An adversarial training method for improving robustness of a natural language processing model

Abstract

The application discloses an adversarial training method for improving robustness of a natural language processing model, and comprises the following steps: sending original text into the model for training; generating an adversarial sample of an attack model by using a combination algorithm; and finally adding the adversarial sample into original samples for adversarial training.

Description

Technical Field

[0001] This invention pertains to adversarial example training techniques, specifically relating to an adversarial training method for improving the robustness of natural language processing models. Background Technology

[0002] The rapid development of deep learning technology has significantly improved the performance of many natural language processing tasks (such as text classification and machine translation). However, many researchers have discovered through experiments that adding even small perturbations to the input of deep learning models can easily change the model's predictions. Subsequent research has termed this perturbation an adversarial perturbation, the perturbed input an adversarial example, and the process of using adversarial examples to mislead the model is called an adversarial attack.

[0003] x adv =x+∈,f(x)=y;

[0004] f(x adv ) = y'; y ≠ y';

[0005] Where x is the original sample, x adv For adversarial examples, x and x adv The differences are difficult for humans to perceive; these samples are very similar to the original samples in terms of semantics, shape, or other aspects, yet some deep learning models can easily misclassify them. The vulnerability of deep learning models to adversarial attacks poses a significant risk to practical applications.

[0006] Applications of natural language processing, such as text classification, sentiment classification, question answering systems, and recommendation systems, are all threatened by adversarial attacks, leading to an increasing number of deep learning models being used in real-world applications. Currently, improving the robustness of text generation models has become a key focus for researchers in the field of natural language processing.

[0007] For example, patent CN115309897A discloses a Chinese multimodal adversarial example defense method based on adversarial training and contrastive learning, which defends against adversarial examples for Chinese multimodal data, and relies solely on adversarial training and contrastive learning for defense. However, this method cannot guarantee defense effectiveness against other languages ​​or single-modal data. Patent CN113935481A discloses an adversarial testing method for natural language processing models under finite-number conditions. This prior art solution can only perform adversarial testing under finite-number conditions and cannot cope with an unlimited number of adversarial attacks. In addition, this solution also has certain limitations on the types of adversarial attacks, only dealing with adversarial attacks against natural language, and cannot effectively defend against other types of adversarial attacks. Patent CN115146055A discloses a general text adversarial defense method and system based on adversarial training. This prior art solution performs general text adversarial defense through adversarial training, but this solution cannot guarantee good defense effectiveness against all types of adversarial attacks, and there may be situations where it cannot cope with certain types of adversarial attacks. Patent CN114564587A discloses a data augmentation method based on adversarial training in a text classification scenario. This prior art solution obtains adversarial samples by back-translating the original text. It requires the use of a translation model for translation, but the translation model itself may have some errors or biases, which may lead to unnatural translation errors in the generated adversarial samples. Summary of the Invention

[0008] Purpose of the invention: The purpose of this invention is to address the shortcomings of existing technologies and provide an adversarial training method to improve the robustness of natural language processing models. This invention uses adversarial samples generated by the attack algorithm and adds them to the original samples in a certain proportion for complete adversarial training. This has a significant effect on enhancing the robustness of the model. At the same time, the attack algorithm generated by this invention also has significant attack performance against the model.

[0009] Technical solution: The present invention provides an adversarial training method for improving the robustness of natural language processing models, characterized by comprising the following steps:

[0010] Step S1: Feed the original samples into a neural network model (e.g., BERT, CNN, LSTM) for initial training.

[0011] Step S2: Generate adversarial examples for the attack model using a combination algorithm, as detailed below:

[0012] Step S2.1: Use a specific beam search keyword algorithm to find the word w that has the greatest impact on the sentence;

[0013] Each time the first h optimal solutions are searched, a solution is randomly added. The input text is processed to obtain the corresponding vector. The words of each text are masked in order. The language model is used to score each word. The first h words with the highest probability of influence are determined, and one is randomly selected and added to them to improve the search space of the optimal solution and also improve the accuracy of the search.

[0014] Step S2.2: Screen for synonyms of the word w (i.e., keyword) that has the greatest impact on the sentence;

[0015] Step S2.3: Use SimpliBert semantic constraints to restrict the replacement words;

[0016] Step S3: After executing step S1, add the adversarial samples generated in step S2 to the original samples and feed them into the model. When the ratio of the number of adversarial samples to the original samples is r, then perform overall adversarial training.

[0017] Furthermore, in step S1, during the initial training, the dataset containing the original text is divided into m batches and fed into the model one by one for training.

[0018] For example, first use jieba for word segmentation, and convert the object returned by lcut into a list object; then use TF-IDF for text vectorization.

[0019] TF = f / N

[0020] TF represents word frequency, f represents the number of times a word appears in document D, and N represents the total number of words in document D;

[0021] IDF = log(n / docs(w,D))

[0022] IDF stands for Inverse Document Frequency, n represents the total number of documents, w represents the word that appears, D represents the document, and docs(w,D) represents the number of documents in which word w appears.

[0023] In general, the data file is first read and the text is segmented. Then, the text is converted into vectors that the model can recognize, and the text features are processed to enhance the readability of the data.

[0024] Furthermore, the specific method for using a specific beam to search for keywords in step S2.1 is as follows: in each iteration, a content word is taken and replaced with its synonym, and a beamwidth K is selected as the optimal node for the next iteration. A solution is randomly added to search for the word w that has the greatest impact on the sentence. However, existing beam search algorithms usually need to capture the h words with the highest current conditional probability, remove the remaining q words with relatively lower conditional probabilities, and discard some potential optimal solutions.

[0025] Furthermore, step S2.2 uses a triple metric learning algorithm to filter synonyms so that words are closer to their positive samples (i.e., synonyms). The specific method is as follows:

[0026] Use minimize L tr (w,S(w),N) is used to reduce the distance between word w and its synonyms (positive samples) and increase the distance between w and its non-synonyms (negative samples) in the embedding space;

[0027] Furthermore, to prevent the distance between positive and negative pairs from increasing simultaneously, once the distance exceeds α, the negative pair will not be pushed away. The triplet loss of the word w is calculated using the following formula:

[0028]

[0029] in Let N represent the set of synonyms for word w, and let N represent the set of words randomly sampled from the dictionary. The distance between two words in the above process is calculated as follows:

[0030] For two words w and w', the distance between them is measured by the "p-norm distance" of their word vectors in the embedding space, using the following formula:

[0031] d(w,w')=||v ( w)-v(w')|| p

[0032] Where w and w' are two different words in the text, v(w) represents the word vector of w in the embedding space, and p represents the norm distance between the two word vectors.

[0033] Furthermore, the specific method for restricting the replacement words using semantic constraints in step S2.3 is as follows:

[0034] A simplified version of the BERT model was used, removing the token type embedding and pooler, and reducing the number of layers by half to perform semantic constraints on the replacement words. Then, synonyms for the keywords were found through S2.2. The semantic correctness was evaluated by calculating the cosine similarity between the synonym embedding and the original keyword text embedding. Finally, the state with the highest score was selected as the generated adversarial sample, which is the final attack sample with the best effect. It is required that the cosine similarity between the sentence encodings of the original text w and the adversarial text w' meets the minimum threshold.

[0035] Furthermore, the sample segmentation batches in step S1 (original training) and step S3 (adversarial training) are different. The hyperparameter value for the original training is: the stage lasts for m rounds; the hyperparameter value for the adversarial training is: the stage lasts for n rounds; m and n are both positive integers.

[0036] Beneficial Effects: This invention, after adding the original text to the model for initial training, continuously adds adversarial examples generated by the algorithm to the original samples for adversarial training, significantly enhancing the model's robustness. Simultaneously, the attack algorithm generated by this invention also exhibits significant attack performance against the model. While ensuring attack effectiveness, this invention generates more natural, semantically more fluent, and less perceptible adversarial text, better reflecting real-life situations when facing attacks. Attached Figure Description

[0037] Figure 1 This is the overall flowchart of the present invention.

[0038] Figure 2 This is a schematic diagram illustrating an attack that involves deleting words, as shown in the example.

[0039] Figure 3 This is a schematic diagram illustrating an attack using added words as an example:

[0040] Figure 4 This is a schematic diagram illustrating a character substitution attack used in an example:

[0041] Figure 5 This is a schematic diagram illustrating the attack effect of the method of the present invention in an embodiment. Detailed Implementation

[0042] The technical solution of the present invention will be described in detail below, but the scope of protection of the present invention is not limited to the embodiments described.

[0043] like Figure 1 As shown, the adversarial training method for improving the robustness of natural language processing models according to the present invention includes the following steps:

[0044] Step S1: Feed the original samples into the model for initial training.

[0045] Step S2: Generate adversarial examples for the attack model using a combinatorial algorithm.

[0046] Step S2-1: Search for the word w that has the greatest impact on the sentence using a specific beam search keyword algorithm; in each iteration, take a content word and replace it with its synonym, select the beam width K as the optimal node for the next iteration, and randomly add a solution to search for the word w that has the greatest impact on the sentence.

[0047] Step S2-2: Perform synonym filtering on the selected keywords;

[0048] By minimizing L tr(w,S(w),N) is used to reduce the distance between the word w and its synonyms, and to increase the distance between w and its non-synonyms in the embedding space;

[0049] To prevent the distance between positive and negative pairs from increasing simultaneously, once the distance exceeds α, negative pairs will no longer be pushed away. The triplet loss for word w is calculated using the following formula:

[0050]

[0051] in Let N represent the set of synonyms for word w, and let N represent the set of words randomly sampled from the dictionary.

[0052] In the above process, the distance between two words is calculated as follows:

[0053] Suppose two words w and w', the distance between them is measured by the "p-norm distance" of their word vectors in the embedding space, using the following formula:

[0054] d(w,w')=||v(w)-v(w')|| p

[0055] Where w and w' are two different words in the text, v(w) represents the word vector of w in the embedding space, and p represents the norm distance between the two word vectors;

[0056] Step S2-3: Use semantic constraints to restrict the replacement words;

[0057] Using a simplified version of the BERT model, SimpliBert, the token type embedding and pooler were removed, and the number of layers was reduced by a factor of 2 to perform semantic constraints on the replacement words in order to ultimately determine the attack sample with the best performance; at the same time, the cosine similarity between the sentence encodings of the original text w and the adversarial text w' was required to meet a minimum threshold.

[0058] For example, when performing keyword searches on the processed data, the impact of each word on the overall sentence is obviously different. For instance, "I like durian" is generally used to determine that the sentence has a positive semantic meaning. Since each word has a significantly different impact on the model's judgment, to save time and improve efficiency, keyword searches are usually performed before word replacement to determine which words have the highest importance in the sentence. Here, a specific beam search keyword algorithm is used to select one content word in each iteration and replace it with its synonym. For the next iteration, K is selected as the optimal node, and a solution is randomly added to search for the word x that has the greatest impact on the sentence. i .

[0059] Step S3: After executing step S1, add the adversarial samples generated in step S2 to the original samples and feed them into the model. When the ratio of the number of adversarial samples to the original samples is r, then perform overall adversarial training.

[0060] In this embodiment, the sample segmentation batches in step S1 (original training) and step S3 (adversarial training) are different. The hyperparameter value for the original training is: the stage lasts for m rounds; the hyperparameter value for the adversarial training is: the stage lasts for n rounds; m and n are both positive integers.

[0061] Example

[0062] The flowchart for the adversarial training technique to improve the robustness of the natural language processing model for each batch of data in this embodiment is as follows:

[0063] Training Methods and Procedures

[0064]

[0065] In summary, the adversarial training method for improving the robustness of natural language processing models in this invention involves first adding the original text to the model for initial training, and then continuously adding adversarial samples generated by the algorithm to the original samples for adversarial training. The method includes: S1, feeding the original text into the model for training; S2, generating adversarial samples to attack the model using a combined algorithm; and S3, adding the adversarial samples generated by our algorithm to the original samples for adversarial training.

[0066] Furthermore, this invention employs keyword search algorithms, synonym replacement algorithms, and semantic constraint algorithms to make the substitution space of the attack method more precise. Unlike many traditional adversarial attack methods that directly delete or add words or replace characters, the adversarial samples generated by this invention are very close to the original text. While achieving perturbation of the model, it solves the problem of adversarial attacks on text classification. A human evaluation study shows that our generated adversarial examples maintain semantic similarity well and are difficult for humans to perceive.

[0067] Example:

[0068] This embodiment focuses on the sentence "The cat is sleeping on mat." Adversarial training was conducted using existing word deletion attack algorithms, word addition attack algorithms, character substitution attack algorithms, and the attack algorithm of this invention. The results are as follows: Figures 2 to 5 As shown, through Figures 2 to 5As can be seen from the comparison, the attack algorithm of this invention adopts a synonym-based replacement algorithm, which generates adversarial text that is closer to the original text and more in line with the contextual semantics than attacks that delete words, add words, or replace characters. This makes the attacked text more natural, easier to understand and accept, and reduces the possibility of the attack being detected.

Claims

1. An adversarial training method for improving the robustness of natural language processing models, characterized in that: Includes the following steps: Step S1: Feed the original samples into the neural network model for initial training; Step S2: Generate adversarial examples for the attack model using a specific beam search keyword algorithm, a triple metric learning algorithm, and a semantic constraint algorithm. The specific details are as follows: Step S2.1: Use a specific beam search keyword algorithm to find the words that have the greatest impact on the sentence. The specific beam search keyword algorithm refers to randomly adding a solution when searching the first h optimal solutions each time: the input text is processed to obtain the corresponding vector, the words of each text are masked in order, the language model is used to score each word, the first h words with the highest probability of influence are determined, and a solution is randomly selected and added to them; During the iteration process, each iteration selects a content word for synonym replacement, and selects the beamwidth K as the optimal node for the next iteration. A solution is then randomly added, and the word with the greatest impact on the sentence is searched. ; Step S2.2: The word that has the greatest impact on the sentence. Perform synonym filtering; use a triple metric learning algorithm to filter synonyms to make words... To get closer to its positive samples, the specific method is as follows: By minimizing To reduce words Synonyms The distance between them, and increase the embedding space. The distance between it and its non-synonyms; To prevent the distance between positive and negative pairs from increasing simultaneously, once the distance exceeds α, negative pairs will no longer be pushed apart, affecting the word pair. The triplet loss is expressed by the following formula: ; in Indicator a collection of synonyms This represents a set containing words randomly sampled from a dictionary; In the above process, the distance between two words is calculated as follows: Suppose two words and Using their word vectors in the embedding space The "norm distance" is used as a distance metric between them using the following formula: ; in and They are two different words in the text. Representative at Word vectors in the embedding space, This represents the norm distance between two word vectors; the smaller the norm distance between two numbers, the more likely the two numbers are to be synonyms. Step S2.3: Use SimpliBert semantic constraints to restrict the replacement words; Step S3: After executing step S1, add the adversarial samples generated in step S2 to the original samples and feed them into the model. When the number of adversarial samples accounts for r of the original samples, then perform overall adversarial training.

2. The adversarial training method for improving the robustness of natural language processing models according to claim 1, characterized in that: In step S1, during the initial training, the dataset containing the original text is divided into... Each batch is fed into the selected model for initial training.

3. The adversarial training method for improving the robustness of natural language processing models according to claim 1, characterized in that: The specific method for using semantic constraints to restrict the replacement words in step S2.3 is as follows: First, the token type embedding and pooler in the simplified BERT model SimpliBert are removed, and the number of layers is reduced by half. Then, synonyms for keywords are found through S2.

2. The semantic correctness is evaluated by calculating the cosine similarity between the synonym embedding and the original keyword text embedding. Finally, the state with the highest score is selected as the generated adversarial sample.

4. The adversarial training method for improving the robustness of natural language processing models according to claim 1, characterized in that: The sample segmentation batches in step S1 (original training) and step S3 (adversarial training) are different. The hyperparameter value for the original training is: the stage lasts for m rounds; the hyperparameter value for the adversarial training is: the stage lasts for n rounds; m and n are both positive integers.

Images