Certified Robustness to Adversarial Word Substitutions

Understand

State-of-the-art NLP models can often be fooled by adversaries that apply seemingly innocuous label-preserving transformations (e.g., paraphrasing) to input text.

• The number of possible transformations scales exponentially with text length, so data augmentation cannot cover all transformations of an input.
• This paper considers one exponentially large family of label-preserving transformations, in which every word in the input can be replaced with a similar word.
• We train the first models that are provably robust to all word substitutions in this family.