The Best Defense is Attack: Repairing Semantics in Textual Adversarial Examples

Heng Yang, Ke Li

Primary Area: unsupervised, self-supervised, semi-supervised, and supervised representation learning

Code Of Ethics: I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics.

Keywords: textual adversarial detection, textual adversarial defense, perturbation defocusing

Submission Guidelines: I certify that this submission complies with the submission instructions as described on https://iclr.cc/Conferences/2024/AuthorGuide.

TL;DR: This paper introduces a novel and effective method to detect and defend against textual adversarial attack

Abstract: Recent studies have revealed the vulnerability of pre-trained language models to adversarial attacks. Existing adversarial defense techniques attempt to reconstruct adversarial examples within feature or text spaces. However, these methods struggle to effectively repair the semantics in adversarial examples, resulting in unsatisfactory performance and limiting their practical utility. To repair the semantics in adversarial examples, we introduce a novel approach named Reactive Perturbation Defocusing (Rapid). Rapid employs an adversarial detector to identify pseudo-labels for adversarial examples and leverage adversarial attackers to repair the semantics in adversarial examples by adversarial attacks. Our extensive experimental results, conducted on four public datasets, spanning various adversarial attack scenarios, convincingly demonstrate the effectiveness of Rapid. To address the problem of defense performance validation in previous works, we provide a demonstration of adversarial detection and repair based on our work, which can be easily evaluated at this page: https://tinyurl.com/22ercuf8.

Anonymous Url: I certify that there is no URL (e.g., github page) that could be used to find authors' identity.

No Acknowledgement Section: I certify that there is no acknowledgement section in this submission for double blind review.

Submission Number: 1263