首度实现文本分类器在编辑距离下的快速可认证鲁棒性验证。
Certified Robustness Under Bounded Levenshtein Distance
- 基于卷积分类器的莱文斯坦距离利普希茨常数估计，构建1-利普希茨模型。
- 在AG-News数据集上，距离1和2时分别达38.80%和13.93%验证准确率。
- 验证速度比现有方法快4个数量级，适合实际部署场景。
文本分类器易受微小扰动影响，若扰动为对抗性选择，可能导致输出剧烈变化。现有验证方法虽能提供鲁棒性证书，但计算成本过高，难以处理莱文斯坦距离约束。本文提出首个针对卷积分类器在莱文斯坦距离下的利普希茨常数计算方法，并据此训练1-利普希茨分类器。该方法可在单次前向传播中完成分类器的认证半径计算。实验表明，LipsLev在AG-News数据集上于距离1和距离2时分别获得38.80%和13.93%的验证准确率，且速度比现有方法快4个数量级。本工作有望推动文本领域更高效的验证技术发展。
原文摘要 · Abstract (English)
Text classifiers suffer from small perturbations, that if chosen adversarially, can dramatically change the output of the model. Verification methods can provide robustness certificates against such adversarial perturbations, by computing a sound lower bound on the robust accuracy. Nevertheless, existing verification methods incur in prohibitive costs and cannot practically handle Levenshtein distance constraints. We propose the first method for computing the Lipschitz constant of convolutional classifiers with respect to the Levenshtein distance. We use these Lipschitz constant estimates for training 1-Lipschitz classifiers. This enables computing the certified radius of a classifier in a single forward pass. Our method, LipsLev, is able to obtain $38.80$% and $13.93$% verified accuracy at distance $1$ and $2$ respectively in the AG-News dataset, while being $4$ orders of magnitude faster than existing approaches. We believe our work can open the door to more efficient verification in the text domain.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。