Source-linked AI summary
Interpretable Adversarial Perturbation in Input Embedding Space for Text
Motoki Sato, Jun Suzuki, Hiroyuki Shindo, Yuji Matsumoto
TL;DR
Embedding-space adversarial training improves NLP performance but loses the interpretability of adversarial texts because perturbations do not directly correspond to words. The paper restricts perturbations toward existing word embeddings, enabling word-substitution reconstructions while maintaining or improving baseline performance across studied tasks. Its practical computation uses a nearest-neighbor vocabulary approximation, with the full vocabulary calculation potentially incurring |V|^2 cost.
Problem
Embedding-space adversarial training lacks interpretable adversarial texts because reconstructing perturbed embeddings as actual text is not straightforward, despite its effectiveness as an NLP regularizer.
Method
The paper restricts perturbation directions toward existing words in the input embedding space so perturbations can be interpreted as sentence word substitutions.
Results
The methods generate reasonable adversarial texts and interpretable perturbation visualizations while maintaining or improving baseline state-of-the-art performance across sentiment classification, category classification, and grammatical error detection.
Takeaways & Limitations
Interpretable adversarial texts and visualizations can help researchers analyze neural-model behavior while retaining the task-performance benefits of embedding-space adversarial training.
Takeaways & Limitations
The unrestricted computation can cost |V|^2, so the method uses much smaller per-step nearest-neighbor vocabularies to reduce computational cost.
Abstract
from arXiv · showhide
Following great success in the image processing field, the idea of adversarial training has been applied to tasks in the natural language processing (NLP) field. One promising approach directly applies adversarial training developed in the image processing field to the input word embedding space instead of the discrete input space of texts. However, this approach abandons such interpretability as generating adversarial texts to significantly improve the performance of NLP tasks. This paper restores interpretability to such methods by restricting the directions of perturbations toward the existing words in the input embedding space. As a result, we can straightforwardly reconstruct each input with perturbations to an actual text by considering the perturbations to be the replacement of words in the sentence while maintaining or even improving the task performance.
1 Introduction
Adversarial training transfers poorly from continuous images to discrete NLP inputs, while embedding-space methods improve performance but sacrifice interpretable adversarial texts. This paper restricts perturbations toward existing word embeddings so perturbed inputs can be reconstructed as word substitutions while preserving the regularization benefits.
- NLP inputs are discrete symbols, so image-based adversarial training cannot be applied straightforwardly.
- Embedding-space adversarial training improves NLP task performance and provides a succinct gradient-based architecture, but its perturbations are not straightforwardly interpretable as texts.
- Researchers and developers want adversarial texts to understand black-box neural models, creating a trade-off between low-cost gradient methods and interpretability.
- The paper restricts perturbation directions toward existing words in embedding space, interpreting each perturbation as a word substitution in the input sentence.
- The proposed approach targets reduction of the trade-off while preserving the good regularization ability of embedding-space adversarial training.
2 Related Work
Prior NLP adversarial-example methods use task-specific manipulations such as added sentences, character swaps, word replacements, human knowledge, dictionaries, or exhaustive search. The paper instead situates its baseline in the perturbation-based strategy developed for image processing.
- Prior methods attack reading comprehension with appended sentences, translation with random character swaps, and other tasks with word replacements.
- Many NLP adversarial-example methods rely on human knowledge, dictionaries, or costly exhaustive searches rather than continuous perturbation theory.
- The paper’s baseline applies the image-processing adversarial-training framework to continuous input word-embedding space.
3 Target Tasks and Baseline Models
The paper formulates text classification and sequence labeling over word-embedding sequences and uses recurrent neural networks as baseline models. Classification uses an LSTM encoder, while sequence labeling uses a bidirectional LSTM with per-step outputs.
- 3.1 Common notation: The target tasks are text classification and sequence labeling, both represented using input word-embedding sequences and corresponding class labels.
- 3.1 Common notation: The sentiment-classification baseline is an LSTM-based classifier, while the grammatical-error-detection baseline is a Bi-LSTM model.
- 3.2 Baseline model for text classification: For text classification, the model obtains the final hidden state from an LSTM and feeds it to a standard feed-forward neural network producing class factors.
- 3.3 Baseline model for sequence labeling: For sequence labeling, each hidden state concatenates forward and backward LSTM states, and output probabilities are decomposed across sequence positions.
- 3.4 Training: Training optimizes the recurrent model’s overall parameters by minimizing a loss over the full training dataset and its individual samples.
4 Adversarial Training in Embedding Space
AdvT-Text applies adversarial training in input word-embedding space, using perturbations constrained by an embedding norm and jointly optimizing adversarial and standard objectives.
- AdvT-Text formulation: AdvT-Text applies adversarial training to input word embeddings, treating each word's perturbation as a vector matching the embedding dimension.The perturbations are concatenated across all word positions to form the perturbed input.
- Model architecture: Figure 3 represents r as the method-dependent perturbation applied within the neural model architecture.The figure distinguishes perturbations associated with AdvT, VAT, iAdvT, and VAT variants.
- Adversarial perturbations: Worst-case perturbations are sought by maximizing negative log-likelihood under a tunable norm constraint ϵ.The resulting concatenated perturbation rAdvT is used to define the adversarial loss.
- Perturbation computation: A non-iterative perturbation solution is obtained by linearizing the loss around the original input for RNN-based models.The exact optimization is generally infeasible for sophisticated deep neural models, motivating this approximation.
- Training objective: The model jointly minimizes the standard objective J(D, W) and adversarial objective JAdvT(D, W), with λ controlling their balance.This combines ordinary training with the loss computed from adversarially perturbed embeddings.
5 Interpretable Adversarial Perturbation
The paper makes embedding-space adversarial training interpretable by restricting perturbations toward existing vocabulary words, enabling adversarial texts formed through word substitutions while preserving task performance.
- Interpretable AdvT-Text: iAdvT-Text restricts perturbation directions toward existing words in the input embedding space, allowing perturbed inputs to be interpreted as word substitutions.The direction toward another word is treated as a candidate substitution that can reconstruct an adversarial sentence.
- Direction vectors: Each direction d^(t)_k points from the t-th input word embedding toward the k-th vocabulary word embedding.The direction is normalized when nonzero, while the direction toward the current word becomes a zero vector.
- Adversarial optimization: The method assigns weights to vocabulary directions and seeks worst-case weights that maximize the loss, identifying adversarial word directions.The resulting perturbation is parameterized by per-position weights and evaluated through the loss function.
- Practical computation: To reduce computation, the method replaces the full vocabulary with |V^(t)| = 10 nearest-neighbor embeddings around each input word during training.Words outside these individual vocabularies receive zero weights because distant words are treated as nearly unrelated.
- Semi-supervised extension: The same interpretable perturbation strategy extends to semi-supervised learning as iVAT-Text by adapting virtual adversarial training to labeled and unlabeled data.VAT-Text is presented as a semi-supervised extension of AdvT-Text, and the paper defines an interpretable objective for this setting.
6 Experiments
Experiments evaluated iAdvT-Text and iVAT-Text across sentiment, category, and grammatical error detection tasks, measuring both task performance and interpretability. The methods maintained or improved baseline performance while producing interpretable perturbations and effective adversarial texts.
- Experimental setup: Experiments covered sentiment classification, category classification, and grammatical error detection, using supervised and semi-supervised benchmark settings.SEC included IMDB, Elec, and Rotten Tomatoes; CAC included DBpedia and RCV1; GED used a grammatical error detection dataset.
- Experimental setup: All four methods shared RNN-based submodules and were compared under identical implementation conditions.The authors implemented iAdvT-Text and iVAT-Text and re-implemented AdvT-Text and VAT-Text with GPU-supported Chainer.
- Task performance: iAdvT-Text outperformed AdvT-Text, while iVAT-Text matched or slightly outperformed VAT-Text on IMDB.The authors expected interpretability restrictions to reduce performance, but observed the opposite for iAdvT-Text and no degradation for iVAT-Text.
- Task performance: AdvT-Text achieved the highest GED F0.5, while iAdvT-Text and iVAT-Text nearly matched AdvT-Text and VAT-Text.AdvT-Text also outperformed previously reported state-of-the-art methods on this dataset.
- Interpretability: The method reconstructs perturbations as word substitutions, producing interpretable examples such as better→worse and practise→play.The visualization selects the highest perturbation direction toward an existing word for each input word.
- Interpretability: Compared with AdvT-Text, iAdvT-Text generated interpretable perturbations and effective adversarial texts that previous methods could hardly reconstruct.AdvT-Text visualizations included implausible substitutions such as <eos>→Analyze and practise→UNFORTUNETELY.
- Interpretability: The authors conclude that embedding directions toward existing words can support human-understandable model analysis without degrading baseline task performance.They report maintained or improved performance across SEC, CAC, and GED benchmark datasets.
7 Conclusion
The paper restricts adversarial perturbations toward existing word locations so they can be reconstructed as actual word substitutions. Across three NLP task types, the resulting methods produced interpretable adversarial texts and visualizations while maintaining or improving baseline performance.
- Conclusion: The proposal restricts perturbation directions toward existing words in embedding space, enabling reasonable adversarial texts and interpretable visualizations.Perturbations are interpreted as substitutions of words in the sentence.
- Conclusion: iAdvT-Text and iVAT-Text maintained or improved AdvT-Text and VAT-Text performance on sentiment, category, and grammatical error detection benchmarks.The conclusion reports this result across well-studied SEC, CAC, and GED datasets.
- Conclusion: The resulting interpretability is intended to help researchers analyze neural models’ behavior.The paper presents interpretable perturbation visualizations and reconstructed adversarial texts as analysis aids.