# Robustness to Programmable String Transformations via Augmented Abstract Training

arXiv: https://arxiv.org/abs/2002.09579 · HTML: https://mlsanity.com/paper/2002.09579/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 22 Feb 2020.

## Built on by (most cited first, 8 of 8)

- [Certifying Robustness to Programmable Data Bias in Decision Trees](https://mlsanity.com/paper/2110.04363/) (2021)
- [Certified Robustness to Programmable Transformations in LSTMs](https://mlsanity.com/paper/2102.07818/) (2021)
- [RoPGen: Towards Robust Code Authorship Attribution via Automatic Coding Style Transformation](https://mlsanity.com/paper/2202.06043/) (2022)
- [Automatic Fairness Testing of Neural Classifiers through Adversarial Sampling](https://mlsanity.com/paper/2107.08176/) (2021)
- [Neural Network Verification is a Programming Language Challenge](https://mlsanity.com/paper/2501.05867/) (2025)
- [Reproducing HotFlip for Corpus Poisoning Attacks in Dense Retrieval](https://mlsanity.com/paper/2501.04802/) (2025)
- [Towards Making Deep Learning-based Vulnerability Detectors Robust](https://mlsanity.com/paper/2108.00669/) (2021)
- [A One-Layer Decoder-Only Transformer is a Two-Layer RNN: With an Application to Certified Robustness](https://mlsanity.com/paper/2405.17361/) (2024)

## Abstract (arXiv)

Deep neural networks for natural language processing tasks are vulnerable to adversarial input perturbations. In this paper, we present a versatile language for programmatically specifying string transformations -- e.g., insertions, deletions, substitutions, swaps, etc. -- that are relevant to the task at hand. We then present an approach to adversarially training models that are robust to such user-defined string transformations. Our approach combines the advantages of search-based techniques for adversarial training with abstraction-based techniques. Specifically, we show how to decompose a set of user-defined string transformations into two component specifications, one that benefits from search and another from abstraction. We use our technique to train models on the AG and SST2 datasets and show that the resulting models are robust to combinations of user-defined transformations mimicking spelling mistakes and other meaning-preserving transformations.