A chinese adversarial sample recovery method based on HMM and denoising autoencoder

Abstract

The application discloses a Chinese adversarial sample recovery method based on an HMM and a noise reduction self-encoder, relates to the technical field of adversarial text processing, and comprises the following steps: acquiring an adversarial text, and performing symbol cleaning on the adversarial text; converting pinyin strings in the adversarial text into Chinese character sequences based on a hidden Markov model, and splicing the Chinese character sequences into Chinese character strings; removing noise from Chinese character characters and Chinese character strings in the adversarial text through a noise reduction self-encoder to obtain a candidate word sequence; decoding the candidate word sequence through a confidence-similarity decoder to obtain a revised text; and processing the revised text through bidirectional machine translation to generate a recovered Chinese character text. The application can realize efficient recovery of Chinese adversarial samples.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of anti-text processing, in particular to a Chinese adversarial sample recovery method based on a Hidden Markov Model (HMM) and a Denoising Autoencoder (DAE). BACKGROUND

[0002] An attacker of a Chinese text adversarial attack generates an adversarial sample by manually creating a character library, thereby bypassing the sensitive word review system of a social network and sending spam messages. Due to the large number of attackers and the various strategies adopted, it is difficult to develop an adversarial defense algorithm for Chinese text.

[0003] Existing defense technologies mainly fall into two categories. The first is traditional spelling correction. By manually constructing a large error correction dictionary, the perturbed fields in the adversarial sample are treated as spelling errors for correction. This method was originally invented to correct errors caused by human errors in typing, so the error types contained in the dictionary are single and difficult to meet the current various styles of adversarial attacks deliberately created. The second is adversarial training, which mixes adversarial samples into the original training set for model training, re-trains or fine-tunes the model, thereby improving the robustness of the model. However, this method also requires the model trainer to collect adversarial samples in advance, and the re-training of the model requires a large amount of time and computing power. At the same time, this method cannot be migrated between different models.

[0004] In summary, the existing technology cannot provide an efficient recovery method for Chinese adversarial text samples. SUMMARY

[0005] To solve the above problems existing in the prior art, the present application provides a Chinese adversarial sample recovery method based on HMM and denoising autoencoder, which does not need to collect a large number of adversarial samples for training, nor does it need to modify the original model. This method saves time and effort and has strong versatility, making it easy to migrate between different models to achieve efficient recovery of Chinese adversarial samples.

[0006] In order to achieve the above technical purpose, the present application provides the following technical scheme: a Chinese adversarial sample recovery method based on HMM and denoising autoencoder, comprising:

[0007] Obtain an adversarial text, and perform symbol cleaning on the adversarial text to retain Chinese characters and English letters in the adversarial text;

[0008] Convert the pinyin string in the adversarial text into a Chinese character sequence based on a Hidden Markov Model (HMM), and concatenate the Chinese character sequence into a Chinese character string;

[0009] The Chinese character and Chinese character string in the adversarial text are denoised by a denoising autoencoder to obtain a candidate word sequence, wherein the denoising autoencoder is constructed based on a BERT model, and the candidate word sequence is sorted according to a corresponding confidence;

[0010] The candidate word sequence is decoded by a confidence-similarity decoder to obtain a revised text.

[0011] The revised text is processed by bidirectional machine translation to generate a recovered Chinese character text.

[0012] Optionally, a regular expression is used to clean up symbols in the adversarial text.

[0013] Optionally, the process of converting the pinyin sequence into a Chinese character sequence includes:

[0014] The pinyin string is split according to the combination of initial and final to convert the pinyin string into a pinyin sequence;

[0015] A directed probabilistic graph is constructed according to the pinyin sequence, and parameters of the directed probabilistic graph are set by training a pre-estimate, wherein the set parameters include a state transition matrix, an observation probability matrix, and an initial state distribution;

[0016] An optimal path of the directed probabilistic graph is solved by a dynamic programming algorithm to obtain a Chinese character sequence.

[0017] Optionally, the dynamic algorithm uses a Viterbi algorithm.

[0018] Optionally, the construction process of the denoising autoencoder includes:

[0019] Noise-free corpus is obtained, and no more than 15% of the words in the noise-free corpus are randomly selected for processing, wherein 80% of the selected words are replaced by “[MASK]”, 10% of the selected words are randomly replaced by other tokens, and 10% of the selected words remain the original token;

[0020] Noise-containing corpus is obtained, and no more than 15% of the words in the noise-containing corpus are randomly selected for processing, wherein the words with spelling errors are replaced by “[MASK]”, and the word vectors corresponding to the words with spelling errors are directed to the correct word vectors, and the words without spelling errors are replaced by “[MASK]”, and the word vectors corresponding to the words without spelling errors are directed to the original word vectors;

[0021] A BERT model is constructed, and the BERT model is pre-trained by the processed noise-free corpus and the processed noise-containing corpus to generate a denoising autoencoder.

[0022] Optionally, the process of decoding the candidate word sequence comprises:

[0023] The similarity of the candidate words in the candidate word sequence is evaluated to obtain a text similarity score;

[0024] According to the confidence corresponding to the candidate word and the text similarity score, a filtering curve is fitted, wherein the filtering curve is fitted by a polynomial expansion method;

[0025] The candidate word is filtered through the filtering curve to generate a revised text.

[0026] Optionally, the process of evaluating the similarity of the candidate word comprises:

[0027] The candidate word is respectively evaluated for font similarity and pronunciation similarity, the pronunciation similarity evaluation result is assigned a weight, and the sum of the font similarity evaluation result and the pronunciation similarity evaluation result after being assigned a weight is calculated by a normalization function to obtain a text similarity score.

[0028] Optionally, the process of processing the revised text comprises:

[0029] The revised text is translated into a third-party language by a trained machine translation model, and then translated back into Chinese to generate a restored Chinese character text.

[0030] The present application has the following technical effects:

[0031] In the scenario where the Chinese natural language processing model is subjected to an adversarial attack, the present application can effectively restore the erroneous Chinese text, and can improve the model robustness by prepositioning a Chinese adversarial sample restoration component based on a hidden Markov model and a denoising autoencoder at the entrance of the natural language processing model without retraining the original model, to defend against Chinese text adversarial attacks. BRIEF DESCRIPTION OF DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed in the embodiments. Obviously, the drawings described below are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0033] Figure 1 The overall flowchart provided by the embodiments of the present application is shown in the figure;

[0034] Figure 2 The hidden Markov model for converting pinyin to Chinese characters provided by the embodiments of the present application is shown in the figure;

[0035] Figure 3The figure shows the maximum probability path of the second layer to the third layer node provided by the Viterbi algorithm of the embodiment of the present application.

[0036] Figure 4 The figure shows the maximum probability path of the third layer to the fourth layer node provided by the Viterbi algorithm of the embodiment of the present application.

[0037] Figure 5 The figure shows the IDS split Chinese character provided by the embodiment of the present application.

[0038] Figure 6 The figure shows the confidence-similarity decoder example provided by the embodiment of the present application.

[0039] Figure 7 The figure shows the defense effect of the MLRC and the baseline task provided by the embodiment of the present application. DETAILED DESCRIPTION

[0040] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the protection scope of the present application.

[0041] In view of the problem that the prior art cannot effectively provide a recovery method for Chinese counter-text samples, the present application aims to provide a Chinese natural language processing model pre-defense component. Through a series of steps, including symbol cleaning, Viterbi algorithm pinyin-to-Chinese character technology based on a hidden Markov model, Chinese character spelling correction technology based on a noise reduction autoencoder, and bidirectional translation technology based on machine translation, the component can recover counter samples containing counter disturbances into harmless text content and input the natural language processing model, thereby achieving the defense purpose of counter attacks.

[0042] As shown in Figure 1 , the present application can obtain recovered text by performing the following operations on the input counter samples, and the related content will be described as follows:

[0043] (1) Symbol cleaning. The characters of the counter text are filtered using a regular expression, and the regular expression used is [^\u4e00-\u9fa5^a-zA-Z]+, wherein \u4e00-\u9fa5 is the Chinese character interval under UTF-8 encoding, and this regular expression only retains Chinese characters and English letters in the text.

[0044] (2) Pinyin to Hanzi. The Pinyin string in the text is operated as follows: (a) Pinyin segmentation. The Pinyin string is split according to the combination of initial and final, and the continuous Pinyin string is converted into a Pinyin sequence, and each element in the sequence can be converted into a Hanzi; (b) using the Viterbi algorithm based on the hidden Markov model to convert the Pinyin sequence into a Hanzi sequence; (c) the Hanzi sequence is spliced into a Hanzi string again.

[0045] (3) Hanzi spelling correction. The adversarial sample is corrected at the sentence level using the Hanzi spelling correction technology based on the denoising autoencoder to generate a corrected text sequence.

[0046] (4) Bidirectional machine translation. The corrected text is first translated into a third-party language by a trained machine translation model, and then translated back into Chinese.

[0047] The core technology of the present application has two parts, namely the Pinyin to Hanzi technology based on the hidden Markov model and the Hanzi spelling correction technology based on the denoising autoencoder, which are described in detail as follows.

[0048] (I) Pinyin to Hanzi technology based on hidden Markov model.

[0049] The present application takes the Pinyin sequence corresponding to the input adversarial text as a continuous signal, and the problem of Pinyin to Hanzi can be converted into a signal decoding problem in the field of communication. The signal decoding is essentially a prediction problem of a hidden Markov model, that is, a problem of finding the maximum probability path of a lattice network directed probability graph using a dynamic programming algorithm. The hidden Markov model is a lattice network directed probability graph structure as shown in Figure 2 , which can be solved using the Viterbi algorithm.

[0050] Suppose the input Pinyin sequence is O = o1, o2, …, o T , and the corresponding Hanzi sequence is S = s1, s2, …, s T , T is the number of layers of the probability graph, and the mapping from O to S is not unique, but the probability of each state mapping is not the same, and the mapping with the maximum probability needs to be solved

[0051] In the hidden Markov model, S is theoretically referred to as a hidden state, and O is referred to as an observation sequence. Through training corpus, the following information can be known:

[0052] State transition matrix A, a ij is an element of A, where a ij represents the probability of the i-th hidden state (Hanzi) s i transferring to the j-th hidden state (Hanzi) s j ; observation probability matrix B, b i (ot Let b be an element of B, where b i (o t ) represents the i-th hidden state (Chinese character) s i The input observed at time t is the observed state (in pinyin) o t The probability; the initial state distribution π, the model is in the i-th hidden state (Chinese character) s at the initial time. i The probability of.

[0053] Define δ t (i) represents time t, where the hidden state is s. i All possible transition paths s1, s2, ..., s t The maximum probability in Ψ t (i) represents the hidden state at time t, s. i If the path with the highest probability among all individual paths is the (t-1)th node, then the optimal path can be found using the Viterbi algorithm proposed by Andrew Viterbi in 1967. The specific steps are as follows:

[0054]

[0055]

[0056] The Viterbi algorithm is a dynamic programming algorithm that finds the global optimum by calculating local optima. (Reference) Figure 2 For each i-th layer observation state (pinyin) O of the observable sequence (pinyin sequence) O i Each corresponds to multiple possible hidden state (Chinese character) nodes S at the i-th level and j-th position. ij These hidden states form a layer of hidden nodes, starting from a certain hidden state node S in the second layer. 2j First, search for the hidden state node S from the second level. 2j To the third hidden state node S 3j The path with the highest probability for each node, we assume, leads to the first hidden state node S in the third layer. 31 The maximum probability path is S 21 →S 31 To the second hidden state node S in the third layer 32 The path with the highest probability is S 23 →S 32 ,like Figure 3 Therefore, the overall maximum probability path must not pass through the second hidden state node S in the second layer. 22 The fourth hidden state node S in the second layer 24 Then you can delete S. 1j →S22 and S 1j →S 24 all the paths of S Figure 4 For the next path, the same step is recursively performed until the end of the sequence. Finally, the path probability of S 1j →S 2j is calculated in reverse, the global maximum probability path is obtained, and the hidden states (Chinese characters) on the global maximum probability path are extracted in turn to generate the corresponding Chinese character sequence.

[0057] (ii) Chinese character spelling correction algorithm based on denoising auto-encoder.

[0058] The framework of the spelling correction scheme of the application is an encoding-decoding framework, and the whole scheme is divided into two parts of encoder and decoder. Respectively, denoising auto-encoder (DAE, Denoising Auto-Encoder) and confidence-similarity decoder (CSD, Confidence-Similarity Decoder).

[0059] (1) Denoising auto-encoder.

[0060] The denoising auto-encoder is an encoder containing random noise in the input. Unlike the task of traditional auto-encoder, which is to compress the input data into low-dimensional encoding, the task of denoising auto-encoder is to remove noise from the input data. According to the principle of denoising auto-encoder, the BERT model can be fine-tuned to become a denoising auto-encoder. The specific method is as follows:

[0061] (a) For the corpus without noise (i.e. the sentence without error), randomly select no more than 15% of the words in the corpus to perform the following operations: 80% of the selected words are replaced with "[MASK]", 10% of the words are randomly replaced with other tokens, and 10% of the words remain the original token.

[0062] (b) For the corpus with noise (i.e. the sentence with error), randomly select no more than 15% of the words in the corpus to perform the following operations: for the word with spelling error, replace it with "[MASK]" and point its word vector to the word vector of the corresponding correct word, for the word without spelling error, replace it with "[MASK]" and its word vector still points to the original word vector, through the above content, the relevant task is trained to avoid overfitting.

[0063] The fine-tuned BERT model already has certain noise reduction capability, which can predict what the word at each position in the sentence is likely to be through the context, and generate a candidate word sequence from high to low according to the confidence. If the original word is ranked very high in the candidate word sequence, then the word at this position is very likely to be correct. If the original word at this position is very low in the confidence sequence, or not in the candidate word sequence, then the word is very likely to be wrong.

[0064] (2) Confidence-similarity decoder.

[0065] The similarity of the candidate word and the original word text can be evaluated from the aspects of the shape and the pronunciation of the word.

[0066] Chinese characters can be transcribed into pinyin represented by Latin letters, and pinyin can intuitively represent the pronunciation of a Chinese character. Pinyin is composed of initial, final and tone, and the similarity of the pronunciation of Chinese characters can be compared through these three parts. For the initial and final, the edit distance between the initial and final of the pinyin corresponding to the Chinese character is directly taken as the similarity score. For the tone, the exclusive or can be taken, and 0 points are counted for the same tone, and 1 point is counted for different tones. The total pronunciation similarity score D p is the sum of the three.

[0067] For the shape similarity, Ideographic Description Characters (IDC) are used for evaluation. IDC is a section of the Unicode standard, which is used to describe the structure and composition of Chinese characters. The encoding and corresponding order of characters are shown in Table 1. Any Chinese character can be continuously split into an Ideographic Description Sequence (IDS), such as Figure 5 The IDS edit distance between Chinese characters can be calculated to obtain the shape similarity score D s .

[0068] Table 1

[0069]

[0070] The total Chinese character similarity score is sim=softmax(D s +λD p ), where softmax is a normalization function, so that sim∈[0, 1].

[0071] The filtering curve can be determined by combining the confidence of the candidate word and the similarity of the Chinese character. For example, Figure 6, the horizontal axis is the confidence of the candidate word given by the denoising autoencoder for the suspected wrong word, the vertical axis is the similarity of these candidate words with the original word, the circle represents the Chinese character that correctly discovers the error and successfully corrects (detection-true-correction-true, DT-CT), the triangle represents the Chinese character that correctly discovers the error but fails to correct (detection-true-correction-false, DT-CF), the cross represents the Chinese character that does not discover the error (detection-false, DF), and the black line is the fitted curve (Fitted curve) obtained by polynomial expansion (more accurate Taylor expansion can be used). In Figure 6 It can be seen in that the corrected successful words are closer to the upper right corner of the graph, and the corrected failed words are closer to the lower left corner, and the corrected successful and corrected failed words can be distinguished to a large extent, and by this method, only the part under the fitted filtering curve needs to be filtered out according to the fitted filtering curve.

[0072] In order to comprehensively and accurately evaluate the usability of the text recovery algorithm, the present application designs the following evaluation indexes and introduces them in detail:

[0073] (1) Correction success rate (CT, correction-true), which represents the accuracy rate of the output result of the modified adversarial sample through the original neural network operation being the same as the original sample, is a basic index for measuring the effectiveness of a text adversarial defense algorithm, and is also an index closest to the actual defense scene.

[0074] (2) Attack success correction success rate (ATCT, attack-true-correction-true), which represents the accuracy rate of the output result of the modified adversarial sample through the original neural network operation being the same as the original sample in the attack successful adversarial sample, is the most intuitive index reflecting the performance of the defense algorithm.

[0075] (3) Attack failure correction error rate (AFCF, attack-false-correction-false), which represents the error rate of the output result of the modified adversarial sample through the original neural network operation being different from the original sample in the attack failed adversarial sample, which is equivalent to helping the original adversarial sample that does not attack successfully attack successfully, and this index shows the probability of the worst performance of the recovery defense algorithm.

[0076] In Figure 7In the middle, MLRC is the method of the invention, Pycorrector and Textcorrector are two existing text correction methods. We use a text adversarial attack method called MCGC to attack three natural language processing models, Text-CNN, Bi-LSTM and BERT-Chinese, and restore the adversarial samples generated by the attack. Figure 7 In the middle, the ordinate is the accuracy, the original accuarcy corresponds to the curve of the accuracy of the original text under the natural language model, the MCGC Black-Box corresponds to the curve of the success rate of the MCGC black-box attack on the original text, and the height of the columnar chart represents the accuracy of the text corrected by the text correction algorithm under the natural language model. Figure 7 In the middle, it can be seen that the adversarial sample recovery ability of the present application is the best.

[0077] The above is only the preferred specific embodiment of the present application, but the protection scope of the present application is not limited to this, any person skilled in the art can easily think of changes or replacements within the technical scope disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for recovering Chinese adversarial examples based on Hidden Markov Models (HMMs) and denoising autoencoders, characterized in that, include: Obtain the adversarial text, perform symbol cleanup on the adversarial text, and retain the Chinese characters and English letters in the adversarial text; Based on the Hidden Markov Model, the Pinyin string in the adversarial text is converted into a Chinese character sequence, and the Chinese character sequence is concatenated into a Chinese character string. The process of converting the pinyin sequence into a Chinese character sequence includes: The pinyin string is split according to the combination of initials and finals in order to convert the pinyin string into a pinyin sequence; A directed probability graph is constructed based on the pinyin sequence, and the parameters of the directed probability graph are set through training. The parameters set include the state transition matrix, the observation probability matrix, and the initial state distribution. The optimal path is obtained by using dynamic programming to solve the directed probability graph, thus obtaining the Chinese character sequence. The dynamic algorithm mentioned above uses the Viterbi algorithm; The Chinese characters and strings in the adversarial text are noise-removed by a denoising autoencoder to obtain a candidate word sequence. The denoising autoencoder is constructed based on the BERT model, and the candidate word sequence is sorted according to the corresponding confidence level. The construction process of the noise reduction autoencoder includes: Obtain a noise-free corpus, randomly select no more than 15% of the words in the noise-free corpus for processing, of which 80% of the selected words are replaced with "[MASK]", 10% of the selected words are randomly replaced with other tokens, and 10% of the selected words retain their original tokens. Obtain noisy corpus, randomly select no more than 15% of the words in the noisy corpus for processing. Words with spelling errors are replaced with "[MASK]" and the word vectors corresponding to the words with spelling errors are pointed to the correct word vectors. Words without spelling errors are replaced with "[MASK]" and the word vectors corresponding to the words without spelling errors are pointed to the original word vectors. A BERT model is constructed, and the BERT model is pre-trained using both processed noiseless and processed noisy corpora to generate a denoised autoencoder. The candidate word sequence is decoded using a confidence-similarity decoder to obtain the corrected text; The process of decoding the candidate word sequence includes: The similarity of candidate words in the candidate word sequence is evaluated to obtain a text similarity score; Based on the confidence score and text similarity score of the candidate words, a filtering curve is fitted, wherein the filtering curve is fitted using a polynomial expansion method; Candidate words are filtered using a filtering curve to generate corrected text; The corrected text is processed by bidirectional machine translation to generate the restored Chinese text.

2. The method according to claim 1, characterized in that: Regular expressions are used to perform symbol cleaning on adversarial text.

3. The method according to claim 1, characterized in that: The process of evaluating the similarity of candidate words includes: The candidate words are evaluated for both glyph similarity and phonetic similarity. Weights are assigned to the phonetic similarity evaluation results. The sum of the glyph similarity evaluation results and the weighted phonetic similarity evaluation results is calculated using a normalization function to obtain the text similarity score.

4. The method according to claim 1, characterized in that: The process of processing the corrected text includes: The corrected text is translated into a third-party language using a trained machine translation model, and then translated back into Chinese to generate the restored Chinese text.

Images