Achieving Verified Robustness to Symbol Substitutions via Interval Bound Propagation

Understand

Neural networks are part of many contemporary NLP systems, yet their empirical successes come at the price of vulnerability to adversarial attacks.

• Previous work has used adversarial training and data augmentation to partially mitigate such brittleness, but these are unlikely to find worst-case adversaries due to the complexity of the search space arising from discrete text perturbations.
• In this work, we approach the problem from the opposite direction: to formally verify a system's robustness against a predefined class of adversarial attacks.
• We study text classification under synonym replacements or character flip perturbations.