# Fixed-point tensor is a four-point function

Atsushi Ueda<EMAIL_ADDRESS>Institute for Solid State Physics,
University of Tokyo, Kashiwa 277-8581, Japan  Masahito Yamazaki
<EMAIL_ADDRESS>Kavli IPMU (WPI), UTIAS, The University of Tokyo,
Kashiwa, Chiba 277-8583, Japan  Center for Data-Driven Discovery, Kavli IPMU
(WPI), UTIAS, The University of Tokyo, Kashiwa, Chiba 277-8583, Japan  Trans-
Scale Quantum Science Institute, The University of Tokyo, Tokyo 113-0033,
Japan

###### Abstract

Through coarse-graining, tensor network representations of a two-dimensional
critical lattice model flow to a universal four-leg tensor, corresponding to a
conformal field theory (CFT) fixed-point. We computed explicit elements of the
critical fixed-point tensor, which we identify as the CFT four-point function.
This allows us to directly extract the operator product expansion coefficients
of the CFT from these tensor elements. Combined with the scaling dimensions
obtained from the transfer matrix, we determine the complete set of the CFT
data from the fixed-point tensor for any critical unitary lattice model.

Introduction.— Renormalization group (RG) [1, *Stuckelberg:1953, 3, 4,
*Bogolubov:1955-2] is one of the most profound concepts in contemporary
physics. RG theory has significantly deepened our understanding of the
universality of critical phenomena [6, 7]. We now understand that each
universality class is described by an RG fixed-point (FP) theory under the RG
transformation, which theory can represented [8, 9] as a conformal field
theory (CFT) [10]. Universal behavior, such as critical exponents, can then be
elucidated from the CFT data, which include central charges, scaling
dimensions, and operator product expansion (OPE) coefficients [11, 12, 13]. It
is therefore of paramount importance to identify this CFT data for a given
ultraviolet (UV) theory (such as a lattice model). 111The conformal bootstrap
[34, 35, 36, 37] is a notable technique that has successfully computed the CFT
data for e.g. the three-dimensional Ising model to a high precision [38].
Despite its successes, the main focus of the conformal bootstrap is to
constrain the possible parameter spaces of CFTs, and is often not sufficient
if one wishes to calculate the CFT data for a specific lattice model. In this
sense, our results are complementary to the bootstrap program..

While the analysis of the real-space RG transformation has a long history
[15], tensor network renormalization (TNR) [16, 17, 18, 19, 20, 21, 22] has
recently emerged as a reliable numerical implementation of the real-space RG.
The application of TNR has demonstrated that the tensor-network representation
of the Boltzmann weights converges to a FP tensor, representing the RG fixed
point.

There are several motivations to study the FP tensors.

First, we expect that the FP tensor encodes the CFT data of the FP theory. Gu
and Wen have established a method for calculating the central charge and
scaling dimensions for fixed-point tensors, a procedure that has since become
standard [23]. It remains an intricate and challenging problem, however, to
compute of the OPE coefficients of the FP CFT [24, 25, 26, 27].

Second, determination of the fixed-point tensor can facilitate concrete
realizations of the RG flow. Recently, Kennedy and Rychkov initiated a
rigorous study of the RG using tensor networks [28, 29]. Employing simple low-
temperature and high-temperature fixed-point tensors, they successfully
demonstrated the stability of the corresponding fixed points. Nevertheless,
the application of similar arguments to critical fixed points remains
unachieved, given that even their tensor network representations are not fully
understood.

Third, precise expressions of the fixed-point tensors will serve as a robust
benchmark for evaluating the precision of different tensor-network algorithms.
A number of algorithms boasting increased accuracy have been developed to
determining the FP tensor, but there remain uncertainties in selecting the
superior option due to our limited understanding of the exact expression of
the fixed-point tensor.

In this Letter, we introduce an exact tensor network representation of
critical RG fixed points, thereby solving the problem of numerically
determining the full defining data of the FP CFT. We anticipate that our
findings will serve as a pivotal contribution in practical computations of the
FP theory on the one hand, and towards the rigorous substantiation of RG
theory, on the other.

Fixed-point tensor.— To simulate two-dimensional statistical models, we use
the tensor network methods, where the local Boltzmann weight is represented as
a four-legged tensor $T^{(0)}$. We obtain the transfer matrix in the
$y$-direction if we contract $L$ copies of the four-leg tensors along a circle
in the $x$-direction; we obtain the partition function $Z(L,T^{(0)})$ if we
contract $L\times L$ copies along the torus in the $x,y$-directions. We can
also contract $L\times L$ copies of $T^{(0)}$ in the $x,y$-directions, but
with endpoints un-contracted (as in the right-hand side of the Figure below).
In the limit $L\to\infty$, this contracted tensor converges to a universal
rank-four tensor $T^{*}$ with an infinite bond dimension that corresponds to
the fixed-point of the RG transformation:

(1)

This tensor $T^{*}$ is called the FP tensor.

If the original tensor $T^{(0)}$ has $\mathrm{D}_{4}$ symmetry, $T^{*}$ also
respects it. This allows the decomposition of the FP tensor into a pair of two
identical three-leg tensors $S^{*}$:

$\displaystyle\begin{matrix}\includegraphics[width=219.08621pt]{S_def.png}\end{matrix}$
(2)

The FP tensor $T^{*}$ has gauge degrees of freedom that change the basis of
each leg. The insertion of the gauge transformation (unitary operators) does
not change the spectral property of the FP tensor. In the following, we fix
the gauge so that each index of the FP tensor is labeled by the eigenstates of
the Hamiltonian $L_{0}+\bar{L}_{0}$ on a cylinder, where $L_{n}$
($\bar{L}_{n}$) are the standard generators of the left-moving (right-moving)
Virasoro algebras. By the state-operator correspondence, we can label these
states by a set of operators $\phi_{\alpha}$, among which we will find the
identity operator $\phi_{1}$ with the lowest scaling dimension. 222Note that
the label $\alpha$ refers to both the primaries and the descendants of the
Virasoro algebra. In tensor-network representations, the projector to this
basis can be found by diagonalizing the transfer matrix as follows [23]:

$\displaystyle\begin{matrix}\includegraphics[width=219.08621pt]{transfer_matrix.png}\end{matrix}$
(3)

Figure 1: $(a)$ The path-integral representation of the tensor
$S^{*}_{\alpha\beta\gamma}$. $(b)$ The path-integral representation of the
tensor $T^{*}_{\alpha\beta\gamma\delta}$.

Main Results.— Let us now state the main results of this paper. First, the
three-leg tensor $S^{*}$ is proportional to the three-point functions of the
FP CFT on the complex plane:

$\displaystyle\frac{S^{*}_{\alpha\beta\gamma}}{S^{*}_{111}}$
$\displaystyle=\langle\phi_{\alpha}(-x_{S})\phi_{\beta}(ix_{S})\phi_{\gamma}(0)\rangle_{\rm
pl}.$ (4)

Second, the four-leg FP tensor determines the four-point functions of the FP
CFT as

$\displaystyle\frac{T^{*}_{\alpha\beta\gamma\delta}}{T^{*}_{1111}}$
$\displaystyle=\langle\phi_{\alpha}(-x_{T})\phi_{\beta}(ix_{T})\phi_{\gamma}(x_{T})\phi_{\delta}(-ix_{T})\rangle_{\rm
pl}.$ (5)

These equalities hold when we choose the values $x_{S}=e^{\pi/4}$ and
$x_{T}=e^{\pi/2}/{2}$. In the following we choose the states
$\alpha,\beta,\dots$ to be primary operators.

We can now reproduce the full defining data for the FP CFT. Recall that we can
extract the scaling dimensions $\Delta_{\alpha}$ operators from Eq. (3). The
remaining data is the OPE coefficients $C_{\alpha\beta\gamma}$ of the
operators $\phi_{\alpha}$, which can be extracted by applying a conformal
transformation to Eq. (4):

$\displaystyle\frac{S^{*}_{\alpha\beta\gamma}}{S^{*}_{111}}$
$\displaystyle=\frac{C_{\alpha\beta\gamma}}{x_{S}^{\Delta_{\beta}+\Delta_{\gamma}-\Delta_{\alpha}}x_{S}^{\Delta_{\gamma}+\Delta_{\alpha}-\Delta_{\beta}}(\sqrt{2}x_{S})^{\Delta_{\alpha}+\Delta_{\beta}-\Delta_{\gamma}}},$
$\displaystyle=\frac{2^{\Delta_{\gamma}}C_{\alpha\beta\gamma}}{(\sqrt{2}x_{S})^{\Delta_{\alpha}+\Delta_{\beta}+\Delta_{\gamma}}}.$
(6)

Equation (2) represents the equivalence of two different decompositions ($s$\-
and $t$-channels) of the four-point function into a pair of three-point
functions, i.e. the celebrated crossing relation of the CFT.

To better understand Eqs. (4-5), we apply conformal transformations to the two
equations, to obtain

$\displaystyle\frac{S^{*}_{\alpha\beta\gamma}}{S^{*}_{111}}$
$\displaystyle=e^{-\frac{\pi}{4}(\Delta_{\alpha}+\Delta_{\beta}+\Delta_{\gamma})}\langle\phi_{\alpha}(-1)\phi_{\beta}(i)\phi_{\gamma}(0)\rangle_{\rm
pl},$ (7) $\displaystyle\frac{T^{*}_{\alpha\beta\gamma\delta}}{T^{*}_{1111}}$
$\displaystyle=\left(\frac{e^{\frac{\pi}{2}}}{2}\right)^{-\Delta_{\rm
tot}}\langle\phi_{\alpha}(-1)\phi_{\beta}(i)\phi_{\gamma}(1)\phi_{\delta}(-i)\rangle_{\rm
pl},$ (8)

where $\Delta_{\rm
tot}\equiv\Delta_{\alpha}+\Delta_{\beta}+\Delta_{\gamma}+\Delta_{\delta}$.

Equations (7-8) naturally arise from conformal mappings [31, 32]. Once we fix
the basis for the fixed-point (FP) tensor, each index corresponds to the
states of CFT. Utilizing state-operator correspondence, the normalized wave
function of the first index of $S^{*}$, for instance, is created by inserting
$\phi_{\alpha}$ in the future infinity of the cylinder as follows:

$|\phi^{1}\rangle=\left(\frac{2\pi}{L}\right)^{-\Delta_{\alpha}}\lim_{z\rightarrow\infty}e^{2\pi
z\Delta_{\alpha}/L}\phi_{\alpha}(\infty)|I^{\rm cyl}\rangle,$

where $|I^{\rm cyl}\rangle$ represents the ground state corresponding to the
identity operator. Subsequently, the FP tensors $S^{*}$ and $T^{*}$ can be
expressed by the path integral on the manifolds $\Sigma_{S}$ and $\Sigma_{T}$,
respectively, as illustrated in Fig. 1. Then, the FP-tensor elements are

$\displaystyle\frac{S^{*}_{\alpha\beta\gamma}}{S^{*}_{111}}$
$\displaystyle=\langle\phi_{\alpha}(\infty)\phi_{\beta}(i\infty)\phi_{\gamma}(-(1+i)\infty)\rangle_{\Sigma_{S}},$
(9) $\displaystyle\frac{T^{*}_{\alpha\beta\gamma\delta}}{T^{*}_{1111}}$
$\displaystyle=\langle\phi_{\alpha}(-\infty)\phi_{\beta}(i\infty)\phi_{\gamma}(\infty)\phi_{\delta}(-i\infty)\rangle_{\Sigma_{T}}.$
(10)

$\Sigma_{S}$ and $\Sigma_{T}$ can be mapped the complex plane $w$ by using
(cf. [33]),

$\displaystyle z_{S}$
$\displaystyle=\frac{L}{2\pi}[-\ln(w-i)-i\ln(w+1)+(1+i)\ln w],$ (11)
$\displaystyle z_{T}$
$\displaystyle=\frac{L}{2\pi}\left[\ln(\frac{w+i}{w-i})+i\ln(\frac{w-1}{w+1})\right].$
(12)

Each operator in the $z$-coordinate transforms accordingly as

$\displaystyle\frac{S^{*}_{\alpha\beta\gamma}}{S^{*}_{111}}$
$\displaystyle=\langle\phi_{\alpha}(-1)\phi_{\beta}(i)\phi_{\gamma}(0)\rangle_{\rm
pl}\prod_{n\in(\alpha,\beta,\gamma)}|J_{n}|^{\Delta_{n}},$
$\displaystyle\frac{T^{*}_{\alpha\beta\gamma\delta}}{T^{*}_{1111}}$
$\displaystyle=\langle\phi_{\alpha}(-1)\phi_{\beta}(i)\phi_{\gamma}(1)\phi_{\delta}(-i)\rangle_{\rm
pl}\prod_{n\in(\alpha,\beta,\gamma,\delta)}|J_{n}|^{\Delta_{n}},$

where
$|J_{n}|=|\left(\frac{2\pi}{L}\right)^{-1}\lim_{z\rightarrow\zeta\infty}e^{2\pi
z\zeta^{*}/(L|\zeta|)}|w^{\prime}(z)|$, and $\zeta\infty$ is the coordinate of
the index in the originate manifold. The resulting $|J_{n}|$ are $e^{-\pi/4}$
and $2e^{-\pi/2}$, respectively, being consistent with Eqs. (7-8). Detailed
calculations are presented in the supplemental material.

Figure 2: The pictorial description of the tensor renormalization group. The
decomposition is done so that $T^{(n)}$ is an exact representation of the
local Boltzmann weights of $L=\sqrt{2}^{n}$

Numerical fixed point tensor.— Let us provide numerical confirmations of our
main results using tensor renormalization group (TRG) [16]. TRG is a numerical
technique devised to calculate effective $L\times L$ tensor networks. In our
study, our interest lies in computing those of large system sizes to obtain a
tensor that is as close as possible to the FP tensor. However, performing an
exact contraction is exponentially difficult, prompting us to focus on
extracting low-lying spectral properties. TRG seeks to circumvent this issue
by employing the principles of the renormalization group theory. Each coarse-
graining step entails decompositions and recombinations as depicted in Fig. 2.
Truncation, parameterized by the bond dimension $D$, is performed to maintain
the tractability of numerical computation. However, it is important to note
that this scheme is considered exact when $D=\infty$, and thus, employing
larger $D$ improves the numerical accuracy. Additionally, we impose ${\rm
D_{4}}$ symmetry in TRG. The details can be found in the supplemental
material.

Figure 3: Estimation of $x_{S}(L)$ from TRG at $D=96$. The values of $x(L)$
from both the Ising and 3-state Potts model converge to the theoretical value
$x_{S}=e^{\pi/4}$ denoted by a black dotted line. We plot $x_{S}=2.23035$
obtained from the critical 9-state clock model [25] with a lime dashed line.
The 3-state Potts model exhibits a deviation for $L>100$ because simulating
systems with higher central charges involves larger numerical errors.

Tests on critical lattice models.—Let us first test the value
$x_{S}=e^{\pi/4}$ in Eq. (7), by computing $x_{S}$ from the critical Ising and
3-state Potts models. Given Eq. (7), we can numerically compute the OPE
coefficients $C_{\alpha\beta\gamma}$ from Eq. (6). We define $x_{S}(L)$ by
solving Eq. (6) to be

$\displaystyle
x_{S}(L)\equiv\frac{1}{\sqrt{2}}\left(\frac{2^{\Delta_{\gamma}}C_{\alpha\beta\gamma}}{S_{\alpha\beta\gamma}(L)}\right)^{1/(\Delta_{\alpha}+\Delta_{\beta}+\Delta_{\gamma})}.$
(13)

Each model has a primary operator $\epsilon$, called the energy and the
thermal operator, respectively. Since $C_{\epsilon\epsilon 1}=1$, $x_{S}(L)$
can be computed from the finite-size three-leg tensor $S_{\epsilon\epsilon
1}(L)$.

Figure 3 shows the value of $x_{S}(L)$ obtained from TRG at the bond dimension
$D=96$. The numerically-derived $x_{S}(L)$’s for both models converge to the
theoretical value of $e^{\pi/4}$. The noticeable increase in amplitude for the
3-state Potts model at $L>10^{2}$ is attributed to the effect of the finite
bond dimension. It is worth noting that our value for $x_{S}$ deviates
slightly from the value $x_{S}=2.23035$ from a previous study on the 9-state
clock model [25]. We speculate that this minor deviation is due to the finite
bond-dimension effect because higher central charges lead to more pronounced
numerical errors [26]. For the system size $L=2048$ and bond dimension $D=96$,
we ascertain $x_{S}=2.193257$ for the Ising model, a value remarkably close to
$e^{\pi/4}=2.193280$.

Once we are certain of the value $x_{S}=e^{\pi/4}$, we can verify Eq. (7) for
all the OPE coefficients, which are computed from the three-leg tensor $S$ as

$\displaystyle
C_{\alpha\beta\gamma}(L)=(\sqrt{2}\,e^{\pi/4})^{\Delta_{\alpha}+\Delta_{\beta}+\Delta_{\gamma}}2^{-\Delta_{\gamma}}S_{\alpha\beta\gamma}(L).$
(14)

The results are exhibited in Fig. 4. The finite-size effect originates from
the twist operator at the branch points [31, 32].

Figure 4: The OPE coefficients evaluated by setting $x_{S}=e^{{\pi/4}}$. The
black dotted lines denote the theoretical values 0.5 and 1.

We next computed four-point tensors $T_{\alpha\beta\gamma\delta}$ and compared
with the theoretical values from Eq. (8), where the explicit forms of the
four-point functions are listed in the supplemental material. The result is
consistent up to two digits for most tensor elements, as shown in Table 1. The
exceptions are $T_{\sigma\sigma\sigma\sigma}$ and $T_{\sigma\sigma 11}$, whose
numerical values deviate approximately 5% from the theoretical values. As for
$T_{\sigma\sigma\epsilon 1}$, the deviation is almost 24%. This discrepancy,
however, can be attributed to finite-size effects and becomes negligible for
infinite system sizes. To illustrate this, we define the finite-size deviation
as

$\displaystyle\delta T_{\alpha\beta\gamma\delta}\equiv
T^{*}_{\alpha\beta\gamma\delta}-T_{\alpha\beta\gamma\delta}(L).$

Figure 5 presents the values of $\delta T_{\sigma\sigma\sigma\sigma}(L)$,
$\delta T_{\sigma\sigma\epsilon 1}(L)$, and $\delta T_{\sigma\sigma 11}(L)$
obtained from TRG calculations. A clear power-law decay with respect to the
system size is observed, supporting the claim that the large deviations for
those elements are finite-size effects. However, it is worth mentioning that
the exponent closely approximates $\sim L^{-1/3}$, hinting at the existence of
an underlying theory that might account for this.

Table 1: The comparison of the numerically-obtained fixed-point tensor $T_{\alpha\beta\gamma\delta}$ at $L=2048$ and the exact four-point function $\langle\phi_{\alpha}(-x_{T})\phi_{\beta}(ix_{T})\phi_{\gamma}(x_{T})\phi_{\delta}(-ix_{T})\rangle_{\rm pl}$ of the Ising model with $x_{T}=e^{\pi/2}/2$.  | $T_{\alpha\beta\gamma\delta}\,(L=2048)$ | $\langle\phi_{\alpha}\phi_{\beta}\phi_{\gamma}\phi_{\delta}\rangle$
---|---|---
$1111$ | 1 | 1
$\sigma\sigma\sigma\sigma$ | 0.610 | 0.645
$\sigma\sigma\epsilon\epsilon$ | 0.0714 | 0.0716
$\sigma\epsilon\sigma\epsilon$ | 0.000 | 0
$\epsilon\epsilon\epsilon\epsilon$ | 0.0168 | 0.0168
$\sigma\sigma\epsilon 1$ | 0.0618 | 0.0765
$\sigma\epsilon\sigma 1$ | 0.133 | 0.140
$\sigma\sigma\sigma 1$ | 0.000 | 0
$\epsilon\epsilon\epsilon 1$ | 0.001 | 0
$\sigma\sigma 11$ | 0.708 | 0.736
$\sigma 1\sigma 1$ | 0.639 | 0.675
$\epsilon\epsilon 11$ | 0.0863 | 0.0864
$\epsilon 1\epsilon 1$ | 0.0439 | 0.0432
$\epsilon\sigma 11$ | 0.000 | 0
Figure 5: The finite-size effect of the fixed point tensor $\delta
T_{\alpha\beta\gamma\delta}\equiv\langle\phi_{\alpha}\phi_{j}{\beta}\phi_{\gamma}\phi_{\delta}\rangle-
T_{\alpha\beta\gamma\delta}(L)$ for various bond dimensions $D=84,\ 88,\ 92,$
and 96. We plot $\delta T_{\alpha\beta\gamma\delta}$ of
$\sigma\sigma\sigma\sigma$(“$+$”), $\sigma\sigma\epsilon 1$(“$\star$”), and
$\sigma\sigma 11$(“$\times$”) with darker colors for higher bond dimensions.
The difference converges to zero for $L\rightarrow\infty$ with the power-law
$\sim L^{-1/3}$.

Acknowledgement— We would like to thank Jacob Bridgeman, Clement Delcamp,
Jutho Haegeman, Rui-Zhen Huang, Kansei Inamura, Andreas Läuchli, Laurens
Lootens, Masaki Oshikawa, Frank Verstraete and Yunqin Zheng for helpful
discussions. A. U. is supported by the MERIT-WINGS Program at the University
of Tokyo, the JSPS fellowship (DC1). He was supported in part by MEXT/JSPS
KAKENHI Grants No. JP21J2052. M. Y. was supported in part by the JSPS Grant-
in-Aid for Scientific Research (19H00689, 19K03820, 20H05860, 23H01168), and
by JST, Japan (PRESTO Grant No. JPMJPR225A, Moonshot R&D Grant No.
JPMJMS2061).

Source Availability.– Our numerical data and analysis codes for the Ising
fixed-point are publicly available at
https://github.com/dartsushi/TRG_D4_symmetry.

## References

  * Stuckelberg and Petermann [1951] E. Stuckelberg and A. Petermann, Helv. Phys. Acta 24, 317 (1951).
  * Stuckelberg and Petermann [1953] E. Stuckelberg and A. Petermann, Helv. Phys. Acta 26, 499 (1953).
  * Gell-Mann and Low [1954] M. Gell-Mann and F. E. Low, Phys. Rev. 95, 1300 (1954).
  * Bogolubov and Shirkov [1955a] N. Bogolubov and D. Shirkov, Dokl. Acad. Nauk SSSR 103, 203 (1955a).
  * Bogolubov and Shirkov [1955b] N. Bogolubov and D. Shirkov, Dokl. Acad. Nauk SSSR 105, 685 (1955b).
  * Wilson and Kogut [1974] K. G. Wilson and J. B. Kogut, Phys. Rept. 12, 75 (1974).
  * Kadanoff [1977] L. P. Kadanoff, Rev. Mod. Phys. 49, 267 (1977).
  * Polchinski [1988] J. Polchinski, Nucl. Phys. B 303, 226 (1988).
  * Luty  _et al._ [2013] M. A. Luty, J. Polchinski, and R. Rattazzi, JHEP 01, 152, arXiv:1204.5221 [hep-th] .
  * Belavin  _et al._ [1984] A. A. Belavin, A. M. Polyakov, and A. B. Zamolodchikov, Nucl. Phys. B 241, 333 (1984).
  * Cardy [1996] J. Cardy,  _Scaling and renormalization in statistical physics_ , Vol. 5 (Cambridge university press, 1996).
  * Di Francesco  _et al._ [1997] P. Di Francesco, P. Mathieu, and D. Senechal,  _Conformal Field Theory_, Graduate Texts in Contemporary Physics (Springer-Verlag, New York, 1997).
  * Zinn-Justin [2021] J. Zinn-Justin,  _Quantum field theory and critical phenomena_ , Vol. 171 (Oxford university press, 2021).
  * Note [1] The conformal bootstrap [34, 35, 36, 37] is a notable technique that has successfully computed the CFT data for e.g. the three-dimensional Ising model to a high precision [38]. Despite its successes, the main focus of the conformal bootstrap is to constrain the possible parameter spaces of CFTs, and is often not sufficient if one wishes to calculate the CFT data for a specific lattice model. In this sense, our results are complementary to the bootstrap program.
  * Kadanoff [1966] L. P. Kadanoff, Physics Physique Fizika 2, 263 (1966).
  * Levin and Nave [2007] M. Levin and C. P. Nave, Phys. Rev. Lett. 99, 120601 (2007).
  * Evenbly and Vidal [2015] G. Evenbly and G. Vidal, Phys. Rev. Lett. 115, 180405 (2015).
  * Evenbly [2017] G. Evenbly, Phys. Rev. B 95, 045117 (2017).
  * Yang  _et al._ [2017] S. Yang, Z.-C. Gu, and X.-G. Wen, Phys. Rev. Lett. 118, 110504 (2017).
  * Bal  _et al._ [2017] M. Bal, M. Mariën, J. Haegeman, and F. Verstraete, Phys. Rev. Lett. 118, 250602 (2017).
  * Hauru  _et al._ [2018] M. Hauru, C. Delcamp, and S. Mizera, Phys. Rev. B 97, 045111 (2018).
  * Homma and Kawashima [2023] K. Homma and N. Kawashima, Nuclear norm regularized loop optimization for tensor network (2023), arXiv:2306.17479 [cond-mat.stat-mech] .
  * Gu and Wen [2009] Z.-C. Gu and X.-G. Wen, Phys. Rev. B 80, 155131 (2009).
  * Evenbly and Vidal [2016] G. Evenbly and G. Vidal, Phys. Rev. Lett. 116, 040401 (2016).
  * Li  _et al._ [2022] G. Li, K. H. Pai, and Z.-C. Gu, Phys. Rev. Res. 4, 023159 (2022).
  * Ueda and Oshikawa [2023] A. Ueda and M. Oshikawa, Finite-size and finite bond dimension effects of tensor network renormalization (2023), arXiv:2302.06632 [cond-mat.stat-mech] .
  * Guo and Wei [2023] W. Guo and T.-C. Wei, Tensor network methods for extracting cft data from fixed-point tensors and defect coarse graining (2023), arXiv:2305.09899 [cond-mat.stat-mech] .
  * Kennedy and Rychkov [2022] T. Kennedy and S. Rychkov, Journal of Statistical Physics 187, 10.1007/s10955-022-02924-4 (2022).
  * Kennedy and Rychkov [2023] T. Kennedy and S. Rychkov, Tensor renormalization group at low temperatures: Discontinuity fixed point (2023), arXiv:2210.06669 [math-ph] .
  * Note [2] Note that the label $\alpha$ refers to both the primaries and the descendants of the Virasoro algebra.
  * Liu  _et al._ [2023] Y. Liu, Y. Zou, and S. Ryu, Phys. Rev. B 107, 155124 (2023).
  * Zou and Vidal [2022] Y. Zou and G. Vidal, Phys. Rev. B 105, 125125 (2022).
  * Mandelstam [1973] S. Mandelstam, Nucl. Phys. B 64, 205 (1973).
  * Ferrara  _et al._ [1973] S. Ferrara, A. F. Grillo, and R. Gatto, Annals Phys. 76, 161 (1973).
  * Polyakov [1974] A. M. Polyakov, Zh. Eksp. Teor. Fiz. 66, 23 (1974).
  * Rattazzi  _et al._ [2008] R. Rattazzi, V. S. Rychkov, E. Tonni, and A. Vichi, JHEP 12, 031, arXiv:0807.0004 [hep-th] .
  * Poland  _et al._ [2019] D. Poland, S. Rychkov, and A. Vichi, Rev. Mod. Phys. 91, 015002 (2019).
  * El-Showk  _et al._ [2012] S. El-Showk, M. F. Paulos, D. Poland, S. Rychkov, D. Simmons-Duffin, and A. Vichi, Phys. Rev. D 86, 025022 (2012), arXiv:1203.6064 [hep-th] .

##  I Supplemental material

###  I.1 Conformal mapping of S

The three-leg tensor $S^{*}_{\alpha\beta\gamma}$ represents the three-sided
thermofield double state corresponding to the geometry in Fig. 1(a). This
manifold $\Sigma_{S}$ is mapped to the plane by a conformal mapping

$\displaystyle z=\frac{L}{2\pi}[-\ln(w-i)-i\ln(w+1)+(1+i)\ln w],$ (15)

which maps the three points in $\Sigma_{S}$,
$(z_{1},z_{2},z_{3})=(\infty,i\infty,-(1+i)\infty)$, to
$(w_{1},w_{2},w_{3})=(i,-1,0)$. Then, the tensor element is

$\displaystyle\frac{S^{*}_{\alpha\beta\gamma}}{S^{*}_{111}}=|J_{1}|^{\Delta_{\alpha}}|J_{2}|^{\Delta_{\beta}}|J_{3}|^{\Delta_{\gamma}}\langle\phi_{\alpha}(-1)\phi_{\beta}(i)\phi_{\gamma}(0)\rangle_{\rm
pl},$ (16)

where $J_{i}$ is the Jacobian of the conformal mapping (15). The initial
states are

$\displaystyle|\phi^{1}\rangle$
$\displaystyle=\left(\frac{2\pi}{L}\right)^{-\Delta_{\alpha}}\lim_{z\rightarrow\infty}e^{2\pi
z\Delta_{\alpha}/L}\phi_{\alpha}(z)|I^{\rm cyl}\rangle,$
$\displaystyle|\phi^{2}\rangle$
$\displaystyle=\left(\frac{2\pi}{L}\right)^{-\Delta_{\beta}}\lim_{z\rightarrow
i\infty}e^{-i2\pi z\Delta_{\beta}/L}\phi_{\beta}(z)|I^{\rm cyl}\rangle,$
$\displaystyle|\phi^{3}\rangle$
$\displaystyle=\left(\frac{\sqrt{2}\pi}{L}\right)^{-\Delta_{\gamma}}$ (17)
$\displaystyle\lim_{z\rightarrow{(-i-1)}\infty}e^{\frac{(i-1)}{\sqrt{2}}\frac{2\pi}{\sqrt{2}L}z\Delta_{\gamma}}\phi_{\gamma}(z)|I^{\rm
cyl}\rangle.$

The Jacobian can be computed as

$\displaystyle|J_{1}|$
$\displaystyle=\left|\left(\frac{2\pi}{L}\right)^{-1}\lim_{z\rightarrow\infty}e^{2\pi
z/L}w^{\prime}(z)\right|$
$\displaystyle=\left|\left(\frac{2\pi}{L}\right)^{-1}\lim_{w\rightarrow
i}e^{2\pi z/L}\left(\frac{dz}{dw}\right)^{-1}\right|.$ (18)

Using Eq. (11), the first and second term is

$\displaystyle e^{2\pi z/L}$
$\displaystyle=\exp[\ln\frac{w}{w-i}+i\ln\frac{w}{w+1}],$ (19)
$\displaystyle\frac{dz}{dw}$
$\displaystyle=\frac{L}{2\pi}\left[-\frac{1}{w-i}-\frac{i}{w+1}+\frac{(1+i)}{w}\right].$
(20)

Substituting these into Eq. (18),

$\displaystyle|J_{1}|$ $\displaystyle=\bigg{|}\lim_{w\rightarrow
i}\frac{w}{w-i}\exp[i\ln\frac{w}{w+1}]$
$\displaystyle\quad\left(\left[-\frac{1}{w-i}-\frac{i}{w+1}+\frac{(1+i)}{w}\right]\right)^{-1}\bigg{|}$
$\displaystyle=\left|\exp(i\ln\frac{i}{1+i})\right|=e^{-\pi/4}.$ (21)

In the same way, we can show $|J_{2}|=|J_{3}|=e^{-\pi/4}$. Thus, the 3-leg
tensor is

$\displaystyle S^{*}_{\alpha\beta\gamma}$
$\displaystyle=e^{-\frac{\pi}{4}(\Delta_{\alpha}+\Delta_{\beta}+\Delta_{\gamma})}\langle\phi_{\alpha}(-1)\phi_{\beta}(i)\phi_{\gamma}(0)\rangle_{\rm
pl}.$ (22)

###  I.2 Conformal mapping of T

The conformal mapping from the four-sided thermofield double state is

$\displaystyle z$
$\displaystyle=\frac{L}{2\pi}[-\ln(w-i)+\log(w+i)-i\ln(w+1)+i\ln(w-1)]$
$\displaystyle=\frac{L}{2\pi}\left[\ln(\frac{w+i}{w-i})+i\ln(\frac{w-1}{w+1})\right].$
(23)

The Jacobian is calculated in a similar way as

$\displaystyle e^{2\pi z/L}$
$\displaystyle=\exp[\ln\frac{w+i}{w-i}+i\ln\frac{w-1}{w+1}],$ (24)
$\displaystyle\frac{dz}{dw}$
$\displaystyle=\frac{L}{2\pi}\left[-\frac{1}{w-i}+\frac{1}{w+i}-\frac{i}{w+1}+\frac{i}{w-1}\right].$
(25)

Then, the Jacobian is computed as

$\displaystyle|J_{1}|^{-1}$ $\displaystyle=\lim_{w\rightarrow i}\left|e^{-2\pi
z/L}\left[-\frac{1}{w-i}+\frac{1}{w+i}-\frac{i}{w+1}+\frac{i}{w-1}\right]\right|$
$\displaystyle=\frac{e^{\pi/2}}{2}.$ (26)

Thus, the four-point function is transformed as

$\displaystyle\frac{T^{*}_{\alpha\beta\gamma\delta}}{T^{*}_{1111}}$
$\displaystyle=|J_{1}|^{\Delta_{\alpha}}|J_{2}|^{\Delta_{\beta}}|J_{3}|^{\Delta_{\gamma}}|J_{4}|^{\Delta_{\delta}}\langle\phi_{\alpha}(-1)\phi_{\beta}(i)\phi_{\gamma}(1)\phi_{\delta}(-i)\rangle_{\rm
pl},$ $\displaystyle=\left(\frac{e^{\frac{\pi}{2}}}{2}\right)^{-\Delta_{\rm
tot}}\langle\phi_{\alpha}(-1)\phi_{\beta}(i)\phi_{\gamma}(1)\phi_{\delta}(-i)\rangle_{\rm
pl}.$ (27)

Figure 6: The contraction of the fixed-point tensors. We obtain $S$ from TRG
and combine together to make $S^{*}$ and $T^{*}$. In this way, $T^{*}$
respects reflection symmetry along the dotted lines in addition to $C_{4}$
rotation symmetry.

###  I.3 ${\rm D_{4}}$-symmetric TRG

We use the TRG scheme which aligns closely with the original paper’s
methodology [16]. In principle, Singular-Value Decomposition (SVD) of the
four-leg tensor should yield two identical symmetric tensors, given the ${\rm
D_{4}}$ symmetry of the original tensor. However, numerical errors sometimes
make these two tensors non-identical. To mitigate this, we consistently select
one of the three-leg tensors and supplement the other with its reflection. By
adopting this approach, the fixed-point tensors, depicted in Fig. 6, maintain
the ${\rm D_{4}}$ symmetry at every RG step by construction.

###  I.4 Four-point function of the critical Ising model

Here, we list the four-point function of the Ising model. Given the four
coordinates $z_{i}$ and its cross-ratio
$x\equiv(z_{12}z_{34})/({z_{13}z_{24}})$, the four-point functions of the
Ising CFT are

$\displaystyle\langle\epsilon^{4}\rangle$
$\displaystyle=\left|\left[\prod_{1\leq i<j\leq
4}z_{ij}^{-\frac{1}{3}}\right]\frac{1-x+x^{2}}{x^{\frac{2}{3}}(1-x)^{\frac{2}{3}}}\right|^{2},$
$\displaystyle\langle\sigma^{2}\epsilon^{2}\rangle$
$\displaystyle=\left|\left[z_{12}^{\frac{1}{4}}z_{34}^{-\frac{5}{8}}\left(z_{13}z_{24}z_{14}z_{23}\right)^{-\frac{3}{16}}\right]\frac{1-\frac{x}{2}}{x^{\frac{3}{8}}(1-x)^{\frac{5}{16}}}\right|^{2},$
$\displaystyle\langle\sigma^{4}\rangle$
$\displaystyle=|z_{13}z_{24}|^{-1/4}\frac{|1+\sqrt{1-x}|+|1-\sqrt{1-x}|}{2|x|^{\frac{1}{4}}|1-x|^{\frac{1}{4}}}.$

The functions above are used to evaluate the analytic FP tensor elements in
the main text.


# Towards Improving Adversarial Training of NLP Models

Jin Yong Yoo, Yanjun Qi
Department of Computer Science
University of Virginia
Charlottesville, VA, USA
{jy2ma<EMAIL_ADDRESS>

###### Abstract

Adversarial training, a method for learning robust deep neural networks,
constructs adversarial examples during training. However, recent methods for
generating NLP adversarial examples involve combinatorial search and expensive
sentence encoders for constraining the generated instances. As a result, it
remains challenging to use vanilla adversarial training to improve NLP models’
performance, and the benefits are mainly uninvestigated. This paper proposes a
simple and improved vanilla adversarial training process for NLP models, which
we name Attacking to Training (A2T ). The core part of A2T is a new and
cheaper word substitution attack optimized for vanilla adversarial training.
We use A2T to train BERT and RoBERTa models on IMDB, Rotten Tomatoes, Yelp,
and SNLI datasets. Our results empirically show that it is possible to train
robust NLP models using a much cheaper adversary. We demonstrate that vanilla
adversarial training with A2T can improve an NLP model’s robustness to the
attack it was originally trained with and also defend the model against other
types of word substitution attacks. Furthermore, we show that A2T can improve
NLP models’ standard accuracy, cross-domain generalization, and
interpretability. 111Code is available at
https://github.com/QData/Textattack-A2T

##  1 Introduction

Recently, robustness of neural networks against adversarial examples has been
an active area of research in natural language processing with a plethora of
new adversarial attacks222We use “methods for adversarial example generation”
and “adversarial attacks” interchangeably. having been proposed to fool
question answering (Jia and Liang, 2017), machine translation (Cheng et al.,
2018), and text classification systems (Ebrahimi et al., 2017; Jia and Liang,
2017; Alzantot et al., 2018; Jin et al., 2019; Ren et al., 2019; Zang et al.,
2020; Garg and Ramakrishnan, 2020). One method to make models more resistant
to such adversarial attacks is adversarial training where the model is trained
on both original examples and adversarial examples Goodfellow et al. (2014);
Madry et al. (2018). Due to its simple workflow, it is a popular go-to method
for improving adversarial robustness.

Typically, adversarial training involves generating adversarial example
${\mathbf{x}}^{\prime}$ from each original example ${\mathbf{x}}$ before
training the model on both ${\mathbf{x}}$ and ${\mathbf{x}}^{\prime}$. In NLP,
generating an adversarial example is typically framed as a combinatorial
optimization problem solved using a heuristic search algorithm. Such an
iterative search process is expensive. Depending on the choice of the search
algorithm, it can take up to tens of thousands of forward passes of the
underlying model to generate one example (Yoo et al., 2020). This high
computational cost hinders the use of vanilla adversarial training in NLP, and
it is unclear how and as to what extent such training can improve an NLP
model’s performance Morris et al. (2020a).

In this paper, we propose to improve the vanilla adversarial training in NLP
with a computationally cheaper adversary, referred to as A2T . The proposed
A2T uses a cheaper gradient-based word importance ranking method to
iteratively replace each word with synonyms generated from a counter-fitted
word embedding Mrksic et al. (2016). We use A2T and its variation A2T-MLM
(which uses masked language model-based word replacements instead) to train
BERT (Devlin et al., 2018) and RoBERTa (Liu et al., 2019) models on text
classification tasks such as IMDB (Maas et al., 2011), Rotten Tomatoes (Pang
and Lee, 2005), Yelp (Zhang et al., 2015), and SNLI (Bowman et al., 2015)
datasets. Our findings are as following:

  * •

Adversarial training with both A2T and A2T-MLM can help improve adversarial
robustness, even against NLP attacks that were not used to train the model
(see Table 5).

  * •

Adversarial training with A2T can provide a regularization effect and improve
the model’s standard accuracy and/or cross-domain generalization, while
A2T-MLM tends to hurt both standard accuracy and cross-domain generalization
(see Table 7).

  * •

Using LIME Ribeiro et al. (2016) and AOPC metric, we demonstrate that
adversarial training with A2T can improve NLP models’ interpretability (see
Table 8).

##  2 Background

Figure 1: Pipeline for vanilla adversarial training in NLP

###  2.1 Vanilla Adversarial Training in NLP

Vanilla adversarial training has been a major defense strategy in most
existing work on adversarial robustness (Goodfellow et al., 2014; Kurakin et
al., 2016; Madry et al., 2018). In our work, we define vanilla adversarial
training as adversarial training that involves augmenting the training data
with adversarial examples generated from perturbing the training data in the
input space. In contrast, non-vanilla adversarial training performs
perturbations on non-input space such as word embeddings Miyato et al. (2017);
Zhu et al. (2019); Jiang et al. (2020); Liu et al. (2020).

In recent NLP literature, vanilla adversarial training has only been evaluated
in a limited context. In most studies, adversarial training is only performed
to show that such training can make models more resistant to the attack it was
originally trained with (Jin et al., 2019; Ren et al., 2019; Li et al., 2020;
Zang et al., 2020; Li et al., 2021). This observation is hardly surprising,
and it is generally recommended to use different attacks to evaluate the
effectiveness of defenses Carlini et al. (2019). Therefore, in this paper, we
perform a more in-depth investigation into how a practical vanilla adversarial
training algorithm we propose affects NLP models’ adversarial robustness
against a set of different attacks that are not used for training.

In addition, we examine how adversarial training affects model’s performance
in other aspects such as standard accuracy, cross-domain generalization, and
interpretability.

###  2.2 Components of an NLP Attack

Figure 1 includes a schematic diagram on vanilla adversarial training where an
adversarial attack is part of the training procedure. We borrow the framework
introduced by Morris et al. (2020b) which breaks down the process of
generating natural language adversarial examples into three parts (see Table
1): (1) A search algorithm to iteratively search for the best perturbations
(2) A transformation module to perturb a text input from ${\mathbf{x}}$ to
${\mathbf{x}}^{\prime}$ (e.g. synonym substitutions) (3) Set of constraints
that filters out undesirable ${\mathbf{x}}^{\prime}$ to ensure that perturbed
${\mathbf{x}}^{\prime}$ preserves the semantics and fluency of the original
${\mathbf{x}}$.

Adversarial attacks frame their approach as a combinatorial search because of
the exponential nature of the search space. Consider the search space for an
adversarial attack that replaces words with synonyms: If a given sequence of
text consists of $N$ words, and each word has $M$ potential substitutions, the
total number of perturbed inputs to consider is $(M+1)^{N}-1$. Thus, the graph
of all potential adversarial examples for a given input is far too large for
an exhaustive search. Studies on NLP attacks have explored various heuristic
search algorithms, including beam search Ebrahimi et al. (2017), genetic
algorithm Alzantot et al. (2018), and greedy method with word importance
ranking Gao et al. (2018); Jin et al. (2019); Ren et al. (2019).

##  3 Method: A2T (Attacking to Training)

In this section, we present our algorithm A2T for an improved and practical
vanilla adversarial training for NLP. We also present the cheaper adversarial
attacks we propose to use in A2T .

###  3.1 Training Objective

Following the recommendations by Goodfellow et al. (2014); Kurakin et al.
(2016), we use both clean333Clean examples refer to the original training
examples. and adversarial examples to train our model. We aim to minimize both
the loss on the original training dataset and the loss on the adversarial
examples.

Let ${\mathbf{L}}(\theta,{\mathbf{x}},{\mathbf{y}})$ represent the loss
function for input text ${\mathbf{x}}$ and label ${\mathbf{y}}$ and let
${\mathbf{A}}(\theta,{\mathbf{x}},{\mathbf{y}})$ be the adversarial attack
that produces adversarial example ${\mathbf{x}}_{adv}$. Then, our training
objective is as following:

$\displaystyle\operatorname*{arg\,min}_{\theta}{\mathbf{E}}_{({\mathbf{x}},{\mathbf{y}})\sim
D}[{\mathbf{L}}(\theta,{\mathbf{x}},{\mathbf{y}})$ (1)
$\displaystyle+\alpha{\mathbf{L}}(\theta,{\mathbf{A}}(\theta,{\mathbf{x}},{\mathbf{y}}),{\mathbf{y}})]$

$\alpha$ is used to weigh the adversarial loss. In this work, we set
$\alpha=1$, weighing the two loss equally. 444We leave tuning for the optimal
$\alpha$ for future work.

###  3.2 A Practical Training Workflow

Previous works in adversarial training, especially those from computer vision
(Goodfellow et al., 2014; Madry et al., 2018), generate adversarial examples
between every mini-batch and use them to train the model. However, it is
difficult in practice to generate adversarial examples between every mini-
batch update when using NLP adversarial attacks.

This is because NLP adversarial attacks typically require other neural
networks as their sub-components (e.g. sentence encoders, masked language
models). For example, Jin et al. (2019) uses Universal Sentence Encoder (Cer
et al., 2018) while Garg and Ramakrishnan (2020) uses BERT masked language
model (Devlin et al., 2018). Given that recent Transformers models such as
BERT and RoBERTa models also require large amounts of GPU memory to store the
computation graph during training, it is impossible to run adversarial attacks
and train the model in the same GPU. We, therefore, propose to instead
maximize GPU utilization by first generating adversarial examples before every
epoch and then using the generated samples to train the model.

Based on our initial empirical study, we found that it is not necessary to
generate adversarial examples for every clean example in the training dataset
to improve the robustness of the model. In fact, as we see in Section 5.6,
training with fewer adversarial examples can often produce better results.
Therefore, we propose to leave the number of adversarial examples produced in
each epoch as a hyperparameter $\gamma$ where it is a percentage of the
original training dataset. For cases where the adversarial attack fails to
find an adversarial example, we skip them and instead sample more from the
training dataset to compensate for the skipped samples. In our experiments,
unless specified, we attack $20\%$ of the training dataset, which was based on
our initial empirical findings.

Algorithm 1 shows the proposed A2T adversarial training algorithm in detail.
We run clean training for $N_{\text{clean}}$ number of epochs before
performing $N_{\text{adv}}$ epochs of adversarial training. Between line 6-13,
we generate the adversarial examples until we obtain $\gamma$ percentage of
the training dataset. When multiple GPUs are available, we use data
parallelism to speed up the generation process. We also shuffle the dataset
before attacking to avoid attacking the same sample every epoch.

Algorithm 1 Adversarial Training with A2T

0: Number of clean epochs $N_{\text{clean}}$, number of adversarial epochs
$N_{\text{adv}}$, percentage of dataset to attack $\gamma$, attack
${\mathbf{A}}(\theta,{\mathbf{x}},{\mathbf{y}})$, and training data
$D=\\{({\mathbf{x}}^{(i)},{\mathbf{y}}^{(i)})\\}^{n}_{i=1}$, $\alpha$ the
smoothing proportion of adversarial training

1: Initialize model $\theta$

2: for clean epoch$=1,\dots,N_{\text{clean}}$ do

3: Train $\theta$ on $D$

4: end for

5: for adversarial epoch$=1,\dots,N_{\text{adv}}$ do

6: Randomly shuffle $D$

7: $D_{\text{adv}}\leftarrow\\{\\}$

8: $i\leftarrow 1$

9: while $|D_{\text{adv}}|<\gamma*|D|$ and $i\leq|D|$ do

10:
${\mathbf{x}}^{(i)}_{\text{adv}}\leftarrow{\mathbf{A}}(\theta,{\mathbf{x}}^{(i)},{\mathbf{y}}^{(i)})$

11: $D_{\text{adv}}\leftarrow
D_{\text{adv}}\cup\\{({\mathbf{x}}^{(i)}_{\text{adv}},{\mathbf{y}}^{(i)})\\}$

12: $i\leftarrow i+1$

13: end while

14: $D^{\prime}\leftarrow D\cup D_{\text{adv}}$

15: Train $\theta$ on $D^{\prime}$ with $\alpha$ used to weigh the loss

16: end for

###  3.3 Cheaper Attack for Adversarial Training

The attack component in A2T is designed to be faster than previous attacks
from literature. We achieve the speedup by making two key choices when
constructing our attack: (1) Gradient-based word importance ordering, and (2)
DistilBERT (Sanh et al., 2019) semantic textual similarity constraint. Table 1
summarizes the differences between A2T and two other attacks from literature:
TextFooler Jin et al. (2019) and BAE Garg and Ramakrishnan (2020).

Components | A2T | A2T-MLM | TextFooler | BAE
---|---|---|---|---
| Search Method
---
for Ranking Words
| Gradient-based
---
Word Importance
| Gradient-based
---
Word Importance
| Deletion-based
---
Word Importance
| Deletion-based
---
Word Importance
Word Substitution | Word Embedding | BERT MLM | Word Embedding | BERT MLM
Constraints | POS Consistency | POS Consistency | POS Consistency | POS Consistency
DistilBERT Similarity | DistilBERT Similarity | USE Similarity | USE Similarity

Table 1: Comparing A2T and variation with TextFooler Jin et al. (2019) and BAE Garg and Ramakrishnan (2020) Attack | Runtime (sec)
---|---
A2T | 5,988
TextFooler + Gradient Search | 8,760
TextFooler | 17,268
Table 2: The runtime (in seconds) of A2T , original TextFooler, and
TextFooler where deletion-based word importance ranking is switched with
gradient-based word importance ranking. We can see that replacing the search
method gives us approximately $2\times$ speedup. The attack was carried out
against a BERT model trained on IMDB dataset and 1000 samples were attacked.

#### Faster Search with Gradient-based Word Importance Ranking:

Previous attacks such as Jin et al. (2019); Garg and Ramakrishnan (2020)
iteratively replace one word at a time to generate adversarial examples. To
determine the order of words in which to replace, both Jin et al. (2019); Garg
and Ramakrishnan (2020) rank the words by how much the target model’s
confidence on the ground truth label changes when the word is deleted from the
input. We will refer to this as deletion-based word importance ranking.

One issue with this method is that an additional forward pass of the model
must be made for each word to calculate its importance. For longer text
inputs, this can mean that we have to make up to hundreds of forward passes to
generate one adversarial example.

A2T instead determines each word’s importance using the gradient of the loss.
For an input text including $n$ words:
${\mathbf{x}}=(x_{1},x_{2},\dots,x_{n})$ where each $x_{i}$ is a word, the
importance of $x_{i}$ is calculated as:

$I(x_{i})=||\nabla_{{\mathbf{e}}_{i}}{\mathbf{L}}(\theta,{\mathbf{x}},{\mathbf{y}}))||_{1}$
(2)

where ${\mathbf{e}}_{i}$ is the word embedding that corresponds to word
$x_{i}$. For BERT and RoBERTa models where inputs are tokenized into sub-
words, we calculate the importance of each word by taking the average of all
sub-words constituting the word.

This requires only one forward and backward pass and saves us from having to
make additional forward passes for each word. Yoo et al. (2020) showed that
the gradient-ordering method is the fastest search method and provides
competitive attack success rate when compared to the deletion-based method.
Table 2 shows that when we switch from deletion-based ranking (“TextFooler”)
to gradient-based ranking (“TextFooler+Gradient Search”), we can obtain
approximately $2\times$ speedup.

#### Cheaper Constraint Enforcing with DistilBERT (Sanh et al., 2019) semantic
textual similarity model:

Most recent attacks like Jin et al. (2019); Garg and Ramakrishnan (2020); Li
et al. (2020) use Universal Sentence Encoders (USE) Cer et al. (2018) to
compare the sentence encodings of original text ${\mathbf{x}}$ and perturbed
text ${\mathbf{x}}^{\prime}$. If the cosine similarity between two encodings
fall below a certain threshold, ${\mathbf{x}}^{\prime}$ is ignored. One of the
challenges of using large encoders like USE is that it can take up significant
amount of GPU memory – up to 9GB in case of USE.

Instead of using USE, A2T uses DistilBERT (Sanh et al., 2019) model trained on
semantic textual similarity task as its constraint module 555We use code from
Reimers and Gurevych (2019). This is because DistilBERT requires $10\times$
less GPU memory than USE and requires fewer operations.

###  3.4 A2T-MLM : Variation with a Different Word Substitution Strategy

A2T generates replacements for each word by selecting top-$k$ nearest
neighbors in a counter-fitted word embedding Mrksic et al. (2016), which helps
nearest-neighbor searches return better synonyms than regular word embeddings.
This word substitution strategy has been previously proposed by Alzantot et
al. (2018); Jin et al. (2019). In our work, we first precompute all the
top-$k$ nearest neighbors and cache them to speed up our attacks. We also
consider another variation we name as A2T-MLM in which BERT masked language
model is used to generate replacements (proposed in Garg and Ramakrishnan
(2020); Li et al. (2020, 2021)).

We consider this variation because two strategies prioritize different
language qualities when proposing word replacements. Counter-fitted word
embeddings are likely to propose synonyms as replacements, but could produce
incoherent texts as it does not take the entire context into account. On the
other hand, BERT masked language model is more likely to propose replacement
words that preserve grammatical and contextual coherency but fail to preserve
the semantics. Comparing A2T with A2T-MLM allows us to study the effect of
word substitution strategy on adversarial training.

##  4 Related Work

Past works on adversarial training for NLP models come in diverse flavors that
differ in how adversarial examples are generated. Miyato et al. (2017), which
is one of the first works to introduce adversarial training to NLP tasks,
perform perturbations in the word embedding level instead of the actual input
space level. Likewise, Zhu et al. (2019); Jiang et al. (2020); Liu et al.
(2020) all apply perturbations in the embedding level using gradient-based
optimization methods from computer vision.

Another family of work on adversarial training involves computing the
hyperspace of activations that contains all texts that can be generated using
word substitutions and then training the model to make consistent prediction
for inputs inside the hyperspace. Jia et al. (2019); Huang et al. (2019)
compute axis-aligned hyper-rectangles and leverages Interval Bound Propagation
Dvijotham et al. (2018) to defend the model against substitution attacks while
Dong et al. (2021) computes the desired hyperspace as a convex hull in the
embedding space and further trains the model to be robust against worst case
embedding in the convex hull.

Yet, adversarial training that simply uses adversarial examples generated in
the input space is still a relatively unexplored area of research despite its
simple, extendable workflow. Most works that have discussed such form of
adversarial training only train limited number of models and datasets to show
that adversarial training can make models more resistant to the particular
attack used to train the model (Jin et al., 2019; Ren et al., 2019; Li et al.,
2020; Zang et al., 2020; Li et al., 2021). Our work demonstrates that simple
vanilla adversarial training can actually provide improvements in adversarial
robustness across many different word substitution attacks. Furthermore, we
show that it can improve both generalization and interpretability of models,
properties that have not been examined by previous works.

##  5 Experiment and Results

###  5.1 Datasets & Models

We chose IMDB Maas et al. (2011), Movie Reviews (MR) Pang and Lee (2005), Yelp
Zhang et al. (2015), and SNLI Bowman et al. (2015) datasets for our
experiment. For Yelp, instead of using the entire training set, we sampled 30k
examples for training and 10k for validation.

Dataset | Train | Dev | Test
---|---|---|---
IMDB | 20k | 5k | 25k
MR | 8.5k | 1k | 1k
Yelp | 30k | 10k | 38k
SNLI | 550k | 10k | 10k
Table 3: Overview of the datasets.

We trained BERT Devlin et al. (2018) and RoBERTa Liu et al. (2019) models
using the implementation provided by Wolf et al. (2020). All texts were
tokenized up to the first 512 tokens and we trained the model for one clean
epoch and three adversarial epochs. Adam optimizer with weight decay of $0.01$
Loshchilov and Hutter (2017) and learning rate of $5\mathrm{e}{-5}$ were used
for training. Also, we used a linear scheduler with $500$ warm-up steps for
IMDB and Yelp, $100$ steps for MR, and $5000$ steps for SNLI. We performed
three runs with random seeds for each model.

###  5.2 Baselines

Adversarial training can be viewed as a data augmentation method where hard
examples are added to the training set. Therefore, besides just having models
that are trained on clean adversarial examples (i.e. “natural training”) as
our baseline, we also compare our results to models trained using more
conventional data augmentation methods. We use SSMBA Ng et al. (2020) and
backtranslation666For backtranslation, we use English-to-German model and
German-to-English model trained by Ng et al. (2019). Xie et al. (2019) methods
as our baselines as both have reported strong performance on text
classification tasks. We use these methods to generate approximately the same
number of new training examples as adversarial training.

###  5.3 Results on Adversarial Robustness

To evaluate models’ robustness to adversarial attacks, we attempt to generate
adversarial examples from 1000 randomly sampled clean examples from the test
set and measure the attack success rate.

$\text{attack success rate}=\frac{\text{\\# of successful attacks}}{\text{\\#
of total attacks}}$

Table 4 shows the attack success rates of A2T attack and A2T-MLM attack
against models that have been trained using A2T , A2T-MLM , and other
baseline methods. Note that the overall attack success rates appear fairly low
because we applied strict constraints to improve the quality of the
adversarial examples (as recommend by Morris et al. (2020b)). Still, we can
see that for both attacks, adversarial training using the same attack can
decrease the attack success rate by up to 70%. What is surprising is that
training the model using a different attack also led to a decrease in the
attack success rate. From Table 4, we can see that adversarial training using
the A2T-MLM attack lowers the attack success rate of A2T attack while training
with A2T lowers the attack success rate of A2T-MLM attack.

To further measure how adversarial training using A2T  can improve model’s
robustness, we evaluated accuracy of BERT-A2T on 1000 adversarial examples
that have successfully fooled BERT-Natural models. Table 6 shows that
adversarial training using A2T greatly improves model’s performance against
adversarial examples from baseline 0% to over 70% for IMDB and Yelp datasets.

Another surprising observation is that training with data augmentations
methods like SSMBA and backtranslation can lead to improvements in robustness
against both adversarial attacks. However, in case of smaller datasets such as
MR, data augmentation can also hurt robustness.

When we compare the attack success rates between BERT and RoBERTa models in
Table 4, we also see an interesting pattern. BERT models, regardless of the
training method, tend to be more vulnerable to A2T attack than RoBERTa models.
At the same time, RoBERTa models tend to be more vulnerable to A2T-MLM attack
than BERT models.

Lastly, we use attacks proposed from literature to evaluate the models’
adversarial robustness. Table 5 shows the attack success rate of TextFooler
Jin et al. (2019), BAE Garg and Ramakrishnan (2020), PWWS Ren et al. (2019),
and PSO Zang et al. (2020).777These attacks were implemented using the
TextAttack library Morris et al. (2020a). Across four datasets and two models,
we can see that both A2T and A2T-MLM lower the attack success rate against all
four attacks in all but five cases. The results for PWWS and PSO are
especially surprising since both use different transformations - WordNet
Miller (1995) and HowNet Dong et al. (2010) \- when carrying out the attacks.

Attack | Model | IMDB | MR | Yelp | SNLI
---|---|---|---|---|---
A.S.% | $\Delta\%$ | A.S.% | $\Delta\%$ | A.S.% | $\Delta\%$ | A.S.% | $\Delta\%$
A2T | BERT-Natural | 42.9 |  | 20.9 |  | 25.4 |  | 53.3 |
BERT-A2T | 12.7 | -70.4 | 13.2 | -36.8 | 11.5 | -54.7 | 15.6 | -70.7
BERT-A2T-MLM | 34.5 | -19.6 | 18.9 | -9.6 | 21.0 | -17.3 | 47.2 | -11.4
BERT-SSMBA | 29.5 | -31.2 | 21.1 | 1.0 | 23.3 | -8.3 | 51.0 | -4.3
BERT-BackTranslation | 33.1 | -22.8 | 19.2 | -8.1 | 24.0 | -5.5 | 48.3 | -9.4
RoBERTa-Natural | 34.3 |  | 18.6 |  | 19.9 |  | 48.4 |
RoBERTa-A2T | 12.4 | -63.8 | 12.1 | -34.9 | 7.6 | -61.8 | 8.3 | -82.9
RoBERTa-A2T-MLM | 19.5 | -43.1 | 17.1 | -8.1 | 13.0 | -34.7 | 40.3 | -16.7
RoBERTa-SSMBA | 24.0 | -30.0 | 21.8 | 17.2 | 19.3 | -3.0 | 48.7 | 0.6
RoBERTa-BackTranslation | 28.9 | -15.7 | 18.3 | -1.6 | 16.1 | -19.1 | 48.6 | 0.4
A2T-MLM | BERT-Natural | 76.6 |  | 37.7 |  | 47.1 |  | 77.9 |
BERT-A2T | 61.7 | -19.5 | 33.2 | -11.9 | 42.5 | -9.8 | 76.7 | -1.5
BERT-A2T-MLM | 48.3 | -36.9 | 24.7 | -34.5 | 27.9 | -40.8 | 37.1 | -52.4
BERT-SSMBA | 59.6 | -22.2 | 36.2 | -4.0 | 44.8 | -4.9 | 76.9 | -1.3
BERT-BackTranslation | 68.8 | -10.2 | 36.3 | -3.7 | 46.8 | -0.6 | 77.3 | -0.8
RoBERTa-Natural | 81.5 |  | 40.9 |  | 53.2 |  | 78.6 |
RoBERTa-A2T | 69.8 | -14.4 | 38.4 | -6.1 | 45.2 | -15.0 | 76.5 | -2.7
RoBERTa-A2T-MLM | 37.0 | -54.6 | 28.5 | -30.3 | 25.8 | -51.5 | 35.2 | -55.2
RoBERTa-SSMBA | 57.0 | -30.1 | 43.1 | 5.4 | 47.8 | -10.2 | 78.3 | -0.4
RoBERTa-BackTranslation | 74.3 | -8.8 | 41.1 | 0.5 | 43.8 | -17.7 | 79.1 | 0.6

Table 4: Attack success rate of A2T and A2T-MLM attacks. A.S.% represents the
attack success rates and $\Delta\%$ column represents the percent change
between the attack success rate of natural training and the different training
methods.

Attack | Model | IMDB | MR | Yelp | SNLI
---|---|---|---|---|---
A.S.% | $\Delta\%$ | A.S.% | $\Delta\%$ | A.S.% | $\Delta\%$ | A.S.% | $\Delta\%$
TextFooler | BERT-Natural | 85.0 |  | 91.6 |  | 55.9 |  | 97.5 |
BERT-A2T | 66.0 | -22.4 | 90.6 | -1.1 | 57.9 | 3.6 | 92.2 | -5.4
BERT-A2T-MLM | 88.2 | 3.8 | 89.0 | -2.8 | 67.7 | 21.1 | 94.1 | -3.5
RoBERTa-Natural | 95.2 |  | 94.4 |  | 74.5 |  | 96.7 |
RoBERTa-A2T | 82.4 | -13.4 | 91.0 | -3.6 | 68.7 | -7.8 | 91.4 | -5.5
RoBERTa-A2T-MLM | 72.9 | -23.4 | 88.6 | -6.1 | 71.7 | -3.8 | 90.8 | -6.1
BAE | BERT-Natural | 60.5 |  | 52.6 |  | 37.8 |  | 76.7 |
BERT-A2T | 46.7 | -22.8 | 51.5 | -2.1 | 34.4 | -9.0 | 75.9 | -1.0
BERT-A2T-MLM | 52.4 | -13.4 | 43.8 | -16.7 | 31.3 | -17.2 | 60.9 | -20.6
RoBERTa-Natural | 65.5 |  | 56.4 |  | 44.4 |  | 75.6 |
RoBERTa-A2T | 56.8 | -13.3 | 54.7 | -3.0 | 38.0 | -14.4 | 76.0 | 0.5
RoBERTa-A2T-MLM | 42.3 | -35.4 | 48.3 | -14.4 | 28.7 | -35.4 | 61.2 | -19.0
PWWS | BERT-Natural | 87.5 |  | 82.1 |  | 67.9 |  | 98.5 |
BERT-A2T | 70.9 | -19.0 | 80.4 | -2.1 | 65.4 | -3.7 | 97.5 | -1.0
BERT-A2T-MLM | 87.1 | -0.5 | 81.3 | -1.0 | 72.2 | 6.3 | 97.5 | -1.0
RoBERTa-Natural | 96.6 |  | 83.8 |  | 77.9 |  | 98.2 |
RoBERTa-A2T | 84.4 | -12.6 | 81.9 | -2.3 | 73.1 | -6.2 | 97.1 | -1.1
RoBERTa-A2T-MLM | 73.5 | -23.9 | 79.8 | -4.8 | 70.7 | -9.2 | 96.5 | -1.7
PSO | BERT-Natural | 43.8 |  | 81.6 | - | 40.3 |  | 92.1 |
BERT-A2T | 16.5 | -62.3 | 73.2 | -10.3 | 26.4 | -34.5 | 89.1 | -3.3
BERT-A2T-MLM | 29.9 | -31.7 | 75.4 | -7.6 | 34.4 | -14.6 | 89.7 | -2.6
RoBERTa-Natural | 34.8 |  | 88.0 |  | 35.7 |  | 90.6 |
RoBERTa-A2T | 12.9 | -62.9 | 81.6 | -7.3 | 21.6 | -39.5 | 85.3 | -5.8
RoBERTa-A2T-MLM | 13.1 | -62.4 | 77.5 | -11.9 | 20.3 | -43.1 | 84.8 | -6.4

Table 5: Attack success rate of attacks from literature, including original
TextFooler Jin et al. (2019), BAE Garg and Ramakrishnan (2020), PWWS Ren et
al. (2019), and PSO Zang et al. (2020). A.S.% represents the attack success
rates and $\Delta\%$ column represents the percent change between natural
training and the different training methods.

Dataset | Model | A2T | A2T-MLM | TextFooler | BAE | PSO | PWWS
---|---|---|---|---|---|---|---
IMDB | BERT-A2T | 94.60 | 75.87 | 93.96 | 78.42 | 87.00 | 89.14
MR | BERT-A2T | 65.90 | 53.25 | 57.56 | 31.96 | 36.57 | 47.76
Yelp | BERT-A2T | 92.00 | 77.78 | 87.17 | 73.88 | 72.44 | 83.21
SNLI | BERT-A2T | 56.43 | 47.10 | 41.99 | 42.71 | 41.67 | 39.84

Table 6: Accuracy of BERT-A2T on 1000 adversarial examples that have
successfully fooled BERT-Natural.

Model | IMDB | MR | Yelp | SNLI
---|---|---|---|---
| Standard
---
Accuracy
| Yelp
---
Accuracy
| Standard
---
Accuracy
| Yelp
---
Accuracy
| Standard
---
Accuracy
| IMDB
---
Accuracy
| Standard
---
Accuracy
| MNLI
---
Accuracy
BERT-Natural | 93.97 | 92.13 | 85.40 | 90.60 | 96.34 | 88.31 | 90.29 | 73.34
BERT-A2T | 94.49 | 92.50 | 85.61 | 88.45 | 96.68 | 89.24 | 90.16 | 73.79
BERT-A2T-MLM | 93.05 | 90.67 | 83.80 | 85.32 | 95.85 | 85.01 | 87.87 | 70.93
BERT-SSMBA | 93.94 | 91.59 | 85.33 | 89.49 | 96.28 | 88.54 | 90.23 | 73.27
BERT-BackTranslation | 93.97 | 91.73 | 85.65 | 89.46 | 96.46 | 88.77 | 90.57 | 72.82
RoBERTa-Natural | 95.26 | 94.09 | 87.52 | 93.42 | 97.26 | 91.94 | 91.56 | 77.66
RoBERTa-A2T | 95.57 | 94.41 | 88.03 | 93.45 | 97.45 | 91.86 | 91.16 | 77.88
RoBERTa-A2T-MLM | 94.71 | 94.48 | 86.49 | 92.93 | 96.84 | 90.44 | 88.56 | 74.82
RoBERTa-SSMBA | 95.25 | 94.11 | 86.46 | 93.03 | 97.16 | 91.90 | 91.38 | 77.02
RoBERTa-BackTranslation | 95.31 | 93.84 | 87.78 | 93.77 | 97.25 | 91.76 | 90.79 | 76.70

Table 7: Accuracy on in-domain and out-of-domain datasets. We can see that
adversarial training can helps model outperform both naturally trained models
and models trained using data augmentation methods.

Model | IMDB | MR | Yelp
---|---|---|---
BERT-Natural | 7.78 | 33.43 | 12.78
BERT-A2T | 10.74 | 34.25 | 13.18
BERT-A2T-MLM | 9.12 | 32.17 | 11.14
BERT-SSMBA | 7.21 | 32.21 | 10.94
BERT-BackTranslation | 6.02 | 0.39 | 11.10
RoBERTa-Natural | 0.35 | 0.01 | -1.09
RoBERTa-A2T | 0.43 | 0.45 | -1.01
RoBERTa-A2T-MLM | 0.09 | -0.12 | -1.13
RoBERTa-SSMBA | 0.26 | 0.05 | -0.43
RoBERTa-BackTranslation | -0.04 | 0.05 | -1.06

Table 8: AOPC scores of the LIME explanations for each model. Higher AOPC
scores indicates that the model is more interpretable.

###  5.4 Results on Generalization

To evaluate how adversarial training affects the model’s generalization
ability, we evaluate its accuracy on the original test set (i.e. standard
accuracy) and on an out-of-domain dataset (e.g. Yelp dataset for model trained
on IMDB dataset). In Table 7, we can see that in all but two cases,
adversarial training using A2T attack beats natural training in terms of
standard accuracy. In the two cases (SNLI) where natural training beats A2T ,
we can see that A2T still outperforms natural training in cross-domain
accuracy. Overall, in six out of eight cases, A2T improves cross-domain
accuracy. On the other hand, adversarial training with A2T-MLM attack tends to
hurt both standard accuracy and cross-domain accuracy. This confirms the
observations reported by Li et al. (2021) and suggests that using a masked
language model to generate adversarial examples can lead to a trade-off
between robustness and generalization. We do not see similar trade-off with
A2T .

###  5.5 Results on Interpretability

We use LIME Ribeiro et al. (2016) to generate local explanations for our
models. For each example, LIME approximates the local decision boundary by
fitting a linear model over the samples obtained by perturbing the example. To
measure the faithfulness of the local explanations obtained using LIME, we
measure the area over perturbation curve (AOPC) Samek et al. (2017); Nguyen
(2018); Chen and Ji (2020) which is defined as:

$AOPC=\frac{1}{K+1}\sum^{K}_{k=1}\frac{1}{N}\sum^{N}_{i=1}f({\mathbf{x}}^{(i)}_{(0)})-f({\mathbf{x}}^{(i)}_{(k)})$
(3)

where ${\mathbf{x}}^{(i)}_{(0)}$ represents example ${\mathbf{x}}^{(i)}$ with
none of the words removed and ${\mathbf{x}}^{(i)}_{(k)}$ represents example
${\mathbf{x}}^{(i)}$ with the top-$k$ most important words removed.
$f({\mathbf{x}})$ here represents the model’s confidence on the target label
${\mathbf{y}}^{(i)}$. Intuitively, AOPC measures on average how the model’s
confidence on the target label changes when we delete the top-$k$ most
important words determined using LIME.

For each dataset, we randomly pick 1000 examples from the test set for
evaluation. When running LIME to obtain explanations, we generate $1000$
perturbed samples for each instance. We set $K=10$ for the AOPC metric. Table
8 shows that across three sentiment classification datasets, BERT model
trained using A2T attack achieves higher AOPC than natural training. For
RoBERTa models, the same observation holds (although by smaller margins).
Overall, we see that the AOPC scores for RoBERTa models are far lower than
those for BERT models, suggesting that RoBERTa might be less interpretable
than BERT.

(a)

(b)

Figure 2: Left: Attack success rates of A2T and A2T-MLM attacks on BERT-A2T
model trained on IMDB dataset. Right: Standard accuracies and cross-domain
accuracies (on Yelp) for the same model.

###  5.6  Analysis

####  A2T vs A2T-MLM attack

We can see that model trained using A2T attack outperforms the model trained
using A2T-MLM attack in standard accuracy and cross-domain accuracy in all but
one case. This suggests that using counter-fitted embeddings can generate
higher quality adversarial examples than masked language models. Since masked
language models are only trained to predict words that are statistically most
likely to appear, it is likely that it will propose words that do change the
semantics of the text entirely; this can lead to false positive adversarial
examples.

We also hypothesize that A2T-MLM ’s tendency to generate false positive
adversarial examples is the reason why RoBERTa appears to be more vulnerable
to A2T-MLM than BERT models. Since RoBERTa models tend to have better
generalization capability than BERT models, RoBERTa models are more likely to
predict the correct labels for false positive adversarial examples that
A2T-MLM can generate (whereas BERT models can predict the wrong labels for
false positive adversarial examples and appear falsely robust).

#### Effect of Gamma

Recall $\gamma$, which is the desired percentage of adversarial examples to
generate in every epoch. To study how it affects the results of adversarial
training, we train BERT model on IMDB dataset with A2T method and $\gamma$
value ranging from $0$ (no adversarial training) to $1.0$. Figure 2 shows the
attack success rates, standard accuracies, and cross-domain accuracies.

We can see from Figure 2 (a) that higher $\gamma$ does not necessarily mean
that our trained model is more robust, with $\gamma=0.2$ producing model that
is more robust than others. Overall, we can see that adversarial training is
insensitive to the specific choice of $\gamma$ and a smaller $\gamma$ can be
used for faster training.

#### Effect of Adversarial Training on Sentence Embedding

Figure 3: BERT-A2T decreases the $\ell_{2}$ distance between [CLS] embeddings
of original ${\mathbf{x}}$ and adversarial ${\mathbf{x}}^{\prime}$.

In BERT Devlin et al. (2018), the output for [CLS] token represents the
sentence-level embedding that is used by the final classification layer. For
BERT-Natural and BERT-A2T , we measured the $\ell_{2}$ distance between the
[CLS] embeddings of original text ${\mathbf{x}}$ and its corresponding
adversarial example ${\mathbf{x}}^{\prime}$ using six different attacks888The
adversarial examples used were the same examples used to generate results for
Table 6. We noticed that across all cases, adversarial training decreases the
average $\ell_{2}$ distance between ${\mathbf{x}}$ and
${\mathbf{x}}^{\prime}$, as shown by Figure 3. This suggests that adversarial
training improves the robustness of models by encouraging the model to learn a
closer mapping of ${\mathbf{x}}$ and ${\mathbf{x}}^{\prime}$.

##  6 Conclusion

In this paper, we have presented a practical vanilla adversarial training
process called A2T that uses a new adversarial attack designed to generate
adversarial examples quickly. We demonstrated that using A2T allows us to
improve model’s robustness against several different types of adversarial
attacks that have been proposed from literature. Also, we have shown that
models trained using A2T can achieve better standard accuracy and/or cross-
domain accuracy than baseline models.

## References

  * Akbik et al. (2018) Alan Akbik, Duncan Blythe, and Roland Vollgraf. 2018.  Contextual string embeddings for sequence labeling.  In _COLING 2018, 27th International Conference on Computational Linguistics_ , pages 1638–1649.
  * Alzantot et al. (2018) Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, and Kai-Wei Chang. 2018.  Generating natural language adversarial examples.  _arXiv preprint arXiv:1804.07998_.
  * Bowman et al. (2015) Samuel R. Bowman, Gabor Angeli, Christopher Potts, and Christopher D Manning. 2015\.  A large annotated corpus for learning natural language inference.  In _Proceedings of the 2015 Conference on Empirical Methods in Natural Language Processing (EMNLP)_. Association for Computational Linguistics.
  * Carlini et al. (2019) Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian J. Goodfellow, Aleksander Madry, and Alexey Kurakin. 2019.  On evaluating adversarial robustness.  _CoRR_ , abs/1902.06705.
  * Cer et al. (2018) Daniel Cer, Yinfei Yang, Sheng-yi Kong, Nan Hua, Nicole Limtiaco, Rhomni St. John, Noah Constant, Mario Guajardo-Cespedes, Steve Yuan, Chris Tar, Yun-Hsuan Sung, Brian Strope, and Ray Kurzweil. 2018.  Universal sentence encoder.  _CoRR_ , abs/1803.11175.
  * Chen and Ji (2020) Hanjie Chen and Yangfeng Ji. 2020.  Learning variational word masks to improve the interpretability of neural text classifiers.  In _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)_ , pages 4236–4251, Online. Association for Computational Linguistics.
  * Cheng et al. (2018) Minhao Cheng, Jinfeng Yi, Huan Zhang, Pin-Yu Chen, and Cho-Jui Hsieh. 2018.  Seq2sick: Evaluating the robustness of sequence-to-sequence models with adversarial examples.  _CoRR_ , abs/1803.01128.
  * Devlin et al. (2018) Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2018.  BERT: pre-training of deep bidirectional transformers for language understanding.  _CoRR_ , abs/1810.04805.
  * Dong et al. (2021) Xinshuai Dong, Anh Tuan Luu, Rongrong Ji, and Hong Liu. 2021.  Towards robustness against natural language word substitutions.  In _International Conference on Learning Representations_.
  * Dong et al. (2010) Zhendong Dong, Qiang Dong, and Changling Hao. 2010.  Hownet and its computation of meaning.  In _Proceedings of the 23rd International Conference on Computational Linguistics: Demonstrations_ , COLING ’10, page 53–56, USA. Association for Computational Linguistics.
  * Dvijotham et al. (2018) Krishnamurthy Dvijotham, Sven Gowal, Robert Stanforth, Relja Arandjelovic, Brendan O’Donoghue, Jonathan Uesato, and Pushmeet Kohli. 2018.  Training verified learners with learned verifiers.  _CoRR_ , abs/1805.10265.
  * Ebrahimi et al. (2017) Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2017.  Hotflip: White-box adversarial examples for text classification.  In _ACL_.
  * Gao et al. (2018) Ji Gao, Jack Lanchantin, Mary Lou Soffa, and Yanjun Qi. 2018.  Black-box generation of adversarial text sequences to evade deep learning classifiers.  _2018 IEEE Security and Privacy Workshops (SPW)_ , pages 50–56.
  * Garg and Ramakrishnan (2020) Siddhant Garg and Goutham Ramakrishnan. 2020.  Bae: Bert-based adversarial examples for text classification.
  * Goodfellow et al. (2014) Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014.  Explaining and harnessing adversarial examples.  _arXiv preprint arXiv:1412.6572_.
  * Huang et al. (2019) Po-Sen Huang, Robert Stanforth, Johannes Welbl, Chris Dyer, Dani Yogatama, Sven Gowal, Krishnamurthy Dvijotham, and Pushmeet Kohli. 2019.  Achieving verified robustness to symbol substitutions via interval bound propagation.  In _Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP)_ , pages 4083–4093, Hong Kong, China. Association for Computational Linguistics.
  * Jia and Liang (2017) Robin Jia and Percy Liang. 2017.  Adversarial examples for evaluating reading comprehension systems.
  * Jia et al. (2019) Robin Jia, Aditi Raghunathan, Kerem Göksel, and Percy Liang. 2019.  Certified robustness to adversarial word substitutions.  In _Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP)_ , pages 4129–4142, Hong Kong, China. Association for Computational Linguistics.
  * Jiang et al. (2020) Haoming Jiang, Pengcheng He, Weizhu Chen, Xiaodong Liu, Jianfeng Gao, and Tuo Zhao. 2020.  SMART: Robust and efficient fine-tuning for pre-trained natural language models through principled regularized optimization.  In _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_ , pages 2177–2190, Online. Association for Computational Linguistics.
  * Jin et al. (2019) Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2019.  Is bert really robust? natural language attack on text classification and entailment.  _ArXiv_ , abs/1907.11932.
  * Kurakin et al. (2016) Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. 2016.  Adversarial examples in the physical world.  _CoRR_ , abs/1607.02533.
  * Li et al. (2021) Dianqi Li, Yizhe Zhang, Hao Peng, Liqun Chen, Chris Brockett, Ming-Ting Sun, and Bill Dolan. 2021.  Contextualized perturbation for textual adversarial attack.
  * Li et al. (2020) Linyang Li, Ruotian Ma, Qipeng Guo, Xiangyang Xue, and Xipeng Qiu. 2020.  Bert-attack: Adversarial attack against bert using bert.
  * Liu et al. (2020) Xiaodong Liu, Hao Cheng, Pengcheng He, Weizhu Chen, Yu Wang, Hoifung Poon, and Jianfeng Gao. 2020.  Adversarial training for large neural language models.
  * Liu et al. (2019) Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. 2019.  Roberta: A robustly optimized BERT pretraining approach.  _CoRR_ , abs/1907.11692.
  * Loshchilov and Hutter (2017) Ilya Loshchilov and Frank Hutter. 2017.  Fixing weight decay regularization in adam.  _CoRR_ , abs/1711.05101.
  * Maas et al. (2011) Andrew L. Maas, Raymond E. Daly, Peter T. Pham, Dan Huang, Andrew Y. Ng, and Christopher Potts. 2011.  Learning word vectors for sentiment analysis.  In _Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics: Human Language Technologies_ , pages 142–150, Portland, Oregon, USA. Association for Computational Linguistics.
  * Madry et al. (2018) Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018.  Towards deep learning models resistant to adversarial attacks.  In _International Conference on Learning Representations_.
  * Miller (1995) George A. Miller. 1995.  Wordnet: A lexical database for english.  _Commun. ACM_ , 38(11):39–41.
  * Miyato et al. (2017) Takeru Miyato, Andrew M. Dai, and Ian Goodfellow. 2017.  Adversarial training methods for semi-supervised text classification.
  * Morris et al. (2020a) John Morris, Eli Lifland, Jin Yong Yoo, and Yanjun Qi. 2020a.  TextAttack: A framework for adversarial attacks in natural language processing.  _ArXiv_ , abs/2005.05909.
  * Morris et al. (2020b) John X. Morris, Eli Lifland, Jack Lanchantin, Yangfeng Ji, and Yanjun Qi. 2020b.  Reevaluating adversarial examples in natural language.
  * Mrksic et al. (2016) Nikola Mrksic, Diarmuid Ó Séaghdha, Blaise Thomson, Milica Gasic, Lina Maria Rojas-Barahona, Pei hao Su, David Vandyke, Tsung-Hsien Wen, and Steve J. Young. 2016.  Counter-fitting word vectors to linguistic constraints.  In _HLT-NAACL_.
  * Ng et al. (2020) Nathan Ng, Kyunghyun Cho, and Marzyeh Ghassemi. 2020.  SSMBA: Self-supervised manifold based data augmentation for improving out-of-domain robustness.  In _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)_ , pages 1268–1283, Online. Association for Computational Linguistics.
  * Ng et al. (2019) Nathan Ng, Kyra Yee, Alexei Baevski, Myle Ott, Michael Auli, and Sergey Edunov. 2019\.  Facebook fair’s wmt19 news translation task submission.  In _Proc. of WMT_.
  * Nguyen (2018) Dong Nguyen. 2018.  Comparing automatic and human evaluation of local explanations for text classification.  In _Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long Papers)_ , pages 1069–1078, New Orleans, Louisiana. Association for Computational Linguistics.
  * Pang and Lee (2005) Bo Pang and Lillian Lee. 2005.  Seeing stars: Exploiting class relationships for sentiment categorization with respect to rating scales.  In _Proceedings of the 43rd Annual Meeting of the Association for Computational Linguistics (ACL’05)_ , pages 115–124, Ann Arbor, Michigan. Association for Computational Linguistics.
  * Reimers and Gurevych (2019) Nils Reimers and Iryna Gurevych. 2019.  Sentence-bert: Sentence embeddings using siamese bert-networks.  In _Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing_. Association for Computational Linguistics.
  * Ren et al. (2019) Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. 2019.  Generating natural language adversarial examples through probability weighted word saliency.  In _Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics_ , pages 1085–1097, Florence, Italy. Association for Computational Linguistics.
  * Ribeiro et al. (2016) Marco Túlio Ribeiro, Sameer Singh, and Carlos Guestrin. 2016.  "why should I trust you?": Explaining the predictions of any classifier.  _CoRR_ , abs/1602.04938.
  * Samek et al. (2017) W. Samek, A. Binder, G. Montavon, S. Lapuschkin, and K. Müller. 2017\.  Evaluating the visualization of what a deep neural network has learned.  _IEEE Transactions on Neural Networks and Learning Systems_ , 28(11):2660–2673.
  * Sanh et al. (2019) Victor Sanh, Lysandre Debut, Julien Chaumond, and Thomas Wolf. 2019.  Distilbert, a distilled version of BERT: smaller, faster, cheaper and lighter.  _CoRR_ , abs/1910.01108.
  * Wolf et al. (2020) Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Remi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, Mariama Drame, Quentin Lhoest, and Alexander Rush. 2020.  Transformers: State-of-the-art natural language processing.  In _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations_ , pages 38–45, Online. Association for Computational Linguistics.
  * Xie et al. (2019) Qizhe Xie, Zihang Dai, Eduard H. Hovy, Minh-Thang Luong, and Quoc V. Le. 2019\.  Unsupervised data augmentation.  _CoRR_ , abs/1904.12848.
  * Yoo et al. (2020) Jin Yong Yoo, John X. Morris, Eli Lifland, and Yanjun Qi. 2020.  Searching for a search method: Benchmarking search algorithms for generating nlp adversarial examples.
  * Zang et al. (2020) Yuan Zang, Fanchao Qi, Chenghao Yang, Zhiyuan Liu, Meng Zhang, Qun Liu, and Maosong Sun. 2020.  Word-level textual adversarial attacking as combinatorial optimization.  In _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_ , pages 6066–6080, Online. Association for Computational Linguistics.
  * Zhang et al. (2015) Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015.  Character-level convolutional networks for text classification.  In C. Cortes, N. D. Lawrence, D. D. Lee, M. Sugiyama, and R. Garnett, editors, _Advances in Neural Information Processing Systems 28_ , pages 649–657. Curran Associates, Inc.
  * Zhu et al. (2019) Chen Zhu, Yu Cheng, Zhe Gan, Siqi Sun, Tom Goldstein, and Jingjing Liu. 2019.  Freelb: Enhanced adversarial training for language understanding.  _CoRR_ , abs/1909.11764.

##  Appendix A Appendix

###  A.1 A2T and A2T-MLM Attacks

Here, we give more details about A2T and A2T-MLM . We will use the framework
introduced by Morris et al. (2020a) to break down adversarial attacks into the
following four components: (1) goal function, (2) transformation, (3) a set of
constraints, (4) search method.

#### Goal Function

In this work, we perform untargeted attack since they are generally easier
than targeted attack. We aim to maximize the following as our goal function:

$1-P(y|{\mathbf{x}};\theta)$ (4)

where $P(y|{\mathbf{x}};\theta)$ means the model’s confidence of label $y$
given input ${\mathbf{x}}$ and parameters $\theta$.

#### Transformation

  1. 1.

A2T Counter-fitted word embedding Mrksic et al. (2016)

  2. 2.

A2T-MLM : BERT masked language model Devlin et al. (2018)

For both methods, we select the top 20 words proposed as replacements. This
helps us narrow down our replacements to the best ones and save time from
considering less desirable replacements.

#### Constraints

We use the following constraints for both attacks:

  * •

Part-of-speech Consistency: To preserve fluency, we require that the two words
being swapped have the same part-of-speech. This is determined by a part-of-
speech tagger provided by Flair Akbik et al. (2018), an open-source NLP
library.

  * •

DistilBERT Semantic Textual Similarity (STS) Sanh et al. (2019): We require
that cosine similarity between the sentence encodings of original text
${\mathbf{x}}$ and perturbed text ${\mathbf{x}}^{\prime}$ meet minimum
threshold value of $0.9$. We use fine-tuned DistilBERT model provided by
Reimers and Gurevych (2019).

  * •

Max modification rate: We allow only 10% of the words to be replaced. This
limits us from modifying the text too much and causing the semantics of the
text to change.

Also, for A2T attack, we require that the word embeddings between original
text ${\mathbf{x}}$ and perturbed text ${\mathbf{x}}^{\prime}$ have minimum
cosine similarity of $0.8$.

The threshold values for word embedding similarity and sentence encoding
similarity were set based on the recommendations by Morris et al. (2020b),
which noted that high threshold values encourages strong semantic similarity
between the original text and the perturbed text.

#### Search Method

Search method is responsible for iteratively perturbing the original text
${\mathbf{x}}$ until we discover an adversarial example ${\mathbf{x}}_{adv}$
that causes the model to mispredict. Algorithm 2 shows A2T ’s search
algorithm. If the search method fails to find an adversarial example by the
time its search is over, it has failed to generate one. It can also exit
preemptively if it has reached maximum number of queries to the victim model.
Such limit is called query budget.

Algorithm 2 A2T ’s Search Method: Gradient-based Word Importance Ranking

0: Original text ${\mathbf{x}}=(x_{1},x_{2},...x_{n})$. Transformation module
$T({\mathbf{x}},i)$ that perturbs ${\mathbf{x}}$ by replacing $x_{i}$.

0: Adversarial text ${\mathbf{x}}_{adv}$ if found

1: Calculate $I(x_{i})$ for all words $x_{i}$ by making one forward and
backward pass.

2: $R\leftarrow$ ranking $r_{1},\dots,r_{n}$ of words $x_{1},\dots,x_{n}$ by
descending importance

3: ${\mathbf{x}}^{*}\leftarrow{\mathbf{x}}$

4: for $i=r_{1},r_{2},\dots,r_{n}$ in $R$ do

5: $X_{cand}\leftarrow T(x^{*},i)$

6: if $X_{cand}\neq\emptyset$ then

7:
${\mathbf{x}}^{*}\leftarrow\operatorname*{arg\,max}_{{\mathbf{x}}^{\prime}\in
X_{cand}}{1-P(y|{\mathbf{x}};\theta)}$

8: if ${\mathbf{x}}^{*}$ fools the model then

9: return ${\mathbf{x}}^{*}$ as ${\mathbf{x}}_{adv}$

10: end if

11: end if

12: end for

During training, we limit the search method to making only 200 queries to the
victim model for faster generation of adversarial examples. For evaluation
using A2T and A2T-MLM , we increase the query budget to 2000 queries for a
more extensive search. For other attacks such as TextFooler Jin et al. (2019),
BAE Garg and Ramakrishnan (2020), PWWS Ren et al. (2019), and PSO Zang et al.
(2020), the query budget is set to 5000.