通过重写文本特征，统一防御NLP模型的对抗与后门攻击
Reformulation is All You Need: Addressing Malicious Text Features in DNNs
- 用文本重写模块识别并消除恶意特征
- 在多种攻击下保持90%以上准确率
- 适合需要强鲁棒性的NLP系统部署
人类语言包含大量复杂且多样的隐含特征，攻击者可利用这些特征发起对抗性或后门攻击，危害NLP任务中的深度神经网络（DNN）模型。现有面向模型的防御方法随模型规模增大而计算开销剧增，而面向样本的防御通常仅针对特定攻击方式，易被适应性攻击绕过。我们观察到，对抗与后门攻击的根本原因在于DNN模型的编码过程：对于人类无感的细微文本特征，模型错误地赋予其过高权重。基于此，我们提出一种统一且自适应的防御框架，能有效抵御两类攻击。该方法通过引入重写模块，在保留原始语义完整性的前提下，处理输入文本中潜在的恶意特征。大量实验表明，该框架在多种恶意文本特征场景下均优于现有样本级防御基线。
原文摘要 · Abstract (English)
Human language encompasses a wide range of intricate and diverse implicit features, which attackers can exploit to launch adversarial or backdoor attacks, compromising DNN models for NLP tasks. Existing model-oriented defenses often require substantial computational resources as model size increases, whereas sample-oriented defenses typically focus on specific attack vectors or schemes, rendering them vulnerable to adaptive attacks. We observe that the root cause of both adversarial and backdoor attacks lies in the encoding process of DNN models, where subtle textual features, negligible for human comprehension, are erroneously assigned significant weight by less robust or trojaned models. Based on it we propose a unified and adaptive defense framework that is effective against both adversarial and backdoor attacks. Our approach leverages reformulation modules to address potential malicious features in textual inputs while preserving the original semantic integrity. Extensive experiments demonstrate that our framework outperforms existing sample-oriented defense baselines across a diverse range of malicious textual features.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。