CERT-ED: Certifiably Robust Text Classification for Edit Distance
Not on the map. Why?
Abstract (arXiv)
With the growing integration of AI in daily life, ensuring the robustness of systems to inference-time attacks is crucial. Among the approaches for certifying robustness to such adversarial examples, randomized smoothing has emerged as highly promising due to its nature as a wrapper around arbitrary black-box models. Previous work on randomized smoothing in natural language processing has primarily focused on specific subsets of edit distance operations, such as synonym substitution or word insertion, without exploring the certification of all edit operations. In this paper, we adapt Randomized Deletion (Huang et al., 2023) and propose, CERTified Edit Distance defense (CERT-ED) for natural language classification. Through comprehensive experiments, we demonstrate that CERT-ED outperforms the existing Hamming distance method RanMASK (Zeng et al., 2023) in 4 out of 5 datasets in terms of both accuracy and the cardinality of the certificate. By covering various threat models, including 5 direct and 5 transfer attacks, our method improves empirical robustness in 38 out of 50 settings.
Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 36 of its 61 references that are in the map. First posted on arXiv 1 Aug 2024.
Builds on
36 of 61 references.
References · 36
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2013Intriguing properties of neural networkscited by 5,114
- 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
- 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 663
- 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
- 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 488
- 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
- 2018Generating Natural Language Adversarial Examplescited by 422
- 2018Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifierscited by 341
- 2020BAE: BERT-based Adversarial Examples for Text Classificationcited by 316
- 2017Synthetic and Natural Noise Both Break Neural Machine Translationcited by 304
24 more
- 2018Adversarial Example Generation with Syntactically Controlled Paraphrase Networkscited by 282
- 2016Adversarial Training Methods for Semi-Supervised Text Classificationcited by 280
- 2019FreeLB: Enhanced Adversarial Training for Natural Language Understandingcited by 261
- 2018Towards Fast Computation of Certified Robustness for ReLU Networkscited by 254
- 2021Gradient-based Adversarial Attacks against Text Transformerscited by 233
- 2019Certified Robustness to Adversarial Word Substitutionscited by 164
- 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfercited by 147
- 2020Contextualized Perturbation for Textual Adversarial Attackcited by 136
- 2024Is LLM-as-a-Judge Robust? Investigating Universal Adversarial Attacks on Zero-shot LLM Assessmentcited by 117
- 2022Why Should Adversarial Perturbations be Imperceptible? Rethink the Research Paradigm in Adversarial NLPcited by 99
- 2019Achieving Verified Robustness to Symbol Substitutions via Interval Bound Propagationcited by 87
- 2019Perturbation Sensitivity Analysis to Detect Unintended Model Biasescited by 74
- 2020SAFER: A Structure-free Approach for Certified Robustness to Adversarial Word Substitutionscited by 72
- 2019Robustness Certificates for Sparse Adversarial Attacks by Randomized Ablationcited by 59
- 2021Certified Robustness to Text Adversarial Attacks by Randomized [MASK]cited by 57
- 2019Training on Synthetic Noise Improves Robustness to Natural Noise in Machine Translationcited by 52
- 2018Training verified learners with learned verifierscited by 50
- 2020CAT-Gen: Improving Robustness in NLP Models via Controlled Adversarial Text Generationcited by 43
- 2020From Hero to Z'eroe: A Benchmark of Low-Level Adversarial Attackscited by 36
- 2023Text-CRS: A Generalized Certified Robustness Framework against Textual Adversarial Attackscited by 32
- 2021Achieving Model Robustness through Discrete Adversarial Trainingcited by 23
- 2023RS-Del: Edit Distance Robustness Certificates for Sequence Classifiers via Randomized Deletioncited by 17
- 2017Satirical News Detection and Analysis using Attention Mechanism and Linguistic Featurescited by 14
- 2023Projected Randomized Smoothing for Certified Adversarial Robustnesscited by 11
Built on by
Citing papers per year: 2025: 1; 2026: 1.
2 papers.