Generating high-quality and interpretable adversarial examples in the text domain is a much more daunting task than it is in the image domain. This is due partly to the discrete nature of text, partly to the problem of ensuring that the adversarial examples are still probable and interpretable, and partly to the problem of maintaining label invariance under input perturbations. In order to address some of these challenges, we introduce sparse projected gradient descent (SPGD), a new approach to crafting interpretable adversarial examples for text. SPGD imposes a directional regularization constraint on input perturbations by projecting them onto the directions to nearby word embeddings with highest cosine similarities. This constraint ensures that perturbations move each word embedding in an interpretable direction (i.e., towards another nearby word embedding). Moreover, SPGD imposes a sparsity constraint on perturbations at the sentence level by ignoring word-embedding perturbations whose norms are below a certain threshold. This constraint ensures that our method changes only a few words per sequence, leading to higher quality adversarial examples. Our experiments with the IMDB movie review dataset show that the proposed SPGD method improves adversarial example interpretability and likelihood (evaluated by average per-word perplexity) compared to state-of-the-art methods, while suffering little to no loss in training performance.
In contrast to the fast-gradient methods just described, global gradient methods use the model gradient to perturb a global embedding of the entire example. For instance, @cite_10 uses an adversarially regularized autoencoder ( @cite_30 ) to learn a continuous projection of example sequences; in the adversarial regime, they perturb this global representation, subsequently decoding the perturbed point using an LSTM. @cite_19 employs a similar approach, using syntactically-controlled paraphrase networks (SCPNs) to generate semantically similar, but syntactically divergent adversarial examples from original, ground-truth examples. The point of these sorts of approaches is usually to generate natural" adversarial examples which, unlike those produced by the fast-gradient methods above, may diverge in word order or sentence structure from the original example. Thus, such methods align with ,--- ,and represent an alternate approach to ,--- ,our goal of generating syntactically well-formed and semantically consistent examples in order to improve model regularization. Unfortunately, text autoencoders tend to suffer from high reconstruction error when dealing with very long sequences (such as those in the IMDB corpus, where sequences can range over 2,000 words), and so global gradient methods cannot, in general, be applied to the same datasets.
@cite_30 @cite_19 @cite_10
2773028880 2963126845 2766108848
Deep latent variable models, trained using variational autoencoders or generative adversarial networks, are now a key technique for representation learning of continuous structures. However, applying similar methods to discrete structures, such as text sequences or discretized images, has proven to be more challenging. In this work, we propose a flexible method for training deep latent variable models of discrete structures. Our approach is based on the recently-proposed Wasserstein autoencoder (WAE) which formalizes the adversarial autoencoder (AAE) as an optimal transport problem. We first extend this framework to model discrete sequences, and then further explore different learned priors targeting a controllable representation. This adversarially regularized autoencoder (ARAE) allows us to generate natural textual outputs as well as perform manipulations in the latent space to induce change in the output space. Finally we show that the latent representation can be trained to perform unaligned textual style transfer, giving improvements both in automatic human evaluation compared to existing methods. Due to their complex nature, it is hard to characterize the ways in which machine learning models can misbehave or be exploited when deployed. Recent work on adversarial examples, i.e. inputs with minor perturbations that result in substantially different model predictions, is helpful in evaluating the robustness of these models by exposing the adversarial scenarios where they fail. However, these malicious perturbations are often unnatural, not semantically meaningful, and not applicable to complicated domains such as language. In this paper, we propose a framework to generate natural and legible adversarial examples that lie on the data manifold, by searching in semantic space of dense and continuous data representation, utilizing the recent advances in generative adversarial networks. We present generated adversaries to demonstrate the potential of the proposed approach for black-box classifiers for a wide range of applications such as image classification, textual entailment, and machine translation. We include experiments to show that the generated adversaries are natural, legible to humans, and useful in evaluating and analyzing black-box classifiers.