FireBERT：增强基于BERT的分类器抵御对抗攻击
FireBERT: Hardening BERT-based classifiers against adversarial attack
摘要：
我们提出了FireBERT，这是一组三个概念验证的NLP分类器，通过对原始样本产生不同的替代品来对抗TextFooler风格的单词扰动。在一种方法中，我们针对训练数据和合成对抗样本共同调整BERT。在第二种方法中，我们通过替换单词和扰动嵌入向量在评估时生成合成样本。然后通过投票将多样化的评价结果组合在一起。第三种方法用嵌入向量的扰动代替评估时的单词替换。我们评估了FireBERT的MNLI和IMDB电影评论数据集，在原始和由TextFocal生成的对抗性示例中。我们还测试了在操作FireBERT时，与使用未硬化的分类器相比，TextFocal在创建新的对抗样本方面是否不太成功。我们表明，在面对对抗攻击时，可以提高基于BERT的模型的准确性，而不会显着降低常规基准样本的准确性。我们提出了与合成数据生成器的协同调整，作为一种高效的方法，可以防止95%的预先制造的对抗性样本，同时保持98%的原始基准性能。我们还证明了评估时间扰动作为一个有前途的方向，为进一步的研究，恢复准确性高达75%的基准性能的预先制作的adversarial，高达65%（从基线的75% orig./12%攻击）下的主动攻击的TextFocal。
英文摘要：
We present FireBERT, a set of three proof-of-concept NLP classifiers hardened against TextFooler-style word-perturbation by producing diverse alternatives to original samples. In one approach, we co-tune BERT against the training data and synthetic adversarial samples. In a second approach, we generate the synthetic samples at evaluation time through substitution of words and perturbation of embedding vectors. The diversified evaluation results are then combined by voting. A third approach replaces evaluation-time word substitution with perturbation of embedding vectors. We evaluate FireBERT for MNLI and IMDB Movie Review datasets, in the original and on adversarial examples generated by TextFooler. We also test whether TextFooler is less successful in creating new adversarial samples when manipulating FireBERT, compared to working on unhardened classifiers. We show that it is possible to improve the accuracy of BERT-based models in the face of adversarial attacks without significantly reducing the accuracy for regular benchmark samples. We present co-tuning with a synthetic data generator as a highly effective method to protect against 95% of pre-manufactured adversarial samples while maintaining 98% of original benchmark performance. We also demonstrate evaluation-time perturbation as a promising direction for further research, restoring accuracy up to 75% of benchmark performance for pre-made adversarials, and up to 65% (from a baseline of 75% orig. / 12% attack) under active attack by TextFooler.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
