we train a scRNN typo-corrector (Sak-aguchi et al., 2017) on random perturbations of each task's training set. At test time inputs are corrected using the typo corrector, then fed into a downstream model. We replace any OOV outputted by the typo-corrector with the neutral word a and use BERT as our downstream model. We run experiments using our two token-level encodings: connected component encodings (CONNCOMP ) and agglomerative cluster encodings (AGGCLUST ). To form clusters, we use the N = 100 , 000 most frequent words from the Corpus of Contemporary American English (Davies, 2008) that are also in GloVe (Pennington et al., 2014). For AGGCLUST we use  = 0 . 3 , which maximizes robust accuracy on SST-2 dev set. Form of encodings. Though unnecessary when training from scratch, to leverage the inductive biases of pre-trained models like BERT (Devlin et al., 2019), we define the encoded token of a cluster to be the cluster's most frequent member word. In the special case of the out-of-vocab token, we map OOV to [ MASK ] . Our final encoding,  ( x ) , is the concatenation of all of these words. For both encodings, we fine-tune BERT on the training data, using  ( x ) as input. Further details are in Appendix A.4. Our main results are shown in Table 1. We show all three baselines, as well as models using our instances of RobEn: CONNCOMP and AGGCLUST . Even against the heuristic attack, each baseline system suffers dramatic performance drops. The system presented by Pruthi et al. (2019), Typo Corrector + BERT, only achieves 35 . 3% attack accuracy, compared to its standard accuracy of 78 . 2% . BERT and Data Augmentation + BERT perform even worse. Moreover, the number of perturbations the heuristic attack explores is a tiny fraction of our attack surface, so the robust accuracy of Typo Corrector + BERT, the quantity we'd like to measure, is likely far lower than the attack accuracy. In contrast, simple instances of RobEn are much more robust. AGGCLUST + BERT achieves average robust accuracy of 71 . 3% , 36 points higher than the attack accuracy of Typo Corrector + BERT. AGGCLUST also further improves on CONNCOMP in terms of both robust accuracy (by 1 . 3 points) and standard accuracy (by 2 . 8 points). Standard accuracy. Like defenses against adversarial examples in other domains, using RobEn decreases standard accuracy (Madry et al., 2017; Zhang et al., 2019; Jia et al., 2019). Our agglomerative cluster encodings's standard accuracy is 10 . 1 points lower then that of normally trained BERT. However, to the best of our knowledge, our standard accuracy is state-of-the-art for approaches that guarantee robustness. We attribute this improvement to RobEn's compatibility with any model. Comparison to smaller attack surfaces. We note that RobEn also outperform existing methods on their original, smaller attack surfaces. On SST-2, Pruthi et al. (2019) achieves an accuracy of 75 . 0% defending against a single ED1 typo, which is 5 . 7 points lower than AGGCLUST 's robust accuracy against perturbations of all tokens: a superset of the original perturbation set. We discuss constrained adversaries further in Appendix A.5. AGGCLUST also outperforms certified training: Huang et al. (2019), which offers robustness guarantees to three character substitution typos (but not insertions or deletions), achieves a robust accuracy of 74 . 9% on SST-2. Certified training requires strong assumptions on model architecture; even the robust accuracy of AGGCLUST outperforms the standard accuracy of the CNN used in Huang et al. (2019). Each instance of RobEn achieves consistently high stability across our tasks, despite reusing a single function. Figure 4 plots the distribution of | B  ( x ) | , across test examples in SST-2 and RTE, where B  ( x ) is the set of encodings that are mapped to by some perturbation of x . Over AGGCLUST encodings, | B  ( x ) | = 1 for 25% of examples in RTE and 66% in SST-2, with the other four datasets falling between these extremes (see Appendix A.6). As expected, these numbers are even higher for the connected component encodings. Note that when | B  ( x ) | = 1 , every perturbation of x maps to the same encoding. When | B  ( x ) | is small, robust accuracy can be computed quickly. In Figure 5, we plot standard and robust accuracy on SST-2 for AGGCLUST encodings, using differ-0 ent values of  . Recall that  = 0 maximizes stability (CONNCOMP ), and  = 1 maximizes fidelity. At  = 0 , the gap between standard and robust accuracy, due to out-of-vocabulary tokens, is negligible. As  increases, both standard accuracy and the gap between standard and robust accuracy increase. As a result, robust accuracy first increases, then decreases. RobEn can also be used to defend against the internal perturbations described in Section 5.1. For normally trained BERT, a heuristic beam search attack using internal permutations reduces average accuracy from 86 . 2% to 15 . 7% across our six tasks. Using CONNCOMP with the internal permutation attack surface, we achieve robust accuracy of 81 . 4% . See Appendix A.7 for further details. Additional related work. In this work, we introduce RobEn, a framework to construct systems that are robust to adversarial perturbations. We then use RobEn to achieve state-of-the-art robust accuracy when defending against adversarial typos. Besides typos, other perturbations can also be applied to text. Prior attacks consider semantic operations, such as replacing a word with a synonym (Alzantot et al., 2018; Ribeiro et al., 2018). Our framework extends easily to these perturbations. Other attack surfaces involving insertion of sentences (Jia and Liang, 2017) or syntactic rearrangements (Iyyer et al., 2018) are harder to pair with RobEn, and are interesting directions for future work. Other defenses are based on various forms of preprocessing. Gong et al. (2019) apply a spell-corrector to correct typos chosen to create ambiguity as to the original word, but these typos are not adversarially chosen to fool a model. Edizel et al. (2019) attempt to learn typo-resistant word embeddings, but focus on common typos, rather than worst-case typos. In computer vision, Chen et al. (2019) discretizes pixels to compute exact robust accuracy on MNIST, but their approach generalizes poorly to other tasks like CIFAR-10. Garg et al. (2018) generate functions that map to robust features, while enforcing variation in outputs. Incorporating context. Our token-level robust encodings lead to strong performance, despite ignoring useful contextual information. Using context is not fundamentally at odds with the idea of robust encodings, and making contextual encodings stable is an interesting technical challenge and a promising direction for future work. In principle, an oracle that maps every word with a typo to the correct unperturbed word seems to have higher fidelity than our encodings, without compromising stability. However, existing typo correctors are far from perfect, and a choosing an incorrect unperturbed word from a perturbed input leads to errors in predictions of the downstream model. This mandates an intractable search over all perturbations to compute the robust accuracy. Task-agnosticity. Many recent advances in NLP have been fueled by the rise of task-agnostic representations, such as BERT, that facilitate the cre-ation of accurate models for many tasks. Robustness to typos should similarly be achieved in a task-agnostic manner, as it is a shared goal across many NLP tasks. Our work shows that even simple robust encodings generalize across tasks and are more robust than existing defenses. We hope our work inspires new task-agnostic robust encodings that lead to more robust and more accurate models. This work was supported by NSF Award Grant no. 1805310 and the DARPA ASED program under FA8650-18-2-7882. A.R. is supported by a Google PhD Fellowship and the Open Philanthropy Project AI Fellowship. We thank Pang Wei Koh, Reid Pryzant, Ethan Chi, Daniel Kang, and the anonymous reviewers for their helpful comments. All code, data, and experiments are available on CodaLab at https://bit.ly/2VSZI2e .
abstain abstain abstain abstain abstain abstain abstain method abstain result abstain abstain abstain abstain abstain objective abstain abstain abstain abstain abstain abstain method abstain abstain abstain abstain abstain method abstain result objective abstain method abstain abstain method abstain method result abstain result objective result result abstain abstain abstain abstain abstain method method abstain abstain abstain abstain method abstain method abstain method method abstain abstain abstain abstain method method abstain abstain abstain method method method abstain method abstain abstain abstain abstain abstain abstain method method method abstain abstain abstain abstain method abstain method abstain abstain abstain abstain method abstain abstain abstain abstain abstain method abstain method method method abstain method abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain method abstain abstain abstain method abstain method method method abstain abstain abstain abstain method abstain abstain abstain abstain abstain abstain abstain abstain abstain method method abstain abstain abstain method method abstain method abstain abstain abstain abstain method abstain abstain abstain abstain method abstain abstain method abstain abstain method abstain method method method method abstain method abstain abstain method method method method method abstain method method abstain method method method method abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain other abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain result result abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain result abstain abstain abstain abstain abstain abstain abstain result abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain result abstain abstain abstain method result abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain result abstain other other other other