论文标题
文本对抗纯化作为对抗攻击的防御
Text Adversarial Purification as Defense against Adversarial Attacks
论文作者
论文摘要
对抗性净化是针对对抗攻击的成功防御机制，而无需了解进攻的形式。通常，对抗纯化旨在消除对抗性扰动，因此可以根据恢复的干净样品做出正确的预测。尽管在计算机视野中取得了对抗性纯化的成功，该电视视野结合了生成模型，例如基于能量的模型和扩散模型，但很少探索纯化作为针对文本对抗攻击的防御策略。在这项工作中，我们介绍了一种新颖的对抗性纯化方法，该方法着重于捍卫文本对抗攻击。在语言模型的帮助下，我们可以通过掩盖输入文本并根据蒙版语言模型重建被掩盖的文本来注入噪声。通过这种方式，我们为文本模型构建了一个对抗性纯化过程，以针对最广泛使用的单词固定性对抗性攻击。我们在包括文本媒介和伯特攻击在内的几种强大的对抗攻击方法上测试了我们提出的对抗纯化方法，实验结果表明，纯化算法可以成功地防止强烈的单词 - 替代攻击。
Adversarial purification is a successful defense mechanism against adversarial attacks without requiring knowledge of the form of the incoming attack. Generally, adversarial purification aims to remove the adversarial perturbations therefore can make correct predictions based on the recovered clean samples. Despite the success of adversarial purification in the computer vision field that incorporates generative models such as energy-based models and diffusion models, using purification as a defense strategy against textual adversarial attacks is rarely explored. In this work, we introduce a novel adversarial purification method that focuses on defending against textual adversarial attacks. With the help of language models, we can inject noise by masking input texts and reconstructing the masked texts based on the masked language models. In this way, we construct an adversarial purification process for textual models against the most widely used word-substitution adversarial attacks. We test our proposed adversarial purification method on several strong adversarial attack methods including Textfooler and BERT-Attack and experimental results indicate that the purification algorithm can successfully defend against strong word-substitution attacks.
