Learning to Discriminate Perturbations forBlocking Adversarial Attacks in Text Classification
Table 5: The accuracy of DISP over different types of attacks on the SST-2 dataset with the tokens recovered by the perturbation discriminator and the embedding estimator trained on the IMDb dataset for robust transfer defense. Note that DISPx indicates the framework is established on the dataset x.
['Method', 'Insertion', 'Delete', 'Swap']
Robust Transfer Defense. In practice, we may not have access to the original training corpus of a prediction model. In the following, we investigate if the perturbation discriminator can transfer across different corpora. We first train the discriminator and the estimator on IMDb denoted as DISPIMDb and then apply it to defend the prediction model on SST-2. DISPIMDb achieves similar performance as the performance of DISPSST-2 trained on the same training set. Hence, it shows that DISP can transfer the ability to recover perpetuated token across different sentiment copora.