Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailment
Table 8: Comparison of the after-attack accuracies before and after removing the word importance ranking of Algorithm 1. For control, Step 2 and the perturbed words ratio are kept the same. BERT model is used as the target model.
['[EMPTY]', '[BOLD] MR', '[BOLD] AG', '[BOLD] SNLI']
We keep the perturbed word ratio and Step 2 the same. We use BERT as the target model and test on three datasets: MR, AG, and SNLI. After removing Step 1 and instead randomly selecting the words to perturb, the after-attack accuracy increases by more than 45% on all three datasets, which reveals that the attack becomes ineffective without the word importance ranking step. The word importance ranking process is crucial to the algorithm in that it can accurately and efficiently locate the words which cast the most significant effect on the predictions of the target model. This strategy can also reduce the number of perturbed words so as to maintain the semantic similarity as much as possible.