Interpretable Adversarial Perturbation in Input Embedding Space for Text

TL;DR

This paper introduces an interpretable adversarial perturbation method in input embedding space for NLP, enabling the generation of adversarial texts through word replacements while maintaining or improving task performance.

Contribution

It proposes a novel approach that restricts adversarial perturbations to existing words in embedding space, restoring interpretability in NLP adversarial training.

Findings

Allows reconstruction of adversarial texts via word replacements

Maintains or improves NLP task performance

Restores interpretability to adversarial perturbations

Abstract

Following great success in the image processing field, the idea of adversarial training has been applied to tasks in the natural language processing (NLP) field. One promising approach directly applies adversarial training developed in the image processing field to the input word embedding space instead of the discrete input space of texts. However, this approach abandons such interpretability as generating adversarial texts to significantly improve the performance of NLP tasks. This paper restores interpretability to such methods by restricting the directions of perturbations toward the existing words in the input embedding space. As a result, we can straightforwardly reconstruct each input with perturbations to an actual text by considering the perturbations to be the replacement of words in the sentence while maintaining or even improving the task performance.