PaperlayerView exact revision on arXiv

Source-linked AI summary

Certified Robustness Against Natural Language Attacks by Causal Intervention

Haiteng Zhao, Chang Ma, Xinshuai Dong, Anh Tuan Luu, Zhi-Hong Deng, Hanwang Zhang

arXiv:2205.12331v3cs.LGcs.CLcs.CR

TL;DR

Natural-language models are vulnerable to adversarial examples, and the paper examines that vulnerability through a causal perspective. It proposes CISS, which models causal effects by smoothing in latent semantic space. CISS reports certified robustness against word substitutions and empirical robustness against integrated attacks, outperforming the runner-up in the reported examples.

  • Problem

    Deep-learning models are vulnerable to adversarial examples, including synonym substitutions that can fool BERT-based sentiment analysis.

    Source: §1 · p. 1

  • Method

    CISS models p(y|do(x)) by removing confounder effects through smoothing in latent semantic space.

    Source: §1 · p. 2

  • Results

    CISS consistently surpasses the runner-up in reported certified and empirical robustness results; on YELP, it achieves 83.1% empirical robustness against integrated attacks, 7.8% above the runner-up.

    Source: §1 · p. 2

  • Takeaways & Limitations

    CISS is presented as a causal approach to NLP robustness that scales to deep architectures and avoids constructing noise distributions customized for specific attacks.

    Source: §1 · p. 2

    The stated theorem concerns l2-bounded perturbations and assumes Gaussian noise for p(n).

    Source: §3.2 · p. 3

Abstract

from arXiv · show

Deep learning models have achieved great success in many fields, yet they are vulnerable to adversarial examples. This paper follows a causal perspective to look into the adversarial vulnerability and proposes Causal Intervention by Semantic Smoothing (CISS), a novel framework towards robustness against natural language attacks. Instead of merely fitting observational data, CISS learns causal effects p(y|do(x)) by smoothing in the latent semantic space to make robust predictions, which scales to deep architectures and avoids tedious construction of noise customized for specific attacks. CISS is provably robust against word substitution attacks, as well as empirically robust even when perturbations are strengthened by unknown attack algorithms. For example, on YELP, CISS surpasses the runner-up by 6.7% in terms of certified robustness against word substitutions, and achieves 79.4% empirical robustness when syntactic attacks are integrated.

1. Introduction

The paper attributes adversarial vulnerability to attack-manipulatable confounding and introduces CISS, which models causal effects through semantic-space smoothing. Experiments report certified robustness against word substitutions and empirical robustness against integrated attacks.

1. Introduction

  • The paper identifies attack-manipulatable confounders as a source of adversarial vulnerability because attacks can exploit spurious correlations between text and labels.Such correlations may help prediction under i.i.d. conditions but become harmful when the confounder is manipulated.Source: §1 · p. 1
  • CISS models the interventional distribution p(y|do(x)) by removing confounder effects in latent semantic space, avoiding noise distributions customized for particular attacks.The paper connects randomized classifiers to causal effects, describing them as expectations over Gaussian noise applied to a base classifier.Source: §1 · p. 2
  • CISS is presented as a causal framework for natural-language robustness that provides certification at deep architectures and empirical robustness under unseen attacks.The paper reports experiments with seen word-substitution attacks and unseen syntactic-trigger-based and editing distance-based attacks.Source: §1 · p. 2
  • 83.1% empirical robustness on YELP against integrated attacks surpassed the runner-up by 7.8%; on IMDB, certified robust accuracy against word substitutions was 76.5%, 7.2% above the runner-up.The experiments also consider unseen syntactic-trigger-based and editing distance-based attacks.Source: §1 · p. 2

2. Preliminaries

The section defines adversarial examples as inputs within a label-preserving neighborhood and distinguishes empirical from certified robustness. It also situates natural-language attacks at the character, word, and sentence levels.

2.1. Notations and Problem Setting

  • An adversarial example is an input in a neighborhood of the original text that retains its human-perceived label while aiming to fool a classifier.The section defines empirical robustness using correctness on attack-generated examples, and certified robustness as correctness guaranteed for every example in the neighborhood.Source: §2.1 · p. 2
  • Natural-language attacks include character-level modifications, word-level substitutions, and sentence-level manipulations.For word substitutions, the neighborhood is defined using a pre-defined set of semantically similar replacements for each word.Source: §2.1 · p. 2

3. Methodology

The method treats attack vulnerability as exploitable confounding and estimates causal effects with randomized smoothing, moved into an encoded semantic space for NLP.

3.1. Robustness from A Causal View

  • Attacks can manipulate confounders that create spurious X←N→Y correlations, so CISS targets the causal effect p(y|do(x)) rather than observational p(y|x).Such correlations can aid prediction in the i.i.d. setting but become harmful when attacks manipulate N.Source: §3.1 · pp. 2–3

3.2. Randomized Classifier Captures the Causal Effect

  • Gaussian-noise smoothing predicts by averaging base-classifier outputs and models p(y|do(x)); Theorem 2 gives an l2 robustness radius for the resulting classifier.The noise distribution is assumed to be N(0, σ^2I).Source: §3.2 · p. 3

3.3. Modeling Causal Effect by Semantic Smoothing

  • CISS smooths encoded inputs to handle NLP perturbations that are neither continuous nor l2-bounded, and certifies robustness when the estimated radius does not exceed the certified radius.The encoder maps text into a semantic space before Gaussian noise is added.Source: §3.3 · pp. 3–4

3.4. The Training Objective of CISS

  • CISS trains the base classifier with cross-entropy and regularizes the encoder to satisfy the certification condition, combining classification and robustness losses in its final objective.The IBP encoder bounds semantic representations under word substitutions; the margin m controls the gap between estimated and certified radii.Source: §3.4 · p. 4
  • CISS adapts its encoder to the Gaussian noise scale σ to avoid tuning σ, while using a shallow IBP encoder to limit the looseness of bounds in deep architectures.The paper notes that IBP bounds can loosen exponentially with model depth.Source: §3.4 · p. 5

3.5. Prediction and Robustness Certification of CISS

  • Prediction and certification use Monte Carlo sampling and hypothesis tests, returning a prediction or certificate at confidence 1−α and abstaining when the test does not support one.The certification procedure estimates a binomial lower confidence bound.Source: §3.5 · p. 5

4. Experiments

Experiments evaluate CISS on YELP and IMDB for certified and empirical robustness against word substitutions and stronger unseen attacks. CISS leads the compared methods on certified word-substitution robustness, empirical ASCC robustness, and the reported unseen-attack comparison, while also showing a favorable accuracy–robustness trade-off.

4.1. Experimental Setting

  • The experiments use YELP and IMDB, compare BERT, IBP, IBP-BERT, and SAFER, and evaluate certification and empirical attacks.Evaluation includes certified word substitutions, ASCC, and unseen syntactic and editing attacks strengthened with word substitutions; the implementation uses a CNN encoder and BERT base classifier.Source: §4.1 · pp. 5–6

4.2. Main Results

  • 90.58% certified robustness on YELP and 76.45% on IMDB surpass the runner-up by 6.8% and 7.2%, respectively.The comparison concerns certified robustness against word substitutions.Source: §4.2 · p. 6, Table 1 · p. 6

4.3. Empirical Robustness Against Word Substitutions

  • CISS surpasses the runner-up by 7.3% on YELP and 3.5% on IMDB under the ASCC word-substitution attack.The evaluation uses ASCC as a real attack and compares empirical robust accuracy.Source: Table 2 · p. 6, §4.3 · p. 7

4.4. Robustness Against Word Substitutions Combined With Unseen Natural Language Attacks

  • Against unseen syntactic and editing attacks strengthened with word substitutions, CISS retains robustness and outperforms state-of-the-art methods by around 7%.These sentence-level attacks were unseen during training.Source: §4.4 · p. 7, Table 3 · p. 7

4.5. Accuracy-Robustness Trade-Off

  • CISS achieves a better robustness–clean-accuracy trade-off than baselines, with its curve close to the clean-accuracy-equals-certified-robust-accuracy upper bound.The curve is obtained by tuning γ for CISS; the dashed line marks the upper bound described in the figure caption.Source: §4.5 · p. 7, Figure 4 · p. 7

4.6. Ablation Study and Hyper-parameter Sensitivity

  • When γ*m is sufficiently large to meet γ*m ≥ 1, performance is insensitive to small changes in γ and m; changing σ affects performance only to an ignorable extent.The authors attribute the γ and m sensitivity pattern to whether the training objective upper-bounds certification error.Source: §4.6 · p. 8, Table 4 · p. 8, Table 5 · p. 8

5. Related work

Related work situates CISS among causal approaches to robustness, NLP attack and defense methods, and certified robustness techniques. Its distinction is semantic latent-space smoothing rather than attack-customized noise in the input space.

Causality and Adversarial Robustness

  • Causal inference studies causal structures, intervention effects, and counterfactuals; prior work has also connected causal methods with distribution change and adversarial robustness.The paper distinguishes its contribution as a causal interpretation of randomized smoothing and certified robustness through causal-effect modeling.Source: §5 · p. 8

NLP Attacks and Empirical Defenses

  • NLP attacks include character-level, sequence-level, and word-substitution manipulations, while adversarial training is described as a leading empirical defense.The passage lists representative prior work across these attack and defense categories.Source: §5 · p. 8

Certified Robustness and Randomized Smoothing

  • Certified robustness methods include deterministic bounds and randomized smoothing; CISS instead smooths in latent space, aiming to cover more general NLP attacks without complicated attack-customized noise distributions.The passage contrasts IBP-style interval propagation with randomized smoothing and token- or substitution-based NLP smoothing.Source: §5 · p. 8

6. Discussion and Conclusion

The paper concludes that CISS offers a causal perspective on model vulnerability and a framework for certified NLP robustness. It reports consistent gains over state-of-the-art methods and identifies broader CV and NLP robustness as future work.

6. Discussion and Conclusion

  • The paper frames model vulnerability through a causal perspective and proposes CISS for certified NLP robustness.Source: §6 · p. 9
  • CISS consistently surpasses state-of-the-art methods by significant margins.Source: §6 · p. 9
  • Future work will explore a more generalized robustness framework spanning CV and NLP.Source: §6 · p. 9

B. Proof of Theorem 3

The proof relates a latent-space distance bound to robust classification under Gaussian smoothing. It then uses containment of transformed adversarial inputs in that bound to establish robustness over the adversarial set.

B. Proof of Theorem 3

C. Theorem for Randomized Smoothing via a Hard Classifier

The theorem certifies the hard classifier built from noisy semantic representations. It guarantees the predicted class within a radius determined by the noise scale and class probability.

C. Theorem for Randomized Smoothing via a Hard Classifier

  • The hard classifier uses the base model’s hard prediction on the encoded input with added noise, making the certification hypothesis test easier to implement.The encoder maps inputs into a semantic space, and the noise is Gaussian with covariance σ^2I.Source: C. Theorem for Randomized Smoothing… · p. 12
  • The certification procedure bases its test on the hard prediction of f rather than its soft output.The passage identifies this choice as making the hypothesis test easier to implement.Source: C. Theorem for Randomized Smoothing… · p. 12
  • The theorem guarantees output y for every perturbed input when the perturbation radius is at most R = σ(Φ^-1(pA)).Φ^-1 is the inverse standard Gaussian c.d.f.Source: C. Theorem for Randomized Smoothing… · p. 12

D. Proof of Remark 3

The proof of Remark 3 uses a classification objective with a robustness penalty. The accompanying certification details specify a binomial test and a one-sided lower confidence bound.

D. Proof of Remark 3

  • The proof of Remark 3 follows Zhai et al. (2020) under the condition γ ≥ 1 and presents a loss combining classification and robustness terms.The displayed objective weights the robustness term by γ.Source: D. Proof of Remark 3 · p. 13

E. Details of PvalueBinom and LowerConfBound

F. Trade off between significance criterion α and sampling number t2

Certification sampling trades runtime against the significance criterion. The lower-sample ablation is reported to achieve similar certification robustness to the main setting.

F. Trade off between significance criterion α and sampling number t2

  • The main certification setting uses t2 = 30000 and α = 0.001, requiring around 12 hours on a Tesla V100 for the 25,000-example IMDB test set.The passage notes that this setting can obtain a p-value below the significance criterion.Source: F. Trade off between significance… · p. 13
  • The authors state that the p-value of a statistical test is strongly correlated with the sample number.The ablation reduces t2 to 300 to improve certification efficiency and adjusts α to 0.05.Source: F. Trade off between significance… · p. 13
  • The t2 = 300, α = 0.05 ablation achieves similar certification robustness to the main t2 = 30000, α = 0.001 setting.The comparison is presented in Table 7.Source: Table 7 · p. 13, F. Trade off between significance… · p. 13
Loading 2205.12331v3…