Text Classification Model Adversarial Defense via Saliency Replacement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for defending against adversarial attacks on text classification models require additional training data and algorithms, making them unsuitable for real-time responses and resource-constrained environments.
Innovation Solution
A text classification apparatus that determines anomalies in input text using an auto-encoder model and replaces high-saliency words with synonyms to generate alternative texts, which are then classified by the model, allowing for real-time defense against adversarial attacks without additional training.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If additional training data and algorithms are used to defend against adversarial attacks, then reliability is improved, but device complexity and loss of time increase
Solution Approach 1:
The patent creates multiple copies of the input text by replacing salient words with alternative words (synonyms, random words, or space characters). These copied texts are then classified independently, and the final classification is determined by majority voting. This approach defends against adversarial attacks without requiring complex additional training algorithms, thus improving reliability while avoiding increased device complexity.
Solution Approach 2:
The patent performs preliminary identification of salient words in the input text before classification. By detecting which words have the most impact on the classification result and replacing them in advance with alternative words, the system prepares multiple variations of the text that are then used for robust classification. This preliminary action enables defense against adversarial attacks using simple majority voting rather than complex algorithms.
2Reliability
If additional training data and algorithms are used to defend against adversarial attacks, then reliability is improved, but loss of time increases
Solution Approach 1:
The patent generates multiple copies of the input text by replacing salient words with alternative words and classifies each copy using the existing classification model. The final result is determined by majority voting among these classifications. This approach provides robust defense against adversarial attacks while maintaining fast response times because it uses the existing model rather than requiring additional training or complex algorithms.
Solution Approach 2:
The patent uses the existing classification model to identify salient words and determine their impact on classification results. By leveraging the model's own internal mechanisms (such as attention weights or gradient information) to guide the replacement process, the system defends against adversarial attacks using self-service rather than requiring external training data or additional algorithms, thus avoiding time loss.
3Reliability
If salient words are replaced with alternative words, then robustness against adversarial attacks is improved, but loss of information increases
Solution Approach 1:
The patent applies word replacement only to salient words (those with high impact on classification results) rather than replacing all words in the text. By selectively replacing only the most critical words with alternative words and maintaining other words unchanged, the system achieves robustness against adversarial attacks while preserving the semantic information contained in non-salient words.
Solution Approach 2:
The patent creates multiple copies of the text with different word replacements and uses majority voting to determine the final classification. This approach ensures that even if some replacements cause information loss in individual copies, the original semantic information is preserved in other copies, and the majority vote recovers the correct classification, thus minimizing overall information loss while improving robustness.
Data Source
AI summary
A method and apparatus for classifying a text using a text classification model are disclosed. In one general aspect, an apparatus is for outputting a classification result for an input text including words by using a text classification model, and the apparatus includes: one or more processors; a memory including instructions configured to cause the one or more processors to: determine whether the input text indicates an anomaly; and responsive to determining that the input text indicates an anomaly: determine saliencies of the respective words; select target words from among the words based on the saliencies; generate a replaced text by replacing, in the input text, the selected words with other words; and obtain a text classification result of the input text based on an inference upon the replaced text by the text classification model receiving the replaced text as an input.