Fooling the Textual Fooler via Randomizing Latent Representations

TL;DR

This paper introduces AdvFooler, a lightweight defense mechanism that randomizes latent representations at inference time to effectively thwart black-box adversarial attacks on NLP models, maintaining high accuracy.

Contribution

AdvFooler is a novel, attack-agnostic defense that does not require additional training and confuses adversaries by randomizing latent space during inference.

Findings

Achieves near state-of-the-art robustness against word-level attacks

Maintains high accuracy on clean data

Requires no extra training overhead

Abstract

Despite outstanding performance in a variety of NLP tasks, recent studies have revealed that NLP models are vulnerable to adversarial attacks that slightly perturb the input to cause the models to misbehave. Among these attacks, adversarial word-level perturbations are well-studied and effective attack strategies. Since these attacks work in black-box settings, they do not require access to the model architecture or model parameters and thus can be detrimental to existing NLP applications. To perform an attack, the adversary queries the victim model many times to determine the most important words in an input text and to replace these words with their corresponding synonyms. In this work, we propose a lightweight and attack-agnostic defense whose main goal is to perplex the process of generating an adversarial example in these query-based black-box attacks; that is to fool the textual fooler. This defense, named AdvFooler, works by randomizing the latent representation of the input at inference time. Different from existing defenses, AdvFooler does not necessitate additional computational overhead during training nor relies on assumptions about the potential adversarial perturbation set while having a negligible impact on the model's accuracy. Our theoretical and empirical analyses highlight the significance of robustness resulting from confusing the adversary via randomizing the latent space, as well as the impact of randomization on clean accuracy. Finally, we empirically demonstrate near state-of-the-art robustness of AdvFooler against representative adversarial word-level attacks on two benchmark datasets.