Adversarial Training with Fast Gradient Projection Method against Synonym Substitution based Text Attacks
Abstract
Adversarial training is the most empirically successful approach in improving the robustness of deep neural networks for image classification.For text classification, however, existing synonym substitution based adversarial attacks are effective but not efficient to be incorporated into practical text adversarial training. Gradient-based attacks, which are very efficient for images, are hard to be implemented for synonym substitution based text attacks due to the lexical, grammatical and semantic constraints and the discrete text input space. Thereby, we propose a fast text adversarial attack method called Fast Gradient Projection Method (FGPM) based on synonym substitution, which is about 20 times faster than existing text attack methods and could achieve similar attack performance. We then incorporate FGPM with adversarial training and propose a text defense method called Adversarial Training with FGPM enhanced by Logit pairing (ATFL). Experiments show that ATFL could significantly improve the model robustness and block the transferability of adversarial examples.
Cite
@article{arxiv.2008.03709,
title = {Adversarial Training with Fast Gradient Projection Method against Synonym Substitution based Text Attacks},
author = {Xiaosen Wang and Yichen Yang and Yihe Deng and Kun He},
journal= {arXiv preprint arXiv:2008.03709},
year = {2020}
}
Comments
Accepted by AAAI 2021, code is available at https://github.com/JHL-HUST/FGPM