Evaluating and Enhancing the Robustness of Neural Network-based Dependency Parsing Models with Adversarial Examples

What it is about

The authors ask whether a neural graph parser (the Dozat and Manning biaffine model) can be fooled by an edit that keeps the syntax of the sentence. They replace a few words of a Penn Treebank sentence with words of the same part of speech, chosen with BERT, so that the gold tree stays the same. A sentence-level attack counts any new error, and a phrase-level attack checks whether a change in one subtree breaks another. In the white-box setting, up to 77% of test sentences admit a perturbation that changes the parse when up to 15% of the words are replaced. For the word-based model the UAS falls from 95.52 to 80.35 under the white-box attack. Adding adversarial sentences to half of the training data raises the black-box attack accuracy of that model from 88.69 to 90.03, with clean accuracy almost unchanged (95.52 to 95.59). Prepositional, verbal and adverbial phrases are the most vulnerable. Human judges found that 75% to 80% of the perturbed sentences kept their syntax.

Ideas

• I1. A deterministic perturbation test for en parse-eval: for each school sentence, replace one word by a same-tag word from the lexicon (en/src/dict.rs), keeping the rest. The parse should stay the same. Report the share of sentences that change, and run it twice to check that it is identical.
• I2. Negative control for I1: replace a function word (a preposition or a conjunction) with another one. Those changes should alter the tree; if they do not, the test is not measuring anything.
• I3. Per-tag sensitivity table, like the paper's Table 3: count the attachment errors per replaced tag (adjective, noun, adverb, verb, preposition), and use the table to decide where lexicon entries need more careful tags.
• I4. Augmentation without a neural candidate generator: add to the perceptron training data the same-tag substitutions of the training lessons, and measure clean accuracy and perturbed accuracy, both on held-out lessons. The paper's result is that the clean score must not drop.
• I5. Phrase-level invariance in prag: change the content of one clause and check that answers about another clause do not change. This is the same test as the phrase-level attack, applied to the world model.

For Mova

Robustness and lexical substitution: 10. Word classes (same-class substitution), 19. The lexicon: vocabulary, multiword expressions and register (lexicon entries and their tags), 27. Negation (function words that must change the tree). Code: en/src/dict.rs (substitutes), en/src/parse.rs (perceptron training with augmented data), en parse-eval (clean and perturbed UAS), world/src/knowledge.rs for the clause-invariance check. Measure: UAS on clean and perturbed held-out lessons, the change share, and the per-tag table. The BERT candidate generator is not used; Mova takes the method and the lexicon instead.

Topics: Dependency parsing

Cite

The paper itself, not this card. BibTeX from the library's record of the work. DOI 10.18653/v1/2020.acl-main.590

@inproceedings{zheng2020evaluating,
  title = {{Evaluating and Enhancing the Robustness of Neural Network-based Dependency Parsing Models with Adversarial Examples}},
  author = {Zheng, Xiaoqing and Zeng, Jiehang and Zhou, Yi and Hsieh, Cho-Jui and Cheng, Minhao and Huang, Xuanjing},
  booktitle = {Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics},
  year = {2020},
  doi = {10.18653/v1/2020.acl-main.590},
  url = {https://doi.org/10.18653/v1/2020.acl-main.590}
}

References

40 references, 8 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, and Kai-Wei Chang. 2018. Generating natural language adversarial examples. In Proceedings of the Conference on Empirical Methods in Natural Language Processing. find
2. Samuel Barham and Soheil Feizi. 2019. Interpretable adversarial training for text. Computing Research Repository, arXiv: 1905.12864. ↗
3. Sabine Buchholz and Erwin Marsi. 2006. CoNLL-X shared task on multilingual dependency parsing. In Proceedings of the International Conference on Computational Natural Language Learning. find our card
4. Nicholas Carlini and David Wagner. 2017. Towards evaluating the robustness of neural networks. In Proceedings of the IEEE Symposium on Security and Privacy. find
5. Minhao Cheng, Wei Wei, and Cho-Jui Hsieh. 2019. Evaluating and enhancing the robustness of dialogue systems: A case study on a negotiation agent. In Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies. find
6. Minhao Cheng, Jinfeng Yi, Huan Zhang, Pin-Yu Chen, and Cho-Jui Hsieh. 2018. Seq2Sick: Evaluating the robustness of sequence-to-sequence models with adversarial examples. Computing Research Repository, arXiv: 1803.01128. ↗
7. Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies. find
8. Timothy Dozat and Christopher D. Manning. 2017. Deep biaffine attention for neural dependency parsing. In Proceedings of the International Conference on Learning Representations. find our card
9. Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018. HotFlip: White-box adversarial examples for text classification. In Proceedings of the Annual Meeting of the Association for Computational Linguistics. find
10. Steffen Eger, Gozde Gul Sahin, Andreas Rucklé, Ji-Ung Lee, Claudia Schulz, Mohsen Mesgar, Krishnkant Swarnkar, Edwin Simpson, and Iryna Gurevych. 2019. Text processing like humans do: Visually attacking and shielding NLP systems. In Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies. find
11. Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. 2018. Robust physical-world attacks on deep learning models. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. find
12. Ji Gao, Jack Lanchantin, Mary Lou Soffa, and Yanjun Qi. 2018. Black-box generation of adversarial text sequences to evade deep learning classifiers. Computing Research Repository, arXiv: 1801.04354. ↗
13. Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and harnessing adversarial examples. In Proceedings of the International Conference on Learning Representations. find
14. Homa B. Hashemi and Rebecca Hwa. 2016. An evaluation of parser robustness for ungrammatical sentences. In Proceedings of the Conference on Empirical Methods in Natural Language Processing. find our card
15. Yu-Lun Hsieh, Minhao Cheng, Da-Cheng Juan, Wei Wei, Wen-Lian Hsu, and Cho-Jui Hsieh. 2019. On the robustness of self-attentive models. In Proceedings of the Annual Meeting of the Association for Computational Linguistics. find
16. Robin Jia and Percy Liang. 2017. Adversarial examples for evaluating reading comprehension systems. In Proceedings of the Conference on Empirical Methods in Natural Language Processing. find our card
17. Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2019. Is BERT really robust? a strong baseline for natural language attack on text classification and entailment. Computing Research Repository, arXiv: 1907.11932. ↗
18. Eliyahu Kiperwasser and Yoav Goldberg. 2016. Simple and accurate dependency parsing using bidirectional LSTM feature representations. Transactions of the Association for Computational Linguistics, 4:313–327. find our card
19. Volodymyr Kuleshov, Shantanu Thakoor, Tingfung Lau, and Stefano Ermon. 2018. Adversarial examples for natural language classification problems. OpenReview Submission, id: r1QZ3zbAZ. find
20. Qi Lei, Lingfei Wu, Pin-Yu Chen, Alexandros G. Dimakis, Inderjit S. Dhillon, and Michael Witbrock. 2019. Discrete adversarial attacks and submodular optimization with applications to text classification. In Proceedings of the Conference on Systems and Machine Learning. find
21. Bin Liang, Hongcheng Li, Miaoqiang Su, Pan Bian, Xirong Li, and Wenchang Shi. 2018. Deep text classification can be fooled. In Proceedings of the International Joint Conference on Artificial Intelligence. find
22. Marie-Catherine de Marneffe, Bill MacCartney, and Christopher D. Manning. 2006. Generating typed dependency parses from phrase structure parses. In Proceedings of the International Conference on Language Resources and Evaluation. find our card
23. Ryan McDonald, Koby Crammer, and Fernando Pereira. 2005. Online large-margin training of dependency parsers. In Proceedings of the Annual Meeting of the Association for Computational Linguistics. find our card
24. Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. 2016. DeepFool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. find
25. Dominick Ng and James R. Curran. 2015. Identifying cascading errors using constraints in dependency parsing. In Proceedings of the Annual Meeting of the Association for Computational Linguistics and the International Joint Conference on Natural Language Processing. find our card
26. Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z. Berkay Celik, and Ananthram Swami. 2016a. The limitations of deep learning in adversarial settings. In Proceedings of the IEEE European Symposium on Security and Privacy. find
27. Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. 2016b. Distillation as a defense to adversarial perturbations against deep neural networks. In Proceedings of the IEEE Symposium on Security and Privacy. find
28. Jeffrey Pennington, Richard Socher, and Christopher Manning. 2014. GloVe: Global vectors for word representation. In Proceedings of the Conference on Empirical Methods in Natural Language Processing. find
29. Wenqi Wang, Lina Wang, Benxiao Tang, Run Wang, and Aoshuang Ye. 2019. A survey: Towards a robust deep neural network in text domain. Computing Research Repository, arXiv: 1902.07285. ↗
30. Catherine Wong. 2017. DANCin SEQ2SEQ: Fooling text classifiers with adversarial text example generation. Computing Research Repository, arXiv: 1712.05419. ↗
31. Han Xu, Yao Ma, Haochen Liu, Debayan Deb, Hui Liu, Jiliang Tang, and Anil K. Jain. 2019. Adversarial attacks and defenses in images, graphs and text: A review. Computing Research Repository, arXiv: 1909.08072. ↗
32. Puyudi Yang, Jianbo Chen, Cho-Jui Hsieh, Jane-Ling Wang, and Michael I. Jordan. 2018. Greedy attack and gumbel attack: Generating adversarial examples for discrete data. Computing Research Repository, arXiv: 1805.12316. ↗
33. Xiaoyong Yuan, Pan He, Qile Zhu, and Xiaolin Li. 2019. Adversarial examples: Attacks and defenses for deep learning. IEEE transactions on neural networks and learning systems, 30(9):2805–2824. find
34. Yuan Zang, Chenghao Yang, Fanchao Qi, Zhiyuan Liu, Meng Zhang, Qun Liu, and Maosong Sun. 2019. Textual adversarial attack as combinatorial optimization. Computing Research Repository, arXiv: 1910.12196. ↗
35. Zhengli Zhao, Dheeru Dua, and Sameer Singh. 2018. Generating natural adversarial examples. In Proceedings of the International Conference on Learning Representations. find
36. Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. 2018. Semantically equivalent adversarial rules for debugging NLP models. In Proceedings of the Annual Meeting of the Association for Computational Linguistics. find
37. Suranjana Samanta and Sameep Mehta. 2017. Towards crafting text adversarial samples. Computing Research Repository, arXiv: 1707.02812. ↗
38. Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2013. Intriguing properties of neural networks. Computing Research Repository, arXiv: 1312.6199. ↗
39. Kristina Toutanova, Dan Klein, Christopher D. Manning, and Yoram Singer. 2003. Feature-rich part-of-speech tagging with a cyclic dependency network. In Proceedings of the Annual Conference of the North American Chapter of the Association for Computational Linguistics. find
40. Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. 2019. Universal adversarial triggers for attacking and analyzing NLP. In Proceedings of the Conference on Empirical Methods in Natural Language Processing and the International Joint Conference on Natural Language Processing. find

This page in Markdown → https://md.mova.elamur.ai/free/en/docs/papers/zheng-2020-evaluating-enhancing-robustness-neural-network/