TextDefense: Adversarial Text Detection based on Word Importance Entropy

1 Introduction

• NLP defenses remain fragmented because detection methods target specific attacks, adversarial training lacks guaranteed broad robustness, and certification requires heavy computation.Existing methods can also impose longer computation time or larger memory requirements than the NLP model itself.Source: §1 · pp. 1–2
• TextDefense exploits the shared pattern that attacks disrupt the importance distribution of words by repeatedly modifying semantically important words.Modified words lose importance while other words gain importance as the target-label confidence declines.Source: §1 · p. 2
• TextDefense estimates word-importance entropy from sampled words and labels an input adversarial when its entropy exceeds a threshold selected to maximize F1.Clean texts generally have lower-scale importance distributions, whereas adversarial texts show higher scales associated with contextual misunderstanding.Source: §1 · p. 2
• TextDefense detects adversarial examples across two model structures, multiple datasets, tasks, and attack types, outperforming three specialized detection methods.The evaluation also includes transfer attacks and shifted data samples, and links performance to the target model’s generalizability.Source: §1 · p. 2
• TextDefense uses the target model directly, avoiding an auxiliary detection or restoration model and requiring no prior attack knowledge.This design is intended to generalize beyond known attack patterns.Source: §1 · p. 2
• Under adaptive attacks, TextDefense lowers attack success rates and increases the number of perturbed words needed for a successful attack.The paper compares this robustness with state-of-the-art adversarial training methods.Source: §1 · p. 2

2.1 Adversarial Attack in NLP

• Character-level attacks perturb characters, whereas word-level attacks replace words and sentence-level attacks transform or insert semantically equivalent sentences.DeepWordBug, TextFooler, PWWS, and TextBugger exemplify these attack strategies.Source: §2.1 · p. 3
• NLP adversarial attacks are classified as character-level, word-level, or sentence-level, with word-level synonym substitutions among the most difficult to defend.Attacks can operate in white-box or black-box settings while using fewer queries and maintaining higher semantic similarity.Source: §2.1 · p. 3

2.2 Defense Methods

• Existing defenses are grouped into detection/restoration, adversarial training, and robustness certification.These families differ in whether they detect or restore perturbations, retrain models, or compute robustness bounds.Source: §2.2 · p. 3
• Detection and restoration methods are attack-specific: DISP handles misspellings but struggles with synonym substitutions, while FGWS favors rare-word substitutions and fails on character-level attacks.TextShield additionally requires prior knowledge of possible attack types to train its restoration model.Source: §2.2 · p. 3
• Adversarial training improves tolerance but depends on attack diversity and remains vulnerable to perturbations that its training does not capture.DNE targets synonym substitution, while A2T provides a cheaper synonym-based training framework.Source: §2.2 · p. 3
• Robustness certification provides theoretical bounds but can require substantial computation, and randomized smoothing is ill-suited to discrete NLP inputs.POPQORN and abstract-interpretation methods reduce or quantify bounds but remain computationally challenging.Source: §2.2 · p. 3

3.1 Problem Definition and Threat Model

• TextDefense defines adversarial detection as distinguishing clean inputs from texts that cause the target model to predict an incorrect label.The attacker may operate in either black-box or white-box settings, while the defense uses the protected model’s own importance-score distribution.Source: §3.1 · pp. 3–4

3.2 Design Intuition

• Attack algorithms first rank vulnerable words and iteratively modify them, amplifying the model’s attention to irrelevant information.Character-level attacks can create unknown tokens, while word-level attacks can introduce complex or neutral words that alter how the model interprets context.Source: §3.2 · p. 4
• Clean texts generally have low-scale importance distributions, whereas adversarial texts assign high importance to many relevant and irrelevant words.Clean examples may distribute importance across multiple task-related words or concentrate it on a few coherent keywords; adversarial examples are more coupled to irrelevant words.Source: §3.2 · p. 4
• Importance-score entropy is near zero for clean texts but large and diverse for adversarial texts, reflecting lower coherence in the latter.TextDefense uses this discrepancy as its detection signal.Source: §3.2 · pp. 4–5

3.3 Defense Method

• The defense computes deletion-based word importance scores from the target-label confidence and aggregates their absolute values with entropy.For word wi, si measures the target-label confidence change after deleting wi; positive values support the target label, while negative values favor other labels.Source: §3.3 · p. 5
• A threshold maximizing F1 on several local adversarial examples separates adversarial from clean texts, while random sampling can reduce the cost of scoring words.The authors report that attack method and the number of local adversarial examples do not affect threshold choice, and that sampled words can approximate the full entropy value.Source: §3.3 · p. 5

4.1 Models

• The study evaluates TextDefense with BERT and a bidirectional LSTM, covering transformer- and recurrent-model architectures.BERT uses an uncased base model, while the LSTM has one bidirectional layer and a 150-dimensional hidden state.Source: §4.1 · p. 5

4.2 Datasets

• Experiments cover five binary-classification datasets and two multi-class datasets spanning sentiment, toxicity, emotion, and news topics.The binary datasets are Amazon, Yelp, IMDb, Twitter, and Jigsaw; the multi-class datasets are Emotion and AG News.Source: §4.2 · pp. 5–6

4.3 Metrics

• The evaluation reports attack success rate, detection AUC, perturbed-word percentage, semantic similarity, and linguistic acceptability.Semantic similarity uses cosine similarity between sentence-encoder representations, while linguistic acceptability estimates grammatical quality with a CoLA-trained classifier.Source: §4.3 · p. 6

4.4 Attack Method

• The attack evaluation emphasizes three untargeted minimal-perturbation word-level attacks and includes TextBugger to represent character-level attacks.TextFooler and PWWS substitute important words, whereas TextBugger combines character- and word-level modifications.Source: §4.4 · p. 6

4.5 Baseline Defense Method

• TextDefense is compared with DISP, FGWS, and TextShield, three state-of-the-art adversarial-example detection or restoration methods.These baselines respectively use perturbation restoration, frequency-based synonym replacement, or neural machine translation before thresholding prediction-score changes.Source: §4.5 · pp. 6–7

5.1 Detection Performance

• TextDefense achieves high AUC across datasets, models, and attack methods, including multi-class classification, although performance is weaker on some datasets and models.Amazon reaches an average AUC of 0.9698, while the LSTM model on IMDb reaches 0.8142; performance is also weaker on Emotion than AgNews.Source: §5.1 · p. 7

5.2 Method Comparison

• TextDefense outperforms FGWS, DISP, and TextShield while detecting both character-level and word-level attacks without relying on attack-specific knowledge.FGWS is limited on character-level attacks, DISP struggles with synonym substitutions, and TextShield fails to transfer to unknown attacks while requiring an inefficient translation model.Source: §5.2 · pp. 7–8, Table 1 · p. 8

5.3 Evaluation of Transferability

• Under dataset shift, TextDefense maintains high AUC, including 0.9436 when an Amazon-trained model predicts Yelp data.The method also detects transferred adversarial examples, although transferability and detection performance vary with the source dataset and target model.Source: Table 2 · p. 8, §5.3 · p. 9, Table 3 · p. 9

5.4 Influence of the Model Generalizability

• Higher target-model generalizability is associated with better TextDefense performance, while more training data can simultaneously increase attack success rates.On Yelp, increasing training samples from 500 to 500k raises clean accuracy from 91.20% to 97.60% and average AUC from 0.9378 to 0.9725; average ASR also rises from 83.26% to 94.67%.Source: §5.4 · pp. 9–11, Figure 5 · p. 10

5.5 Evaluation on Different Models

• TextDefense performs well across RoBERTa, DeBERTa, ALBERT, and BART, with its best performance on the more robust DeBERTa model.BART’s strong performance indicates applicability beyond BERT-variant architectures.Source: §5.5 · p. 11, Table 4 · p. 11

5.6 Online NLP Classifier

• TextDefense detects character-level and word-level attacks against online NLP classifiers, supporting integration with machine-learning-as-a-service systems.It remains effective despite unknown training data for NLPTown and lower classifier accuracy for Symanto, though performance is somewhat weaker for Symanto.Source: §5.6 · p. 11, Table 5 · p. 11

6.1 Adaptive Attack and Comparison with Adversarial Training

• 75% empirical robustness is achieved at threshold 0.04, while threshold 0.07 yields 45% robustness with TPR 0.95 and FPR 0.09.At threshold 0.04, TPR is 1.00 and FPR is 0.17; all locally generated adversarial examples are detected.Source: §6.1 · pp. 11–12, Table 6 · p. 12
• TextDefense’s protection level trades off against false positives: threshold 0.04 favors stronger protection, whereas 0.07 favors a lower false-positive rate.The reported thresholds produce different attack success rates and empirical robustness levels.Source: §6.1 · p. 12
• The average adaptive-attack success rate against TextDefense is 53.18%, lower than for the compared adversarially trained models.The protected model also requires substantially more perturbed words, indicating stronger resistance to adaptive attacks.Source: §6.1 · p. 12, Table 7 · p. 12

6.2 Robustness against Adversarial Examples with High Confidence

• As the target score decreases, attack success rate, TextDefense AUC, and linguistic acceptability decrease while the percentage of perturbed words increases.This pattern is reported across TextBugger, TextFooler, and PWWS.Source: §6.2 · p. 12
• At target score 0.02, TextDefense’s average AUC falls to 0.6449, while TextBugger’s attack success rate falls to 30.10% with 41% of words perturbed.TextBugger acceptability also falls from 0.4601 to 0.2215, making these examples less imperceptible.Source: §6.2 · p. 12
• TextFooler and PWWS retain relatively high attack success rates under high-confidence attacks, suggesting that stronger versions may bypass TextDefense.The authors defer the empirical study of this possibility to Appendix G.2.Source: §6.2 · p. 12

7.1 Relationship with Randomized Smoothing

• TextDefense perturbs words, whereas randomized smoothing perturbs vector representations with Gaussian noise and requires many model evaluations.The paper argues that vector-space perturbations may not correspond to physically meaningful text, making certified radii unrealistic for NLP.Source: §7.1 · pp. 12–13, Table 8 · p. 13
• Randomized smoothing provides certified robustness for a smoothed classifier but does not prevent successful attacks by stronger attack algorithms.The discussion also notes that constructing the smoothed classifier requires heavy computational resources.Source: §7.1 · p. 13

7.2 Challenges

• TextDefense requires multiple target-model queries; with a sample size of two, it queries the model three times and may burden very large deployed models.The authors recommend a small surrogate model when resource consumption is problematic.Source: §7.2 · p. 13

7.3 Limitations

• Some false negatives arise when attacks change toxic and non-toxic words so that the generated text’s true label should be reversed.The paper gives PWWS examples in which toxic words become non-toxic or non-toxic words become toxic.Source: §7.3 · p. 13

8 Conclusion

• TextDefense is presented as a universal NLP adversarial-example detection framework that uses the target model’s comprehensibility, expressed through information entropy.The evaluation covers five datasets and multiple attack methods.Source: §8 · p. 13
• The evaluation reports high-AUC detection, robustness across circumstances, and performance exceeding state-of-the-art detection and adversarial-training methods.These are the paper’s stated overall conclusions rather than a single dataset-specific result.Source: §8 · p. 13

A.1 Gradient Method

• Replacing WIR-based importance with word gradients produces much worse TextDefense AUC, indicating that gradients do not capture the words’ real importance for this detector.The authors speculate that word correlations, a smooth loss surface, local extrema, or method mismatch may explain the gap.Source: §A.1 · p. 16, Table 9 · p. 16

A.2 Sampling Method

• Sampling 20 or 50 words matches using all words on Twitter, showing that full-text scoring is unnecessary in that dataset.AUC increases with sample size across datasets, but the overall trend is not significant.Source: §A.2 · p. 16
• 0.03 AUC separates sampling all words from sampling two words on Amazon, while gains become minor after sampling 10 words.Amazon AUC rises from 0.9439 with two sampled words to 0.9647 with 10 and 0.9744 with all words.Source: §A.2 · p. 16
• Sampling reduces computation overhead while keeping TextDefense’s performance unchanged.The method calculates importance scores for only a portion of the input words.Source: §A.2 · p. 16

A.3 Scoring Metric

• 0.9754 average AUC makes entropy the best of nine scoring metrics, while quartile deviation reaches 0.9718.Quartile deviation is only 0.0036 lower than entropy.Source: §A.3 · p. 17

• 0.04 to 0.06 is the threshold range where TextDefense performs best across attack methods.The local attack method does not affect threshold determination, so a value in this range can be selected directly.Source: B Influence of Attack Method on the… · p. 17

C Influence of the Number of Local Samples on the Determination of the threshold

• 0.04 to 0.06 remains the best threshold range regardless of the number of local clean and adversarial samples.The number of local samples does not affect threshold determination.Source: C Influence of the Number of Local… · p. 17

D Trade-off between TPR and FPR

• 95% TPR is achievable at approximately 0.1 FPR in one dataset with threshold 0.06, while another reaches 90% TPR at approximately 0.15 FPR.These operating points are reported from the ROC curves in Fig. 7.Source: D Trade-off between TPR and FPR · p. 17
• 0.83 average TPR and 0.22 average FPR are obtained on Jigsaw at threshold 0.07.Twitter uses threshold 0.07 and reports attack-specific TPR/FPR values; PWWS performs below expectation because it generates low-quality adversarial examples.Source: D Trade-off between TPR and FPR · p. 17

E Performance of TextDefense and TextShield on Other Adversarial Attack Methods

• TextDefense achieves high AUC across different attack methods, whereas TextShield detects only DeepWordBug and Kuleshov et al. examples effectively.TextShield performs poorly on BERT-Attack, BAE, and IGA because its performance depends on NMT training-sample diversity.Source: E Performance of TextDefense and… · p. 17, Table 13 · p. 18

F Run-time and Extra Storage Comparison

• The reported comparison measures average runtime per sample and extra storage: FGWS takes 3.9s and requires 78GB, while TextShield takes 1.888s and T5 requires 242MB.Source: F Run-time and Extra Storage Comparison · p. 18
• 27.2ms per sample with 10 sampled words is faster than DISP, while two sampled words reduce runtime to 7.4ms.These results are reported for Amazon and Yelp.Source: F Run-time and Extra Storage Comparison · p. 18, Table 15 · p. 18

G Worst-case Analysis

• The worst-case trade-off between true-positive and false-positive rates is summarized across five datasets.Figure 7 presents the TPR–FPR trade-off, while the accompanying analysis focuses on dataset- and attack-specific failure cases.Source: G Worst-case Analysis · pp. 18–19, Figure 7 · p. 19

G.1 Twitter/Jigsaw

• TextDefense degrades on Twitter and Jigsaw because synonym substitutions can remove abusiveness by changing the sentence meaning, while character-level attacks may require spelling-checker defenses.The analyzed examples show abusive words replaced by unknown tokens or neutral synonyms before the model prediction changes.Source: §G.1 · p. 19

G.2 TextFooler/PWWS

• TextFooler and PWWS achieve high attack success with fewer perturbed words, but many generated texts change the original meaning and therefore no longer satisfy the definition of adversarial examples.The analysis reports emotionally positive words replaced with neutral or negative terms, producing semantically altered predictions.Source: §G.2 · p. 20

H The Distribution of Perturbations Identified by DISP

• The percentage of perturbed words is insufficient for detection because adversarial examples have larger, more scattered values that still heavily overlap with clean examples.This comparison is presented in Figure 8.Source: H The Distribution of Perturbations… · p. 20, Figure 8 · p. 20

I The Adversarial Attack Rules under PWWS

• PWWS false negatives arise when toxic or sentiment-bearing words are replaced with words whose task-relevant cues differ, including neutral substitutions and undetected polarity reversals.The reported Jigsaw and IMDb examples show toxic words replaced by non-toxic words and sentiment words replaced by neutral or opposite-valence words.Source: I The Adversarial Attack Rules under… · p. 20, Table 18 · p. 21, Table 19 · p. 21