Source-linked AI summary
On Adversarial Examples for Character-Level Neural Machine Translation
Javid Ebrahimi, Daniel Lowd, Dejing Dou
TL;DR
Character-level NMT robustness is difficult to assess because discrete text has made white-box attacks uncommon. The paper develops gradient-ranked string-edit attacks, including attacks that remove or replace translated words, and finds stronger white-box adversaries plus improved robustness after adversarial training.
Problem
Most NLP robustness analyses use black-box adversarial examples because white-box attacks for discrete text are difficult to create.
Method
The paper uses differentiable character-edit operations and gradient-based search to construct untargeted, controlled, and targeted attacks for character-level NMT.
Results
White-box attacks significantly outperform black-box attacks in controlled and targeted scenarios, while adversarial training improves model robustness.
Takeaways & Limitations
The approach exposes more effective NMT vulnerabilities and supports training more robust models than previous black-box methods.
Takeaways & Limitations
Experiments restrict character changes so the resulting new word does not exist in the vocabulary.
Abstract
from arXiv · showhide
Evaluating on adversarial examples has become a standard procedure to measure robustness of deep learning models. Due to the difficulty of creating white-box adversarial examples for discrete text input, most analyses of the robustness of NLP models have been done through black-box adversarial examples. We investigate adversarial examples for character-level neural machine translation (NMT), and contrast black-box adversaries with a novel white-box adversary, which employs differentiable string-edit operations to rank adversarial changes. We propose two novel types of attacks which aim to remove or change a word in a translation, rather than simply break the NMT. We demonstrate that white-box adversarial examples are significantly stronger than their black-box counterparts in different attack scenarios, which show more serious vulnerabilities than previously known. In addition, after performing adversarial training, which takes only 3 times longer than regular training, we can improve the model's robustness significantly.
1 Introduction
The paper examines serious vulnerabilities in character-level NMT by developing white-box and targeted adversarial attacks, then studies adversarial training for robustness.
- Motivation: The work addresses the need to understand worst-case MT failures as machine translation becomes more widely trusted and used.The introduction connects this need to a wrongful arrest caused by a one-character mistranslation.
- Contributions: The paper introduces controlled attacks that mute a translated word and targeted attacks that replace it with another word.These attacks preserve most of the translation while pursuing specific output changes.
- Motivation: White-box attacks use model parameters and gradients to seek more damaging manipulations than black-box heuristics.White-box attacks approximate worst-case attacks within an allowed perturbation set.
- Method: The attack framework ranks adversarial manipulations with gradients and searches for examples using greedy or beam search.The broader method extends differentiable string-edit attacks for character-level NMT.
- Findings: Experiments show that white-box adversaries are significantly stronger than black-box adversarial examples.The comparison covers the paper’s adversarial attack scenarios.
2 Related Work
Prior NLP robustness work largely used black-box attacks and showed vulnerability to character noise, while adversarial training improved robustness.
- Character-level NMT: Character-level NMT systems were shown to be overly sensitive to random character manipulations such as keyboard typos.The prior work used black-box heuristics rather than model parameters or gradients.
- This paper: This paper contrasts its white-box attacks with black-box counterparts and reports that white-box attacks significantly outperform them in controlled and targeted scenarios.The comparison focuses on translation-specific attack settings.
- Adversarial training: Adversarial training improved NMT robustness to adversarial noise in earlier work.Related work also identified the difficulty of efficiently creating real-world adversarial examples for training.
3 White-Box Adversarial Examples
The paper formulates character-level adversarial text editing as a combinatorial search problem and uses gradient-based directional derivatives to rank differentiable string edits. It extends these attacks from untargeted loss increases to word removal or replacement, and compares one-shot, greedy, and beam-search strategies for multiple changes.
- Single-Edit Optimization: Gradient-based optimization ranks flip, swap, delete, and insert operations using derivatives with respect to one-hot character representations.The method represents edits as vectors and estimates their loss changes through directional derivatives.
- Single-Edit Optimization: The best flip can be estimated with one forward pass and one backward pass, while selecting among |V|mn candidate character changes.The search considers m words, n characters per word, and an alphabet of size |V|.
- Targeted Objectives: Controlled attacks maximize loss on a selected target word, enabling translation attacks that remove sensitive information or key modifiers.The objective focuses the adversary on input regions affecting the chosen output word rather than the entire translation.
- Targeted Objectives: Targeted attacks maximize −J(x, y_t′) to replace a selected translation word with a specified alternative, using the same derivative-based framework.The negated objective is equivalent to minimizing predictive loss on the replacement word.
- Multiple Changes: Multiple edits can use one-shot, greedy, or beam search; beam search requires O(br) forward and backward passes and sorts candidates by true loss plus gradient estimates.One-shot is more efficient but less optimal, while greedy search repeatedly updates gradients and beam search strengthens it.
4 Experiments
The experiments use TED-talk translation data across three language pairs and evaluate a character-level architecture under constrained character changes and decoding settings.
- Data: Experiments use the IWSLT 2016 TED talks parallel corpus for German–English, Czech–English, and French–English translation.Development and test sets from previous years are used, except 2015 serves as the development set.
- Attack constraint: Character changes are allowed only when the resulting word is absent from the vocabulary, preventing expected translation responses to ordinary word substitutions.For example, changing German “nacht” to “nackt” could naturally produce “nude.”
- Model: The studied character-level architecture extracts features with character convolutions, processes them through highway networks, and models word sequences with recurrent neural networks.The architecture was proposed for language modeling and later adapted for translation.
- Implementation: The implementation largely follows Yoon Kim’s seq2seq system and uses similar hyperparameters aligned with attentional translation guidelines.The implementation mostly follows Luong et al. (2015).
- Decoding: BLEU experiments use beam width 4 for the decoder, whereas the white-box attacker uses greedy decoding to compute correct gradients.Gradient computation requires greedy decoding or a decoder architecture that allows gradients to flow through beam-search paths.
5 Analysis of Adversaries
The first-order gradient estimate moderately correlates with true loss increases, supporting its use to rank adversarial manipulations. Across untargeted, controlled, and targeted settings, white-box attacks outperform black-box attacks, with especially clear advantages for goal-based attacks.
- Untargeted Attack: Spearman coefficient ρ = 0.61 indicates a moderately positive correlation between true loss increases and gradient-based estimates.The estimate has smaller variance because of first-order linearization bias, but remains useful for ranking manipulations.
- Adversary Comparison: White-box adversaries significantly outperform black-box adversaries in untargeted, controlled, and targeted attack scenarios.The advantage is especially pronounced in controlled and targeted attacks.
- Untargeted Attack: White-box attacks can select the best change for each word using gradients, whereas black-box attacks may choose changes uniformly or randomly.This difference particularly disadvantages black-box flip attacks, which have more possible character changes than swap or delete attacks.
- Controlled Attack: White-box adversaries are more efficient in controlled attacks, using fewer queries and fewer manipulated characters within a budget of 20% of the text.Additional backward passes and gradient sorting make their running times comparable to black-box attacks.
- Controlled Attack: Controlled attacks show a more convincing superiority of white-box attacks over black-box attacks than the preceding untargeted results.Success rate is evaluated against α, which penalizes ad hoc manipulations that produce radically different translations.
- Targeted Attack: Targeted attacks have much lower success rates than less demanding attacks, but white-box adversaries still perform significantly better than black-box adversaries.For the 100th-most likely target, success rate is more than ten times smaller than for the second-most likely attack.
- Adversarial Examples: The examples include a controlled word removal and second-most and 100th-most likely targeted replacements, with BLEU ratios of 0.52, 1.00, and 0.70.The 100th-most likely replacement required considerably more manipulations.
6 Robustness to Adversarial Examples
The section develops FIDS-based adversarial training and evaluates robustness across clean, black-box, and white-box noise. White-box training improves transfer to several unseen noise types, though random noise remains difficult without an ensemble.
- 6.1 Baselines: FIDS-B trains on Flips, Inserts, Deletes, and Swaps sampled to match natural-noise distributions across languages.These operations account for 64%, 80%, and 70% of natural noise in Czech, German, and French, respectively.
- 6.2 Adversarial Training: FIDS-W generates white-box adversarial examples with the same four edit operations and creates them for every mini-batch at each epoch.The one-shot procedure changes every word in a sentence with a single FIDS operation in parallel.
- 6.3 Discussion: FIDS-W performs best on natural noise and improves performance on keyboard and random noise relative to models not trained on those noise types.It does not generalize fully to random noise, for which an ensemble approach is still needed.
- 6.3 Discussion: The white-box adversarially trained model becomes more resilient as training loss on newly generated adversarial examples decreases.Adversarial examples are created at the start of each epoch.
7 Conclusion and Future Work
The paper argues that stronger, targeted adversaries are increasingly important as people rely more on machine translation. Its white-box optimization and adversarial training find vulnerabilities and improve robustness, while future work will broaden attack goals and constraints.
- 7 Conclusion and Future Work: The paper studies attacks against specific models that can remove or change words, rather than only degrade translation quality.It presents white-box optimization, targeted attacks, and new evaluation methods as steps toward understanding and fixing NMT vulnerabilities.
- 7 Conclusion and Future Work: The authors report more effective attacks and more robust models than previous black-box methods.Proposed future work includes multi-word targeted attacks and constraints that better characterize minimally unintelligible character changes.