CR-UTP: Certified Robustness against Universal Text Perturbations on Large Language Models
Not on the map. Why?
Abstract (arXiv)
It is imperative to ensure the stability of every prediction made by a language model; that is, a language's prediction should remain consistent despite minor input variations, like word substitutions. In this paper, we investigate the problem of certifying a language model's robustness against Universal Text Perturbations (UTPs), which have been widely used in universal adversarial attacks and backdoor attacks. Existing certified robustness based on random smoothing has shown considerable promise in certifying the input-specific text perturbations (ISTPs), operating under the assumption that any random alteration of a sample's clean or adversarial words would negate the impact of sample-wise perturbations. However, with UTPs, masking only the adversarial words can eliminate the attack. A naive method is to simply increase the masking ratio and the likelihood of masking attack tokens, but it leads to a significant reduction in both certified accuracy and the certified radius due to input corruption by extensive masking. To solve this challenge, we introduce a novel approach, the superior prompt search method, designed to identify a superior prompt that maintains higher certified accuracy under extensive masking. Additionally, we theoretically motivate why ensembles are a particularly suitable choice as base prompts for random smoothing. The method is denoted by superior prompt ensembling technique. We also empirically confirm this technique, obtaining state-of-the-art results in multiple settings. These methodologies, for the first time, enable high certified accuracy against both UTPs and ISTPs. The source code of CR-UTP is available at url https://github.com/UCFML-Research/CR-UTP.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 33 of its 54 references that are in the map. First posted on arXiv 4 Jun 2024.
Builds on
33 of 54 references.
References · 33
- 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
- 2020Language Models are Few-Shot Learnerscited by 32,199
- 2023GPT-4 Technical Reportcited by 18,132
- 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
- 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
- 2022PaLM: Scaling Language Modeling with Pathwayscited by 5,304
- 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
- 2022LaMDA: Language Models for Dialog Applicationscited by 1,218
- 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 709
- 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 663
- 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
21 more
- 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 488
- 2018Generating Natural Language Adversarial Examplescited by 422
- 2022RLPrompt: Optimizing Discrete Text Prompts with Reinforcement Learningcited by 361
- 2018Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifierscited by 341
- 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
- 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
- 2018Towards Fast Computation of Certified Robustness for ReLU Networkscited by 254
- 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attackscited by 189
- 2020RAB: Provable Robustness Against Backdoor Attackscited by 115
- 2020MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radiuscited by 114
- 2020SoK: Certified Robustness for Deep Neural Networkscited by 100
- 2016Yelp Dataset Challenge: Review Rating Predictioncited by 84
- 2021Towards Improving Adversarial Training of NLP Modelscited by 79
- 2020Consistency Regularization for Certified Robustness of Smoothed Classifierscited by 73
- 2020SAFER: A Structure-free Approach for Certified Robustness to Adversarial Word Substitutionscited by 72
- 2021Certified Robustness to Text Adversarial Attacks by Randomized [MASK]cited by 57
- 2021Boosting Randomized Smoothing with Variance Reduced Classifierscited by 47
- 2023TrojText: Test-time Invisible Textual Trojan Insertioncited by 26
- 2023Certified Robustness for Large Language Models with Self-Denoisingcited by 23
- 2023TrojFSP: Trojan Insertion in Few-shot Prompt Tuningcited by 9
- 2020Denoised Smoothing: A Provable Defense for Pretrained Classifierscited by 8
Built on by
Citing papers per year: 2026: 1.
1 paper.