Residue-Based Natural Language Adversarial Attack Detection

TL;DR

This paper introduces a residue-based sentence embedding method for detecting adversarial examples in NLP, outperforming existing image-inspired and NLP-specific detectors by leveraging model embedding space differences.

Contribution

It proposes a novel residue-based detector utilizing sentence embeddings, addressing the limitations of existing input feature-focused methods in NLP adversarial attack detection.

Findings

Outperforms ported image domain detectors in NLP tasks

Surpasses recent state-of-the-art NLP adversarial detectors

Effective across multiple NLP tasks

Abstract

Deep learning based systems are susceptible to adversarial attacks, where a small, imperceptible change at the input alters the model prediction. However, to date the majority of the approaches to detect these attacks have been designed for image processing systems. Many popular image adversarial detection approaches are able to identify adversarial examples from embedding feature spaces, whilst in the NLP domain existing state of the art detection approaches solely focus on input text features, without consideration of model embedding spaces. This work examines what differences result when porting these image designed strategies to Natural Language Processing (NLP) tasks - these detectors are found to not port over well. This is expected as NLP systems have a very different form of input: discrete and sequential in nature, rather than the continuous and fixed size inputs for images. As an equivalent model-focused NLP detection approach, this work proposes a simple sentence-embedding "residue" based detector to identify adversarial examples. On many tasks, it out-performs ported image domain detectors and recent state of the art NLP specific detectors.