PaperlayerView exact revision on arXiv

Source-linked AI summary

Better Robustness by More Coverage: Adversarial Training with Mixup Augmentation for Robust Fine-tuning

Chenglei Si, Zhengyan Zhang, Fanchao Qi, Zhiyuan Liu, Yasheng Wang, Qun Liu, Maosong Sun

arXiv:2012.15699v3cs.CL

TL;DR

Textual adversarial data augmentation provides too few examples to cover the large attack space and can degrade clean-data performance. The paper proposes AMDA, which interpolates training representations to create virtual examples, and evaluates robustness with new attacks targeted at each model. AMDA improves robustness across the reported cases, including a large after-attack accuracy recovery on IMDB.

  • Problem

    Text ADA provides too few examples because text is discrete and attack search spaces can be exponentially large, and it can degrade clean-data performance.

    Source: §1 · p. 2

  • Method

    AMDA combines adversarial data augmentation with mixup by interpolating training representations and labels, while evaluation regenerates targeted adversarial examples for each model.

    Source: §1 · p. 2, §2.2 · p. 2

  • Results

    AMDA significantly improved robustness across reported cases without significant clean-test degradation versus ADA; RoBERTa after-attack accuracy on IMDB rose from 6.35% to 51.84%.

    Source: §1 · p. 2, §4.3 · p. 5

  • Takeaways & Limitations

    The authors present AMDA as a generally applicable defense and a competitive baseline for future work on PLM robustness.

    Source: §5 · p. 5

    The authors leave a more thorough theoretical analysis of AMDA's effectiveness on textual data for future work.

    Source: §5 · p. 5

Abstract

from arXiv · show

Pretrained language models (PLMs) perform poorly under adversarial attacks. To improve the adversarial robustness, adversarial data augmentation (ADA) has been widely adopted to cover more search space of adversarial attacks by adding textual adversarial examples during training. However, the number of adversarial examples for text augmentation is still extremely insufficient due to the exponentially large attack search space. In this work, we propose a simple and effective method to cover a much larger proportion of the attack search space, called Adversarial and Mixup Data Augmentation (AMDA). Specifically, AMDA linearly interpolates the representations of pairs of training samples to form new virtual samples, which are more abundant and diverse than the discrete text adversarial examples in conventional ADA. Moreover, to fairly evaluate the robustness of different models, we adopt a challenging evaluation setup, which generates a new set of adversarial examples targeting each model. In text classification experiments of BERT and RoBERTa, AMDA achieves significant robustness gains under two strong adversarial attacks and alleviates the performance degradation of ADA on the clean data. Our code is available at: https://github.com/thunlp/MixADA .

1 Introduction

PLMs remain vulnerable to adversarial attacks, while text ADA has limited attack-space coverage and can reduce clean-data performance. The introduction presents AMDA as a way to address these limitations and reports robustness gains under strong attacks.

1 Introduction

  • Attack-specific defenses are limited to particular attack types, whereas ADA applies broadly but is described as insufficiently effective against attacks.The paper aims to improve ADA as a general defense during finetuning.Source: §1 · pp. 1–2
  • Text ADA yields too few training examples because textual inputs are discrete and the attack search space can grow exponentially; it can also degrade clean-data performance.The authors attribute the clean-data degradation to the different distribution of adversarial and clean examples.Source: §1 · p. 2
  • AMDA interpolates continuous representations of existing samples to create more abundant virtual training examples that discrete textual perturbations cannot provide.The authors say these virtual samples are closer to the original-data distribution, alleviating ADA's clean-data performance degradation.Source: §1 · p. 2
  • Across three text-classification datasets and two strong attacks, AMDA improved robustness; RoBERTa after-attack accuracy on IMDB rose from 6.35% to 51.84%.The authors report that AMDA outperformed all other baselines by large margins on IMDB.Source: §1 · p. 2
  • The authors use Targeted Attack Evaluation, which generates new targeted adversarial examples for each evaluated model, rather than testing all models on one fixed set.They describe this as a more challenging evaluation setup for model-specific attacks.Source: §1 · p. 2

2 Method

AMDA combines adversarial data augmentation with mixup on the augmented training set. It creates virtual examples by interpolating representations and labels, then trains with both standard and mixup losses.

2 Method

  • AMDA first applies adversarial data augmentation, then performs mixup on the resulting augmented training set.The training objective combines standard training loss with mixup loss.Source: §2 · p. 2, §2.3 · p. 3

2.1 Adversarial Data Augmentation

  • Adversarial data augmentation adds label-preserving examples that the victim model initially classifies correctly but now classifies incorrectly.The training set is the union of original and adversarial examples.Source: §2.1 · p. 2

2.2 Mixup Data Augmentation

  • Mixup interpolates representations and labels of paired training samples; textual inputs use word embeddings or hidden representations, and pairs may combine original and adversarial examples.The interpolation weight λ is sampled from Beta(α, α), and mixing different data types increases diversity.Source: §2.2 · pp. 2–3

2.3 AMDA

  • AMDA trains on the combined augmented set using standard loss for original or adversarial examples and KL-divergence loss for virtual mixup examples.The mixup examples are sampled as random pairs from the ADA-augmented data.Source: §2.3 · p. 3

3 Robustness Evaluation

The paper distinguishes fixed-set evaluation from evaluation that regenerates adversarial examples for each model. It notes that unspecified evaluation modes have caused confusion and conflicting conclusions.

3 Robustness Evaluation

  • Static Attack Evaluation (SAE) creates adversarial examples on the original model and tests every new model on that fixed set.This setup has been adopted in prior work cited by the paper.Source: §3 · p. 3
  • Targeted Attack Evaluation (TAE) regenerates adversarial examples to target each model being evaluated.The paper identifies this as a separate evaluation mode from SAE.Source: §3 · p. 3
  • The authors report that papers often omit their evaluation mode, leading to confusion and conflicting conclusions.They explicitly distinguish SAE and TAE and compare them in their experiments.Source: §3 · p. 3

4 Experiments

Experiments compare BERT and RoBERTa defenses on three text-classification datasets under PWWS and TextFooler, using targeted attacks that generate adversarial examples for each evaluated model. AMDA improves robustness over ADA and mixup while avoiding significant clean-test degradation.

4.1 Experiment Setups

  • Experiments use BERT-base-uncased and RoBERTa-base on SST-2, IMDB, and AGNews, with PWWS and TextFooler as attacks.The attack evaluation uses all 1,821 SST-2 test instances, 488 IMDB instances, and a 10% AGNews test sample.Source: §4.1 · p. 3
  • Mixup interpolates either the [CLS] vector or every token vector from a randomly selected BERT layer among 7, 9, and 12.SMix uses the [CLS] vector; TMix mixes every token representation.Source: §4.1 · p. 3

4.2 Comparison of SAE and TAE

  • Changing random seeds can raise static-attack scores, but models, including ADA-trained ones, remain poor under newly generated targeted attacks.The evaluation generates a new adversarial test set for each model; the authors consider this setting more challenging and meaningful for targeted attacks.Source: §4.2 · pp. 4–5

4.3 Mixup Improves Robustness

  • AMDA variants improve robustness beyond ADA and mixup in all cases without significant clean-test degradation; RoBERTa+AMDA-TMix has 59.68% PWWS modification versus 37.48% for RoBERTa.The reported modification rates indicate that more words had to be replaced to attack the AMDA-trained model.Source: §4.3 · p. 5
  • Mixup alone often improves robust accuracy, while combining mixup with ADA yields further gains across the reported cases.The authors suggest virtual examples closer to the empirical data distribution may help avoid clean-test degradation.Source: §4.3 · p. 5

5 Conclusion

The paper presents AMDA as a generally applicable defense that combines adversarial and mixup augmentation to cover more of the attack space. Its theoretical effectiveness on textual data remains for future analysis.

  • AMDA combines adversarial and mixup augmentation as a generally applicable defense to cover more of the attack space.Source: §5 · p. 5
  • A more thorough theoretical analysis of AMDA’s effectiveness on textual data is left for future work.Source: §5 · p. 5

Hyper-parameter Analysis

The analysis considers how the amount of adversarial training data and the mixup beta-distribution parameter affect results, alongside iterative ADA.

  • The hyper-parameter analysis examines adversarial-data amount, the mixup beta-distribution parameter α, and an alternative iterative ADA strategy.Source: Hyper-parameter Analysis · p. 8

Amount of Adversarial Training Data

The study varies the adversarial-training-data ratio and finds that increasing it does not necessarily improve robustness.

  • Higher adversarial-training-data ratios do not necessarily bring additional robustness gains across the tested settings.The tested ratios were 25%, 50%, 75%, and 100% for SST-2, and 5%, 10%, 15%, and 20% for IMDB.Source: Amount of Adversarial Training Data · p. 8

Interpolation Coefficient in Mixup

The authors vary the beta-distribution parameter α used to sample the mixup interpolation coefficient. They find no consistent optimal α across datasets and tune it after selecting the adversarial-data ratio.

Interpolation Coefficient in Mixup

Iterative ADA

The authors compare one-shot adversarial-example generation before fine-tuning with iterative generation during fine-tuning. On SST-2, the iterative approach performs far worse; they hypothesize that its early examples are less challenging and useful.

Iterative ADA

  • The one-shot approach generates all adversarial training samples at once and mixes them with original examples before fine-tuning.Source: Iterative ADA · p. 8
  • One-shot MixADA performs far better than iterative MixADA under attacks on SST-2.The approaches use the same adversarial-data ratio and mixup parameter α.Source: Table 4 · p. 8, Iterative ADA · p. 8
  • The authors hypothesize that iterative generation performs worse because early examples come from a not-well-fine-tuned model and are less challenging and useful.Source: Iterative ADA · p. 8

Related papers

Loading 2012.15699v3…