On-Device Text Representations Robust To Misspellings via Projections

TL;DR

This paper introduces LSH projection-based neural classifiers for on-device NLP tasks, demonstrating they are inherently more robust to misspellings and perturbations than traditional models like BERT and BiLSTMs.

Contribution

The paper shows that LSH projection neural classifiers are naturally robust to misspellings, offering a privacy-preserving, low-memory alternative for on-device NLP applications.

Findings

LSH projection classifiers outperform BiLSTMs and BERT in robustness to misspellings.

Accuracy drop for LSH classifiers under misspelling attacks is only 2.94%.

BERT's accuracy drops by 11.44% under similar conditions.

Abstract

Recently, there has been a strong interest in developing natural language applications that live on personal devices such as mobile phones, watches and IoT with the objective to preserve user privacy and have low memory. Advances in Locality-Sensitive Hashing (LSH)-based projection networks have demonstrated state-of-the-art performance in various classification tasks without explicit word (or word-piece) embedding lookup tables by computing on-the-fly text representations. In this paper, we show that the projection based neural classifiers are inherently robust to misspellings and perturbations of the input text. We empirically demonstrate that the LSH projection based classifiers are more robust to common misspellings compared to BiLSTMs (with both word-piece & word-only tokenization) and fine-tuned BERT based methods. When subject to misspelling attacks, LSH projection based classifiers had a small average accuracy drop of 2.94% across multiple classifications tasks, while the fine-tuned BERT model accuracy had a significant drop of 11.44%.

Tables

Table 1. Table 1: Classification Dataset Characteristics

Tasks	# Classes	Avg-len	Train	Test
ATIS (Dialog act)	$21$	$11$	$4.4k$	$0.89k$
MRDA (Dialog act)	$6$	$8$	78k	15k
SWDA (Intent Prediction)	42	7	193k	5k
YAHOO (Answers Categorization)	10	108	1400k	60k
AMAZON (Review Prediction)	5	92	3000k	650k

Table 2. Table 2: Each entry in the table denotes the average drop in accuracy(%) when classifiers are subject to test inputs with misspellings, P p ​ e ​ r ​ t ​ u ​ r ​ b = 0.2 subscript 𝑃 𝑝 𝑒 𝑟 𝑡 𝑢 𝑟 𝑏 0.2 P_{perturb}=0.2 . ATIS and MRDA are smaller datasets, while Yahoo! Answers and Amazon reviews are larger. BERT-base refers to the BERT-base (Devlin et al., 2018 ) word-piece model fine-tuned to individual tasks and it converged to state-of-the-art for all tasks.

Accuracy drop (%) $\pm$ std-deviation (over 5 runs)
Datasets $\to$	MRDA	ATIS	YAHOO	AMAZON
Models $\downarrow$
BERT-base	${8.25}_{\pm 3.4}$	${15.57}_{\pm 1.2}$	${9.06}_{\pm 5.4}$	${12.88}_{\pm 3.8}$
BiLSTM-wp	${8.91}_{\pm 3.9}$	${20.11}_{\pm 3.1}$	${11.32}_{\pm 4.5}$	${9.46}_{\pm 1.3}$
BiLSTM-w	${15.14}_{\pm 4.3}$	${16.23}_{\pm 2.6}$	${9.32}_{\pm 2.3}$	${8.88}_{\pm 2.4}$
SGNN	${1.91}_{\pm 0.5}$	${2.80}_{\pm 0.3}$	-	-
ProSeqo	${2.11}_{\pm 0.4}$	${2.84}_{\pm 0.6}$	${3.11}_{\pm 0.3}$	${3.91}_{\pm 0.5}$

Table 3. Table 3: Comparison of projection based models vs BiLSTMs subject to various types and amounts of perturbations. BiLSTM-wp and BiLSTM-w refer to models with word-piece and word-only tokenization respectively.

Accuracy(%) (Averaged over 5 runs)
Datasets	MRDA			ATIS			SWDA
Perturb(%)	BiLSTM-wp	BiLSTM-w	SGNN	BiLSTM-wp	BiLSTM-w	SGNN	BiLSTM-wp	BiLSTM-w	SGNN
$0$	$79.23$	$78.14$	$87.22$	$91.73$	$92.04$	$93.51$	$72.92$	$72.94$	$76.21$
Perturbation operation: drop
$20$	${69.46}_{\pm 1.1}$	${74.96}_{\pm 0.7}$	${85.43}_{\pm 0.3}$	${81.95}_{\pm 2.2}$	${80.15}_{\pm 2.0}$	${91.05}_{\pm 0.2}$	${65.05}_{\pm 4.2}$	${64.95}_{\pm 4.1}$	${70.76}_{\pm 1.1}$
$40$	${72.34}_{\pm 2.9}$	${55.17}_{\pm 3.1}$	${84.62}_{\pm 0.22}$	${71.69}_{\pm 2.9}$	${65.88}_{\pm 2.1}$	${91.86}_{\pm 0.3}$	${61.24}_{\pm 4.1}$	${64.95}_{\pm 5.2}$	${67.79}_{\pm 1.2}$
$60$	${69.81}_{\pm 4.7}$	${42.25}_{\pm 4.2}$	${83.27}_{\pm 0.25}$	${59.16}_{\pm 4.8}$	${56.25}_{\pm 3.9}$	${90.12}_{\pm 0.4}$	${57.48}_{\pm 5.7}$	${58.77}_{\pm 5.8}$	${63.21}_{\pm 1.3}$
Perturbation operation: swap
$20$	${78.25}_{\pm 1.1}$	${71.34}_{\pm 2.2}$	${86.74}_{\pm 0.1}$	${86.12}_{\pm 1.7}$	${85.05}_{\pm 1.8}$	${92.05}_{\pm 0.3}$	${66.27}_{\pm 3.3}$	${64.52}_{\pm 2.1}$	${70.84}_{\pm 0.3}$
$40$	${75.91}_{\pm 3.9}$	${69.22}_{\pm 2.1}$	${86.39}_{\pm 0.2}$	${82.06}_{\pm 2.7}$	${78.04}_{\pm 2.9}$	${91.15}_{\pm 0.2}$	${62.67}_{\pm 5.8}$	${54.93}_{\pm 2.4}$	${67.22}_{\pm 0.3}$
$60$	${69.22}_{\pm 3.8}$	${66.91}_{\pm 4.0}$	${85.99}_{\pm 0.2}$	${72.34}_{\pm 3.3}$	${68.54}_{\pm 4.1}$	${91.27}_{\pm 0.3}$	${59.20}_{\pm 4.8}$	${47.93}_{\pm 4.3}$	${64.48}_{\pm 0.3}$
Perturbation operation: all
$20$	${72.96}_{\pm 1.3}$	${73.39}_{\pm 2.3}$	${86.71}_{\pm 0.4}$	${80.40}_{\pm 1.7}$	${83.55}_{\pm 2.1}$	${92.83}_{\pm 0.2}$	${60.49}_{\pm 4.3}$	${64.28}_{\pm 3.3}$	${68.96}_{\pm 0.2}$
$40$	${70.32}_{\pm 3.4}$	${63.04}_{\pm 4.3}$	${85.31}_{\pm 0.5}$	${71.62}_{\pm 3.1}$	${75.81}_{\pm 2.6}$	${90.71}_{\pm 0.3}$	${54.96}_{\pm 4.1}$	${59.46}_{\pm 4.6}$	${65.44}_{\pm 0.4}$
$60$	${67.64}_{\pm 5.7}$	${55.50}_{\pm 5.3}$	${84.21}_{\pm 0.5}$	${61.10}_{\pm 6.1}$	${66.58}_{\pm 5.6}$	${88.35}_{\pm 0.3}$	${49.62}_{\pm 6.7}$	${51.85}_{\pm 6.3}$	${64.97}_{\pm 0.5}$

Table 4. Table 4: Avg. changes in word projections (bits) for different Char Perturbation % in enwik9 corpus.

LSH Proj.Dim ($𝐊$)	Character Perturbations
	5%	10%
840	10.08	24.33
980	15.48	31.24
1120	18.83	33.65
1260	19.71	39.01

Equations

$$U_V(x)=W_V\ast \mathbb{Y}(x{)}^{\top }\in {\mathbb{R}}^d$$

$$x\stackrel{\mathbb{F}}{\to }[f_1,\cdots ,f_n]\stackrel{\mathbb{L}}{\to }\mathbb{P}(x)\in [0,1{]}^K$$

$$U_W(x)=W_K\ast \mathbb{P}(x{)}^{\top }\in {\mathbb{R}}^d$$

Full text

In this paper, we show that the projection based neural classifiers are inherently robust to misspellings and perturbations of the input text. We empirically demonstrate that the LSH projection based classifiers are more robust to common misspellings compared to BiLSTMs (with both word-piece & word-only tokenization) and fine-tuned BERT based methods. When subject to misspelling attacks, LSH projection based classifiers had a small average accuracy drop of 2.94% across multiple classifications tasks, while the fine-tuned BERT model accuracy had a significant drop of 11.44%.

1 Introduction

At the core of Natural Language Processing (NLP) neural models are pre-trained word embeddings like Word2Vec Mikolov et al. (2013), GloVe Pennington et al. (2014a) and ELMo Peters et al. (2018). They help initialize the neural models, lead to faster convergence and have improved performance for numerous application such as Question Answering Liu et al. (2018), Summarization Cheng and Lapata (2016), Sentiment Analysis Yu et al. (2017). While word embeddings are powerful in unlimited constraints such as computation power and compute resources, it becomes challenging to deploy them to on-device due to their huge size.

This led to interesting research by Ravi and Kozareva (2018); Sankar et al. (2019), who showed that word embeddings can be replaced with lightweight binary Locality-Sensitive Hashing (LSH) based projections learned on-the-fly. The projection approach surmounts the need to store any embedding matrices, since the projections are dynamically computed. This further enables user privacy by performing inference directly on device without sending user data (e.g., personal information) to the server. The embedding memory size is reduced from $O(V)$ to $O(K)$, where $V$ is the token vocabulary size and $K<<V$, is the binary LSH projection size. The projection representations can operate on either word or character level, and can be used to represent a sentence or a word depending on the NLP application. For instance, recently the Projection Sequence Networks (ProSeqo) (Kozareva and Ravi, 2019) used BiLSTMs over word-level projection representations to represent long sentences and achieved close to state-of-the-art results in both short and long text classification tasks with varying amounts of supervision and vocabulary sizes.

Despite being successful, there are no existing systematic research efforts focusing on evaluating the capabilities of the LSH based projection for text representations. To that end, we empirically analyze the effectiveness and robustness of the LSH projection approach for text representation by conducting two types of studies in this paper.

Classification with perturbed inputs, where we show that Projection based networks 1) Projection Sequence Networks (ProSeqo) (Kozareva and Ravi, 2019) and 2) Self-Governing Neural Networks (SGNN) models Ravi and Kozareva (2019) evaluated with perturbed LSH projections are robust to misspellings and transformation attacks, while we observe significant drop in performance for BiLSTMs and fine-tuned BERT classifiers. 2. 2.

Perturbation Analysis, where we test the robustness of the projection approach by directly analyzing the changes in representations when the input words are subject to the char misspellings. The purpose of this study is to examine if the words or sentences with misspelling are nearby in the projection space instead of frequently colliding with the projection representations of other valid words.

Overall, our studies showcase the robustness of LSH projection representations and resistance to misspellings. Due to their effectiveness, we believe that in the future, text representations using LSH projections can go beyond memory constrained settings and even be exploited in large scale models like Transformers (Vaswani et al., 2017).

2 Binary LSH projections for text representations

The dependency on vocabulary size $V$, is one of the primary reasons for the huge memory footprint of embedding matrices. It is common to represent a token, $x$ by one-hot representation, $\mathbb{Y}(x)\in[0,1]^{V}$ and a distributed representation of the token is obtained by multiplying the one-hot representation with the embedding matrix, $W_{V}\in\mathbb{R}^{d\times V}$ as in

[TABLE]

One way to remove the dependency on the vocabulary size is to learn a smaller matrix, $W_{K}\in\mathbb{R}^{d\times K}$ ($K<<V$), as shown in Figure 2. For instance, 300-dimensional Glove embeddings, $W_{V}$ (Pennington et al., 2014b) with 400k vocabulary size occupies $>$ 1 GB while the $W_{K}$ occupies only $\approx$ 1.2 MB for $K=1000$ yielding a $1000\times$ reduction in size. Instead of learning a unique vector for each token in the vocabulary, we can think of the columns of this $W_{K}$ matrix as a set of basis vectors and each token can be represented as a linear combination of basis vectors in $W_{K}$ as in Figure 1. We select the basis vectors from $W_{K}$ for each token with a fixed $K$-bit binary vector instead of a $V$-bit one-hot vector.

The LSH Projection function, $\mathbb{P}$ (Figure 3)(Ravi, 2017, 2019) used in SGNN (Ravi and Kozareva, 2018) and ProSeqo (Kozareva and Ravi, 2019) does exactly this as it dynamically generates a fixed binary projection representation, $\mathbb{P}(x)\in[0,1]^{K}$ for any token, $x$ by extracting morphological input features like char (or token) n-gram & skip-gram features, parts of speech tags etc. from $x$ and a modified Locality-Sensitive Hashing (LSH) based transformation, $\mathbb{L}$ as in

[TABLE]

where $\mathbb{F}$ extracts n-grams (or skip-grams), $[f_{1},\cdots,f_{n}]$ from the input text. Here, $[f_{1},\cdots,f_{n}]$ could refer to either character level or token level n-grams(or skip-grams) features. Given the LSH projection representation, $\mathbb{P}(x)$, the distributed representation of the token, $x$ is represented as in

[TABLE]

. It is worth noting that projection operation, $\mathbb{P}$ can also be used map an entire sentence directly to the $[0,1]^{K}$ space.

As for the projection based classifiers, the ProSeqo model (Kozareva and Ravi, 2019) runs a BiLSTM over word-level binary LSH projection representations to predict the correct classes, while the SGNN model (Ravi and Kozareva, 2018) computes a binary LSH projection representation for the entire input text, followed by a 2-layer MLP and a softmax layer on top of it for class prediction. SGNN was designed for short text, while ProSeqo is also suitable for long text classification tasks.

There have been a number of research efforts (Sakaguchi et al., 2016; Edizel et al., 2019; Pruthi et al., 2019) to improve the robustness of neural classifiers to misspelling attacks and other text transformations. Recently, Pruthi et al. (2019) observe that fine-tuned BERT and BiLSTM based models are very brittle (for e.g., accuracy drops from 90.3% to 45.8% in the SST (Socher et al., 2013) classification task) to adversarial misspelling attacks. Contrary to intuition, they observe that word-piece and character-level models are more susceptible to spelling attacks compared to the word-level models.

The LSH projection operation, $\mathbb{P}$, is a function of n-grams (and skip-grams) of the input text $x$ and usually the fraction of n-grams affected by spelling attacks tend to be minimal resulting in insignificant changes to the projection representation, $\mathbb{P}(x)$. Therefore, we hypothesize that the projection based models like ProSeqo, SGNN, etc. are inherently robust to commonly occurring spelling attacks. In the following sections, we investigate the robustness of projection based classifiers by subjecting them to common misspellings, followed by an analysis of changes in the binary LSH projections of input text under such transformations.

3 Effect of Misspellings on Text Classification

We study the robustness of two types of projection based models – ProSeqo and SGNN. On the other hand, we fine-tune the pretrained BERT-base model (with word-piece tokenization) (Devlin et al., 2018) and train two-layer BiLSTMs (with both word-only and word-piece tokenization) for comparable accuracies with respect to the projection based models for a fair comparison. By word-only tokenization, we mean that models encode input words using a lookup table for each word. In our setup, we test the robustness of the neural classifiers by subjecting the corresponding test sets to common misspellings and omissions. We consider the following perturbation operations: randomly dropping, inserting, and swapping internal characters within words of the input sentences (Gao et al., 2018; Pruthi et al., 2019) 111Further details on the perturbation operations and training details necessary for reproducibility are presented in the supplementary material. We decide to perturb each word in a sentence with a fixed probability, $P_{perturb}$. Following (Ravi and Kozareva, 2018), we fix the projection dimension to $K=1120$.

3.1 Datasets

For evaluation purposes, we use the following text classification datasets for dialog act classification MRDA (Shriberg et al., 2004) and SWDA (Godfrey et al., 1992; Jurafsky et al., 1997), for intent prediction ATIS (Tür et al., 2010) and long text classification Amazon Reviews Zhang et al. (2015) and Yahoo! Answers Zhang et al. (2015). Table 1 shows the characteristics of each dataset.

3.2 Experiments and Results

Table 2 reports the average classifier accuracy drops when all the models are subject to all types of perturbations (swap, drop, & add) on multiple classification tasks (two short text and two long text). We see that the accuracy drop for the projection based models is significantly lower across all datasets. It is also worth noting that the standard deviations across the $5$ runs are also minimal for the projection based models further showcasing the stability of projection representations.

In another experiment shown in Table 3, we subject different models to varying types and amounts of perturbations. Similarly, we see that the accuracy drop for the projection based models is the smallest across all datasets and amounts of perturbation. Compared to the word-only models, we observe that the word-piece models are also comparably susceptible to character perturbations which agrees with the findings in (Pruthi et al., 2019).

4 Perturbation Analysis

Apart from the classification experiments, we also directly analyze the changes in the binary LSH projection representations by subjecting input text to different types and amount of perturbations. To that end, we take a large corpus enwik9222enwik9 is a byte-level dataset consisting of the first $10^{9}$ bytes of the English Wikipedia XML dump, http://mattmahoney.net/dc/textdata.html. (vocabulary size of $500k$ and $129M$ words) to analyze the average Hamming distance between LSH projections of the words in the corpus. Next, we compute the average changes in the projection representations by subjecting them to the character perturbations from Section 3. Table 4 shows the results. We make the following observations from our experiments:

Average Hamming distance between LSH projections of words is $\approx K/2$, where $K$ is the projection dimension which implies that the words are more or less uniformly spread out from each other indicating that there are no bias issues in the $[0,1]^{K}$ representation space. 2. 2.

Assuming $P_{perturb}=0.2$, we observe that LSH projection changes only by $\approx$ $11$% w.r.t the average Hamming distance between the words in the corpus when subject to misspellings. For instance, if the average Hamming distance between LSH projections of words is $100$ bits, misspellings change the projections by only $11$ bits on average. Intuitively, this suggests that neural layers on top of the LSH projection tend to rarely confuse a misspelled word for another valid word.

Also from Table 4, we found that the changes in the LSH-projection, $\Delta_{\mathbb{P}(x)}$ due to perturbations is directly proportional to LSH projection dimension, $K$ and perturbation probability, $P_{perturb}$ as in, $\Delta_{\mathbb{P}(x)}\propto K\,\cdot P_{perturb}$.

5 Conclusion

In this work, we perform a detailed study analyzing the robustness of recent LSH-based projection neural networks for memory-efficient text representations. Based on multiple text classification tasks and perturbation studies, we find projection-based neural models to be robust to text transformations compared to BERT or BiLSTMs with embedding lookup tables for words and word-pieces.