Input-specific Attention Subnetworks for Adversarial Detection
Not on the map. Why?
Abstract (arXiv)
Self-attention heads are characteristic of Transformer models and have been well studied for interpretability and pruning. In this work, we demonstrate an altogether different utility of attention heads, namely for adversarial detection. Specifically, we propose a method to construct input-specific attention subnetworks (IAS) from which we extract three features to discriminate between authentic and adversarial inputs. The resultant detector significantly improves (by over 7.5%) the state-of-the-art adversarial detection accuracy for the BERT encoder on 10 NLU datasets with 11 different adversarial attack types. We also demonstrate that our method (a) is more accurate for larger models which are likely to have more spurious correlations and thus vulnerable to adversarial attack, and (b) performs well even with modest training sets of adversarial examples.
Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Builds on 26 of its 38 references that are in the map. First posted on arXiv 23 Mar 2022.
Builds on
26 of 38 references.
References · 26
- 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,733
- 2018GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understandingcited by 4,899
- 2016SQuAD: 100,000+ Questions for Machine Comprehension of Textcited by 4,148
- 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,884
- 2017A Broad-Coverage Challenge Corpus for Sentence Understanding through Inferencecited by 2,682
- 2015Character-level Convolutional Networks for Text Classificationcited by 2,330
- 2015A large annotated corpus for learning natural language inferencecited by 1,847
- 2019TinyBERT: Distilling BERT for Natural Language Understandingcited by 1,167
- 2019BERT Rediscovers the Classical NLP Pipelinecited by 1,059
- 2019When Does Label Smoothing Help?cited by 988
- 2019Analyzing Multi-Head Self-Attention: Specialized Heads Do the Heavy Lifting, the Rest Can Be Prunedcited by 856
- 2019Are Sixteen Heads Really Better than One?cited by 816
14 more
- 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 671
- 2017Learning Sparse Neural Networks through L0 Regularizationcited by 583
- 2018Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifierscited by 345
- 2018Feature Denoising for Improving Adversarial Robustnesscited by 314
- 2019Assessing BERT's Syntactic Abilitiescited by 192
- 2019Certified Robustness to Adversarial Word Substitutionscited by 168
- 2019Combating Adversarial Misspellings with Robust Word Recognitioncited by 163
- 2016Counter-fitting Word Vectors to Linguistic Constraintscited by 140
- 2018Pathologies of Neural Models Make Interpretations Difficultcited by 140
- 2019How Does BERT Answer Questions? A Layer-Wise Analysis of Transformer Representationscited by 63
- 2019Learning to Discriminate Perturbations for Blocking Adversarial Attacks in Text Classificationcited by 57
- 2020Frequency-Guided Word Substitutions for Detecting Textual Adversarial Examplescited by 54
- 2018Adversarial Sample Detection for Deep Neural Network through Model Mutation Testingcited by 48
- 2021The heads hypothesis: A unifying statistical approach towards understanding multi-headed attention in BERTcited by 15
Built on by
Citing papers per year: 2022: 1; 2023: 1.
2 papers.