Adversarial Training with Fast Gradient Projection Method against Synonym Substitution Based Text Attacks

Authors

  • Xiaosen Wang Huazhong University of Science and Technology
  • Yichen Yang Huazhong University of Science and Technology
  • Yihe Deng University of California, Los Angeles
  • Kun He Huazhong University of Science and Technology

Keywords:

Adversarial Attacks & Robustness

Abstract

Adversarial training is the most empirically successful approach in improving the robustness of deep neural networks for image classification. For text classification, however, existing synonym substitution based adversarial attacks are effective but not very efficient to be incorporated into practical text adversarial training. Gradient-based attacks, which are very efficient for images, are hard to be implemented for synonym substitution based text attacks due to the lexical, grammatical and semantic constraints and the discrete text input space. Thereby, we propose a fast text adversarial attack method called Fast Gradient Projection Method (FGPM) based on synonym substitution, which is about 20 times faster than existing text attack methods and could achieve similar attack performance. We then incorporate FGPM with adversarial training and propose a text defense method called Adversarial Training with FGPM enhanced by Logit pairing (ATFL). Experiments show that ATFL could significantly improve the model robustness and block the transferability of adversarial examples.

Downloads

Published

2021-05-18

How to Cite

Wang, X., Yang, Y., Deng, Y., & He, K. (2021). Adversarial Training with Fast Gradient Projection Method against Synonym Substitution Based Text Attacks. Proceedings of the AAAI Conference on Artificial Intelligence, 35(16), 13997-14005. Retrieved from https://ojs.aaai.org/index.php/AAAI/article/view/17648

Issue

Section

AAAI Technical Track on Speech and Natural Language Processing III