# Light Lies: Optical Adversarial Attack

Kyulim Kim
<EMAIL_ADDRESS>
&JeongSoo Kim
<EMAIL_ADDRESS>
&Seungri Song22footnotemark: 2
<EMAIL_ADDRESS>
&Jun-Ho Choi
<EMAIL_ADDRESS>
&Chulmin Joo22footnotemark: 2
<EMAIL_ADDRESS>
&Jong-Seok Lee11footnotemark: 1 33footnotemark: 3
<EMAIL_ADDRESS>Department of Artificial Intelligence, Yonsei
University, South KoreaDepartment of Mechanical Engineering, Yonsei
University, South KoreaSchool of Integrated Technology, Yonsei University,
South Korea

###### Abstract

A significant amount of work has been done on adversarial attacks that inject
imperceptible noise to images to deteriorate the image classification
performance of deep models. However, most of the existing studies consider
attacks in the digital (pixel) domain where an image acquired by an image
sensor with sampling and quantization has been recorded. This paper, for the
first time, introduces an optical adversarial attack, which physically alters
the light field information arriving at the image sensor so that the
classification model yields misclassification. More specifically, we modulate
the phase of the light in the Fourier domain using a spatial light modulator
placed in the photographic system. The operative parameters of the modulator
are obtained by gradient-based optimization to maximize cross-entropy and
minimize distortions. We present experiments based on both simulation and a
real hardware optical system, from which the feasibility of the proposed
optical attack is demonstrated. It is also verified that the proposed attack
is completely different from common optical-domain distortions such as
spherical aberration, defocus, and astigmatism in terms of both perturbation
patterns and classification results.

##  1 Introduction

It is well known that injecting small perturbations to input data can
significantly degrade the performance of deep neural networks, called
adversarial attacks. Because such attacks raise security concerns of deep
learning-based applications, many researchers have studied the impact of the
adversarial attacks on various deep models, especially for image
classification models [1, 2].

Most existing studies focus on finding adversarial examples in the digital
domain, i.e., altering the pixel values of digital images. Another possibility
is that an attack is applied to the target object in the physical domain. For
this, a few studies demonstrate the efficacy of adversarial examples found in
the digital domain when they are implemented in the physical domain, e.g.,
printed objects [3, 4]. Such applicability of adversarial examples on real
objects raises more severe security concerns in various practical applications
(e.g., autonomous vehicle system [5], person detector [6]).

Orthogonal to these attempts, this paper introduces an _optical adversarial
attack_ by considering a new layer between real objects and digital images for
implementing adversarial attacks, i.e., the optical system acquiring the light
field information from the target object in the physical world and converting
it to the image in the digital domain. The idea is to modulate the phase of
the light information in the Fourier domain using a device called spatial
light modulator (SLM). Spatially varying phase modulations are found by
optimizing an objective function to minimize image distortion and maximize the
cross-entropy, which are realized by the SLM in the optical system. The change
in the digital image obtained by the image sensor due to the phase modulations
is hardly perceptible, but can significantly deteriorate the performance of
the image classification model.

The main contribution of our work can be summarized as follows.

  * •

We propose an optical adversarial attack that is implemented in the optical
system, which deteriorates the performance of the deep models performing
classification using the images acquired from the optical system (Section 3).

  * •

We show the feasibility of our optical adversarial attack by conducting
experiments on a simulated optical system for various images from the ImageNet
dataset (Section 4). It is shown that the attacked optical system produces
output images that have similar quality as the original outputs but fool the
subsequent image classification models.

  * •

We conduct real experiments on an actual system implementing our attack to
demonstrate the feasibility of the proposed idea in the real world (Section
5). Our attack is also compared to common optical-domain phase distortions
such as spherical aberration, defocus, and astigmatism, which verifies the
significant superiority of our method as an attack.

Our work has two important implications. First, our work is the first to
demonstrate the possibility of implementing adversarial attacks by altering
the light information in the optical system. The work in [7] proposes a
physical attack by putting a sticker on the camera lens, but the attack occurs
outside the optical system and, furthermore, physical intervention (i.e.,
putting a sticker) is required. In contrast, our attack takes place _inside_
the optical system, and is implemented without physical intervention by
maliciously controlling the computer used as the controller of the SLM.
Second, we raise a new immediate vulnerability issue of practical systems
where SLMs are employed, including biomedical imaging, holography, and optical
encryption. In such systems, our work shows that malicious attempts may be
made not only by conventional attacks in the digital domain but also by
optical attacks in the physical domain.

##  2 Related work

###  2.1 Adversarial attack

Various adversarial attack methods against image classification models have
been developed. Goodfellow _et al._ [1] proposed the fast gradient sign method
(FGSM) that obtains a perturbation for a given image from the sign of the
gradients of a target image classification model. Kurakin _et al._ [8]
extended FGSM to an iterative approach to find a more powerful perturbation,
which is called I-FGSM. Carlini and Wagner [9] developed an efficient attack
method that finds a perturbation by minimizing the amount of deterioration and
the distance of logits between the original predicted class label and the
target label.

While the aforementioned methods focus on injecting a perturbation into a
given digital image that will be directly inputted to a target image
classification model, some researchers have also investigated adversarial
examples that are applicable to physical objects. Kurakin _et al._ [3]
demonstrated the feasibility of finding adversarial examples that can fool the
classification model even when the attacked images are printed and captured
again using a phone camera. Eykholt _et al._ [10] showed that physically
perturbing real objects such as road signs can attack image classification
models. Athalye _et al._ [4] further provided adversarial showcases with
3D-printed objects that can make the classification model misclassify the
images taken in various viewpoints.

Previous research has focused on attacking images or objects themselves, and
to the best of our knowledge, there is no approach that attacks optical
systems acquiring images from real objects.

###  2.2 SLM-based optical system

An SLM is an computer-controlled active device used to modulate the amplitude,
phase, or polarization of light waves in space and time. Among several types
of SLMs, liquid crystal on silicon (LCoS) SLMs are used in applications that
call for phase modulations in optical systems such as lithography [11, 12,
13], optical tweezer [14, 15, 16], turbulence simulation [17, 18], and imaging
[19, 20, 21, 22, 23, 24].

In Fourier optics, a lens is regarded as a Fourier transform engine. That is,
for a given object field in the front focal plane of the lens, its Fourier
transform can be obtained in the back focal plane of the lens. This plane is
referred to as the Fourier plane, where one has access to the spatial
frequency spectrum of the object field. By placing an SLM in the Fourier
plane, one can alter phase delay individually for each spatial frequency
component, thus modifying the transfer function or image formation of an
optical imaging system. For example, it has been shown that the depth-of-field
of optical imaging systems can be increased significantly by introducing cubic
phase offset in the Fourier plane [19]. In addition, the phase modulation
technology using SLMs has been used in phase imaging of thin biological
specimens [20, 21] and aberration correction of optical systems [22, 23].
Various applications of SLMs for the pupil engineering can be referred to in
the review paper [25].

A recent study by Kravets _et al._ [26] introduced a defense technique using
an SLM to defend adversarial attacks applied in the digital domain. On the
other hand, we consider an optical adversarial attack, which is implemented
using a phase SLM.

##  3 Proposed system

Figure 1: Overview of the proposed optical adversarial attack system. A phase
modulation module consisting of a polarizer, relay lens, beam splitter, and
SLM is implemented to the photography system. The unattacked image obtained
without phase modulation and the attacked image obtained with adversarial
phase modulation are acquired, respectively. When the acquired images are
classified by the deep model, the unattacked image is classified correctly,
but the attacked image is misclassified. CL: camera lens; P: polarizer; RL:
relay lens; BS: beam splitter.

We set up an SLM-based optical system that consists of a camera lens, an SLM,
and an image sensor, which is illustrated in Figure 1. The image acquisition
process is as follows. First, a commercial camera lens (SP AF 60mm F/2 Di II
Macro 1:1, Tamron) collects the object field and then generates the image at
the intermediate image plane. In order to achieve direct access to the Fourier
plane, we construct a 4-f system using two lenses (RL, AC508-100-A, Thorlabs)
to relay the information onto the image plane. A phase-only SLM (HSP512,
Meadowlark) is placed in the Fourier plane, i.e., the back focal plane of the
first relay lens. Since the SLM is polarization-dependent, a linear polarizer
(LPVISC100, Thorlabs) is placed before the SLM. The phase-modulated light via
the SLM is then reflected by the beam splitter (BS031, Thorlabs), and the
image in the image plane is captured by an image sensor (Flare 4M180-CL, IO
Industries).

An obtained digital image is then inputted to a deep neural network that
classifies an object in the image. In this study, we consider three widely
known models, namely, ResNet50 [27], VGG16 [28], and MobileNetV3 [29], which
are pre-trained on the ImageNet dataset [30].

On this system architecture, our optical adversarial attack aims to find an
adversarial perturbation that is displayed as an SLM pattern, which leads the
classifier to misclassify the resulting image, while no significant visible
differences are observed between the unattacked and attacked images.

###  3.1 Imaging model of SLM-based optical adversarial attack

Let ${X}_{\mathrm{obj}}$ be the intensity of an object. The camera lens forms
image ${X}_{\mathrm{img}}$ at the intermediate image plane, and then the 4-f
system relays this information onto the image plane (see Figure 1). For an
incoherent imaging system, the acquired image ${X}$ can be expressed as [31]

${X}={iPSF}\otimes{X}_{\mathrm{img}},$ (1)

where ${iPSF}$ denotes the incoherent point spread function and $\otimes$
represents 2D convolution. ${iPSF}$ is equal to the squared magnitude of the
coherent point spread function $h$ (i.e., ${iPSF}=|h|^{2}$). Note that $h$ is
the Fourier transform of the pupil function $H$. In the Fourier domain, (1)
can be written as

$\tilde{X}={MTF}\cdot\tilde{X}_{\mathrm{img}},$ (2)

where ${MTF}$ is the modulation transfer function, and
$\tilde{X}_{\mathrm{img}}$ is the Fourier transform of ${X}_{\mathrm{img}}$.
Using convolution theorem, ${MTF}$ can be obtained as
${MTF}=\mathcal{F}(|h|^{2})=|H\star H|$, where $\mathcal{F}(\cdot)$ is the
Fourier transform operator and $\star$ represents 2D correlation.

We consider a circular aperture in the pupil plane with a radius of $R$. If a
phase modulation is applied in the pupil plane, the corresponding pupil
function can be expressed as

${H}=\begin{cases}{e}^{j\phi(\vec{u})},&\text{if }||\vec{u}||<R\\\
0,&\text{otherwise}\end{cases},$ (3)

where $\vec{u}$ is the spatial frequency coordinate at the Fourier plane and
$\phi(\vec{u})$ is the modulated phase distribution, which is applied through
the SLM in our case.

###  3.2 Finding adversarial perturbation

In our attack, non-targeted adversarial phase perturbation $\phi(\vec{u})$ is
found by a gradient-based ${l}_{2}$-norm optimization method to maximize the
classification loss while minimizing image distortions.

Let $\hat{X}_{\phi}$ denote the attacked version of $X$ with phase modulation
$\phi$. The optimization problem to find $\hat{X}_{\phi}$ is written as

$\mathrm{arg}\min_{\phi}\lambda||\hat{X}_{\phi}-{X}||_{2}-l\big{(}{y},{f}(\hat{X}_{\phi})\big{)},$
(4)

where $\lambda$ is a balancing constant between the two terms, $l$ is the
classification loss (i.e., cross-entropy), $y$ is the ground truth class
label, and $f$ is the classification model. To find an appropriate value of
$\lambda$, we adopt an iterative approach that starts with a large value (to
ensure a small amount of image distortion) and gradually decreases it until
the classification result becomes incorrect.

##  4 Simulation experiments

Before we apply our adversarial attack on a real system composed of physical
devices, we first conduct experiments on a simulation environment using the
forward model explained in Section 3.1. This enables us to find out the
feasibility of our proposed adversarial attack method by employing a
relatively larger number of images containing diverse objects.

###  4.1 Implementation details

We employ 1,000 test images of the NeurIPS 2017 Adversarial Attacks and
Defences Competition [32]111We obtained the images from
https://kaggle.com/c/6864.. This dataset contains images associated with each
of the 1,000 ImageNet classes, which are not included in the training images
of the original ImageNet dataset.

(a)

$\lambda=10^{-2}$ | $\lambda=10^{-3}$ | $\lambda=10^{-4}$ |
---|---|---|---
|  |  |
|  |  |
mountain bike | mountain bike | tricycle |

(b)

Figure 2: (a) Comparison of the classification accuracy of the original and
attack images with respect to the value of $\lambda$ for the VGG16 model. PSNR
values calculated from the unattacked and attacked images are also shown. (b)
A showcase of the attacked images (top) and their phase perturbations (bottom)
for different values of $\lambda$.

The classification accuracy is used as the primary evaluation metric. In
addition, we employ the peak signal-to-noise ratio (PSNR) and structural
similarity (SSIM) to measure the amount of deterioration in the attacked
images compared to their corresponding unattacked images.

To find an adversarial example $\hat{X}_{\phi}$ for a given image ${X}$ by
(4), we employ the Adam optimizer [33] because it is known to be effective in
quickly finding adversarial examples [9]. We use a learning rate of
${5}\times{10}^{-3}$ and a weight decay factor of ${5}\times{10}^{-6}$. We
initially set the value $\lambda$ to ${10}^{-2}$ and reduce it by $1/10$ if a
valid $\hat{X}_{\phi}$ is not found within the maximum number of iterations,
which is set to 150. The optimization process stops once we obtain a valid
$\hat{X}_{\phi}$ that makes the model misclassify the attacked image.

We observe that both accuracy and PSNR tend to converge to certain values as
$\lambda$ decreases. Figure 2(a) shows such a tendency of convergence for
VGG16. When $\lambda$ becomes ${10}^{-4}$, the accuracy and PSNR are measured
as 0.270 and 33.60 dB, respectively, and both do not significantly change when
$\lambda$ decreases further. Therefore, we set the minimum value of $\lambda$
as ${10}^{-6}$. Figure 2(b) depicts a showcase of the obtained images for
different values of $\lambda$. The three cases do not show significant
perceptual differences, while the classification result becomes wrong when
$\lambda$ becomes ${10}^{-4}$ and a larger amount of phase modulation is
applied.

###  4.2 Results

Table 1: Performance comparison in terms of accuracy, PSNR, and SSIM evaluated on different image classification models. Standard deviations across images are also shown. Note that relatively large standard deviations of PSNR are due to the images with failed attack despite severe phase perturbations and the images with little changes despite the attack. Model | Accuracy (original) | Accuracy (attacked) | PSNR (dB) | SSIM
---|---|---|---|---
ResNet50 | 0.896 | 0.334 | 33.98 ($\pm 9.77$) | 0.9623 ($\pm 0.0495$)
VGG16 | 0.840 | 0.260 | 32.96 ($\pm 9.10$) | 0.9561 ($\pm 0.0572$)
MobileNetV3 | 0.860 | 0.323 | 35.40 ($\pm 9.79$) | 0.9669 ($\pm 0.0458$)

Table 1 shows the performance comparison on the three classification models.
When the attack method is not employed, all the models achieve classification
accuracy above 0.840. However, when our adversarial attack is employed, the
accuracy values are significantly reduced. This result proves that the optical
system for the image classification task is highly vulnerable to our proposed
adversarial attack. In addition, both the PSNR and SSIM values of the images
obtained from the attacked optical system are significantly high (i.e., above
30 dB). It implies that differences between the original and attacked images
are hardly noticeable.

As a baseline, we test a so-called “random phase attack” by constructing a
random phase pattern $\phi$ that generates a digital image having a similar
PSNR value to that of an image obtained from our adversarial attack. With this
method, we obtain images having an average PSNR value of 33.12 dB, which is
similar to the average PSNR values in Table 1 and even slightly lower than
those obtained from our attack for ResNet50 and MobileNetV3. However, the
classification accuracy barely drops when those images are inputted to the
models, which are 0.894, 0.828, and 0.860 for ResNet50, VGG16, and
MobileNetV3, respectively. This result shows that the perturbations found by
our proposed attack method are very different from random perturbations and
our method successfully deteriorates the classification performance while
preserving the quality of the obtained images.

| Original | Attacked | Diff. (PSNR, SSIM) | Phase
---|---|---|---|---
ResNet50 |  |  | starfish
---
(70.0%)
|  | honeycomb
---
(12.9%)
|  | 31.94 dB
---
0.7712
|  | cabbage
---
butterfly
(45.1%)
|  | earthstar
---
(22.2%)
|  | 35.15 dB
---
0.9930
|  | airliner
---
(94.8%)
|  | space
---
shuttle
(43.1%)
|  | 28.58 dB
---
0.9840
VGG16 |  |  | starfish
---
(23.5%)
|  | flatworm
---
(18.5%)
|  | 39.86 dB
---
0.8799
|  | cabbage
---
butterfly
(71.6%)
|  | sulphur
---
butterfly
(45.1%)
|  | 29.86 dB
---
0.9803
|  | airliner
---
(94.8%)
|  | airship
---
(48.1%)
|  | 36.21 dB
---
0.9952
MobileNetV3 |  |  | starfish
---
(98.2%)
|  | mask
---
(46.4%)
|  | 29.73 dB
---
0.7004
|  | cabbage
---
butterfly
(72.3%)
|  | axolotl
---
(33.0%)
|  | 37.33 dB
---
0.9953
|  | airliner
---
(75.9%)
|  | airship
---
(49.0%)
|  | 36.87 dB
---
0.9960
Figure 3: Visual showcases of the unattacked and attacked images for the three
image classification models. Classified labels and their confidence levels are
also reported. The third column shows the absolute pixel value differences
between the unattacked and attacked images, which are magnified 10 times for
better visualization. The last column shows the modulated phase in the Fourier
domain.

Figure 3 shows example images with and without the adversarial attack. The
absolute differences of the unattacked and attacked images in the digital
domain and the optimized phase modulation patterns ($\phi$ in Section 3.1) are
also shown. It can be seen that differences between the original and attacked
images are not significant, which is also shown as high PSNR and SSIM values.
However, the classification models misclassify all the attacked images. Here,
the classified labels differ depending on the employed models. For instance,
the starfish image is misclassified as honeycomb, flatworm, and mask by each
model, respectively. The pixel-domain changes also differ depending on the
employed models. For example, the differences are mostly on the red channel
for ResNet50, while those are mostly on the green channel for MobileNetV3. The
amount of distortion is also model-dependent, i.e., the PSNR and SSIM values
differ depending on the target classification model for the same image. For
example, the PSNR values of the cabbage butterfly image for VGG16 and
MobileNetV3 are 29.86 dB and 37.33 dB, respectively. These model-dependent
characteristics of the perturbations can be also found from low
transferability of the attacked images between the models as shown in Table 2.

Table 2: Transferability of attacked images for different models in terms of accuracy Source Target | ResNet50 | VGG16 | MobileNetV3
---|---|---|---
ResNet50 | 0.334 | 0.792 | 0.840
VGG16 | 0.851 | 0.260 | 0.823
MobileNetV3 | 0.862 | 0.782 | 0.323

However, we also observe the following characteristics of the phase modulation
patterns for different images and classifiers. First, a wider range of phase
modulations tends to yield a more distorted image having a lower PSNR value.
For instance, for ResNet50, the phase patterns of both the starfish and
airliner images contain larger values (appearing as more red and blue colors)
than that of the cabbage butterfly image. Second, the phase patterns of the
same image appear similar to some extent across different models. For example,
the phases of starfish show wave-like patterns, while those of cabbage
butterfly contain more grain-like textures.

The overall patterns of the pixel value changes are largely different from
those obtained from many existing adversarial attacks in the pixel domain [1,
8, 9]. The former preserves textures of the original images, whereas the
latter is typically similar to random noise and barely preserves the original
textures. It is because our adversarial attack method manipulates the imaging
system in the phase domain instead of the pixel domain.

##  5 Real experiments

We physically implement our proposed adversarial attack with an optical system
as explained in Section 3 in order to demonstrate the vulnerability of real
optical systems in the wild to the proposed optical attack.

###  5.1 Implementation details

In the real experiments, we place “actual” objects in front of the optical
system to capture and acquire images of the objects. Considering this
practical constraint, we use ten real objects that correspond to ten ImageNet
classes to obtain images of those objects in the digital domain, which are
bath towel, computer keyboard, lighter, paintbrush, ping-pong ball, plate
rack, ruler, screwdriver, syringe, and toilet tissue. We place an object
100-120 cm away from the camera lens, which is a distance with a field-of-view
of about $250\times 250$ mm. Phase modulation is performed using the SLM with
a resolution of $224\times 224$ pixels and a pixel size of 30 $\mathrm{\mu
m}$.

We employ the pre-trained ResNet50 and VGG16 models. The MobileNetV3 model is
excluded here due to its relatively poor performance on the actual objects.

In addition to our attack method, we also investigate the impact of other
optical-domain distortions that are usually found in real optical systems. In
this study, we consider spherical aberration, defocus, and astigmatism. The
amounts of these distortions are determined in a way that the resulting images
have similar SSIM values to those perturbed by our attack.

###  5.2 Results

Table 3: Performance comparison in terms of accuracy, PSNR, and SSIM for the original images, attacked images in simulation, attacked images in the real system, and images with optical distortions in the real system. Standard deviations across images are also shown. Model | Metric | Original | Simulation | Real | Aberration | Defocus | Astigmatism
---|---|---|---|---|---|---|---
ResNet50 | Accuracy | 1.0 | 0.0 | 0.0 | 1.0 | 1.0 | 1.0
PSNR (dB) | – | – |  | 33.36
---
($\pm 3.53$)
| 35.81
---
($\pm 1.83$)
| 36.03
---
($\pm 2.08$)
| 36.11
---
($\pm 2.12$)
SSIM | – | – |  | 0.9357
---
($\pm 0.0263$)
| 0.9391
---
($\pm 0.0191$)
| 0.9386
---
($\pm 0.0195$)
| 0.9394
---
($\pm 0.0206$)
VGG16 | Accuracy | 1.0 | 0.0 | 0.0 | 0.9 | 0.9 | 0.9
PSNR (dB) | – | – |  | 34.31
---
($\pm 2.75$)
| 35.38
---
($\pm 1.75$)
| 35.37
---
($\pm 2.11$)
| 35.29
---
($\pm 2.49$)
SSIM | – | – |  | 0.9381
---
($\pm 0.0323$)
| 0.9380
---
($\pm 0.0170$)
| 0.9366
---
($\pm 0.0191$)
| 0.9367
---
($\pm 0.0212$)

Table 3 shows the overall performance comparison of our attack method and the
three optical distortions for different image classification models, where the
accuracy, PSNR, and SSIM values are reported. We also report the accuracy of
the original images and the attacked images obtained from our simulation
environment explained in Section 4. Both ResNet50 and VGG16 successfully
classify the ten real objects when no distortion is involved. However, when
our attack method is employed, all the objects are classified incorrectly for
both models in both simulation and real environments. Furthermore, all
optical-domain distortions do not affect much the classification performance
unlike our attack method; all ten objects are still classified correctly for
ResNet50 and nine objects for VGG16. These results demonstrate that the real
optical system is highly vulnerable to the proposed optical adversarial
attack.

| Original | Attacked | Optical distortions
---|---|---|---
|  | Simulation | Real | Aberration | Defocus | Astigmatism
#1 |  |
---
screwdriver
(42.7%)
|
---
assault rifle
(18.5%)
|
---
assault rifle
(17.9%)
|
---
screwdriver
(21.1%)
|
---
screwdriver
(23.1%)
|
---
screwdriver
(21.5%)
#2 |  |
---
bath towel
(29.5%)
|
---
paper towel
(24.0%)
|
---
paper towel
(23.6%)
|
---
bath towel
(18.9%)
|
---
bath towel
(16.9%)
|
---
bath towel
(14.2%)
#3 |  |
---
plate rack
(20.7%)
|
---
minivan
(12.4%)
|
---
oxygen mask
(17.7%)
|
---
plate rack
(14.8%)
|
---
plate rack
(14.9%)
|
---
plate rack
(17.9%)
#4 |  |
---
paintbrush
(30.7%)
|
---
mortar
(25.4%)
|
---
mortar
(26.5%)
|
---
paintbrush
(26.6%)
|
---
paintbrush
(26.9%)
|
---
paintbrush
(27.3%)
|  |  |
Figure 4: Visual showcases of the original and attacked images for ResNet50.
Classified labels and their confidence levels are also reported.

Figure 4 shows four visual showcases of our attack and the optical distortions
for ResNet50. When the original and attacked outputs are compared in the
digital domain, there are no obvious visual differences between them, which
also appears as high PSNR in Table 3. However, our attack method successfully
fools the target image classification model. For example, the original image
#4 is correctly classified as paintbrush. However, the attacked ones are
misclassified as mortar in the simulation and real environments. The optical
distortions hardly affect the classification performance, reducing the
confidence levels only slightly (e.g., from 30.7% to 26.6% by spherical
aberration) without resulting in misclassification.

The patterns of the phase images obtained from our attack method and those of
the optical distortions also show significant differences. First, the range of
the phase values for our attack is significantly smaller that those for the
optical distortions: about $\left[-0.5,0.5\right]$ (rad) vs.
$\left[-3,3\right]$ (rad). In addition, the phase patterns are highly
distinguishable across different objects for our attack method, while they are
not for the optical distortions.

##  6 Conclusion

We presented the feasibility of attacking optical systems in the optical
domain instead of attacking images in the digital domain by introducing an
optical adversarial attack. For a given real object, our attack method finds a
spatially varying phase modulation pattern implemented by an SLM in order to
minimize the amount of distortion in the digital domain but significantly
degrade the performance of image classification models. We conducted
experiments not only in a simulation environment to evaluate with a large
amount of data but also in a real optical system to evaluate the proposed
attack method in the wild. The results showed that the optical systems are
highly vulnerable to our adversarial attack method, raising a new significant
security issue of imaging systems.

Our current work has the following limitations that call for future work.
First, our study can be expanded to a broader range of application fields.
Although we considered the image classification task as the main target of our
experiments, our proposed adversarial attack method can be further applied to
other fields that employ optical imaging systems to acquire digital images and
deep neural networks to perform classification or enhancement, such as
microscopic image enhancement [34] and hologram classification [35]. Second,
we focused on investigating the vulnerability of the physical imaging system
in this study, and to this end, we proposed the optical adversarial attack.
One of the important next directions will be to find ways to protect optical
systems against adversarial attacks applied in both the optical domain and the
digital domain.

## References

  * [1] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples.  In Proceedings of the International Conference on Learning Representations, 2015.
  * [2] Dong Su, Huan Zhang, Hongge Chen, Jinfeng Yi, Pin-Yu Chen, and Yupeng Gao.  Is robustness the cost of accuracy? – A comprehensive study on the robustness of 18 deep image classification models.  In Proceedings of the European Conference on Computer Vision, 2018\.
  * [3] Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio.  Adversarial examples in the physical world.  In Proceedings of the International Conference on Learning Representations Workshop, 2017.
  * [4] Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok.  Synthesizing robust adversarial examples.  In Proceedings of the International Conference on Machine Learning, 2018.
  * [5] Dudi Nassi, Raz Ben-Netanel, Yuval Elovici, and Ben Nassi.  MobilBye: Attacking ADAS with camera spoofing.  arXiv:1906.09765, 2019.
  * [6] Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Mengshu Sun, Hongge Chen, Pin-Yu Chen, Yanzhi Wang, and Xue Lin.  Adversarial T-shirt! Evading person detectors in a physical world.  In Proceedings of the European Conference on Computer Vision, 2020\.
  * [7] Juncheng B. Li, Frank R. Schmidt, and J. Zico Kolter.  Adversarial camera stickers: A physical camera-based attack on deep learning systems.  In Proceedings of the International Conference on Machine Learning, 2019.
  * [8] Alexey Kurakin, Ian Goodfellow, and Samy Bengio.  Adversarial machine learning at scale.  In Proceedings of the International Conference on Learning Representations, 2017.
  * [9] Nicholas Carlini and David Wagner.  Towards evaluating the robustness of neural networks.  In Proceedings of the IEEE Symposium on Security and Privacy, 2017\.
  * [10] Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song.  Robust physical-world attacks on deep learning visual classification.  In Proceedings of the IEEE/CVF International Conference on Computer Vision, 2019.
  * [11] Nathan J. Jenness, Kurt D. Wulff, Matthew S. Johannes, Miles J. Padgett, Daniel G. Cole, and Robert L. Clark.  Three-dimensional parallel holographic micropatterning using a spatial light modulator.  Optics Express, 16(20):15942–15948, 2008.
  * [12] Nathan J. Jenness, Ryan T. Hill, Angus Hucknall, Ashutosh Chilkoti, and Robert L. Clark.  A versatile diffractive maskless lithography for single-shot and serial microfabrication.  Optics Express, 18(11):11754–11762, 2010.
  * [13] David Lowell, Jeffrey Lutkenhaus, David George, Usha Philipose, Banglin Chen, and Yuankun Lin.  Simultaneous direct holographic fabrication of photonic cavity and graded photonic lattice with dual periodicity, dual basis, and dual symmetry.  Optics Express, 25(13):14444–14452, 2017.
  * [14] Marcus Reicherter, Thomas Haist, E. U. Wagemann, and Hans J. Tiziani.  Optical particle trapping with computer-generated holograms written on a liquid-crystal display.  Optics Letters, 24(9):608–610, 1999.
  * [15] Hyosub Kim, Woojun Lee, Han-gyeol Lee, Hanlae Jo, Yunheung Song, and Jaewook Ahn.  In situ single-atom array synthesis using dynamic holographic optical tweezers.  Nature Communications, 7(1):1–8, 2016.
  * [16] Barak Hadad, Sahar Froim, Harel Nagar, Tamir Admon, Yaniv Eliezer, Yael Roichman, and Alon Bahabad.  Particle trapping and conveying using an optical Archimedes’ screw.  Optica, 5(5):551–556, 2018.
  * [17] Liesl Burger, Igor A. Litvin, and Andrew Forbes.  Simulating atmospheric turbulence using a phase-only spatial light modulator.  South African Journal of Science, 104(3-4):129–134, 2008.
  * [18] James D. Phillips, Matthew E. Goda, and Jason Schmidt.  Atmospheric turbulence simulation using liquid crystal spatial light modulators.  In Proceedings of the Advanced Wavefront Control: Methods, Devices, and Applications III, volume 5894, 2005.
  * [19] Sean Quirin, Darcy S. Peterka, and Rafael Yuste.  Instantaneous three-dimensional sensing using spatial light modulator illumination with extended depth of field imaging.  Optics Express, 21(13):16007–16021, 2013.
  * [20] Zhuo Wang, Larry Millet, Mustafa Mir, Huafeng Ding, Sakulsuk Unarunotai, John Rogers, Martha U. Gillette, and Gabriel Popescu.  Spatial light interference microscopy (SLIM).  Optics Express, 19(2):1016–1026, 2011.
  * [21] Guohai Situ, Michael Warber, Giancarlo Pedrini, and Wolfgang Osten.  Phase contrast enhancement in microscopy using spiral phase filtering.  Optics Communications, 283(7):1273–1277, 2010.
  * [22] A. Jesacher, A. Schwaighofer, S. Fürhapter, C. Maurer, S. Bernet, and M. Ritsch-Marte.  Wavefront correction of spatial light modulators using an optical vortex image.  Optics Express, 15(9):5801–5808, 2007.
  * [23] Michael Warber, Selim Maier, Tobias Haist, and Wolfgang Osten.  Combination of scene-based and stochastic measurement for wide-field aberration correction in microscopic imaging.  Applied Optics, 49(28):5474–5479, 2010.
  * [24] Saswata Mukherjee, A. Vijayakumar, and Joseph Rosen.  Spatial light modulator aided noninvasive imaging through scattering layers.  Scientific Reports, 9(1):1–11, 2019.
  * [25] Christian Maurer, Alexander Jesacher, Stefan Bernet, and Monika Ritsch-Marte.  What spatial light modulators can do for optical microscopy.  Laser & Photonics Reviews, 5(1):81–101, 2011.
  * [26] Vladislav Kravets, Bahram Javidi, and Adrian Stern.  Compressive imaging for defending deep neural networks from adversarial attacks.  Optics Letters, 46(8):1951–1954, 2021.
  * [27] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.  Deep residual learning for image recognition.  In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2016.
  * [28] Karen Simonyan and Andrew Zisserman.  Very deep convolutional networks for large-scale image recognition.  In Proceedings of the International Conference on Learning Representations, 2015.
  * [29] Andrew Howard, Mark Sandler, Grace Chu, Liang-Chieh Chen, Bo Chen, Mingxing Tan, Weijun Wang, Yukun Zhu, Ruoming Pang, Vijay Vasudevan, et al.  Searching for MobileNetV3.  In Proceedings of the IEEE/CVF International Conference on Computer Vision, 2019.
  * [30] Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al.  ImageNet large scale visual recognition challenge.  International Journal of Computer Vision, 115(3):211–252, 2015\.
  * [31] Joseph W. Goodman.  Introduction to Fourier optics.  Roberts and Company Publishers, 2005.
  * [32] Alexey Kurakin, Ian Goodfellow, Samy Bengio, Yinpeng Dong, Fangzhou Liao, Ming Liang, Tianyu Pang, Jun Zhu, Xiaolin Hu, Cihang Xie, et al.  Adversarial attacks and defences competition.  The NIPS’17 Competition: Building Intelligent Systems, 2018.
  * [33] Diederik P. Kingma and Jimmy Ba.  Adam: A method for stochastic optimization.  arXiv:1412.6980, 2014.
  * [34] Yair Rivenson, Zoltan Gorocs, Harun Gunaydin, Yibo Zhang, Hongda Wang, and Aydogan Ozcan.  Deep learning microscopy.  Optica, 4(11):1437–1443, 2017.
  * [35] Sung-Jin Kim, Chuangqi Wang, Bing Zhao, Hyungsoon Im, Jouha Min, Hee June Choi, Joseph Tadros, Nu Ri Choi, Cesar M. Castro, Ralph Weissleder, Hakho Lee, and Kwonmoo Lee.  Deep transfer learning-based hologram classification for molecular diagnostics.  Scientific Reports, 8, 2018.


# Towards Reliable Neural Machine Translation with Consistency-Aware Meta-
Learning

Rongxiang Weng1,2, Qiang Wang3,4, Wensen Cheng2, Changfeng Zhu2, Min Zhang1

###### Abstract

Neural machine translation (NMT) has achieved remarkable success in producing
high-quality translations. However, current NMT systems suffer from a lack of
reliability, as their outputs that are often affected by lexical or syntactic
changes in inputs, resulting in large variations in quality. This limitation
hinders the practicality and trustworthiness of NMT. A contributing factor to
this problem is that NMT models trained with the one-to-one paradigm struggle
to handle the source diversity phenomenon, where inputs with the same meaning
can be expressed differently. In this work, we treat this problem as a bilevel
optimization problem and present a consistency-aware meta-learning (CAML)
framework derived from the model-agnostic meta-learning (MAML) algorithm to
address it. Specifically, the NMT model with CAML (named CoNMT) first learns a
consistent meta representation of semantically equivalent sentences in the
outer loop. Subsequently, a mapping from the meta representation to the output
sentence is learned in the inner loop, allowing the NMT model to translate
semantically equivalent sentences to the same target sentence. We conduct
experiments on the NIST Chinese to English task, three WMT translation tasks,
and the TED M2O task. The results demonstrate that CoNMT effectively improves
overall translation quality and reliably handles diverse inputs.

## Introduction

Neural machine translation (NMT) based on the encoder-decoder structure
(Bahdanau, Cho, and Bengio 2014; Sutskever, Vinyals, and Le 2014) and
attention mechanism (Luong, Pham, and Manning 2015), has achieved prominent
success in the vast majority of translation tasks (Cho et al. 2014; Vaswani et
al. 2017) in recent years. Most NMT models are trained by parallel data in an
end-to-end manner. In a nutshell, the encoder encodes an input sentence into
sequential hidden states as contextual representation. Then, the decoder
fetches the contextual representation through cross attention and generates
the corresponding target sentence.

Figure 1: Translations (Trans) from semantically equivalent inputs (Source).
Compared to the first one, Some semantically irrelevant modifications in the
following inputs bring apparent changes in the outputs.

However, many previous studies have shown that NMT models are highly
susceptible to lexical or syntactic changes in inputs (Ott et al. 2018; He,
Meister, and Su 2020). This means that altering the structure of the input
sentence or even just a few words, without changing the semantics, can result
in a significant change in the output, frequently leading to inaccurate
translations (See Figure 1). One reason for this is that the one-to-one
training paradigm conflicts with the many-to-many characteristic of natural
language. We define the aforementioned phenomenon as the source diversity
problem and focus on the many-to-one situation in this work. In reality, the
many-to-one mapping is commonplace in NMT. For example, individuals may
express the same concept in different ways, and even two descriptions of the
same concept from a single individual may vary significantly. When NMT
correctly handles the source diversity, it will become more reliable in
diversified application scenarios.

Some recent works have noticed this problem and sought to address it. Nguyen
et al. (2020) proposed a data augmentation method, which back-translates the
original sentence by several machine translation systems, and then directly
adds them into the model training process. However, it does not constrain the
NMT model, leaving them to deal only with synthetic data. Wei et al. (2020)
proposed a variational method to model uncertainty, so as to map semantically
equivalent sentences into a sentence representation. However, this method is
tendentious to get a trivial solution, where all sentences are embedded in a
meaningless vector. Moreover, studies on the robustness of NMT can also
mitigate this problem. Liu et al. (2019) incorporated noisy input with similar
pronunciations into NMT training to address homophone noise. Cheng, Jiang, and
Macherey (2019); Cheng et al. (2020) proposed to use adversarial examples to
address synonym problem. However, they only focus on the noisy input, part of
the source diversity phenomenon.

In this work, we divide this source diversity problem into two subproblems:
The first one is how to learn a consistent context representation from
semantically equivalent sentences; The second one is how to map representation
to the ground-truth outputs. Following this intuition, we present a
consistency-aware meta-learning (CAML) framework based on the model-agnostic
meta-learning (MAML) algorithm (Finn, Abbeel, and Levine 2017) to address it.
Unlike the traditional MAML, our CAML contains two task-specific training
objectives to constrain the meta representation. Concretely, we design 1). a
sentence-level objective to force semantically equivalent sentences to
generate each other; 2). a word-level objective to constrain the output
distributions from these sentences to be similar. CAML can promote NMT to
learn a consistent meta representation from semantically equivalent samples in
the outer loop. After this, NMT will focus on learning a mapping from the meta
representation to the output sentence in the inner loop.

To illustrate the effectiveness of the proposed CAML, we conduct experiments
on widely used machine translation tasks with different settings.
Specifically, we first evaluate our approach on the WMT14 English to German
(En$\rightarrow$De), WMT17 Chinese to English (Zh$\rightarrow$En), and WMT16
Romanian to English (Ro$\rightarrow$En) tasks, and gets more than 1 BLEU score
gain in all of them. Further, we apply our approach to three varieties: non-
autoregressive generation, multilingual translation, and larger model
structure. The empirical results are indicative of a good versatility of our
method. Finally, we make a simulation experiment, which demonstrating that our
approach effectively alleviates the influence of the different forms of
inputs.

## The Proposed Approach

In this section, we will briefly introduce NMT based on the Transformer
(Vaswani et al. 2017) structure and the application of MAML (Finn, Abbeel, and
Levine 2017) to NMT. Then, we will describe the proposed CAML based on the
Transformer backbone in detail.

### Background and Notations

#### Neural machine translation.

Given a source-target sentence pair $\\{x,y\\}$ from the parallel data-set
$\mathcal{B}$, where $|\mathcal{B}|$ is the number of sentence pairs. The
paradigm of NMT is:

$\displaystyle
P(y|x)\propto\textsc{Dec}(\textsc{Enc}(x;\theta_{e});\theta_{d}),$ (1)

where the $\textsc{Enc}(\cdot)$ and $\textsc{Dec}(\cdot)$ are encoder and
decoder networks respectively, and $\theta_{e}$ and $\theta_{d}$ are
corresponding parameters. In Transformer, they are composed of multiple self-
attention layers. Then the NMT model is optimized by minimizing the negative
log-likelihood, denoted by:

$\displaystyle\mathcal{L}_{\text{N}}(y,f_{\theta}(x))=-\mathbb{E}_{\\{x,y\\}\sim\mathcal{B}}\left[\log
P(y|x;\theta)\right],$ (2)

where $\theta=\\{\theta_{e},\theta_{d}\\}$, $f_{\theta}(x)$ denotes the model
prediction of $x$ with model parameters $\theta$.

#### MAML for NMT.

Model-agnostic meta-learning (MAML) is an widely used meta-learning (or
learning to learn) algorithm, which divides the training process into two
stages (Finn, Abbeel, and Levine 2017), named meta-train and meta-test. In
meta-train step, a general model is learned from different data (called
supported set), while a task-specific data (called target set) is used in the
meta-test step.

In our setup, we take the original parallel data $\\{x,y\\}$ as the target
set, and construct the support set by introducing a set $\textbf{x}^{s}$ which
is semantically equivalent to $x$.
$\textbf{x}^{s}=\\{x^{s}_{1},\cdots,x^{s}_{i},\cdots,x^{s}_{I}\\}$, where $I$
is the number of sentences. The $\textbf{x}^{s}$ is generated from a sampling
function $\varphi(x,y)$, which will be described in the Section Semantically
Equivalent Sentences. Following Gu et al. (2018); Li et al. (2018a), we can
readily employ MAML on NMT to utilize $\textbf{x}^{s}$. In this way, we first
update the current model parameters from $\theta$ to $\theta^{\prime}$ by the
gradients in the meta-train step:

$\displaystyle\theta^{\prime}\leftarrow\theta-\alpha\nabla_{\theta}$
$\displaystyle\left\\{\mathcal{L}_{\text{Train}}(y_{i},f_{\theta}(x_{i}^{s}))\right\\},$
(3)

where $\alpha$ is the learning rate and $\mathcal{L}_{\text{Train}}$ is the
loss function for the meta-train step. We can calculate
$\mathcal{L}_{\text{Train}}$ through the support set as:

$\displaystyle\mathcal{L}_{\text{Train}}(y_{i},f_{\theta}(x^{s}_{i}))=\frac{1}{I}\sum_{i}^{I}\left\\{\mathcal{L}_{\text{N}}(y_{i},f_{\theta}(x_{i}^{s}))\right\\}.$
(4)

Given $\theta^{\prime}$, we further leverage the target set to update the
model parameters through the meta-test step:

$\displaystyle\mathcal{L}_{\text{Test}}(y,$ $\displaystyle
f_{\theta}(x))=\mathcal{L}_{\text{N}}(y,f_{\theta^{\prime}}(x)).$ (5)

### Consistency-aware Meta-learning for NMT

The ideal case for increasing the reliability of NMT is that semantically
equivalent sentences have the same representation in the semantic space, which
allows the model to generate stable outputs from various inputs. Following
this motivation, the proposed CAML concentrates on promoting NMT to learn a
consistent meta representation from semantically equivalent samples and to
translate from the meta representation to the ground truth. In this section,
we will first introduce two simple training objectives in the CAML, which
constrain the contextual representation in different aspects. Then, we will
expound on how to incorporate the CAML into the training process to build a
reliable NMT model.

#### Modeling consistency through multi-level constraints.

In Transformer, the output is decided by the contextual representation encoded
from the encoder. Namely, when the representations from sentences in
$\textbf{x}^{s}$ are equivalent:

$\displaystyle||\textsc{Enc}(x^{s}_{i};\theta_{e})-\textsc{Enc}(x^{s}_{j};\theta_{e})||_{2}^{2}=0,\\{x^{s}_{i},x^{s}_{j}\\}\subset\textbf{x}^{s},$
(6)

where the NMT model can generate the same output by the contextual
representation. However, it is hard to optimize this objective due to the
variable sentence structure. From another perspective, we consider two
training objectives of different granularity to optimize the NMT model.

The first is the consistency of the sentence representation, which we consider
to be optimized by a partial reconstruction manner. We randomly sample a
sentence pair $\\{x_{i}^{s},x_{j}^{s}\\}$ from $\textbf{x}^{s}$ and mask the
same part of them, which are denoted as $\\{x_{i}^{m},x_{j}^{m}\\}$. Then, the
NMT model is asked to generate one when given another. Specifically, the
sentence level training loss is formalized as:

$\displaystyle\mathcal{L}$
${}_{\text{S}}(x^{s}_{j},x^{s}_{i})=\mathcal{L}_{\text{N}}(x^{s}_{j},f_{\theta}(x^{s}_{i}))+\mathcal{L}_{\text{N}}(x^{s}_{i},f_{\theta}(x^{s}_{j}))=$
(7)
$\displaystyle-\mathbb{E}_{\\{x_{i}^{s},x_{j}^{s}\\}\sim\varphi(\cdot)}\mathbb{E}_{\\{x,y\\}\sim\mathcal{B}}[\log
P(x_{j}^{m}|x_{i}^{s};\theta)P(x_{i}^{m}|x_{j}^{s};\theta)].$

Here, $\mathcal{L}_{\text{S}}$ encourages the contextual representation to
recover sentences that have similar semantics as itself. This is almost equal
to enabling NMT to generate the same sentence representations between
semantically equivalent sentences.

Algorithm 1 The training process of NMT with CAML

Input: Parallel data set $\mathcal{B}$; Sampling function: $\varphi(\cdot)$;
Epoch $E$
Output: The NMT model $f_{\theta}(\cdot)$

1: for $e=0$ to $E$ do

2: for $\\{x,y\\}$ in $\mathcal{B}$ do

3: Optimizing $f_{\hat{\theta}}(\cdot)$ by the Equation 2

4: end for

5: end for

6: for $e=0$ to $E$ do

7: for $\\{x,y\\}$ in $\mathcal{B}$ do

8: Sampling $\textbf{x}^{s}$ by the $\varphi(x,y)$

9: for $\\_$ in T do

10: Optimizing $f_{\theta^{\prime}}(\cdot)$ by the Equation 9

11: end for

12: Optimizing $f_{\theta}(\cdot)$ by the Equation 10

13: end for

14: end for

15: return $f_{\theta}(\cdot)$

Besides modeling the sentence-level semantics embedded in the sequential
representations, we need to treat the difference in syntactic structure,
determining how the decoder gets the correct contextual information. In
contrast, instead of exploiting the syntactic information, which needs human-
annotated data, we adopt a word-level training objective as an alternative to
making the output distribution generated by one sentence governed by the
others.

Specifically, we constrain the output distributions from semantically
equivalent sentences to be similar at each decoding step. Formally, the word-
level loss function is summarized as:

$\displaystyle\mathcal{L}_{\text{W}}$
$\displaystyle(f_{\tilde{\theta}}(x),f_{\theta}(x^{s}_{i}))=$ (8)
$\displaystyle-\mathbb{E}_{x_{i}^{s}\sim\varphi(\cdot)}\mathbb{E}_{\\{x,y\\}\sim\mathcal{B}}[P(y|x;\tilde{\theta})\log
P(y|x_{i}^{s};\theta)],$

where $\tilde{\theta}$ is the copy of the NMT parameters, which will not be
updated by the gradient. For different forms of input, the NMT decoder trained
by this objective can get the similar contextual information at each step,
avoiding the the influence of the structural differences.

#### Meta-learning with $\mathcal{L}_{\text{S}}$ and $\mathcal{L}_{\text{W}}$.

Following the MAML framework (Finn, Abbeel, and Levine 2017), we sample $T$
pairs from $\textbf{x}^{s}$ as the support set, and then use the
$\\{x^{s}_{i},x,y\\}$ as the target set. The training function of the meta-
train step can be summarized as follows:

$\displaystyle\mathcal{L}_{\text{Train}}$ $\displaystyle(x^{s}_{\setminus
i},f_{\theta}(x^{s}_{i}))=$ (9)
$\displaystyle\beta\sum^{T}\left\\{\mathcal{L}_{\text{S}}(x^{s}_{\setminus
i},f_{\theta}(x^{s}_{i}))+\mathcal{L}_{\text{W}}(f_{\theta}(x^{s}_{\setminus
i}),f_{\theta}(x^{s}_{i}))\right\\},$

where $x^{s}_{\setminus i}$ is a sentence from $\textbf{x}^{s}$ which not
equal to $x^{s}_{i}$, $\beta$ is the learning rate for the meta-train step.
Compared to the Eq. 4, we use the aforementioned self-supervised training
objectives instead of the NMT training loss (i.e., $\mathcal{L}_{\text{T}}$)
in this step. Our goal is to facilitate the model to pay attention to learning
the contextual representation in the outer loop rather than directly learning
the translation from noisy input data.

The next step of the CAML is to learn to translate based on contextual
representation. An intuitive approach is to adopt Eq. 9 to train the model.
However, it may cause the forgetting problem since the objective functions of
the two steps are different. To avoid this problem, we integrate
$\mathcal{L}_{\text{S}}$ and $\mathcal{L}_{\text{W}}$ into the meta-test step
as a regularization term to maintain the representation consistently.
Specifically, the meta-test step in the CAML is reorganized as:

$\displaystyle\mathcal{L}_{\text{Test}}$
$\displaystyle(y,f_{\theta}(x))=\gamma\mathcal{L}_{\text{N}}(y,f_{\theta}(x))$
(10)
$\displaystyle+\underbrace{\epsilon\left\\{\mathcal{L}_{\text{S}}(x,f_{\theta{{}^{\prime}}}(x^{s}_{i}))+\mathcal{L}_{\text{W}}(f_{\theta}(x),f_{\theta{{}^{\prime}}}(x^{s}_{i}))\right\\}}_{\text{maintaining
consistency}}.$

The coefficients $\gamma$ and $\epsilon$ are used to balance the preference
among these losses, which are empirically set to 1 and 0.5, respectively.
Here, the updated parameters $\theta^{\prime}$ are computed by $T$ gradient
descent updates on the support task, which equals $2I$. The one gradient
update in the meta-train step is:

$\displaystyle\theta^{\prime}\leftarrow\theta-\gamma\nabla_{\theta}$
$\displaystyle\left\\{\mathcal{L}_{\text{S}}(x_{\setminus
i},f_{\theta}(x_{i})))+\mathcal{L}_{\text{W}}(f_{\theta}(x_{\setminus
i}),f_{\theta}(x_{i}))\right\\},$

where $\gamma$ is the learning rate of the meta-train step. The overall
training algorithm of our approach is shown in Algorithm 1. An intuitive
illustration is shown in Figure 2.

Figure 2:  An intuitive illustration of the impact of the proposed CAML on the
contextual representation of NMT.

### Semantically Equivalent Sentences

A key factor of our approach is how to build the $\textbf{x}^{s}$ by the
$\varphi(\cdot)$. It is difficult to obtain perfect semantically equivalent
sentences by data augmentation methods. Here, we use two steps to construct
semantically similar sentences as approximations. Coincidentally, previous
studies show that noisy samples enhance the performance of meta-learning
(Wang, Hu, and Hu 2020; Yao et al. 2021). It is worthy to note that our work
focuses on the training strategy of NMT, so we only use two common data
augmentation approaches. Any advanced approaches can be easily applied here
(Wang et al. 2018; Hoang et al. 2018; Nguyen et al. 2020).

#### Step 1: replacing words with alignment relationships.

Given the sentence $x$, we sample and replace 20% words with similar words.
More specifically, for a selected word in $x$, we choose 100 words from the
vocabulary $\mathcal{V}$ ordered by the frequency of a word alignment model,
which is trained on the same parallel
data.111https://github.com/clab/fast$\\_$align Then, we form these words as a
subset and randomly choose one to replace the original word.

#### Step 2: noisy round-trip translation.

Then, we use noisy round-trip translation to process the data from Step 1
further. Given sentences from Step 1, we add random vectors sampled from the
standard normal distribution to them and translate them to target language
sentences
$\textbf{y}^{\prime}=\\{y^{\prime}_{1},\cdot,y^{\prime}_{j},\cdot,y^{\prime}_{J}\\}$,
where $J$ is the number of sentences. We select several sentences from the
$\textbf{y}^{\prime}$ according to the weight
$\textsc{EditDist}(y^{\prime}_{j},y)*\textsc{Overlap}(y^{\prime}_{j},y)$. The
$\textsc{EditDist}(\cdot)$ is edit distance and $\textsc{Overlap}(\cdot)$ is
word overlap ratio. Then, these sentences are back-translated to the source
language to compose the $\textbf{x}^{s}$.

# | Model | MT06 | MT02 | MT03 | MT04 | MT05 | MT08 | Avg
---|---|---|---|---|---|---|---|---
1 | Vaswani et al. (2017) | 44.57 | 45.49 | 44.55 | 46.20 | 44.96 | 35.11 | 43.26
2 | Ebrahimi, Lowd, and Dou (2018) | 45.28 | 45.95 | 44.68 | 45.99 | 45.32 | 35.84 | 43.56
3 | Cheng, Jiang, and Macherey (2019) | 46.95 | 47.06 | 46.48 | 47.39 | 46.58 | 37.38 | 44.98
4 | Hao et al. (2019) | 44.00 | N/A | 43.98 | 45.60 | 44.28 | N/A | N/A
5 | Cheng et al. (2020) | 49.26 | 49.03 | 47.96 | 48.86 | 49.88 | 39.63 | 47.07
6 |  Sennrich, Haddow, and Birch (2016a)∗ | 46.20 | 47.78 | 46.93 | 47.80 | 46.81 | 36.79 | 45.22
7 |  Cheng, Jiang, and Macherey (2019)∗ | 47.74 | 48.13 | 47.83 | 49.13 | 49.04 | 38.61 | 46.55
8 |  Wei et al. (2020)∗ | 48.88 | N/A | N/A | 49.15 | 49.21 | 40.94 | N/A
9 |  Cheng et al. (2020)∗ | 49.98 | 50.34 | 49.81 | 50.61 | 50.72 | 40.45 | 48.39
10 | Transformer | 45.24 | 46.89 | 46.32 | 46.83 | 45.72 | 36.31 | 44.41
11 | Transformer${}_{\text{sync}}^{*}$ | 46.57 | 47.13 | 47.69 | 47.51 | 46.88 | 39.67 | 45.77
12 | CoNMT | 49.41 | 49.83 | 48.83 | 49.51 | 50.03 | 39.99 | 47.64
13 | CoNMT${}_{\text{sync}}^{*}$ | 49.74 | 50.79 | 50.53 | 50.96 | 51.27 | 40.88 | 48.89
Table 1: The effectiveness of our approach (CoNMT) on the NIST
Zh$\rightarrow$En task. “$*$” indicates the model uses extra monolingual data-
set. “Avg” is the average score of all test sets.

## Experiments

### Implementation Detail

#### Data-set.

We first conduct experiments on the NIST Chinese to English
(Zh$\rightarrow$En) task and three widely-used WMT translation tasks: WMT14
English to German (En$\rightarrow$De), WMT16 Romanian to English
(Ro$\rightarrow$En), and WMT18 Chinese to English (Zh$\rightarrow$En). On the
NIST Zh$\rightarrow$En task, we use NIST 2006 (MT06) as the dev set and NIST
2002 (MT02), 2003 (MT03), 2004 (MT04), 2005 (MT05), 2008 (MT08) as the test
sets. On the En$\rightarrow$De task, we use newstest2013 as the dev set and
newstest2014 as the test set. On the Ro$\rightarrow$En task, we use
newstest2015 as the dev set and newstest2016 as the test set. On the
Zh$\rightarrow$Ee task, we use newsdev2017 as the dev set, and newstest2017 as
the test set. Moreover, we evaluate our method on the TED multilingual machine
translation task. The overall data-set is divided into two training sets
according to language diversity, which is named related and diverse. The
detail is shown in Wang, Tsvetkov, and Neubig (2020). We only conduct the
many-to-one (M2O), which translates eight languages to English.

#### Setting.

We adopt the Transformer-base for the NIST Zh$\rightarrow$En and WMT
Ro$\rightarrow$En, Transformer-big for the WMT Zh$\rightarrow$En, and both
base and big for the WMT En$\rightarrow$De. We apply the byte pair encoding
(BPE) (Sennrich, Haddow, and Birch 2016b) to all language pairs and limit
vocabulary size to 32K. All out-of-vocabulary words were mapped to the UNK. In
order to avoid the problem of vocabulary mismatch, we adopt an additional
four-layer parallel decoder (Ghazvininejad et al. 2019) for the
$\mathcal{L}_{\text{S}}$. We set label smoothing as 0.1 and dropout rate as
0.1. The Adam is adopted as the optimizer, and the $\beta 1/\beta 2$ is set as
$0.9/0.98$ for the base setting and $0.9/0.998$ for the big setting. The
initial learning rate is 0.001. We adopt the warm-up strategy with 4000 steps.
The learning rate $\gamma$ of meta-train remains one-tenth of NMT. Other
settings are followed as Vaswani et al. (2017).

We implement our approach on fairseq222https://github.com/pytorch/fairseq. We
use 4 V100 GPUs and accumulate the gradient four iterations on the WMT
En$\rightarrow$De and Zh$\rightarrow$En. Other tasks run on 2 V100 GPUs. We
use beam search as the decoding algorithm and set the beam size as 5 and the
length penalty as 0.6. For a fair comparison, we calculate the case-sensitive
tokenized BLEU with the multi-bleu.perl script for the NIST Zh$\rightarrow$En,
and use the
sacreBLEU333https://github.com/mjpost/sacreBLEU444BLEU+case.mixed+lang.${Src}-${Trg}+num-
refs.1+smooth.exp+test.${Task}+tok.13a+version.1.5.1 to calculate case-
sensitive BLEU (Papineni et al. 2002) for all WMT and TED tasks.

### Results on NIST Zh$\rightarrow$En Task

In order to compare with the related work, we first carried out experiments on
the NIST Zh$\rightarrow$En task with the same setting (Wei et al. 2020; Cheng
et al. 2020). Following Cheng et al. (2020), we sample 1.25M English sentences
from the Xinhua portion of the gigaword corpus as the extra corpus to enhance
the model.555https://catalog.ldc.upenn.edu/LDC2003T05

The overall results are shown in Table 1. We divide the experiment into three
parts. Firstly, we compare our model to the Transformer baselines. We
implement the vanilla Transformer-base trained by the parallel data
(Transformer, Row 10) and both the parallel and synthetic data
(Transformer${}_{\text{sync}}$, Row 11), respectively. The synthetic data
brings a 1.36 BLEU score gain. Transformer with the proposed CAML (CoNMT, Row
12) attains 47.64 BLEU. When incorporating the synthetic data, our approach
improves 1.24 to 48.89 BLEU (CoNMT${}_{\text{sync}}$, Row 13). Summarily, our
approach gets 3.23/3.12 absolute improvements compared to the corresponding
baselines on the NIST Zh$\rightarrow$En task.

Then, we compare our approach to several related work including the robust NMT
(Ebrahimi, Lowd, and Dou 2018; Cheng, Jiang, and Macherey 2019; Cheng et al.
2020), data-augmentation (Wei et al. 2020), and enhancing the contextual
representation (Hao et al. 2019). In the same way, we also report the results
from the model trained with or without synthetic data. Our approach achieves
the best performance on both settings. Furthermore, our method outperforms the
AdvAug by 0.57/0.50 BLEU and achieves state-of-the-art in four test sets.

# | Model | Trans. Base | Trans. Big
---|---|---|---
1 | Vaswani et al. (2017) | 27.30 | 28.40
2 | Li et al. (2018b) | 28.51 | 29.28
3 |  Cheng et al. (2018)∗ | 28.09 | N/A
4 |  Gao et al. (2019)∗ | N/A | 29.70
5 |  Jiao et al. (2020)∗ | 28.30 | 29.20
6 | Transformer | 27.53 | 28.73
7 |  Transformer${}_{\text{sync}}^{*}$ | 28.82 | 29.71
8 | CoNMT | 28.64‡ | 29.58†
9 | CoNMT${}_{\text{sync}}^{*}$ | 30.22‡ | 30.87‡
Table 2: The effectiveness of our approach (CoNMT) on the En$\rightarrow$De task. “$\dagger$/$\ddagger$” indicate the model is significantly better than the baseline ($p<0.05/0.01$) (Neubig et al. 2019). “$*$” indicates using extra monolingual data. “Trans. Base” and “Trans. Big” are the base and big setting, respectively. # | Model | Zh$\rightarrow$En | Ro$\rightarrow$En
---|---|---|---
1 | Vaswani et al. (2017) | 25.21 | 31.90
2 | Wei et al. (2020) | 26.48 | N/A
3 | Yang et al. (2019) | 25.15 | N/A
4 | Zhou et al. (2020) | 25.04 | N/A
5 | Gu et al. (2018) | N/A | 31.76
6 | Transformer | 25.37 | 31.93
7 |  Transformer${}_{\text{sync}}^{*}$ | 26.63 | 36.94
8 | CoNMT | 26.38 | 33.72
9 | CoNMT${}_{\text{sync}}^{*}$ | 27.49 | 38.44
Table 3: The effectiveness of our approach (CoNMT) on the WMT
Zh$\rightarrow$En and WMT16 Ro$\rightarrow$En. “$*$” indicates that the model
uses extra monolingual data. We use the Transformer-big on the
Zh$\rightarrow$En and Transformer-base on the Ro$\rightarrow$En.

### Results on WMT Tasks

We further evaluate our approach on three widely-used WMT benchmarks,
including WMT14 En$\rightarrow$De, WMT17 Zh$\rightarrow$En, and WMT16
En$\rightarrow$Ro. Meanwhile, we report several previous work as a
comparison.666We consider the work which measure the results by the scareBLEU
toolkit. The results on WMT14 En$\rightarrow$De are summarized in the Table 2.
Our model gets 28.64/29.58 BLEU in the base/big setting (Row 8). Compared to
the baseline (Row 7), our model achieves 1.11/0.85 gains. We use 8M German
monolingual sentences sampled from Caswell, Chelba, and Grangier (2019) to
enhance the model. When combined with the synthetic data, our model gets
30.22/30.87 BLEU (Row 9), which gets 1.4/1.06 improvements and outperforms all
previous work.

The results on the WMT17 Zh$\rightarrow$En and WMT16 Ro$\rightarrow$En are
shown in Table 3. We use 10M monolingual sentences sampled from WMT News Craw
and 2M monolingual sentences from Sennrich, Haddow, and Birch (2016a) for the
Zh$\rightarrow$En and Ro$\rightarrow$En, respectively. Compared to baselines,
our work gets 1.01/0.86 gains on the Zh$\rightarrow$En, and 1.79/1.50 gains on
the Ro$\rightarrow$En. The extensive experiments on the WMT benchmark
demonstrate more powerfully the effect of the proposed CAML algorithm.

Model | Speedup | En$\rightarrow$De
---|---|---
Vaswani et al. (2017) | 1.0x | 27.30
Gu et al. (2017) | 2.36x | 19.17
Ghazvininejad et al. (2019) | 1.7x | 27.03
Transformer | 1.0x | 27.53
Mask-Predict | 1.63x | 27.14
CoNMT | 1.63x | 28.21
Table 4: The results of the proposed CAML (CoNMT) on the NAT structure.

### Effectiveness on Different Varieties

The proposed CAML framework only changes the training schema of NMT, which
means it can be employed on any Transformer-based NMT tasks. In this section,
we conduct condensed experiments on three popular NMT directions: non-
autoregressive translation, multi-lingual translation, and larger model size.

#### Non-autoregressive NMT.

Our approach is tangential to the decoding mode. Thus, whether our approach
works on NAT (Gu et al. 2017; Ghazvininejad et al. 2019) is valuable to
investigate. Here, we employ the CAML based on the Mask-Predict (Ghazvininejad
et al. 2019) framework777The detail of this model is shown in Ghazvininejad et
al. (2019). and evaluate on the En$\rightarrow$De task. The results are shown
in Table 4. Our work largely outperforms the Mask-Predict baseline (+1.07
BLEU) without dropping the decoding speed.

Model | Related | Diverse
---|---|---
Uni. ($\tau=\infty$) | 22.63 | 24.81
Temp. ($\tau=5$) | 24.00 | 26.01
Prop. ($\tau=1$) | 24.88 | 26.68
Wang, Tsvetkov, and Neubig (2020) | 25.26 | 27.00
Wu et al. (2021) | 26.28 | 27.82
CoNMT | 26.77 | 28.09
Table 5: The results of our method (CoNMT) on the M2O task. Uni.: sampling
data with equal frequency. Temp.: sampling data according to size
exponentiated by $\tau$. Prop.: sampling data in portions equivalent to the
size of each language.

#### Multilingual NMT.

We believe that sentences from different languages with the same semantics can
be regarded as semantically equivalent sentences. To verify that, we employ
our approach on the many-to-one (M2O) translation task following the setting
from Wang, Tsvetkov, and Neubig (2020). We sample $I$ sentences and use a one-
to-many NMT model to translate to other languages. Then these synthetic
sentences are used as training data for the meta-train step.

The results are shown in Table 5. Compared to Wang, Tsvetkov, and Neubig
(2020), our approach obtains 1.51/1.09 improvements in the related/diverse
language pairs. Furthermore, our approach gets better results than Wu et al.
(2021), especially in related language pairs. Empirically, our approach works
better for similar language pairs than diverse ones, which indicate that it is
difficult for NMT to learn consistent representations for diverse languages.

Model | #Param | En$\rightarrow$De
---|---|---
Vaswani et al. (2017) | 213M | 28.40
Wei et al. (2022) | 265M | 29.80
Wang et al. (2019) | 137M | 29.30
Zhu et al. (2020) | 500M | 30.75
Raffel et al. (2020) | 700M | 30.90
Deep Transformer | 159M | 29.82
mBART Fine-tuning | 610M | 28.82
CoNMT${}_{\text{sync}}$ | 207M | 30.87
mBART w/ CAML | 610M | 30.23
Deep Transformer w/ CAML | 159M | 31.26
Table 6: The results of the proposed method with larger model size on the
En$\rightarrow$De task.

#### Larger model size.

A spontaneous confusion is whether a larger model can eliminates the source
diversity problem. To verify the availability in this situation, we employ the
CAML on the pre-trained mBART (Liu et al. 2020) and Deep Transformer (Wang et
al. 2019) on the En$\rightarrow$De task. The results are shown in Table 6.
Compared to the fine-tuning, our approach gets a 1.41 improvement. Then, when
combined with Deep Transformer, our approach gets a 1.44 gain, outperforming
all previous work. The evaluation results demonstrate that a larger model can
not escape the source diversity problem, and our CAML still works in this
situation.

Figure 3:  The BLEU curve under the different ratio of diverse input. The
dotted line is the BLEU from the original inputs. Figure 4:  The number of
sentences divided according to the sentence BLEU.

### Analysis

#### The influence of the diverse input.

We sample 300 samples from MT02-05, each one has one source sentence and four
references, to appraise the ability of our approach to handle the source
diversity problem. We ask two professional translators to translate source
sentences according to the first reference and the remaining three,
respectively. Then, we use the first reference and the corresponding
translation as the standard test set, and replace input sentences from another
translator in different proportions. The results are presented in Figure 3. As
the replacement proportion increases, the performance of all models decreases.
However, our model is more reliable than the baseline, which performs
similarly to the original input even with a large replacement proportion.

#### Distribution across translation quality.

Then, we sample one thousand translations on the En$\rightarrow$De task and
calculate the sentence-BLEU of each one.888We use the script from THUMT:
https://github.com/THUNLP-MT/THUMT/blob/master/thumt/utils/bleu.py We divide
these sentences into several groups according to the BLEU score and count the
number of sentences at each group. The results are shown in Figure 4. Compared
to the baseline, the translations of our model are more concentrated into
interval [60-80) and have less number in interval [0-40). The evaluation
results show that the proposed CAML can accelerate the model to generate more
stable results, which effectively improves the reliability of NMT.

Model | En$\rightarrow$De | $\Delta$
---|---|---
Transformer (Vaswani et al. 2017) | 27.53 | $-$
$+$ Data Augmentation | 27.87 | +0.34
$+$ MAML (Eq.5-4) | 27.41 | -0.12
$+$ MTL with $\mathcal{L}_{\text{W}}$ and $\mathcal{L}_{\text{S}}$ | 28.01 | +0.48
$+$ CAML (CoNMT) | 28.64 | +1.11
$+\mathcal{L}_{\text{T}}$ in Eq. 9 | 28.37 | +0.84
$-\mathcal{L}_{\text{S}}$ in Eq. 9 and Eq. 10 | 28.27 | +0.74
$-\mathcal{L}_{\text{W}}$ in Eq. 9 and Eq. 10 | 28.12 | +0.59
Table 7: Ablation study on the WMT14 En$\rightarrow$De task.

#### Ablation study.

To further show the effect of each module in our approach, we make an ablation
study which is shown in Table 7. On the one hand, we implement three methods
to analyze effect of $\textbf{x}^{s}$, $\mathcal{L}_{\text{S}}$ and
$\mathcal{L}_{\text{W}}$. The first one is to use $\\{\textbf{x}^{s},y\\}$
with the original training set to train the model. The second one is to apply
MAML as described in Eq.4-5. The third one is to use $\mathcal{L}_{\text{S}}$
and $\mathcal{L}_{\text{W}}$ in a multi-task learning (MTL) manner. The first
and third methods can get 0.34 and 0.48 gains, respectively. It is unexpected
that the MAML does not work. We believe one of the reasons is that tasks in
two stages of MAML are too similar.

On the other hand, when ablating $\mathcal{L}_{\text{S}}$ and
$\mathcal{L}_{\text{W}}$, the BLEU score drops 0.37 and 0.52, respectively. We
further attempts to add the $\mathcal{L}_{\text{T}}$ to meta-train step, which
leads to a 0.27 drop. We think the reason for this is the same as MAML. In
summary, the CAML algorithm is conducive to training, making the model achieve
better results. $\mathcal{L}_{\text{S}}$ and $\mathcal{L}_{\text{W}}$ play
different roles and brings certain improvements to the model.

## Related Work

#### Reliability vs. Robustness.

There is some overlap between robustness and reliability in NMT (Sperber,
Niehues, and Waibel 2017). Thus, some studies on the robustness of NMT can
partially improve reliability. For example, Liu et al. (2019) proposed to
incorporate noisy sentences into NMT training to address homophone noise,
where words are replaced by others with similar pronunciations. Ebrahimi,
Lowd, and Dou (2018); Cheng et al. (2020) proposed to use adversarial examples
to address the synonym problem. However, robustness focuses on noisy inputs,
which can deal with the errors in the sentence. Some pre-processing methods,
e.g., grammar correction models, are another way to solve the robustness
problem. Our work improves the reliability of NMT by addressing the source
diversity phenomenon. Various expressions, all of which are proper, are more
common and intractable than incorrect inputs.

#### Meta-learning in NLP.

Meta-learning offers a strong generalization ability with limited data.
Previous work has successfully employed model-agnostic meta-learning (MAML)
(Finn, Abbeel, and Levine 2017) to various tasks, e.g., text classification
(Bansal et al. 2020) and generation (Qian and Yu 2019). In NMT, Gu et al.
(2018) proposed to improve the low-resource machine translation with MAML. Li
et al. (2018a) proposed to improve the domain generalization of NMT with MAML.
The proposed CAML is a derivative of the standard MAML, which focuses on a
more fundamental issue of how to solve the problem of source diversity to
improve the reliability of NMT.

#### Self-supervised training.

Recently, self-supervised training has been widely used in NLP (Devlin et al.
2019; Brown et al. 2020; Lample and Conneau 2019). In NMT, Sennrich, Haddow,
and Birch (2016a) firstly proposed back-translation to translate target
monolingual data to synthetic parallel data. Caswell, Chelba, and Grangier
(2019) proposed to add a tag at the source side of the synthetic data. These
data-augmentation methods objectively enhance the ability of NMT to deal with
source diversity. Wei et al. (2020, 2022) proposed to model continuous
semantics towards reducing the source uncertainty problem. Following these
studies, our work adopts the self-supervised method to learn the consistent
representation from semantically equivalent sentences.

## Conclusion

In this work, we clarify the shortcoming of current NMT models, specifically
models trained by the one-to-one paradigm are hard to deal with the multi-to-
one scenario. To address this problem, we present a consistency-aware meta-
learning (CAML) framework derived from the model-agnostic meta-learning
algorithm. In the proposed CAML, two customized training objectives are used
with the MAML manner to model the consistent representation, thereby enhancing
the reliability of the NMT model. Extensive experiments show that CAML
effectively improves translation quality by producing stable outputs for
diverse inputs.

## Acknowledgments

We would like to thank the reviewers for their insightful comments. This work
is supported by the National Natural Science Foundation of China (Grant No.
62036004).

## References

  * Bahdanau, Cho, and Bengio (2014) Bahdanau, D.; Cho, K.; and Bengio, Y. 2014.  Neural Machine Translation by Jointly Learning to Align and Translate.  _arXiv:1409.0473_.
  * Bansal et al. (2020) Bansal, T.; Jha, R.; Munkhdalai, T.; and McCallum, A. 2020.  Self-Supervised Meta-Learning for Few-Shot Natural Language Classification Tasks.  In _EMNLP_ , 522–534.
  * Brown et al. (2020) Brown, T.; Mann, B.; Ryder, N.; Subbiah, M.; Kaplan, J. D.; Dhariwal, P.; Neelakantan, A.; Shyam, P.; Sastry, G.; Askell, A.; et al. 2020.  Language models are few-shot learners.  _Neurips_ , 1877–1901.
  * Caswell, Chelba, and Grangier (2019) Caswell, I.; Chelba, C.; and Grangier, D. 2019.  Tagged back-translation.  _arXiv:1906.06442_.
  * Cheng, Jiang, and Macherey (2019) Cheng, Y.; Jiang, L.; and Macherey, W. 2019.  Robust Neural Machine Translation with Doubly Adversarial Inputs.  In _ACL_ , 3044–3049.
  * Cheng et al. (2020) Cheng, Y.; Jiang, L.; Macherey, W.; and Eisenstein, J. 2020.  AdvAug: Robust Adversarial Augmentation for Neural Machine Translation.  In _ACL_ , 5961–5970.
  * Cheng et al. (2018) Cheng, Y.; Tu, Z.; Meng, F.; Zhai, J.; and Liu, Y. 2018.  Towards Robust Neural Machine Translation.  In _ACL_ , 1756–1766.
  * Cho et al. (2014) Cho, K.; van Merrienboer, B.; Gulcehre, C.; Bahdanau, D.; Bougares, F.; Schwenk, H.; and Bengio, Y. 2014.  Learning Phrase Representations using RNN Encoder–Decoder for Statistical Machine Translation.  In _EMNLP_ , 1724–1734.
  * Devlin et al. (2019) Devlin, J.; Chang, M.-W.; Lee, K.; and Toutanova, K. 2019.  BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding.  In _NAACL_ , 4171–4186.
  * Ebrahimi, Lowd, and Dou (2018) Ebrahimi, J.; Lowd, D.; and Dou, D. 2018.  On Adversarial Examples for Character-Level Neural Machine Translation.  In _Coling_ , 653–663.
  * Finn, Abbeel, and Levine (2017) Finn, C.; Abbeel, P.; and Levine, S. 2017.  Model-agnostic meta-learning for fast adaptation of deep networks.  In _ICML_ , 1126–1135.
  * Gao et al. (2019) Gao, F.; Zhu, J.; Wu, L.; Xia, Y.; Qin, T.; Cheng, X.; Zhou, W.; and Liu, T.-Y. 2019\.  Soft Contextual Data Augmentation for Neural Machine Translation.  In _ACL_ , 5539–5544.
  * Ghazvininejad et al. (2019) Ghazvininejad, M.; Levy, O.; Liu, Y.; and Zettlemoyer, L. 2019.  Mask-Predict: Parallel Decoding of Conditional Masked Language Models.  In _EMNLP-IJCNLP_ , 6112–6121.
  * Gu et al. (2017) Gu, J.; Bradbury, J.; Xiong, C.; Li, V. O.; and Socher, R. 2017.  Non-autoregressive neural machine translation.  _arXiv preprint arXiv:1711.02281_.
  * Gu et al. (2018) Gu, J.; Wang, Y.; Chen, Y.; Li, V. O.; and Cho, K. 2018.  Meta-Learning for Low-Resource Neural Machine Translation.  In _EMNLP_ , 3622–3631.
  * Hao et al. (2019) Hao, J.; Wang, X.; Shi, S.; Zhang, J.; and Tu, Z. 2019.  Multi-Granularity Self-Attention for Neural Machine Translation.  In _EMNLP-IJCNLP_ , 887–897.
  * He, Meister, and Su (2020) He, P.; Meister, C.; and Su, Z. 2020.  Structure-invariant testing for machine translation.  In _ICSE_ , 961–973. IEEE.
  * Hoang et al. (2018) Hoang, V. C. D.; Koehn, P.; Haffari, G.; and Cohn, T. 2018.  Iterative Back-Translation for Neural Machine Translation.  In _NMTG_ , 18–24.
  * Jiao et al. (2020) Jiao, W.; Wang, X.; He, S.; King, I.; Lyu, M.; and Tu, Z. 2020.  Data Rejuvenation: Exploiting Inactive Training Examples for Neural Machine Translation.  In _EMNLP_ , 2255–2266.
  * Lample and Conneau (2019) Lample, G.; and Conneau, A. 2019.  Cross-lingual Language Model Pretraining.  _arXiv preprint arXiv:1901.07291_.
  * Li et al. (2018a) Li, D.; Yang, Y.; Song, Y.-Z.; and Hospedales, T. 2018a.  Learning to generalize: Meta-learning for domain generalization.  In _AAAI_ , volume 32.
  * Li et al. (2018b) Li, J.; Tu, Z.; Yang, B.; Lyu, M. R.; and Zhang, T. 2018b.  Multi-Head Attention with Disagreement Regularization.  In _EMNLP_ , 2897–2903.
  * Liu et al. (2019) Liu, H.; Ma, M.; Huang, L.; Xiong, H.; and He, Z. 2019.  Robust Neural Machine Translation with Joint Textual and Phonetic Embedding.  In _ACL_ , 3044–3049.
  * Liu et al. (2020) Liu, Y.; Gu, J.; Goyal, N.; Li, X.; Edunov, S.; Ghazvininejad, M.; Lewis, M.; and Zettlemoyer, L. 2020.  Multilingual Denoising Pre-training for Neural Machine Translation.  _TACL_ , 726–742.
  * Luong, Pham, and Manning (2015) Luong, M.; Pham, H.; and Manning, C. D. 2015.  Effective Approaches to Attention-based Neural Machine Translation.  In _EMNLP_ , 1412–1421.
  * Neubig et al. (2019) Neubig, G.; Dou, Z.; Hu, J.; Michel, P.; Pruthi, D.; Wang, X.; and Wieting, J. 2019\.  compare-mt: A Tool for Holistic Comparison of Language Generation Systems.  _CoRR_ , abs/1903.07926.
  * Nguyen et al. (2020) Nguyen, X.-P.; Joty, S.; Kui, W.; and Aw, A. T. 2020.  Data Diversification: A Simple Strategy For Neural Machine Translation.  In _NIPS_ , 10018–10029.
  * Ott et al. (2018) Ott, M.; Auli, M.; Grangier, D.; and Ranzato, M. 2018.  Analyzing uncertainty in neural machine translation.  In _ICML_ , 3956–3965.
  * Papineni et al. (2002) Papineni, K.; Roukos, S.; Ward, T.; and Zhu, W.-J. 2002.  BLEU: A Method for Automatic Evaluation of Machine Translation.  In _ACL_ , 311–318.
  * Qian and Yu (2019) Qian, K.; and Yu, Z. 2019.  Domain Adaptive Dialog Generation via Meta Learning.  In _ACL_ , 2639–2649.
  * Raffel et al. (2020) Raffel, C.; Shazeer, N.; Roberts, A.; Lee, K.; Narang, S.; Matena, M.; Zhou, Y.; Li, W.; Liu, P. J.; et al. 2020.  Exploring the limits of transfer learning with a unified text-to-text transformer.  _JMLR_ , 21(140): 1–67.
  * Sennrich, Haddow, and Birch (2016a) Sennrich, R.; Haddow, B.; and Birch, A. 2016a.  Improving Neural Machine Translation Models with Monolingual Data.  In _ACL_ , 86–96.
  * Sennrich, Haddow, and Birch (2016b) Sennrich, R.; Haddow, B.; and Birch, A. 2016b.  Neural Machine Translation of Rare Words with Subword Units.  In _ACL_ , 1715–1725.
  * Sperber, Niehues, and Waibel (2017) Sperber, M.; Niehues, J.; and Waibel, A. 2017.  Toward robust neural machine translation for noisy input sequences.  In _ICSLT_ , 90–96.
  * Sutskever, Vinyals, and Le (2014) Sutskever, I.; Vinyals, O.; and Le, Q. V. 2014.  Sequence to Sequence Learning with Neural Networks.  In _NIPS_ , volume 27.
  * Vaswani et al. (2017) Vaswani, A.; Shazeer, N.; Parmar, N.; Uszkoreit, J.; Jones, L.; Gomez, A. N.; Kaiser, Ł.; and Polosukhin, I. 2017.  Attention is all you need.  In _NIPS_ , volume 30.
  * Wang et al. (2019) Wang, Q.; Li, B.; Xiao, T.; Zhu, J.; Li, C.; Wong, D. F.; and Chao, L. S. 2019.  Learning Deep Transformer Models for Machine Translation.  In _ACL_ , 1810–1822.
  * Wang et al. (2018) Wang, X.; Pham, H.; Dai, Z.; and Neubig, G. 2018.  SwitchOut: an Efficient Data Augmentation Algorithm for Neural Machine Translation.  In _EMNLP_ , 856–861.
  * Wang, Tsvetkov, and Neubig (2020) Wang, X.; Tsvetkov, Y.; and Neubig, G. 2020.  Balancing Training for Multilingual Neural Machine Translation.  In _ACL_ , 8526–8537.
  * Wang, Hu, and Hu (2020) Wang, Z.; Hu, G.; and Hu, Q. 2020.  Training noise-robust deep neural networks via meta-learning.  In _CVPR_ , 4524–4533.
  * Wei et al. (2022) Wei, X.; Yu, H.; Hu, Y.; Weng, R.; Luo, W.; and Jin, R. 2022.  Learning to Generalize to More: Continuous Semantic Augmentation for Neural Machine Translation.  In _ACL_ , 7930–7944.
  * Wei et al. (2020) Wei, X.; Yu, H.; Hu, Y.; Weng, R.; Xing, L.; and Luo, W. 2020.  Uncertainty-Aware Semantic Augmentation for Neural Machine Translation.  In _EMNLP_ , 2724–2735.
  * Wu et al. (2021) Wu, M.; Li, Y.; Zhang, M.; Li, L.; Haffari, G.; and Liu, Q. 2021.  Uncertainty-Aware Balancing for Multilingual and Multi-Domain Neural Machine Translation Training.  In _EMNLP_ , 7291–7305.
  * Yang et al. (2019) Yang, B.; Li, J.; Wong, D. F.; Chao, L. S.; Wang, X.; and Tu, Z. 2019.  Context-aware self-attention networks.  In _AAAI_ , 387–394.
  * Yao et al. (2021) Yao, H.; Wang, Y.; Wei, Y.; Zhao, P.; Mahdavi, M.; Lian, D.; and Finn, C. 2021.  Meta-learning with an Adaptive Task Scheduler.  In _Neurips_ , 7497–7509.
  * Zhou et al. (2020) Zhou, Y.; Yang, B.; Wong, D. F.; Wan, Y.; and Chao, L. S. 2020.  Uncertainty-Aware Curriculum Learning for Neural Machine Translation.  In _ACL_ , 6934–6944.
  * Zhu et al. (2020) Zhu, J.; Xia, Y.; Wu, L.; He, D.; Qin, T.; Zhou, W.; Li, H.; and Liu, T.-Y. 2020\.  Incorporating BERT into Neural Machine Translation.  In _arXiv:2002.06823_.