Recently, few certified defense methods have been developed to provably guarantee the robustness of a text classifier to adversarial synonym substitutions. However, all existing certified defense methods assume that the defenders are informed of how the adversaries generate synonyms, which is not a realistic scenario. In this paper, we propose a certifiably robust defense method by randomly masking a certain proportion of the words in an input text, in which the above unrealistic assumption is no longer necessary. The proposed method can defend against not only word substitution-based attacks, but also character-level perturbations. We can certify the classifications of over 50% texts to be robust to any perturbation of 5 words on AGNEWS, and 2 words on SST2 dataset. The experimental results show that our randomized smoothing method significantly outperforms recently proposed defense methods across multiple datasets.
@article{arxiv.2105.03743,
title = {Certified Robustness to Text Adversarial Attacks by Randomized [MASK]},
author = {Jiehang Zeng and Xiaoqing Zheng and Jianhan Xu and Linyang Li and Liping Yuan and Xuanjing Huang},
journal= {arXiv preprint arXiv:2105.03743},
year = {2021}
}