Chinese adversarial sample recovery method based on HMM and denoising auto-encoder

Abstract

The present invention relates to the technical field of adversarial text processing, and disclosed is a Chinese adversarial sample recovery method based on an HMM and a denoising auto-encoder. The method comprises: acquiring an adversarial text, and carrying out symbol cleaning on the adversarial text; converting pinyin strings in the adversarial text into Chinese character sequences on the basis of a hidden Markov model, and splicing the Chinese character sequences into Chinese character strings; performing denoising on the Chinese characters and the Chinese character strings in the adversarial text by means of a denoising auto-encoder, so as to obtain a candidate word sequence; decoding the candidate word sequence by means of a confidence-similarity decoder, so as to obtain a corrected text; and processing the corrected text by means of bidirectional machine translation to generate a recovered Chinese character text. The present invention can achieve efficient recovery of Chinese adversarial samples.

Description

A Chinese adversarial sample recovery method based on HMM and denoising autoencoder Technical Field

[0001] The present invention relates to the field of adversarial text processing technology, and in particular to a Chinese adversarial sample recovery method based on a Hidden Markov Model (HMM) and a Denoising Autoencoder (DAE). Background Art

[0002] Attackers of Chinese text adversarial attacks generate adversarial samples by hand-crafting character libraries, thereby bypassing the sensitive word censorship system of social networks and sending spam messages. Due to the large number of attackers and the variety of variant strategies they adopt, it is difficult to develop adversarial defense algorithms for Chinese text.

[0003] Existing defense technologies fall into two main categories. The first is traditional spelling correction. This involves manually constructing a massive error correction dictionary, treating the perturbed fields in adversarial examples as spelling errors and correcting them accordingly. This method was originally invented to correct errors caused by human error in typing, so the error types contained in the dictionary are limited and difficult to withstand the various types of deliberately crafted adversarial attacks currently in use. The second is adversarial training, which involves retraining or fine-tuning the model by incorporating adversarial examples into the original training set for model training, thereby improving its robustness. However, this method also requires the model trainer to collect adversarial examples in advance, and retraining the model consumes a significant amount of time and computing power. Furthermore, this method cannot be transferred between different models.

[0004] In summary, the existing technology cannot provide an efficient recovery method for Chinese adversarial text samples.

[0005] Summary of the Invention

[0006] In order to solve the problems existing in the above-mentioned prior art, the present invention provides a Chinese adversarial sample recovery method based on HMM and denoising autoencoder. It does not require the collection of a large number of adversarial samples for training, nor does it require the modification of the original model. This method saves time and effort, has strong versatility, and is convenient for migration between different models to achieve efficient recovery of Chinese adversarial samples.

[0007] In order to achieve the above technical objectives, the present invention provides the following technical solutions: a Chinese adversarial sample recovery method based on HMM and denoising autoencoder, comprising:

[0008] Obtain the adversarial text, perform symbol cleaning on the adversarial text, and retain the Chinese characters and English letters in the adversarial text;

[0009] Converting the pinyin string in the adversarial text into a Chinese character sequence based on a hidden Markov model, and concatenating the Chinese character sequence into a Chinese character string;

[0010] Denoising the Chinese characters and Chinese character strings in the adversarial text using a denoising autoencoder to obtain a candidate word sequence, wherein the denoising autoencoder is constructed based on the BERT model, and the candidate word sequences are sorted according to corresponding confidence levels;

[0011] Decoding the candidate word sequence using a confidence-similarity decoder to obtain a corrected text;

[0012] The corrected text is processed by bidirectional machine translation to generate a restored Chinese character text.

[0013] Optionally, regular expressions are used to clean the adversarial text.

[0014] Optionally, the process of converting the pinyin sequence into a Chinese character sequence includes:

[0015] Splitting the pinyin string according to the combination of initial consonants and finals to convert the pinyin string into a pinyin sequence;

[0016] Constructing a directed probability graph according to the pinyin sequence, and setting parameters of the directed probability graph through training prediction, wherein the set parameters include a state transfer matrix, an observation probability matrix and an initial state distribution;

[0017] The optimal path of the directed probability graph is solved by the dynamic programming algorithm to obtain the Chinese character sequence.

[0018] Optionally, the dynamic algorithm adopts the Viterbi algorithm.

[0019] Optionally, the construction process of the denoising autoencoder includes:

[0020] Obtain noise-free corpus and randomly select no more than 15% of the words in the noise-free corpus for processing. 80% of the selected words are replaced with "[MASK]", 10% of the selected words are randomly replaced with other tokens, and 10% of the selected words retain the original tokens.

[0021] Obtain noisy corpus and randomly select no more than 15% of the words in the noisy corpus for processing. The misspelled words are replaced with "[MASK]" and the word vectors corresponding to the misspelled words are pointed to the correct word vectors. The non-spelled words are replaced with "[MASK]" and the word vectors corresponding to the non-spelled words are pointed to the original word vectors.

[0022] Build a BERT model, pre-train the BERT model using the processed noise-free corpus and the processed noisy corpus to generate a denoising autoencoder.

[0023] Optionally, the process of decoding the candidate word sequence includes:

[0024] Perform similarity evaluation on the candidate words in the candidate word sequence to obtain a text similarity score;

[0025] Fitting a filtering curve according to the confidence scores and text similarity scores corresponding to the candidate words, wherein the filtering curve is fitted by a polynomial expansion method;

[0026] The candidate words are filtered through the filtering curve to generate the revised text.

[0027] Optionally, the process of evaluating the similarity of candidate words includes:

[0028] The candidate words are evaluated for glyph similarity and pronunciation similarity respectively, weights are assigned to the glyph similarity evaluation results, and the sum of the glyph similarity evaluation results and the weighted pronunciation similarity evaluation results is calculated through a normalization function to obtain a text similarity score.

[0029] Optionally, the process of processing the revised text includes:

[0030] The corrected text is translated into a third-party language using a trained machine translation model, and then the third-party language is translated back into Chinese to generate the restored Chinese text.

[0031] The present invention has the following technical effects:

[0032] In the scenario where the Chinese natural language processing model is subjected to adversarial attacks, the present invention can effectively recover erroneous Chinese text. Without retraining the original model, the model robustness can be improved by prepending a Chinese adversarial sample recovery component based on a hidden Markov model and a denoising autoencoder at the entrance of the natural language processing model to defend against adversarial attacks on Chinese text. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0034] FIG1 is a schematic diagram of an overall process provided by an embodiment of the present invention;

[0035] FIG2 is a schematic diagram of a hidden Markov model for converting pinyin to Chinese characters provided by an embodiment of the present invention;

[0036] FIG3 is a schematic diagram of a Viterbi algorithm for finding the maximum probability path from the second layer to the third layer nodes according to an embodiment of the present invention;

[0037] FIG4 is a schematic diagram of a Viterbi algorithm for finding the maximum probability path from the third layer to the fourth layer nodes according to an embodiment of the present invention;

[0038] FIG5 is a schematic diagram of IDS splitting Chinese characters according to an embodiment of the present invention;

[0039] FIG6 is a schematic diagram of an example of a confidence-similarity decoder provided by an embodiment of the present invention;

[0040] FIG7 is a schematic diagram of the defense effect of MLRC and baseline tasks provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0041] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0042] In response to the problem that the above-mentioned existing technologies cannot effectively provide a method for recovering Chinese adversarial text samples, the present invention aims to provide a front-end defense component for a Chinese natural language processing model. This component, through a series of steps including symbol cleaning, pinyin-to-Chinese character conversion technology based on the Viterbi algorithm of the hidden Markov model, Chinese character spelling correction technology based on the denoising autoencoder, and bidirectional translation technology based on machine translation, recovers adversarial samples containing adversarial perturbations into harmless text content and inputs it into the natural language processing model, thereby achieving the purpose of defending against adversarial attacks.

[0043] As shown in FIG1 , the present invention performs the following operations on the input adversarial sample to obtain the recovered text. The relevant contents are now described:

[0044] (1) Symbol cleaning. Use regular expressions to filter characters in the adversarial text. The regular expression used is [^\u4e00-\u9fa5^a-zA-Z]+, where \u4e00-\u9fa5 is the Chinese character range under UTF-8 encoding. This regular expression only retains Chinese characters and English letters in the text.

[0045] (2) Pinyin to Chinese characters. The pinyin strings in the text are subjected to the following operations: (a) Pinyin segmentation. The pinyin strings are split according to the combination of initials and finals, and the continuous pinyin strings are converted into pinyin sequences. Each element in the sequence can be converted into a Chinese character; (b) The pinyin sequence is converted into a Chinese character sequence using the Viterbi algorithm based on the hidden Markov model; (c) The Chinese character sequence is reassembled into a Chinese character string.

[0046] (3) Chinese character spelling correction. The Chinese character spelling correction technology based on denoising autoencoder is used to correct the adversarial samples at the sentence level and generate a corrected text sequence.

[0047] (4) Bidirectional machine translation: The corrected text is first translated into a third language using a trained machine translation model, and then the text is translated back into Chinese.

[0048] The present invention has two core technologies, namely, the pinyin-to-Chinese character technology based on the hidden Markov model and the Chinese character spelling error correction technology based on the noise reduction autoencoder, which are respectively described in detail below.

[0049] (1) Pinyin-to-Chinese character technology based on hidden Markov model.

[0050] The present invention uses the pinyin sequence corresponding to the input adversarial text as a continuous signal. The problem of converting pinyin to Chinese characters can be converted into a signal decoding problem in the communication field. Signal decoding is essentially a prediction problem of a hidden Markov model, that is, using a dynamic programming algorithm to find the maximum probability path of a lattice network (lattice) directed probability graph. The hidden Markov model, that is, the structure of the lattice network directed probability graph is shown in Figure 2, and can be solved using the Viterbi algorithm.

[0051] Assume that the input pinyin sequence is O=o1, o2, ..., o T , the corresponding Chinese character sequence is S=s1,s2,...,s T , T is the number of nodes in the probability graph. The mapping from O to S is not unique, but the probability of each state mapping is not the same. It is necessary to solve the mapping with the highest probability among these mappings.

[0052] In the Hidden Markov Model, theoretically, S is called the hidden state and O is called the observation sequence. Through the training corpus, we can know the following information:

[0053] State transition matrix A,a ij is an element of A, where a ij Represents the i-th hidden state (Chinese character) s i Transfer to the jth hidden state (Chinese character) s j The probability of observation probability matrix B, b i (o t) is an element of B, where b i (o t ) indicates the i-th hidden state (Chinese character) s i The input observed at time t is the observed state (pinyin) o t The probability of initial state distribution π, the model is the i-th hidden state (Chinese character) s at the initial moment i probability.

[0054] Define δ t (i) is time t, and the hidden state is s i All possible transition paths s1, s2, ..., s t The maximum probability in Ψ t (i) The hidden state at time t is s i The optimal path is the t-1th node of the path with the highest probability among all individual paths. The Viterbi algorithm proposed by Andrew Viterbi in 1967 can be used to solve the problem. The specific solution steps are as follows:

[0055] The Viterbi algorithm is a dynamic programming algorithm that seeks the global optimal solution by calculating the local optimal solution. i , which correspond to multiple possible hidden state (Chinese characters) nodes S in the i-th layer ij , these hidden states form a layer of hidden nodes, from a hidden state node S in the second layer 2j To begin, first look for the hidden state node S from the second layer 2j To the third layer hidden state node S 3j The maximum probability path for each node, we assume to be the first hidden state node S in the third layer 31 The maximum probability path is S 21 →S 31 , to the second hidden state node S in the third layer 32 The maximum probability path is S 23 →S 32 , as shown in Figure 3. Then the overall maximum probability path must not pass through the second hidden state node S in the second layer. 22 and the fourth hidden state node S in the second layer 24 , then you can delete S 1j →S 22 and S 1j →S 24All paths are shown in Figure 4. For the next path, recursively perform the same steps until the end of the sequence. Finally, reversely calculate which S 1j →S 2j The path probability is the largest, and the global maximum probability path can be obtained. The hidden states (Chinese characters) on the global maximum probability path are extracted in turn to generate the corresponding Chinese character sequence.

[0056] (2) Chinese character spelling correction algorithm based on denoising autoencoder.

[0057] The framework of the spelling correction solution of the present invention is an encoder-decoder framework, which consists of two parts: an encoder and a decoder. They are respectively a denoising auto-encoder (DAE) and a confidence-similarity decoder (CSD).

[0058] (1) Noise Reduction Autoencoder.

[0059] A denoising autoencoder is an encoder whose input contains random noise. Unlike traditional autoencoders, which compress input data into low-dimensional codes, a denoising autoencoder removes noise from the input data. Based on the principles of a denoising autoencoder, the BERT model can be fine-tuned to become a denoising autoencoder. The specific steps are as follows:

[0060] (a) For a corpus without noise (i.e., a sentence with no errors), randomly select no more than 15% of the words in the corpus and perform the following operation: 80% of the selected words are replaced with "[MASK]", 10% of the words are randomly replaced with other tokens, and 10% of the words retain the original tokens.

[0061] (b) For noisy corpus (i.e., corpus with errors in sentences), randomly select no more than 15% of the words in the corpus and perform the following operations: For words with spelling errors, use "[MASK]" to replace them, and point their word vectors to the word vectors of the corresponding correct words. For words without spelling errors, after using "[MASK]" to replace them, their word vectors still point to the original word vectors. The above content is used to train related tasks to avoid overfitting.

[0062] The fine-tuned BERT model already has a certain degree of noise reduction capability. It can predict the possible word at each position in the sentence based on the context and generate a candidate word sequence from high to low based on the confidence level. If the original word ranks very high in the candidate word sequence, then the word at this position is very likely to be correct. If the original word at this position ranks very low in the confidence sequence, or is not in the candidate word sequence, then the word is very likely to be incorrect.

[0063] (2) Confidence-similarity decoder.

[0064] The similarity between the candidate word and the original word can be evaluated from two aspects: the shape and the pronunciation.

[0065] Chinese characters can be transcribed into pinyin represented by Latin letters. Pinyin can intuitively represent the pronunciation of a Chinese character. Pinyin consists of three parts: initial consonant, final vowel, and tone. These three parts can be used to compare the similarity of Chinese character pronunciation. For initial consonants and final vowels, the edit distance between the initial consonant and final vowel of the pinyin corresponding to the Chinese character is directly used as the similarity score. For tones, the XOR can be used. The same tone is scored as 0, and different tones are scored as 1. The total pronunciation similarity score D p It is the sum of the three.

[0066] For glyph similarity, ideographic description characters (IDC) are used for evaluation. IDC is a section of the Unicode standard that is used to describe the structure and composition of Chinese characters. The corresponding order of its encoding and characters is shown in Table 1. Any Chinese character can be continuously split into ideographic description sequences (IDS), as shown in Figure 5. By calculating the IDS edit distance between Chinese characters, the glyph similarity score D can be obtained. s .

[0067] Table 1

[0068] The total Chinese character similarity score is sim=softmax(D s +λD p ), where softmax is a normalization function such that sim∈[0,1].

[0069] The filtering curve can be determined by combining the confidence of candidate words and the similarity of Chinese characters. As shown in Figure 6, the horizontal axis is the confidence of the candidate words given by the denoising autoencoder for suspected error words, and the vertical axis is the similarity between these candidate words and the original words. Circles represent Chinese characters that were correctly detected and corrected (detection-true-correction-true, DT-CT), triangles represent Chinese characters that were correctly detected but failed to be corrected (detection-true-correction-false, DT-CF), and crosses represent Chinese characters that were not detected (detection-false, DF). The black line is the fitted filtering curve obtained by polynomial expansion (Taylor expansion can be used for more precision). As can be seen in Figure 6, successfully corrected words are closer to the upper right corner of the graph, while uncorrected words are closer to the lower left corner. This allows for a significant distinction between successfully and uncorrected words. With this method, the portion below the fitted filtering curve can be simply filtered out.

[0070] In order to comprehensively and accurately evaluate the usability of the text recovery algorithm, the present invention designs the following evaluation indicators and introduces them in detail:

[0071] (1) Correction success rate (CT, correction-true), which indicates the accuracy rate at which the output of the corrected adversarial sample after the original neural network operation is the same as the original sample. It is the basic indicator for measuring the effectiveness of a text adversarial defense algorithm and is also the indicator that is closest to the actual defense scenario.

[0072] (2) Attack-true-correction-true success rate (ATCT) refers to the accuracy rate of the corrected adversarial samples in the adversarial samples that are successfully attacked, and the output results after the original neural network operation are the same as the original samples. It is the most intuitive indicator of the performance of the defense algorithm.

[0073] (3) Attack-false-correction-false error rate (AFCF) indicates the error rate of the adversarial samples that failed to attack, and the output of the corrected adversarial samples after the original neural network operation is different from the original samples. This is equivalent to helping the adversarial samples that did not attack successfully to attack successfully. This indicator shows the probability of the recovery defense algorithm discovering the worst performance.

[0074] In Figure 7, MLRC is the method invented in this paper, while Pycorrector and Textcorrector are two existing text correction methods. We used a text adversarial attack method called MCGC to attack three natural language processing models, Text-CNN, Bi-LSTM, and BERT-Chinese, and recovered the adversarial examples generated by the attacks. The vertical axis in Figure 7 represents accuracy. The curve corresponding to Original Accuracy represents the accuracy of the original text under the natural language model, and the curve corresponding to MCGC Black-Box represents the success rate of the MCGC black-box attack on the original text. The height of the bar graph represents the accuracy of the text corrected by the text correction algorithm under the natural language model. As shown in Figure 7, our method has the best ability to recover from adversarial examples.

[0075] The above are merely preferred embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A Chinese adversarial sample recovery method based on HMM and denoising autoencoder, characterized in that: include: Obtain adversarial text, perform symbol cleaning on the adversarial text, and retain Chinese characters and English alphabet characters in the adversarial text; Based on a hidden Markov model, the pinyin string in the adversarial text is converted into a Chinese character sequence, and the Chinese character sequence is spliced ​​into a Chinese character string; Denoising the Chinese characters and Chinese character strings in the adversarial text by using a denoising autoencoder to obtain a candidate word sequence, wherein the denoising autoencoder is constructed based on a BERT model, and the candidate word sequence is sorted according to corresponding confidence levels; Decoding the candidate word sequence by a confidence-similarity decoder to obtain a corrected text; The corrected text is processed by bidirectional machine translation to generate a restored Chinese character text.

2. The method according to claim 1, characterized in that: Regular expressions are used to clean symbols from adversarial text.

3. The method according to claim 1, characterized in that: The process of converting the pinyin sequence into a Chinese character sequence includes: Splitting the pinyin string according to the combination of initial consonants and finals to convert the pinyin string into a pinyin sequence; Constructing a directed probability graph according to the pinyin sequence, and setting parameters of the directed probability graph through training prediction, wherein the set parameters include a state transfer matrix, an observation probability matrix and an initial state distribution; The optimal path of the directed probability graph is solved through a dynamic programming algorithm to obtain the Chinese character sequence.

4. The method according to claim 3, characterized in that: The dynamic algorithm adopts the Viterbi algorithm.

5. The method according to claim 1, characterized in that: The construction process of the denoising autoencoder includes: Obtain noise-free corpus, randomly select no more than 15% of the words in the noise-free corpus for processing, of which 80% of the selected words are replaced by "[MASK]", 10% of the selected words are randomly replaced with other tokens, and 10% of the selected words keep the original tokens; Obtain noisy corpus, randomly select no more than 15% of the words in the noisy corpus for processing, replace misspelled words with "[MASK]", and point the word vectors corresponding to misspelled words to the correct word vectors, and replace non-spelled words with "[MASK]", and point the word vectors corresponding to non-spelled words to the original word vectors; Build a BERT model, pre-train the BERT model with the processed noise-free corpus and the processed noisy corpus, and generate a denoising autoencoder.

6. The method according to claim 1, characterized in that: The process of decoding the candidate word sequence includes: Evaluate the similarity of the candidate words in the candidate word sequence to obtain a text similarity score; Fitting a filtering curve according to the confidence and text similarity scores corresponding to the candidate words, wherein the filtering curve is fitted by a polynomial expansion method; The candidate words are filtered through the filtering curve to generate the revised text.

7. The method according to claim 6, characterized in that: The process of evaluating the similarity of candidate words includes: The candidate words are evaluated for glyph similarity and pronunciation similarity respectively, weights are assigned to the pronunciation similarity evaluation results, and the sum of the glyph similarity evaluation results and the weighted pronunciation similarity evaluation results is calculated through a normalization function to obtain a text similarity score.

8. The method according to claim 1, characterized in that: The process of processing the revised text includes: The corrected text is translated into a third-party language using a trained machine translation model, and then the third-party language is translated back into Chinese to generate the restored Chinese text.

Images