Combating Adversarial Misspellings with Robust Word Recognition
Table 4: Accuracy of BERT, with and without defenses, on MRPC when attacked under the ‘all’ attack setting.
['[BOLD] Model', '[BOLD] No Attack', '[BOLD] All attacks  [BOLD] 1-char', '[BOLD] All attacks  [BOLD] 2-char']
We re-trained the ScRNN model variants on the MRPC training set for these experiments. Again, we find that simple 1-2 character attacks can bring down the accuracy of BERT significantly (89% to 31%). Word recognition models can provide an effective defense, with both our pass-through and neutral variants recovering most of the accuracy. While the neutral backoff model is effective on 2-char attacks, it hurts performance in the no attack setting, since it incorrectly modifies certain correctly spelled entity names. Since the two variants are already effective, we did not train a background model for this task.