A defense method for adversarial training based on part-of-speech fusion in Chinese text

Abstract

The present invention discloses a defense method for word-level attacks against adversarial samples, which belongs to the field of computer technology; the method uses a word segmentation tool to extract part-of-speech information of Chinese text, and converts the semantic information and part-of-speech information of the text into semantic features and part-of-speech features according to different word embedding methods, and then splices the two to form a high joint representation as the input data of the neural network model, thereby strengthening the association between words in the text, helping to solve the common word-level attacks based on human visual limitations in Chinese adversarial samples, that is, the destruction of sentence structure by the phenomenon of unregistered words caused by the replacement of homophones and pictographic characters, and can improve the accuracy of the model in identifying adversarial samples of word-level attacks, and can be widely used in existing neural network models for tasks related to Chinese natural language processing. In addition, adversarial training of the model with input samples in the form of high-level joint representation improves the robustness of the model.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology and relates to a defense method based on adversarial training of part-of-speech fusion in Chinese text, which can be widely used in content detection models of Chinese online media platforms. Background Art

[0002] With the popularity of smart devices, people are increasingly inclined to communicate and interact on social media and express their opinions. In the Chinese environment, online media platform content detection mainly relies on deep neural network models. However, deep neural network models are vulnerable to adversarial samples, that is, adding a carefully designed small perturbation to the original sample can deceive the model's classification, allowing malicious speech to evade supervision and affect public perception.

[0003] Unlike modifying pixel values ​​in images, text is discrete data, and perturbations to text are easy to detect and difficult to keep semantics intact. In addition, Chinese is composed of a large number of Chinese characters with independent meanings, in which the meaning of each sentence directly depends on the meaning of the Chinese characters that make up the sentence and the way these characters are syntactically related to each other. This is completely different from alphabetic languages ​​with smaller alphabets such as English and French. Therefore, simply modifying a single Chinese character may greatly change the original semantics of the sentence, making Chinese adversarial attacks more difficult. At present, Chinese text adversarial attacks mainly use homophones, similar characters, typos, and sequence replacements to replace keywords in the text to interfere with the normal decision-making of the deep neural network model.

[0004] Adversarial training is a direct means of defending against adversarial attacks. By adding adversarial samples to normal samples as training data for the model, the robustness of the model against attacks can be enhanced to a certain extent.

[0005] At present, there are relatively few studies on adversarial sample defense in Chinese, which can be roughly divided into three methods: adversarial sample detection, adversarial training, and model enhancement. For example, Wang et al. proposed a defense method called random replacement encoding (RSE), which generates a set of candidate words for a text by randomly selecting a replacement rate, and performs synonym attacks and replacements on each word, and uses the newly generated samples to train the model. However, this scheme can only defend against synonym attacks, and cannot defend against other types of attacks; the main reasons for this phenomenon include: there is a lack of a good theoretical model for complex optimization problems such as adversarial samples; secondly, the diversity of attack forms makes it difficult to estimate the output of the model, so a truly adaptive defense method is difficult. Summary of the invention

[0006] In order to improve the accuracy and robustness of the model in identifying word-level attacks on adversarial samples, the present invention generates adversarial samples through multiple word-level adversarial attacks, mixes the adversarial samples with the original samples, forms high-level joint features by extracting part-of-speech features and semantic features of the data, and then uses the mixed word-level attack samples to perform adversarial training on the model.

[0007] The present invention mainly includes two parts: advanced joint representation construction and adversarial training. In the advanced joint representation construction part, it is necessary to first use the original Chinese text data set and the adversarial sample data set to form a training set, respectively use the word segmentation tool to extract the sentence semantic information and part-of-speech information from the training set, and encode and splice them into advanced joint features using different word embedding methods; in the adversarial training part, different proportions of word-level adversarial attack samples can be selected in turn and added to the original samples, and the deep neural network model can be trained using the advanced joint representation as input data.

[0008] The present invention adopts the following technical solutions to solve the above technical problems:

[0009] A defense method for adversarial training based on part-of-speech fusion in Chinese text, the method comprising collecting an original Chinese text data set, processing the Chinese text data set using multiple word-level adversarial attacks to form an adversarial sample data set; mixing the Chinese text data set with the adversarial sample data set to form multiple training sets; extracting semantic information and part-of-speech information of Chinese text words from the training set using a Chinese word segmentation tool, encoding them into semantic features and part-of-speech features respectively in different word embedding methods, splicing the semantic features and the part-of-speech features into high-level joint features, using the high-level joint features as input data of a neural network model, performing adversarial training, with the goal of minimizing adversarial losses, and training to obtain a reinforced model that can defend against word-level attacks.

[0010] Beneficial effects of the present invention:

[0011] The present invention can, without changing the model architecture, strengthen the connection between the semantics and parts of speech between words in a sentence by adding part-of-speech features, thereby solving the problem of sentence structure changes caused by changes in the parts of speech of words due to existing word-level attacks to a certain extent, and improving the model's ability to recognize and judge word-level attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is a defense framework diagram of adversarial training based on part-of-speech fusion in Chinese text in an embodiment of the present invention;

[0013] Figure 2 It is a flow chart of a defense method based on adversarial training of part-of-speech fusion in Chinese text in an embodiment of the present invention;

[0014] Figure 3is a graph showing the effect of the proportion of adversarial samples on the recognition accuracy of TextCNN in an embodiment of the present invention. Figure 3 (a) is the change diagram of the original sample recognition accuracy. Figure 3 (b) is the recognition accuracy of adversarial samples;

[0015] Figure 4 This is a graph showing how the change in the proportion of adversarial samples affects the recognition accuracy of BiLSTM in an embodiment of the present invention. Figure 4 (a) Original sample recognition accuracy, Figure 4 (b) Accuracy of adversarial sample recognition. DETAILED DESCRIPTION

[0016] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0017] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0018] Figure 1 is a defense framework diagram of adversarial training based on part-of-speech fusion in Chinese text in an embodiment of the present invention, such as Figure 1 As shown, the framework mainly includes four layers of architecture. The first layer of architecture is adversarial sample generation, which forms an adversarial sample data set by conducting adversarial attacks on the original data set; the second layer of architecture is training set sample generation, which forms n different training sets by mixing the original data set and the adversarial sample data set; the third layer of structure is advanced joint feature generation, which extracts semantic information and part-of-speech information from these training sets respectively; then encodes the semantic information and part-of-speech information respectively to form semantic features and part-of-speech features; concatenates the semantic features and part-of-speech features to form advanced joint features; the fourth layer of architecture is to generate a reinforcement model, which uses the advanced joint features as the input data of the neural network model, and after adversarial training, a reinforcement model that can defend against word-level attacks can be obtained.

[0019] Figure 2 is a flow chart of a defense method for adversarial training based on part-of-speech fusion in Chinese text according to an embodiment of the present invention. Figure 2 As shown, the method includes:

[0020] 101. Collect original Chinese text datasets;

[0021] In an embodiment of the present invention, the original Chinese text data set can be text input by a user, or it can be text in a designated text storage space, which can store text of a specific application scenario, for example, microblog text stored in the designated text storage space.

[0022] 102. Using multiple word-level adversarial attacks to process the Chinese text dataset and form an adversarial sample dataset;

[0023] In an embodiment of the present invention, since the adversarial training defense method based on part-of-speech fusion is mainly used to solve the problem of sentence structural destruction caused by word-level attacks in Chinese text, in order to improve the accuracy of the original model in classifying unconventional sentence structure samples, the present invention selects a variety of attack strategies including sequential perturbations and adding invalid characters to attack the original neural network model, thereby generating an adversarial sample data set for mixed word-level attacks.

[0024] 103. Mix the Chinese text dataset with the adversarial sample dataset to form multiple training sets;

[0025] In an embodiment of the present invention, in order to simulate a real attack environment, the present invention mixes the original Chinese text dataset with the generated adversarial sample dataset. The specific mixing ratio can be selected manually. After mixing, multiple training sets with different ratios can be formed.

[0026] Although the above embodiment can solve the class imbalance problem of the original Chinese text dataset and the adversarial text dataset to a certain extent, it can only improve the accuracy of the model within a limited range, affecting the generalization ability of the model, and requires manual participation, which is inefficient.

[0027] Based on this, in a preferred embodiment of the present invention, the present invention adopts deep learning combined with back propagation to obtain the optimal extraction ratio, and replaces the text data in the original Chinese text data level with the adversarial sample data set with the optimal extraction ratio. The back propagation process of adversarial training is combined to update the optimal extraction ratio to achieve automatic extraction of adversarial text, thereby improving the accuracy of the model in recognizing adversarial samples in a more fine-grained manner.

[0028] 104. Using a Chinese word segmentation tool to extract semantic information and part-of-speech information of Chinese text words from the training set, respectively encoding them into semantic features and part-of-speech features in different word embedding methods, and splicing the semantic features and the part-of-speech features to form a high-level joint feature;

[0029] In an embodiment of the present invention, the Chinese text data set can be preprocessed based on the natural language processing technology NLP (Natural Language Processing) tool pyltp, which specifically includes: inputting the data set that needs to be preprocessed, loading the commonly used delimiters in Chinese (punctuation marks, special symbols, charts and common stop words in Chinese), performing forward matching from the input data set and the delimiter, replacing the string with a space at the text position that successfully matches the delimiter in the data set, so that the initial text data set is divided into a series of short strings separated by spaces. The short string is input into the pyltp tool, and a general word segmentation dictionary is loaded at the same time. The general word segmentation dictionary can select the Baidu general word segmentation dictionary with a relatively complete current coverage, or the Sogou general word segmentation dictionary, and the short string is segmented. Due to the addition of a professional dictionary, the word segmentation result will be different from the ordinary word segmentation result, and it is also convenient to obtain Chinese words in related fields later. The word segmentation result continues to be tagged with parts of speech, and these part-of-speech tags can be entities identified by names, organization names, place names, time, numbers and other types.

[0030] In the embodiment of the present invention, FoolNLTK Chinese word segmentation tool can be used to extract semantic information sequence and part-of-speech information sequence from sentence word segmentation. For example, given a text W with a length of N after word segmentation, N} and its corresponding part-of-speech tag p = {p1,p2,…,p N}.

[0031] Since the deep neural network model cannot directly process the text sequence and needs to be encoded into a numerical form as the input of the model, the present invention can encode the semantic sequence and the part-of-speech sequence into a semantic vector feature V(s) and a part-of-speech vector feature V(p) according to different word embedding coding dictionaries.

[0032] The specific embedding method of the semantic vector feature V(s) is as follows: statistically analyze the word frequency and other related information in the data set corpus, remove the stop words in the text, generate a text encoding dictionary, and form a one-to-one mapping relationship between words and numbers, thereby converting the text into a digital vector feature with a length of N and a dimension of 1.

[0033] The specific embedding method of the part-of-speech vector feature V(p) is as follows: 63 categories of part-of-speech tags after text preprocessing by the word segmentation tool FoolNLTK are counted, and based on the semantic vector feature embedding method, a part-of-speech encoding dictionary with a one-to-one mapping between part-of-speech and numbers is constructed, as shown in Table 1. The part-of-speech tag p of each word can be converted into a corresponding numerical code. Then the part-of-speech tag sequence of the sentence can be converted into a part-of-speech feature vector with a length of N and a dimension of 1.

[0034] Table 1 Part-of-speech encoding conversion table

[0035]

[0036]

[0037] Through the above method, the present invention can adopt the Early Multimodel Fusion (EMF) strategy for the fusion of semantic vector features V(s) and part-of-speech vector features V(p), that is, directly splicing the encoded semantic vector features and part-of-speech vector features. According to the different splicing methods, it is divided into horizontal fusion (HF) and vertical fusion (VF).

[0038] Horizontal fusion means splicing V(p) behind V(s) to increase its length without changing the dimension of the joint representation, as shown in the formula:

[0039]

[0040] Vertical fusion means aligning V(p) and V(s) bit by bit and splicing them below each other to fuse the two one-dimensional single features into a two-dimensional fused vector feature, as shown in the formula:

[0041]

[0042] In the embodiment of the present invention, both fusion methods can form advanced joint features. On the one hand, the present invention can use any one of the advanced joint features to perform adversarial training respectively; on the other hand, the present invention can also use two advanced joint features at the same time to perform adversarial training. This multi-dimensional training method can enhance the generalization ability of the model and ensure the defense capability of the model.

[0043] 105. The advanced joint features are used as input data of a neural network model to perform adversarial training with the goal of minimizing adversarial loss, thereby training a reinforced model that can defend against word-level attacks.

[0044] In an embodiment of the present invention, the generated high-level joint features and the corresponding part-of-speech tags are used as input data of the neural network model, and the model is optimized and strengthened through adversarial training.

[0045] In an embodiment of the present invention, the adversarial training process can mainly include using the currently extracted original samples and adversarial samples, with the goal of maximizing the classification loss, that is, making the classification prediction results of the original samples and adversarial samples of the neural network model with current parameters as wrong as possible; with the goal of minimizing the distribution loss, that is, making the classification prediction results of the original samples and adversarial samples of the neural network model with current parameters as consistent as possible; updating the parameters θ of the neural network model through adversarial training; updating the extraction ratio of adversarial samples in an adaptive manner, updating the adversarial samples using the updated original samples and adversarial samples, optimizing the parameters of the neural network model, and maximizing the accuracy of the neural network model in recognizing adversarial samples in different extraction processes. The extraction ratio is updated through back propagation, and the optimal neural network model corresponding to the optimal extraction ratio is output.

[0046] Among them, in the embodiment of the present invention, the objective function of the optimal neural network model is expressed as:

[0047]

[0048] in, Represents the use of adversarial training set The recognition accuracy of the adversarial sample x′ is represents the original Chinese text training set, represents the adversarial sample training set, θ represents the neural network model parameters, L(x+Δx,y; θ) represents the loss value corresponding to the original sample x after the adversarial perturbation Δx to generate the adversarial sample and the predicted classification result y. It represents updating the model parameter θ by minimizing the loss value of the model, Ω represents the perturbation space, x represents the original sample, Δx represents the adversarial perturbation, and x′ represents the adversarial sample.

[0049] During the training process of the neural network model, the model parameters can be updated by forward propagation and backward propagation. For details, please refer to the following:

[0050] Step 1) Input the training set data into the input layer of the neural network model, pass through the hidden layer, and finally reach the output layer and output the result. This is the process of forward propagation. The neurons in each layer need to receive the data input from the upper layer, which can be expressed as:

[0051] z l =ω l a l-1 +b l ,a l =σ(z l )

[0052] Among them, z l represents the input of the lth layer of neurons, ω lrepresents the weight of the l-1th layer of neurons connected to the lth layer of neurons, a l represents the output of the lth layer of neurons, b l represents the bias of the l-th layer of neurons, and σ represents the activation function.

[0053] Step 2) Since there is an error between the output result of the neural network model and the actual result, the error between the estimated value and the actual value is calculated and expressed as:

[0054]

[0055] Among them, x represents the input sample, y represents the actual classification, and a L represents the predicted output, and L represents the maximum number of layers of the neural network.

[0056] The total error is propagated back from the output layer to the hidden layer until it reaches the input layer; the error generated by calculating the output layer is expressed as:

[0057]

[0058] Where ⊙ represents the Hadamard product, which is used for point-to-point multiplication operations between matrices or vectors.

[0059] The formula for calculating the back propagation error is:

[0060] δ l =((ω l+1 ) T δ l+1 )⊙σ′(z l )

[0061] Step 3) During the back propagation process, adjust the values ​​of various parameters according to the error; continue to iterate the above process until convergence, which can be expressed as:

[0062]

[0063]

[0064] Among them, μ represents the parameter learning rate, and m represents the partial derivative of the total model error with respect to the hidden layer weights.

[0065] In a preferred embodiment of the present invention, during the back-propagation process of the present invention, gradient calculation can also be performed with the adversarial loss corresponding to the current extraction ratio, and the model parameters of the neural network model can be back-propagated in combination with the results of the gradient calculation until the neural network model converges and outputs the model parameters under the current optimal extraction ratio. This method can solve the class imbalance problem of adversarial samples and original samples to a certain extent, optimize the training process of the model, and enhance the defense capability of the model.

[0066] It is understandable that the neural network model of the present invention can adopt commonly used networks such as convolutional neural network, attention neural network, long short-term memory neural network, etc.

[0067] In an embodiment of the present invention, a control experiment is adopted. While ensuring that the total amount of training set data and the data of each label category remain unchanged, the corresponding original data are replaced with adversarial samples in the adversarial sample data set at a data ratio growth rate of 10%, and a total of 11 groups of adversarial training data sets are generated. The data in each group of adversarial training data sets are input into the training reinforcement model in turn in the form of joint representation fusion, and the model that performs well for both the original samples and the adversarial samples is selected.

[0068] In the JingDong dataset, the feasibility of the adversarial training method based on part-of-speech fusion for the defense of text sentiment classification tasks is evaluated on the TextCNN and BiLSTM models. Table 2 shows the initial accuracy of BiLSTM for data with three different feature forms:

[0069] Table 2 Initial accuracy of the model for three types of feature data

[0070]

[0071] The generated adversarial sample dataset is used to replace the data in the original training set in turn to obtain the recognition accuracy of the model for adversarial samples and original samples at different proportions. The appropriate model is selected based on the relative requirements for the recognition accuracy of the original samples and adversarial samples. Figure 3 (a) and Figure 4 (a) As can be seen, as the proportion of adversarial samples in the training set continues to increase, the classification accuracy of the original samples by the models TextCNN and BiLSTM gradually decreases, but the overall decrease is very small. For each image, the overall accuracy of horizontal fusion and vertical fusion is better than that of the model using a single feature. Figure 3 (b) and Figure 4 (b) As the proportion of adversarial samples in the training set continues to increase, the classification accuracy of adversarial samples by the TextCNN and BiLSTM models has been greatly improved, especially when the proportion of adversarial samples is large, the accuracy gradually stabilizes, and can increase by about 15 percentage points compared with the initial accuracy. For each image, there is a significant gap in accuracy between the fused joint representation model and the single feature model, but the gap between horizontal fusion and vertical fusion is not large.

[0072] In the description of the present invention, it is necessary to understand that the terms "coaxial", "bottom", "one end", "top", "middle", "the other end", "upper", "one side", "top", "inside", "outside", "front", "center", "both ends" and the like indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0073] In the present invention, unless otherwise clearly stipulated and limited, the terms such as "installation", "setting", "connection", "fixation" and "rotation" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral one; it can be a mechanical connection or an electrical connection; it can be directly connected or indirectly connected through an intermediate medium; it can be the internal connection of two elements or the interaction relationship between two elements. Unless otherwise clearly defined, ordinary technicians in this field can understand the specific meanings of the above terms in the present invention according to the specific circumstances.

[0074] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A defense method for adversarial training based on part-of-speech fusion in Chinese text, characterized in that: The method comprises collecting an original Chinese text data set, processing the Chinese text data set by using a plurality of word-level adversarial attacks, and forming an adversarial sample data set; mixing the Chinese text data set with the adversarial sample data set to form a training set; extracting semantic information and part-of-speech information of Chinese text words from the training set by using a Chinese word segmentation tool, encoding them into semantic features and part-of-speech features respectively in different word embedding modes, splicing the semantic features and the part-of-speech features to form a high-level joint feature, using the high-level joint feature as input data of a neural network model, performing adversarial training, with the goal of minimizing adversarial losses, and training to obtain a reinforced model that can defend against word-level attacks; The word embedding method of semantic information includes removing stop words on the training set, using a word segmenter to generate a coding dictionary on a specified data set, and counting word frequency related information in the data set corpus to form a corresponding relationship between semantic information and vectors, thereby converting the text into a vector representation, and using a zero-filling method to set the sentence to a fixed-length semantic feature; The word embedding method of part-of-speech information includes constructing a part-of-speech encoding conversion table corresponding to part-of-speech and numbers, converting each part-of-speech information into a numerical value as a part-of-speech feature according to the part-of-speech encoding conversion table, and using the zero-filling method to represent the part-of-speech feature as the length of the semantic feature; Splicing the semantic features and the part-of-speech features to form a high-level joint feature includes aligning and splicing the one-dimensional semantic features and the one-dimensional part-of-speech features in a horizontal fusion and a vertical fusion manner to form a high-level joint feature, wherein the horizontal fusion is represented by horizontally splicing the one-dimensional semantic features and the one-dimensional part-of-speech features to form a one-dimensional high-level joint feature; The vertical fusion is represented by vertically splicing the one-dimensional semantic features and the one-dimensional part-of-speech features to form a two-dimensional high-level joint feature; The adversarial training process includes two steps: adversarial sample generation and model training. In the sample generation stage, a variety of word-level attack strategies are used to attack the original neural network model and generate a mixed adversarial sample dataset. In the model training phase, an adaptive method is used to iteratively extract part of the adversarial sample data set to replace the corresponding Chinese text data set in the original training set, and train the neural network model; The process of performing adversarial training includes: Using the currently extracted original samples and adversarial samples, the goal is to maximize the classification loss, that is, to make the classification prediction results of the original samples and adversarial samples of the neural network model with the current parameters as wrong as possible; the goal is to minimize the distribution loss, that is, to make the classification prediction results of the original samples and adversarial samples of the neural network model with the current parameters as consistent as possible; update the parameters θ of the neural network model through adversarial training; update the extraction ratio of adversarial samples in an adaptive manner, update the adversarial samples using the updated original samples and adversarial samples, optimize the parameters of the neural network model, and in different extraction processes, maximize the accuracy of the neural network model in recognizing adversarial samples, update the extraction ratio through back propagation, and output the optimal neural network model corresponding to the optimal extraction ratio; The objective function of the optimal neural network model is expressed as: in, Represents the use of adversarial training set Adversarial example x ′ The corresponding recognition accuracy is represents the original Chinese text training set, represents the adversarial sample training set, θ represents the neural network model parameters, L(x+Δx,y; θ) represents the loss value corresponding to the original sample x after the adversarial perturbation Δx to generate the adversarial sample and the predicted classification result y. represents updating the model parameter θ by minimizing the loss value of the model, Ω represents the perturbation space, x represents the original sample, Δx represents the adversarial perturbation, and x ′ Represents adversarial examples.

2. According to claim 1, a defense method for adversarial training based on part-of-speech fusion in Chinese text is characterized in that: The extraction of semantic information and part-of-speech information of Chinese text includes using a trained Chinese word segmentation toolkit to perform word segmentation processing on Chinese text sentences, dividing the sentences into a number of words that can be directly processed by a neural network model, using the words as semantic information, tagging the words with parts of speech, and using the part-of-speech tagging information as part-of-speech information.

3. According to claim 1, a defense method for adversarial training based on part-of-speech fusion in Chinese text is characterized in that: The updating of the extraction ratio by back propagation includes performing a gradient operation on the adversarial loss corresponding to the current extraction ratio, and back propagating the model parameters of the neural network model in combination with the result of the gradient operation until the neural network model converges, and outputting the model parameters at the current optimal extraction ratio.

Images