Masked Language Model Based Textual Adversarial Example Detection

Zhang, X; Zhang, Z; Zhong, Q; Zheng, X; Zhang, Y; Hu, S; Zhang, LY

Masked Language Model Based Textual Adversarial Example Detection

Zhang, X Zhang, Z

Zhong, Q Zheng, X Zhang, Y

Hu, S Zhang, LY

Permalink

Publisher:: ASSOC COMPUTING MACHINERY
Publication Type:: Conference Proceeding
Citation:: Proceedings of the ACM Conference on Computer and Communications Security, 2023, pp. 925-937
Issue Date:: 2023-07-10

Closed Access

	Filename	Description	Size
	23‘ AsiaCCS MLMD.pdf	Accepted version	781.37 kB	Adobe PDF	View/Open

Copyright Clearance Process

Recently Added
In Progress
Closed Access

This item is closed access and not available.

Full metadata record

Field	Value	Language
dc.contributor.author	Zhang, X
dc.contributor.author	Zhang, Z https://orcid.org/0000-0002-3813-2776
dc.contributor.author	Zhong, Q
dc.contributor.author	Zheng, X
dc.contributor.author	Zhang, Y https://orcid.org/0000-0001-5611-3483
dc.contributor.author	Hu, S
dc.contributor.author	Zhang, LY
dc.date	2023-07-10
dc.date.accessioned	2024-02-01T00:44:18Z
dc.date.available	2024-02-01T00:44:18Z
dc.date.issued	2023-07-10
dc.identifier.citation	Proceedings of the ACM Conference on Computer and Communications Security, 2023, pp. 925-937
dc.identifier.isbn	9798400700989
dc.identifier.issn	1543-7221
dc.identifier.uri	http://hdl.handle.net/10453/175173
dc.description.abstract	Adversarial attacks are a serious threat to the reliable deployment of machine learning models in safety-critical applications. They can misguide current models to predict incorrectly by slightly modifying the inputs. Recently, substantial work has shown that adversarial examples tend to deviate from the underlying data manifold of normal examples, whereas pre-trained masked language models can fit the manifold of normal NLP data. To explore how to use the masked language model in adversarial detection, we propose a novel textual adversarial example detection method, namely Masked Language Model-based Detection (MLMD), which can produce clearly distinguishable signals between normal examples and adversarial examples by exploring the changes in manifolds induced by the masked language model. MLMD features a plug and play usage (i.e., no need to retrain the victim model) for adversarial defense and it is agnostic to classification tasks, victim model's architectures, and to-be-defended attack methods. We evaluate MLMD on various benchmark textual datasets, widely studied machine learning models, and state-of-the-art (SOTA) adversarial attacks (in total 3∗4∗4 = 48 settings). Experimental results show that MLMD can achieve strong performance, with detection accuracy up to 0.984, 0.967, and 0.901 on AG-NEWS, IMDB, and SST-2 datasets, respectively. Additionally, MLMD is superior, or at least comparable to, the SOTA detection defenses in detection accuracy and F1 score. Among many defenses based on the off-manifold assumption of adversarial examples, this work offers a new angle for capturing the manifold change. The code for this work is openly accessible at https://github.com/mlmddetection/MLMDdetection.
dc.language	en
dc.publisher	ASSOC COMPUTING MACHINERY
dc.relation.ispartof	Proceedings of the ACM Conference on Computer and Communications Security
dc.relation.ispartof	18th ACM ASIA Conference on Computer and Communications Security (ASIA CCS)
dc.relation.isbasedon	10.1145/3579856.3590339
dc.rights	info:eu-repo/semantics/closedAccess
dc.title	Masked Language Model Based Textual Adversarial Example Detection
dc.type	Conference Proceeding
utslib.location.activity	AUSTRALIA, Melbourne
pubs.organisational-group	University of Technology Sydney
pubs.organisational-group	University of Technology Sydney/Faculty of Engineering and Information Technology
pubs.organisational-group	University of Technology Sydney/Faculty of Engineering and Information Technology/School of Computer Science
utslib.copyright.status	closed_access	*
dc.date.updated	2024-02-01T00:44:17Z
pubs.finish-date	2023-07-14
pubs.publication-status	Published
pubs.start-date	2023-07-10

Abstract:

Adversarial attacks are a serious threat to the reliable deployment of machine learning models in safety-critical applications. They can misguide current models to predict incorrectly by slightly modifying the inputs. Recently, substantial work has shown that adversarial examples tend to deviate from the underlying data manifold of normal examples, whereas pre-trained masked language models can fit the manifold of normal NLP data. To explore how to use the masked language model in adversarial detection, we propose a novel textual adversarial example detection method, namely Masked Language Model-based Detection (MLMD), which can produce clearly distinguishable signals between normal examples and adversarial examples by exploring the changes in manifolds induced by the masked language model. MLMD features a plug and play usage (i.e., no need to retrain the victim model) for adversarial defense and it is agnostic to classification tasks, victim model's architectures, and to-be-defended attack methods. We evaluate MLMD on various benchmark textual datasets, widely studied machine learning models, and state-of-the-art (SOTA) adversarial attacks (in total 3∗4∗4 = 48 settings). Experimental results show that MLMD can achieve strong performance, with detection accuracy up to 0.984, 0.967, and 0.901 on AG-NEWS, IMDB, and SST-2 datasets, respectively. Additionally, MLMD is superior, or at least comparable to, the SOTA detection defenses in detection accuracy and F1 score. Among many defenses based on the off-manifold assumption of adversarial examples, this work offers a new angle for capturing the manifold change. The code for this work is openly accessible at https://github.com/mlmddetection/MLMDdetection.

Please use this identifier to cite or link to this item:

http://hdl.handle.net/10453/175173