PaperlayerView exact revision on arXiv

Source-linked AI summary

InfoBERT: Improving Robustness of Language Models from An Information Theoretic Perspective

Boxin Wang, Shuohang Wang, Yu Cheng, Zhe Gan, Ruoxi Jia, Bo Li, Jingjing Liu

arXiv:2010.02329v4cs.CLcs.AIcs.LG

TL;DR

BERT-based language models are vulnerable to textual adversarial attacks. InfoBERT fine-tunes them using two mutual-information-based regularizers, and is reported to achieve state-of-the-art robust accuracy across adversarial datasets on NLI and QA without sacrificing benign accuracy.

  • Problem

    BERT-based language models are vulnerable to textual adversarial attacks, raising the challenge of building robust real-world applications against unknown attacks.

    Source: §1 · pp. 1–2

  • Method

    InfoBERT fine-tunes language models with an Information Bottleneck regularizer and an Anchored Feature regularizer that refines local and global representations.

    Source: §1 · p. 2

  • Results

    InfoBERT substantially improves robust accuracy without sacrificing benign accuracy and achieves state-of-the-art performance across multiple adversarial datasets on NLI and QA.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The proposed regularizers are presented as applicable to both standard and adversarial training for different NLP tasks.

    Source: §1 · p. 2

    The paper mainly targets word-level attacks and defines adversarial text examples using distortions constrained in embedding space.

    Source: §3 · p. 3

Abstract

from arXiv · show

Large-scale language models such as BERT have achieved state-of-the-art performance across a wide range of NLP tasks. Recent studies, however, show that such BERT-based models are vulnerable facing the threats of textual adversarial attacks. We aim to address this problem from an information-theoretic perspective, and propose InfoBERT, a novel learning framework for robust fine-tuning of pre-trained language models. InfoBERT contains two mutual-information-based regularizers for model training: (i) an Information Bottleneck regularizer, which suppresses noisy mutual information between the input and the feature representation; and (ii) a Robust Feature regularizer, which increases the mutual information between local robust features and global features. We provide a principled way to theoretically analyze and improve the robustness of representation learning for language models in both standard and adversarial training. Extensive experiments demonstrate that InfoBERT achieves state-of-the-art robust accuracy over several adversarial datasets on Natural Language Inference (NLI) and Question Answering (QA) tasks. Our code is available at https://github.com/AI-secure/InfoBERT.

1 INTRODUCTION

BERT-based language models are vulnerable to textual adversarial attacks, motivating work on robust NLP applications. InfoBERT uses mutual-information regularizers to refine local and global features, and is reported to improve robust accuracy across NLI and QA datasets without sacrificing benign accuracy.

1 INTRODUCTION

  • Prior work frames self-supervised representation learning as maximizing input-representation mutual information, and a unified view extends this perspective to pre-trained language models in NLP.The passage also notes that high-dimensional mutual information is computationally intractable and motivates lower- and upper-bound estimators.Source: §1 · p. 1
  • Studies show that BERT-based language models are vulnerable to textual adversarial attacks, challenging the development of robust real-world language-model applications against unknown attacks.Textual attacks may use word substitutions or sentence-level paraphrases that preserve apparent meaning or utility to human readers while fooling NLP models.Source: §1 · pp. 1–2
  • InfoBERT combines an Information Bottleneck regularizer that removes excessive noisy information with an Anchored Feature regularizer that aligns stable local features with global representations.The paper presents the two mutual-information-based regularizers as ways to refine local and global features for robustness.Source: §1 · p. 2
  • InfoBERT substantially improves robust accuracy without sacrificing benign accuracy, achieving state-of-the-art performance across multiple adversarial datasets on NLI and QA.The framework is described as applicable to both standard and adversarial training.Source: §1 · p. 2

2 RELATED WORK

Related work covers word-level textual attacks, three defense families with practical constraints, and information-theoretic approaches to representation learning. InfoBERT is positioned as compatible with standard and adversarial training for language models with discrete inputs.

Textual Adversarial Attacks/Defenses

  • Most existing textual adversarial attacks focus on word-level manipulation; Ebrahimi et al. (2018) first proposed a whitebox gradient-based search for adversarial word/character substitutions, while later work constrained the search space and used POS checking for naturalness.Source: §2 · p. 2
  • Defenses include adversarial training, IBP certification, and randomized smoothing; cited limitations include unknown threat models, transformer adaptation, and synonym-set completeness, respectively.The passage associates adversarial training with Zhu et al. (2020a), Jiang et al. (2020), Liu et al. (2020), and Gan et al. (2020); IBP with Huang et al. (2019) and Jia et al. (2019); and synonym-based smoothing with Ye et al. (2020).Source: §2 · p. 2

Representation Learning

  • InfoMax-style mutual-information maximization may introduce excessive noisy information; unlike a cited continuous-space approach, InfoBERT is designed for discrete language inputs and both standard and adversarial training.The passage attributes the noisy-information concern to Tian et al. (2020) and describes Zhu et al. (2020b) as focusing mainly on continuous-space computer vision.Source: §2 · p. 2

3 INFOBERT

InfoBERT adapts the Information Bottleneck to local word features and adds an anchored-feature regularizer that aligns stable local features with sentence-level representations. Its analysis connects reducing input-feature information with a smaller benign–adversarial performance gap.

3 INFOBERT

  • The paper defines ε-bounded textual adversarial examples as classifier errors under word-level embedding perturbations bounded by ε.The definition also requires the benign sentence's classifier output to match the oracle's decision.Source: §3 · p. 3

3.1 INFORMATION BOTTLENECK AS A REGULARIZER

  • InfoBERT applies the Information Bottleneck to BERT's local word features, retaining label information while penalizing input-feature information.Because full I(X;T) is difficult to compute for high-dimensional, length-dependent features, the paper maximizes a localized formulation that is a lower bound of the full objective.Source: §3.1 · pp. 3–4
  • Theorem 3.2 bounds the benign–adversarial performance gap using local input-feature mutual information, which the IB regularizer minimizes.The analysis suggests that combining adversarial training with IB can further minimize adversarial input-feature mutual information, leading to better robustness.Source: §3.1 · p. 4

3.2 ANCHORED FEATURE REGULARIZER

  • Local anchored features are selected by excluding words with very large perturbations as nonrobust and very small perturbations as unuseful.The paper gives words ranked among 50% ∼80% of perturbation magnitudes as one feasible selection range.Source: §3.2 · p. 5
  • The Anchored Feature Regularizer increases mutual information between selected local features and sentence-level representations, aligning global features with stable, useful information.The final-layer [CLS] embedding can represent the global feature, and InfoNCE provides a lower-bound approximation to the mutual information term using positive and negative samples.Source: §3.2 · pp. 5–6

4 EXPERIMENTS

Across NLI and QA evaluations, InfoBERT improves adversarial robustness in the tested training settings, with benign performance largely maintained. The feature analysis reports increased mutual information between local and global features after adversarial retraining, with anchored features contributing more to that gain.

4.1 EXPERIMENTAL SETUP

  • Evaluations cover ANLI, adversarial SQuAD, and TextFooler; InfoBERT is tested on RoBERTaLarge and BERTLarge against FreeLB, SMART, and ALUM, with two ANLI training settings.The ANLI settings use benign-only data or both benign and adversarial training data.Source: §4.1 · p. 6, §4.2 · p. 7

4.2 EXPERIMENTAL RESULTS

  • With benign-only training on ANLI, standard-training InfoBERT exceeds FreeLB's robust accuracy for both RoBERTa and BERT and takes 1/3–1/2 less training time.Vanilla BERTLarge achieves the lowest robust accuracy among the models in this setting, at 26.5%.Source: Table 1 · p. 7, §4.2 · p. 7
  • 58.3% robust accuracy: InfoBERT combined with adversarial training achieves state-of-the-art performance on ANLI when trained with benign and adversarial data.The second setting combines ANLI training data with FeverNLI, MNLI, and SNLI.Source: Table 2 · p. 7, §4.2 · p. 7
  • Under TextFooler, InfoBERT with adversarial training performs best, while standard-training InfoBERT and adversarial training each substantially improve robust accuracy.The evaluation uses adversarial SNLI and MNLI examples generated by TextFooler.Source: Table 3 · p. 8, §4.2 · p. 8
  • 78.5/72.9 robust F1/EM: standard-training InfoBERT achieves state-of-the-art scores on adversarial SQuAD while requiring half the training time of adversarial-training methods.The scores are reported for AddSent and AddOneSent adversarial QA test sets.Source: Table 4 · p. 8, §4.2 · p. 8

4.3 ANALYSIS OF LOCAL ANCHORED FEATURES

  • After adversarial retraining, mutual information between local and global features rises on adversarial test data, with anchored features contributing more improvement than nonrobust or unuseful features.The reported anchored-feature MI improvement is higher than the corresponding improvement for nonrobust/unuseful features.Source: Figure 1 · p. 8, §4.3 · p. 9

5 CONCLUSION

InfoBERT robustly fine-tunes pretrained language models by refining local and global features with two mutual-information regularizers. The authors report theoretical support and state-of-the-art performance against strong attacks across NLI and QA tasks.

5 CONCLUSION

  • InfoBERT uses an Information Bottleneck Regularizer to remove excessive spurious features and a Local Anchored Feature Regularizer to align local features with global features.The framework is presented as a principled way to improve robustness of learned representations.Source: §5 · p. 9
  • The authors report that InfoBERT outperforms existing baselines and achieves state of the art on adversarial datasets across NLP tasks, including NLI and QA.The conclusion says theoretical analysis supports improving BERT and RoBERTa robustness against strong attacks.Source: §5 · p. 9

A APPENDIX

Figure 2 decomposes InfoBERT’s objective into a task objective and two mutual-information regularizers, one for compression and one for local-to-global feature alignment.

A APPENDIX

  • The complete objective combines a standard task objective, an Information Bottleneck Regularizer, and a Local Anchored Feature Regularizer.Figure 2 presents these as components (a), (b), and (c), respectively.Source: Figure 2 · p. 13
  • Decreasing I(Xi; Ti) is reported to improve adversarial robustness without much effect on benign accuracy.This is the role of the Information Bottleneck Regularizer in the figure.Source: Figure 2 · p. 13
  • The Local Anchored Feature Regularizer maximizes I(Tkj; Z) to align local anchored features with the global feature.The local anchored features are highlighted in yellow in Figure 2.Source: Figure 2 · p. 13

A.1 IMPLEMENTATION DETAILS

The appendix specifies BERT and RoBERTa baselines, task-specific fine-tuning and regularizer settings, and the selected approach for modeling the conditional representation distribution.

A.1 IMPLEMENTATION DETAILS

  • BERTLarge-uncased is the baseline, with 24 layers, 1024 hidden units, 16 attention heads, and 340M parameters; RoBERTaLarge shares its architecture but uses different pretraining choices.RoBERTa removes the next-sentence objective and trains with larger mini-batches and learning rates.Source: §A.1 · p. 13
  • Fine-tuning runs for 3 epochs on NLI and 2 on QA, with best checkpoints selected on development data.NLI uses batch size 256, learning rate 2 × 10^-5, sequence length 128, and 1000 warm-up steps; QA uses batch size 32, learning rate 3 × 10^-5, and sequence length 384 without warm-up.Source: §A.1 · p. 13
  • For adversarial training, InfoBERT uses FreeLB with 3 adversarial steps and specified learning-rate and perturbation-norm settings.The listed adversarial learning rates are 10^-1 or 4 × 10^-2, maximum norms 3 × 10^-1 or 2 × 10^-1, and initial norms 10^-1 or 0.Source: §A.1 · p. 13
  • For modeling p(t | x), the authors select the BERT encoder rather than an auxiliary neural network because it gave greater robustness improvement empirically.The encoder approach barely sacrificed benign performance, whereas the auxiliary-net approach could hurt benign accuracy slightly.Source: §A.1 · p. 14
  • The Information Bottleneck regularizer uses β to trade off representation compression against predictive power, with different selected values across tasks and encoders.β is 5 × 10^-2 for RoBERTa and 10^-3 for BERT on NLI, and 5 × 10^-5 on QA, which the authors associate with QA’s reliance on word-level features for answer spans.Source: §A.1 · p. 14
  • The anchored-feature regularizer uses α = 5 × 10^-3, task-specific extraction thresholds, and a two-layer fully connected MI estimator with hidden size 300.The thresholds are ch = 0.9 and cl = 0.5 for NLI, and ch = 0.95 and cl = 0.75 for QA.Source: §A.1 · p. 14

A.2.1 ABLATION STUDY ON INFORMATION BOTTLENECK REGULARIZER

Ablations favor modeling p(t | x) with the BERT encoder and using local rather than global features for robust accuracy; the β search also shows a compression trade-off on QA.

A.2.1 ABLATION STUDY ON INFORMATION BOTTLENECK REGULARIZER

  • Both conditional-distribution modeling methods improved robustness, but the BERT encoder gave a larger margin than the auxiliary net and barely sacrificed benign performance.The auxiliary-net approach could hurt benign accuracy slightly; these comparisons used standard training with α = 0 and β = 5 × 10^-2.Source: §A.2.1 · p. 14
  • Table 5 reports robust accuracy on ANLI and defines standard datasets as MNLI plus SNLI training; “Vanilla” is BERT without the Information Bottleneck Regularizer.The supplied caption identifies the table’s scope and terms but does not provide cell values.Source: Table 5 · p. 15
  • Both local and global features improved robustness, but local features yielded higher robust-accuracy gains, especially when adversarial training data was added.The comparison used standard training with α = 0 and β = 5 × 10^-2 to eliminate other factors.Source: §A.2.1 · pp. 14–15
  • On QA, increasing β from a very small value initially raised benign and adversarial F1, with both best at β = 5 × 10^-5 (log(β) = −9.9).At larger β, benign F1 began to fall as the representation was further compressed.Source: §A.2.1 · p. 15

A.2.2 ABLATION STUDY ON ANCHORED FEATURE REGULARIZER

Anchored Feature Regularizer examples show local cues and matching premise–hypothesis features used to support robust global representations. The supplied visual captions identify ANLI robust-accuracy and QA benign/robust F1 evaluation settings.

A.2.2 ABLATION STUDY ON ANCHORED FEATURE REGULARIZER

  • Anchored features highlight stable local cues and matching premise–hypothesis features, which the authors say improve the robustness of global representations.Examples include the quantity “Two,” “playing,” “card”/“poker,” and aligned pairs such as “people”/“roller” versus “park.”Source: §A.2.2 · p. 15, Table 7 · p. 16
  • Table 6 covers ANLI robust accuracy across benign-only and benign-plus-adversarial training settings; Vanilla is RoBERTa without the Information Bottleneck regularizer.The supplied caption does not provide table values or establish a winning model.Source: Table 6 · p. 15
  • Figure 3 plots benign and robust F1 on QA datasets for models trained on benign SQuAD with different β values.The caption supplies the metrics and training condition, but no plotted values.Source: Figure 3 · p. 16

A.2.3 ABLATION STUDY ON DISENTANGLING TWO REGULARIZERS

The ablation reports that combining both regularizers gives the best robust accuracy, while either one alone reaches performance similar to FreeLB. It compares the regularizers individually under standard and adversarial training.

A.2.3 ABLATION STUDY ON DISENTANGLING TWO REGULARIZERS

  • The ablation applies each regularizer individually under both standard and adversarial training.“IBR only” sets α = 0 and uses β = 5 × 10−2; “AFR only” sets β = 0 and uses α = 5 × 10−3, ch = 0.9, and cl = 0.5.Source: §A.2.3 · p. 16
  • The three compared variants are IBR only, AFR only, and Both, with Both denoting the standard InfoBERT setting that trains with both regularizers.The ablation is intended to separate the regularizers’ contributions to robustness.Source: §A.2.3 · p. 16
  • Combining both regularizers achieves the best robust accuracy, while either regularizer alone achieves performance similar to FreeLB.Both regularizers improve robust accuracy over vanilla and FreeLB by a similar margin; InfoBERT’s training time is described as “only 1/3˜1/2 less than FreeLB.”Source: §A.2.3 · p. 16

A.2.4 EXAMPLES OF ADVERSARIAL DATASETS GENERATED BY TEXTFOOLER

TextFooler examples are mostly described as human-valid, but some substitutions lose critical information and can fool both people and NLP models. The appendix also gives proof steps for lower bounds involving LIB and changes in I(Y;T).

A.2.4 EXAMPLES OF ADVERSARIAL DATASETS GENERATED BY TEXTFOOLER

  • Some TextFooler examples are invalid: replacing “stand” with “position” loses critical information and fools both humans and NLP models.The authors expect robustness to be higher if such invalid examples are removed from evaluation.Source: §A.2.4 · p. 16, Table 9 · p. 17

A.3.1 PROOF OF THEOREM 3.1

  • The proof of Theorem 3.1 plugs Lemma A.2 into the theorem to obtain a lower bound for LIB.Lemma A.2 concerns representations generated by applying a deterministic function to a sequence of random variables.Source: §A.3.1 · p. 18

A.3.2 PROOF OF THEOREM 3.2

  • Theorem 3.2 bounds changes in I(Y;T) through conditional and marginal entropy changes; with finite vocabulary, log C ≤ n log k bounds nearby perturbation counts.The proof combines bounds on those entropy terms to establish the theorem’s bound.Source: §A.3.2 · pp. 19, 23
Loading 2010.02329v4…