English

Learn2Weight: Parameter Adaptation against Similar-domain Adversarial Attacks

Machine Learning 2022-09-21 v2

Abstract

Recent work in black-box adversarial attacks for NLP systems has attracted much attention. Prior black-box attacks assume that attackers can observe output labels from target models based on selected inputs. In this work, inspired by adversarial transferability, we propose a new type of black-box NLP adversarial attack that an attacker can choose a similar domain and transfer the adversarial examples to the target domain and cause poor performance in target model. Based on domain adaptation theory, we then propose a defensive strategy, called Learn2Weight, which trains to predict the weight adjustments for a target model in order to defend against an attack of similar-domain adversarial examples. Using Amazon multi-domain sentiment classification datasets, we empirically show that Learn2Weight is effective against the attack compared to standard black-box defense methods such as adversarial training and defensive distillation. This work contributes to the growing literature on machine learning safety.

Keywords

Cite

@article{arxiv.2205.07315,
  title  = {Learn2Weight: Parameter Adaptation against Similar-domain Adversarial Attacks},
  author = {Siddhartha Datta},
  journal= {arXiv preprint arXiv:2205.07315},
  year   = {2022}
}

Comments

Accepted in COLING 2022

R2 v1 2026-06-24T11:17:50.188Z