Achieving Verified Robustness to Symbol Substitutions via Interval Bound Propagation
Not on the map. Why?
Abstract (arXiv)
Neural networks are part of many contemporary NLP systems, yet their empirical successes come at the price of vulnerability to adversarial attacks. Previous work has used adversarial training and data augmentation to partially mitigate such brittleness, but these are unlikely to find worst-case adversaries due to the complexity of the search space arising from discrete text perturbations. In this work, we approach the problem from the opposite direction: to formally verify a system's robustness against a predefined class of adversarial attacks. We study text classification under synonym replacements or character flip perturbations. We propose modeling these input perturbations as a simplex and then using Interval Bound Propagation -- a formal model verification method. We modify the conventional log-likelihood training objective to train models that can be efficiently verified, which would otherwise come with exponential search complexity. The resulting models show only little difference in terms of nominal accuracy, but have much improved verified accuracy under perturbations and come with an efficiently computable formal guarantee on worst case adversaries.
Key facts. Cited by 87 papers in the map (data through 7 Oct 2026). First posted on arXiv 3 Sep 2019.
Builds on
No reference list yet.
Built on by
Citing papers per year: 2021: 24; 2022: 27; 2023: 17; 2024: 5; 2025: 7; 2026: 7.
87 papers.
Sort:
By area:
- 2022Competition-Level Code Generation with AlphaCodecited by 1,427
- 2023Certifying LLM Safety against Adversarial Promptingcited by 248
- 2021Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Modelscited by 227
- 2022Why Should Adversarial Perturbations be Imperceptible? Rethink the Research Paradigm in Adversarial NLPcited by 99
- 2023A Survey of Safety and Trustworthiness of Large Language Models through the Lens of Verification and Validationcited by 91
- 2021Towards Improving Adversarial Training of NLP Modelscited by 79
- 2021Towards Robustness Against Natural Language Word Substitutionscited by 68
- 2021Certified Robustness to Text Adversarial Attacks by Randomized [MASK]cited by 57
- 2021Searching for an Effective Defender: Benchmarking Defense against Adversarial Word Substitutioncited by 55
- 2021On Guaranteed Optimal Robust Explanations for NLP Modelscited by 54
- 2021How Should Pre-Trained Language Models Be Fine-Tuned Towards Adversarial Robustness?cited by 49
- 2021Policy Smoothing for Provably Robust Reinforcement Learningcited by 39
38 more
- 2023Text-CRS: A Generalized Certified Robustness Framework against Textual Adversarial Attackscited by 32
- 2021On the Sensitivity and Stability of Model Interpretations in NLPcited by 30
- 2021Defending Pre-trained Language Models from Adversarial Word Substitutions Without Performance Sacrificecited by 30
- 2023The Trickle-down Impact of Reward (In-)consistency on RLHFcited by 29
- 2021Grey-box Adversarial Attack And Defence For Sentiment Classificationcited by 28
- 2021Achieving Model Robustness through Discrete Adversarial Trainingcited by 23
- 2022Certified Robustness Against Natural Language Attacks by Causal Interventioncited by 23
- 2023Certified Robustness for Large Language Models with Self-Denoisingcited by 23
- 2022A Survey of Adversarial Defences and Robustness in NLPcited by 22
- 2021Improving Zero-Shot Cross-Lingual Transfer Learning via Robust Trainingcited by 21
- 2021Adversarial Training is Not Ready for Robot Learningcited by 20
- 2021Does Robustness Improve Fairness? Approaching Fairness with Word Substitution Robustness Methods for Text Classificationcited by 20
- 2022Textual Manifold-based Defense Against Natural Language Adversarial Examplescited by 19
- 2021Certified Robustness to Programmable Transformations in LSTMscited by 18
- 2021Center Smoothing: Certified Robustness for Networks with Structured Outputscited by 18
- 2022Improving the Adversarial Robustness of NLP Models by Information Bottleneckcited by 17
- 2021The King is Naked: on the Notion of Robustness for Natural Language Processingcited by 16
- 2022On Robust Prefix-Tuning for Text Classificationcited by 15
- 2022Text Adversarial Purification as Defense against Adversarial Attackscited by 15
- 2021Automatic Fairness Testing of Neural Classifiers through Adversarial Samplingcited by 14
- 2023From Robustness to Explainability and Back Againcited by 14
- 2022Robust Textual Embedding against Word-level Adversarial Attackscited by 12
- 2022Adversarial Training for Improving Model Robustness? Look at Both Prediction and Interpretationcited by 12
- 2023Improving the Robustness of Transformer-based Large Language Models with Dynamic Attentioncited by 10
- 2021Double Perturbation: On the Robustness of Robustness and Counterfactual Bias Evaluationcited by 9
- 2021BERT is Robust! A Case Against Synonym-Based Adversarial Examples in Text Classificationcited by 9
- 2022Robust Natural Language Processing: Recent Advances, Challenges, and Future Directionscited by 9
- 2022Impact of Adversarial Training on Robustness and Generalizability of Language Modelscited by 9
- 2023Less is More: Understanding Word-level Textual Adversarial Attack via n-gram Frequency Descendcited by 9
- 2021Detecting Textual Adversarial Examples through Randomized Substitution and Votecited by 8
- 2023TextShield: Beyond Successfully Detecting Adversarial Sentences in Text Classificationcited by 8
- 2023Don't Retrain, Just Rewrite: Countering Adversarial Perturbations by Rewriting Textcited by 8
- 2026Mechanistic Interpretability for Large Language Model Alignment: Progress, Challenges, and Future Directionscited by 8
- 2023ANTONIO: Towards a Systematic Method of Generating NLP Benchmarks for Verificationcited by 6
- 2022Certifying Model Accuracy under Distribution Shiftscited by 5
- 2022Rethinking Textual Adversarial Defense for Pre-trained Language Modelscited by 5
- 2024ProTransformer: Robustify Transformers via Plug-and-Play Paradigmcited by 5
- 2022Identifying Adversarial Attacks on Text Classifierscited by 4
50 most cited of 87 All 87 (JSON)
- 2026SoK: Formal Methods for Fact-Checking and Information Integrity19 Sep 2026
- 2026CAGE: Certified Authorization under Typed-Return Uncertainty for Tool-Using Agents31 Jul 2026
- 2026S-GBT: Smooth Growth Bound Tensor for Certified Robustness Against Word Substitution Attacks in NLP11 Jun 2026
- 2026Small Data, Big Noise: Adversarial Training for Robust Parameter-Efficient Fine-Tuning9 Jun 2026
- 2026When Efficiency Backfires: Cascading LLMs Trigger Cascade Failure under Adversarial Attack17 May 2026
- 2026SpectralGuard: Detecting Memory Collapse Attacks in State Space Models12 Mar 2026
- 2026Mechanistic Interpretability for Large Language Model Alignment: Progress, Challenges, and Future Directions21 Jan 2026
- 2025RobustMask: Certified Robustness against Adversarial Neural Ranking Attack via Randomized Masking29 Dec 2025
- 2025AdaptDel: Adaptable Deletion Rate Randomized Smoothing for Certified Robustness12 Nov 2025
- 2025Reconcile Certified Robustness and Accuracy for DNN-based Smoothed Majority Vote Classifier30 Sep 2025
- 2025Bridging Robustness and Generalization Against Word Substitution Attacks in NLP via the Growth Bound Matrix Approach14 Jul 2025
- 2025Robustness in Both Domains: CLIP Needs a Robust Text Encoder3 Jun 2025
38 more
- 2025Language Models That Walk the Talk: A Framework for Formal Fairness Certificates19 May 2025
- 2025Principal Eigenvalue Regularization for Improved Worst-Class Certified Robustness of Smoothed Classifiers21 Mar 2025
- 2024ProTransformer: Robustify Transformers via Plug-and-Play Paradigm30 Oct 2024
- 2024CERT-ED: Certifiably Robust Text Classification for Edit Distance1 Aug 2024
- 2024GenFighter: A Generative and Evolutive Textual Attack Removal17 Apr 2024
- 2024Adversarial Attacks and Dimensionality in Text Classifiers3 Apr 2024
- 2024The Impact of Quantization on the Robustness of Transformer-based Text Classifiers8 Mar 2024
- 2023Improving the Robustness of Transformer-based Large Language Models with Dynamic Attention29 Nov 2023
- 2023Fooling the Textual Fooler via Randomizing Latent Representations2 Oct 2023
- 2023The Trickle-down Impact of Reward (In-)consistency on RLHF28 Sep 2023
- 2023Certifying LLM Safety against Adversarial Prompting6 Sep 2023
- 2023Text-CRS: A Generalized Certified Robustness Framework against Textual Adversarial Attacks31 Jul 2023
- 2023Certified Robustness for Large Language Models with Self-Denoising14 Jul 2023
- 2023From Robustness to Explainability and Back Again5 Jun 2023
- 2023Improving Adversarial Robustness of DEQs with Explicit Regulations Along the Neural Dynamics2 Jun 2023
- 2023From Adversarial Arms Race to Model-centric Evaluation: Motivating a Unified Automatic Robustness Evaluation Framework29 May 2023
- 2023A Tale of Two Approximations: Tightening Over-Approximation for DNN Robustness Verification via Under-Approximation26 May 2023
- 2023Don't Retrain, Just Rewrite: Countering Adversarial Perturbations by Rewriting Text25 May 2023
- 2023A Survey of Safety and Trustworthiness of Large Language Models through the Lens of Verification and Validation19 May 2023
- 2023ANTONIO: Towards a Systematic Method of Generating NLP Benchmarks for Verification6 May 2023
- 2023Provable Robustness for Streaming Models with a Sliding Window28 Mar 2023
- 2023Less is More: Understanding Word-level Textual Adversarial Attack via n-gram Frequency Descend6 Feb 2023
- 2023TextShield: Beyond Successfully Detecting Adversarial Sentences in Text Classification3 Feb 2023
- 2023REaaS: Enabling Adversarially Robust Downstream Classifiers via Robust Encoder as a Service7 Jan 2023
- 2022DualApp: Tight Over-Approximation for Neural Network Robustness Verification via Under-Approximation21 Nov 2022
- 2022Impact of Adversarial Training on Robustness and Generalizability of Language Models10 Nov 2022
- 2022Textual Manifold-based Defense Against Natural Language Adversarial Examples5 Nov 2022
- 2022Emergent Linguistic Structures in Neural Networks are Fragile31 Oct 2022
- 2022Disentangled Text Representation Learning with Information-Theoretic Perspective for Adversarial Robustness26 Oct 2022
- 2022ADDMU: Detection of Far-Boundary Adversarial Examples with Data and Model Uncertainty Estimation22 Oct 2022
- 2022TCAB: A Large-Scale Text Classification Attack Benchmark21 Oct 2022
- 2022Identifying Human Strategies for Generating Word-Level Adversarial Examples20 Oct 2022
- 2022Balanced Adversarial Training: Balancing Tradeoffs between Fickleness and Obstinacy in NLP Models20 Oct 2022
- 2022Why Should Adversarial Perturbations be Imperceptible? Rethink the Research Paradigm in Adversarial NLP19 Oct 2022
- 2022Probabilistic Inverse Modeling: An Application in Hydrology12 Oct 2022
- 2022On the tightness of linear relaxation based robustness certification methods1 Oct 2022
- 2022Rethinking Textual Adversarial Defense for Pre-trained Language Models21 Jul 2022
- 2022Why Robust Natural Language Understanding is a Challenge21 Jun 2022
50 newest of 87 All 87 (JSON)
- 2022Competition-Level Code Generation with AlphaCodecited by 1,427
- 2022Competition-Level Code Generation with AlphaCode8 Feb 2022
- 2023Certifying LLM Safety against Adversarial Promptingcited by 248
- 2023Certifying LLM Safety against Adversarial Prompting6 Sep 2023
- 2021Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Modelscited by 227
- 2022Why Should Adversarial Perturbations be Imperceptible? Rethink the Research Paradigm in Adversarial NLPcited by 99
- 2023A Survey of Safety and Trustworthiness of Large Language Models through the Lens of Verification and Validationcited by 91
- 2021Towards Improving Adversarial Training of NLP Modelscited by 79
- 2021Towards Robustness Against Natural Language Word Substitutionscited by 68
- 2021Certified Robustness to Text Adversarial Attacks by Randomized [MASK]cited by 57
- 2021Searching for an Effective Defender: Benchmarking Defense against Adversarial Word Substitutioncited by 55
- 2021On Guaranteed Optimal Robust Explanations for NLP Modelscited by 54
- 2021How Should Pre-Trained Language Models Be Fine-Tuned Towards Adversarial Robustness?cited by 49
- 2021Policy Smoothing for Provably Robust Reinforcement Learningcited by 39
- 2023Text-CRS: A Generalized Certified Robustness Framework against Textual Adversarial Attackscited by 32
- 2021On the Sensitivity and Stability of Model Interpretations in NLPcited by 30
12 most cited of 80 All 80 (JSON)
- 2026SoK: Formal Methods for Fact-Checking and Information Integrity19 Sep 2026
- 2026S-GBT: Smooth Growth Bound Tensor for Certified Robustness Against Word Substitution Attacks in NLP11 Jun 2026
- 2026Small Data, Big Noise: Adversarial Training for Robust Parameter-Efficient Fine-Tuning9 Jun 2026
- 2026When Efficiency Backfires: Cascading LLMs Trigger Cascade Failure under Adversarial Attack17 May 2026
- 2025AdaptDel: Adaptable Deletion Rate Randomized Smoothing for Certified Robustness12 Nov 2025
- 2025Reconcile Certified Robustness and Accuracy for DNN-based Smoothed Majority Vote Classifier30 Sep 2025
- 2025Bridging Robustness and Generalization Against Word Substitution Attacks in NLP via the Growth Bound Matrix Approach14 Jul 2025
- 2025Robustness in Both Domains: CLIP Needs a Robust Text Encoder3 Jun 2025
- 2025Language Models That Walk the Talk: A Framework for Formal Fairness Certificates19 May 2025
- 2025Principal Eigenvalue Regularization for Improved Worst-Class Certified Robustness of Smoothed Classifiers21 Mar 2025
- 2024ProTransformer: Robustify Transformers via Plug-and-Play Paradigm30 Oct 2024
- 2024CERT-ED: Certifiably Robust Text Classification for Edit Distance1 Aug 2024
12 newest of 80 All 80 (JSON)