Text-CRS：一种针对文本对抗攻击的广义认证鲁棒性框架
Text-CRS: A Generalized Certified Robustness Framework against Textual Adversarial Attacks
AI总结：
本文提出Text-CRS框架，基于随机平滑为NLP模型提供针对同义词替换、单词重排、插入和删除四种词级对抗攻击的可证明鲁棒性认证，并在多个模型和数据集上取得优于现有方法的认证准确率与半径。
摘要：
语言模型，尤其是基础文本分类模型，已被证明容易受到同义词替换和单词插入等文本对抗攻击的影响。为了防御此类攻击，越来越多的研究致力于提高模型的鲁棒性。然而，提供可证明的鲁棒性保证而非经验鲁棒性仍然是一个尚未被广泛探索的领域。在本文中，我们提出了Text-CRS，一个基于随机平滑的面向自然语言处理（NLP）的广义认证鲁棒性框架。据我们所知，现有的NLP认证方案只能认证同义词替换攻击中针对$\ell_0$扰动的鲁棒性。我们将每种词级对抗操作（即同义词替换、单词重排、插入和删除）表示为置换与嵌入变换的组合，提出了新的平滑定理，以在置换空间和嵌入空间中推导针对此类对抗操作的鲁棒性边界。为了进一步提高认证准确率和认证半径，我们考虑了离散单词之间的数值关系，并为随机平滑选择了合适的噪声分布。最后，我们在多个语言模型和数据集上进行了大量实验。Text-CRS能够应对全部四种不同的词级对抗操作，并实现了显著的准确率提升。我们还提供了首个关于四种词级操作的认证准确率和认证半径的基准，并且在针对同义词替换攻击的认证方面超越了当前最先进的方法。
英文摘要：
The language models, especially the basic text classification models, have been shown to be susceptible to textual adversarial attacks such as synonym substitution and word insertion attacks. To defend against such attacks, a growing body of research has been devoted to improving the model robustness. However, providing provable robustness guarantees instead of empirical robustness is still widely unexplored. In this paper, we propose Text-CRS, a generalized certified robustness framework for natural language processing (NLP) based on randomized smoothing. To our best knowledge, existing certified schemes for NLP can only certify the robustness against $\ell_0$ perturbations in synonym substitution attacks. Representing each word-level adversarial operation (i.e., synonym substitution, word reordering, insertion, and deletion) as a combination of permutation and embedding transformation, we propose novel smoothing theorems to derive robustness bounds in both permutation and embedding space against such adversarial operations. To further improve certified accuracy and radius, we consider the numerical relationships between discrete words and select proper noise distributions for the randomized smoothing. Finally, we conduct substantial experiments on multiple language models and datasets. Text-CRS can address all four different word-level adversarial operations and achieve a significant accuracy improvement. We also provide the first benchmark on certified accuracy and radius of four word-level operations, besides outperforming the state-of-the-art certification against synonym substitution attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
