RAA 2021 Vol.21 No.10, 247(10pp) doi: 10.1088/1674-14527/21/10/247

11institutetext: Department of Astronomy, School of Physics and Astronomy,
Shanghai Jiao Tong University, Shanghai 200240, China<EMAIL_ADDRESS>
22institutetext: Shanghai Key Laboratory for Particle Physics and Cosmology,
Shanghai Jiao Tong University, Shanghai 200240, China
33institutetext: Tsung-Dao Lee Institute, Shanghai, 200240, China
Received 2021 March 29; accepted 2021 June 15

# Weak lensing magnification reconstruction with the modified internal linear
combination method

Shutong Hou 11 Yu Yu 1122 Pengjie Zhang 112233

###### Abstract

Measuring weak lensing cosmic magnification signal is very challenging due to
the overwhelming intrinsic clustering in the observed galaxy distribution. In
this paper, we modify the Internal Linear Combination (ILC) method to
reconstruct the lensing signal with an extra constraint to suppress the
intrinsic clustering. To quantify the performance, we construct a realistic
galaxy catalogue for the LSST-like photometric survey, covering $20\,000\
\deg^{2}$ with mean source redshift at $z_{s}\sim 1$. We find that the
reconstruction performance depends on the width of the photo-z bin we choose.
Due to the correlation between the lensing signal and the source galaxy
distribution, the derived signal has smaller systematic bias but larger
statistical uncertainty for a narrower photo-z bin. We conclude that the
lensing signal reconstruction with the Modified ILC method is unbiased with a
statistical uncertainty $<5\%$ for bin width $\Delta z^{P}=0.2$.

###### keywords:

cosmology: observations — large-scale structure of universe — weak lensing

##  1 Introduction

Weak lensing is a powerful probe of large-scale structure and geometry of the
universe (Bartelmann & Schneider 2001; Kilbinger 2015). It contains tremendous
information on dark energy, dark matter and gravity at cosmological scales.

The most successful method to measure weak gravitational lensing is through
cosmic shear (Bacon et al. 2000; Hoekstra & Jain 2008). With the coming of
large and deep surveys, such as Euclid, Large Synoptic Survey Telescope (LSST)
and the Square Kilometre Array (SKA), cosmic shear measurement has great
promise to improve. However, weak lensing measurement through cosmic shear
suffers from systematic errors associated with galaxy shape, such as the point
spread function (Rhodes et al. 2007) in the measurement, galaxy intrinsic
alignment contamination (Okumura et al. 2009; Troxel & Ishak 2015), and etc.
Only galaxies with good shape measurement are used in the cosmic shear
analysis.

Another way of lensing measurement is through cosmic magnification. Cosmic
magnification is the lensing-induced changes in galaxy number density. On one
hand, lensing effect increases (decreases) the flux of sources and more (less)
sources can be detected. On the other hand, cosmic magnification enlarges
(reduces) the solid angle of the sky patches. The galaxy number density after
lensing suffers from the two competing effects and depends on the the
logarithmic slope of source galaxy luminosity function. In ideal case, the
cosmological information extracted from cosmic magnification two point
statistics is equivalent to that from cosmic shear. The measurement of cosmic
magnification does not require a good estimation of galaxy shapes because we
simply count the galaxy number and therefore is free of the systematic errors
that cosmic shear suffers much.

However, cosmic magnification signal is overwhelmed by the galaxy intrinsic
clustering, which is the correlation of galaxy number density from the
evolution of the Universe. Galaxy intrinsic clustering (noise) is the main
obstruction to measure weak lensing by cosmic magnification. In order to
improve signal-to-noise ratio, very massive objects are used as lenses, such
as luminous red galaxies (LRGs) and clusters (Broadhurst et al. 1995,Chiu et
al. 2016), and high redshift objects are used as sources, such as Lyman break
galaxies (Hildebrandt et al. 2009,Morrison et al. 2012), and quasars
(Bartelmann & Schneider 1993,Scranton et al. 2005) . In this way, cosmic
magnification is measured through cross correlations of two spatially well
separated samples. In addition to this, the magnification effects have been
detected through the shift in number count (Seldner & Peebles 1979,Garcia-
Fernandez et al. 2018), magnitude (Ménard et al. 2010), flux (Jain & Lima
2011), and size (Huff & Graves 2014).

The application of cross-correlation is limited by the unknown foreground
galaxy bias. The direct measurement of cosmic magnification is of great
importance for the precision cosmology. Zhang & Pen (2006) first tried to
separate the magnification bias from the intrinsic clustering in flux space
since magnification and galaxy clustering differently depend on galaxy flux.
Magnification bias changes sign with the increase of flux while galaxy bias is
nearly unchanged with flux (Yang et al. 2017). Yang & Zhang (2011) proposed a
method to reconstruct the lensing convergence map from the surface number
density distribution of galaxies using this idea. Zhang et al. (2018) proposed
an analytical blind separation method to extract the cosmic magnification by
counting galaxies.

The internal linear combination (ILC) method is a sophisticated method in the
cosmic microwave background analysis. A clean map is reconstructed by co-
adding the data at different fluxes with a set of weights that minimizes the
variance of the map. Bennett et al. (2003) first proposed the ILC method to
obtain maps with foregrounds and noise being suppressed as far as possible.
The main advantage of this method is that it has no assumption about the
noise. Another advantage is that it is easy to implement and computationally
fast (Basak & Delabrouille 2012).

Analog to the cosmic microwave background case, the cosmic magnification
signal is hidden in the galaxy maps of different bands. The dependence on the
flux is known. The intrinsic clustering is the overwhelming unknown noise we
want to remove. The future surveys will provide huge number of galaxies with
good photometry and photometric redshift estimation. LSST will observe $\sim
10$ billion galaxies with number density of $30\ \mathrm{arcmin}^{-2}$ in
$u,g,r,i,z,y$ bands (LSST Dark Energy Science Collaboration 2012). The great
survey power enables us to reconstruct the cosmic magnification signal by
counting the galaxies.

In this work, we modify the ILC method and validate the reconstruction of the
lensing magnification signal in the context of future LSST-like survey. The
structure of the paper is organized as follows. We describe the lensing basics
and the methodology of the Modified ILC method in Section 2. In Section 3, our
simulation and the mock data are introduced . We quantify the performance of
the Modified ILC method in Section 4. A conclusion is made in Section 5.

##  2 Lensing Magnification and the Modified ILC method

###  2.1 Lensing Basics

The foreground matter distribution deflects the light-rays, leading to the
lensing effects on the galaxies. To describe the lensing field, a common
quantity is the dimensionless lensing convergence $\kappa$, which is the
projection of the matter overdensity $\delta_{m}$ weighted by the lensing
kernel $W_{L}$,

$\kappa(\vec{\theta},z_{s})=\int_{0}^{z_{s}}\delta_{m}(\vec{\theta},z_{L})W_{L}(z_{L},z_{s})\frac{dz_{L}}{H(z_{L})/H_{0}}\
,$ (1) $W_{L}(z_{L},z_{s})=\left\\{\begin{aligned}
&\frac{3}{2}\Omega_{m}(1+z_{L})\widetilde{\chi}(z_{L})(1-\frac{\chi(z_{L})}{\chi(z_{s})})\
,\\\ &\hskip 42.67912ptz_{L}<z_{s}\\\ &0\ ,\hskip 31.2982ptz_{L}\geq z_{s}\\\
\end{aligned}\right.\ .$ (2)

Here, $z_{s}$ and $z_{L}$ are the redshift of source and lens. $\chi$ is the
comoving distance and $\tilde{\chi}=\chi/(c/H_{0})$ . $\Omega_{m}$ is the
matter density today and $H$ is the Hubble parameter.

The lensing convergence is related to the lensing potential through
$\nabla^{2}\psi=2\kappa$, and the deflection angle $\vec{\alpha}=\nabla\psi$.
All the galaxy positions are changed according to this deflection field. We
can derive the change of galaxy shape and flux by looking at the Jacobian,

$A_{ij}=\delta_{ij}-\frac{\partial^{2}\psi}{\partial\theta_{i}\partial\theta_{j}}=\left(\begin{array}[]{cc}1-\kappa-\gamma_{1}&-\gamma_{2}\\\
-\gamma_{2}&1-\kappa+\gamma_{1}\end{array}\right).$ (3)

The diagonal part $\kappa=\frac{1}{2}\nabla^{2}_{\theta}\psi$ describes the
isotropic zoom of the image, and the off-diagonal part
$\gamma=\gamma_{1}+\mathrm{i}\gamma_{2}$ describes the shear of the galaxy
shape. Since the lensing effect does not change the surface brightness, the
flux of the galaxy is changed by
$\mu=\frac{1}{\|A\|}=\frac{1}{(1-\kappa)^{2}-|\gamma|^{2}}$ . In weak lensing
regime, $\mu\approx 1+2\kappa$ .

Weak lensing signal could be extracted from the coherent change of the galaxy
shape, so called cosmic shear. Here we focus on the cosmic magnification, the
combined effect of the change of sky area and the galaxy flux. Totally, the
galaxy number overdensity after lensing (Bartelmann 1995; Scranton et al.
2005) is

$\delta^{L}_{g}=\delta_{g}+g\kappa\ .$ (4)

The prefactor

$g=2(\alpha-1)\ ,\ \ \ \alpha=-\frac{d\ln{n(F)}}{d\ln{F}}-1\ ,$ (5)

is determined by $n(F)$ , the number of galaxies per flux interval.

The power spectrum of the observed galaxy distribution
$C^{L}_{gg}=C_{gg}+g^{2}C_{\kappa\kappa}+2gC_{g\kappa}$. The lensing signal
$C_{\kappa\kappa}$ is overwhelmed by the intrinsic clustering $C_{gg}$.
Usually we use galaxies within a wide photo-z bin to ensure the good
measurement of the clustering. In this case, the cross-term cannot be ignored.
Under the Limber approximation (Limber 1954), the angular cross-power spectrum
of two fields $X$ and $Y$ is an integral of the 3D matter power spectrum along
with the corresponding kernel,

$C_{XY}(\ell)=\int dz\frac{H(z)}{c}W^{X}(z)W^{Y}(z)\\\
\frac{1}{\chi^{2}}P\left(k=\frac{\ell}{\chi};z\right)\ .$ (6)

Here, $X,Y=\kappa,g$. For galaxy field, $W^{g}(z)=n(z)$, which is the
normalised redshift distribution of the galaxy sample. For lensing field,
$W^{\kappa}(z)=\int W_{L}(z,z_{s})n(z_{s})dz_{s}$.

###  2.2 The Modified ILC method

Extracting the lensing signal from Equation 4 is challenging, since the
intrinsic clustering is overwhelming. The ILC method is based on a simple
premise (Delabrouille & Cardoso 2007; Saha et al. 2008): suppose there are
$N_{F}$ observed overdensity maps with different fluxes, adding the maps with
a set of weights and the aim is to minimize the variance of the map. First,
the galaxies are divided into $N_{F}$ flux bins. For each bin,
$\delta_{g,i}^{L}=b_{i}\delta_{m}+g_{i}\kappa$. $b_{i}$ is the deterministic
bias in the $i$th flux bin. For brevity, $\delta_{g,i}^{L}$ is denoted as
$\delta_{i}^{L}$ . The estimated convergence map is defined as

$\hat{\kappa}=\sum_{i=1}^{N_{F}}w_{i}\delta_{i}^{L}\ .$ (7)

Note that the weighting can be performed over $\delta_{g}^{L}(\vec{\theta})$
in real space and over $\delta_{g}^{L}(\vec{\ell})$ in Fourier space. The
following methodology is same but they are not equivalent to each other. In
Fourier space, it minimize the noise for each angular scale $\ell$. In this
work we only validate the performance in Fourier space.

We extend the widely used ILC method in CMB analysis to extract cosmic
magnification. The weights of ILC are to minimize
$\langle\hat{\kappa}^{2}\rangle$, up to the constraint

$\sum_{i=1}^{N_{F}}w_{i}g_{i}=1\ .$ (8)

However, since it does not distinguish intrinsic clustering and shot noise, we
find that it leads to significant bias to the reconstruction (refer to
Appendix A and Fig 7). Therefore we modify the ILC method by including an
extra constraint

$\sum_{i=1}^{N_{F}}w_{i}b_{i}=0\ .$ (9)

This eliminates the intrinsic clustering in the limit of deterministic bias.
For a rough approximation, bias $b_{i}$ is regard as a constant and Equation 9
is reduced to

$\sum_{i=1}^{N_{F}}w_{i}=0\ .$ (10)

The auto power spectrum of Equation 7 can be written as

$\left\langle\left(\sum_{i=1}^{N_{F}}w_{i}\delta_{i}^{L}\right)^{2}\right\rangle=\sum_{i,j=1}^{N_{F}}w_{i}w_{j}C_{ij}\
.$ (11)

Here, $C_{ij}$ is the cross-power of two maps, and for each $\ell$ they form
an $N_{F}\times N_{F}$ matrix ${\mathbf{C}}$.

Using the Lagrangian multiplier method,

$\sum_{i,j=1}^{N_{F}}w_{i}w_{j}C_{ij}-\lambda_{1}\sum_{i=1}^{N_{F}}w_{i}g_{i}-\lambda_{2}\sum_{i=1}^{N_{F}}w_{i}=0~{},$
(12)
$\left(2\sum_{i=1}^{N_{F}}w_{i}C_{ij}-\lambda_{1}g_{j}-\lambda_{2}\right)\delta
w_{j}=0~{}.$ (13)

We find the solution to be

$w_{i}=\frac{1}{2}\left(\lambda_{1}\sum_{j=1}^{N_{F}}{[\mathbf{C}^{-1}]}_{ij}g_{j}+\lambda_{2}\sum_{j=1}^{N_{F}}{[\mathbf{C}^{-1}]}_{ij}\right)~{}.$
(14)

Here, the two Lagrangian multipliers are given by

$\lambda_{1}=\frac{2\sum_{i,j=1}^{N_{F}}{[\mathbf{C}^{-1}]}_{ij}}{(\sum_{i,j=1}^{N_{F}}{[\mathbf{C}^{-1}]}_{ij}g_{i}g_{j})\cdot(\sum_{i,j=1}^{N_{F}}{[\mathbf{C}^{-1}]}_{ij})-(\sum_{i,j=1}^{N_{F}}{[\mathbf{C}^{-1}]}_{ij}g_{i})^{2}}~{},$
(15a)
$\lambda_{2}=\frac{-2\sum_{i,j=1}^{N_{F}}{[\mathbf{C}^{-1}]}_{ij}g_{j}}{(\sum_{i,j=1}^{N_{F}}{[\mathbf{C}^{-1}]}_{ij}g_{i}g_{j})\cdot(\sum_{i,j=1}^{N_{F}}{[\mathbf{C}^{-1}]}_{ij})-(\sum_{i,j=1}^{N_{F}}{[\mathbf{C}^{-1}]}_{ij}g_{i})^{2}}~{}.$
(15b)

The Modified ILC method takes use of the prior knowledge that for each flux
bin, the lensing contribution to the clustering is proportional to the lensing
prefactor $g$. The weights are constructed under this prior knowledge
independent of the cosmology and noise, and are obtained from the noisy data
itself.

In the Modified ILC method, we require a measurement of the prefactor
$g=2(\alpha-1)$ for each flux bin. According to the definition (Eq. (5)),
$\alpha$ could be measured from the change of the galaxy counts in response to
some small shift in the flux. We numerically add an extra shift on the
observed flux catalogue, $F^{\prime}=F(1+2\epsilon)$, and compare the number
counts pre to and post to the shift. Equivalently, $\alpha$ of the flux bin
$[a,b]$ is estimated by

$\alpha=\frac{\log(\int_{a/(1+2\epsilon)}^{b/(1+2\epsilon)}n(F)dF)-\log(\int_{a}^{b}n(F)dF)}{\log(1+2\epsilon)}\
.$ (16)

We find that the numerical calculation converges for $|\epsilon|<0.1$. We take
the average result from positive and negative shift $\epsilon=\pm 0.025$.

The noise term post to reconstruction $\sum_{i}w_{i}\delta_{i}$ will be
largely suppressed due to the requirement $\sum_{i}w_{i}=0$. However, the
galaxy bias has weak flux dependence and the noise term may not be eliminated
completely. The remaining part has weak correlation with the lensing signal,
and thus it serve as a systematic bias for the Modified ILC method.

##  3 Simulation and the Mock Catalogue Construction

###  3.1 Simulations

We use simulations and mocks to validate the Modified ILC method. Light-cone
simulation covering the full Stage-IV lensing survey footprint is still
challenge. Here we construct 200 sky portions of size $10^{\circ}\times
10^{\circ}$ instead to mimic the statistical power of the future survey. We
use $\Omega_{\rm{cdm}}=0.223$ , $\Omega_{b}=0.045$ , $n_{s}=0.968$ ,
$\Omega_{\Lambda}=0.732$ , $h=0.71$ , and $\sigma_{8}=0.83$ as the
cosmological parameters in this work.

For the source galaxies, we use FASTPM (Feng et al. 2016) to generate 200
boxes with size of $411.604\ h^{-1}{\rm Mpc}$. This box size corresponds to
the map size $10\ \deg$ at $z=1$ in the cosmology used in this work. The
particle number is chosen to be $1536^{3}$ and we save the Friends-of- Friends
(FoF) halos with mass above $2.86\times 10^{10}M_{\odot}/h$ . In the flat-sky
approximation, we randomly pick three boxes with random axis as the line-of-
sight direction, and stack them together to cover a sufficiently wide true
galaxy distribution. We add Gaussian photo-z scatter with
$\sigma_{z}=0.05(1+z)$ to each galaxy. Totally we obtain $200$ independent
galaxy distributions.

To obtain mock galaxy catalogues with realistic observation properties, we use
the public cosmoDC2 (Korytov et al. 2019) mock catalogue to assign the
observed galaxy flux in this validation. CosmoDC2 catalogue covers 440 deg2 of
sky area to a redshift of $z=3$. The mass limit is $1.25\times
10^{10}M_{\odot}/h$ , smaller than the halo catalogue we constructed. We list
all the cosmoDC2 galaxies in redshift range $0.8<z<1.2$ and divide them into
$30$ mass bins spanning $2.86\times 10^{10}M_{\odot}/h$ to $1.18\times
10^{15}M_{\odot}/h$ . For each halo, we randomly pick one galaxy in the above
list within the corresponding mass bin, and assign the photometry data to the
halo. We use three bands, $r,i,g$ to test the reconstruction. The flux limits
are chosen as 27 to ensure a flux-limited sample similar to LSST. The number
density of the final catalogue is $\sim 12\ \mathrm{arcmin}^{-2}$ for photo-z
range $0.8<z^{P}<1.2$.

###  3.2 Lensing Effects

The lensing maps are generated according to the theoretical lensing power
spectrum at $z=1$ obtained by CAMB code (Lewis et al. 2000) and Limber
approximation. Here we ignore the non-Gaussianity of these lensing maps and
this does not impact the validation of the Modified ILC method. In real
Universe, the lensing field and a given photometric source galaxy sample has
weak correlation (Hamana 2001; Yu et al. 2015), i.e. the overlap between
$W^{g}$ and $W^{\kappa}$. We modify the lensing fields to introduce the
correct correlation with the source galaxy distribution.

$\tilde{\kappa}(\vec{\ell})=r_{\kappa
g}\sqrt{\frac{C_{\kappa\kappa}}{C_{gg}}}\delta_{g}(\vec{\ell})+\sqrt{1-r_{\kappa
g}^{2}}\cdot\kappa(\vec{\ell})~{}.$ (17)

Here, $r_{\kappa g}^{2}\equiv\frac{C_{\kappa g}^{2}}{C_{gg}C_{\kappa\kappa}}$
. We measure this quantity under the Limber approximation for a given galaxy
sample and fiducial cosmology. $\delta_{g}(\vec{\ell})$ is the Fourier
transform of galaxy field, and $\kappa$ is the convergence map with no
correlation with the galaxy sample. Obviously, the power of $\tilde{\kappa}$
in Equation 17 is $C_{\kappa\kappa}$ and the correlation of $\tilde{\kappa}$
and $\delta_{g}$ is $C_{\kappa g}$ . When $r_{\kappa g}=0$, the lensing
convergence is independent of the galaxy number density, and
$\tilde{\kappa}=\kappa$.

In the above construction, both the galaxy distributions $\delta_{g}$ and
lensing maps $\tilde{\kappa}$ satisfy the periodic boundary condition. We use
Fourier transform to compute the lensing deflection field and magnification
field. Since the light is deflected at the lens plane, it is an inverse
problem that we need to solve for the observed galaxy position at which the
inverse deflection converges with the unlensed galaxy position. We use
iteration to obtain the lensed position for each galaxy. The galaxy flux is
modified according to the magnification at the observed galaxy position. We
use $4096^{2}$ meshes to process the galaxy catalogue according to the
resolution dependence test in the Appendix B (Fig. 8).

##  4 The Performance of the Modified ILC method

Figure 1: The cross-correlation coefficient between the distribution of the
source and lensing field in the $r$-band is presented in $r_{\kappa
g}^{2}\equiv\frac{C^{2}_{\kappa g}}{C_{gg}C_{\kappa\kappa}}$. The correlation
is larger for the wider photo-z bin case.

We use the constructed lensed galaxy catalogues and the true lensing maps to
test the performance of the Modified ILC method. First, a given flux-limited
photometric galaxy sample is divided into different flux bins. The galaxy
overdensity fields are measured by the CIC mass assignment and converted into
Fourier space $\delta_{i}(\ell)$ with $i=1,\cdots,N_{F}$. Then, the $g$
prefactors for each bin is numerically obtained from Eqs. (5) and (16). The
weights $w_{i}$ and the Fourier space lensing field $\hat{\kappa}(\ell)$ is
obtained by the Modified ILC method (Equations (7) and (14)). Although the
reconstructed lensing map has minimal variance by design, the shot noise is
still large. Thus, extracting the cosmological information from the
reconstructed lensing field itself is challenge. However, this noise is
usually uncorrelated with the lensing measurement from other approaches such
as cosmic shear. The reconstruction is very useful to extract the cosmological
information in the cross correlation with another lensing measurement. We
quantify the performance by the comparison with the true lensing map $\kappa$,

$R(\ell)=\frac{\langle\hat{\kappa}(\ell)\kappa^{*}(\ell)\rangle}{\sqrt{1-r_{\kappa
g}^{2}}\langle\kappa(\ell)\kappa^{*}(\ell)\rangle}\ .$ (18)

Here, the cross correlation with the true lensing field in the nominator picks
out the correlated part in the reconstructed lensing field. Particularly, if
the reconstruction is perfect, the nominator will be $\sqrt{1-r_{\kappa
g}^{2}}C_{\kappa\kappa}$ according to Eq. 17. Thus, we add the prefactor
$\sqrt{1-r_{\kappa g}^{2}}$ in the denominator to cancel this effect.

We test the performance for two cases. The first one has a wide photo-z range
$0.8<z^{P}<1.2$, while the second case has a narrow photo-z range
$0.9<z^{P}<1.1$. We present the cross-correlation coefficient of the
convergence and galaxy number density for the $r$-band in Fig. 1. The wide
photo-z range encloses more source galaxies in the analysis, and thus the shot
noise is lower. However, the residual intrinsic clustering is large.
$r_{\kappa g}^{2}$ is about $0.015$ at $\ell<2000$. In the narrower photo-z
range case, the number density is lower. Meanwhile, a small cross-correlation
is observed, with $r_{\kappa g}^{2}$ is about $0.009$ at $\ell<2000$. This
cross-correlation will downgrade the Modified ILC reconstruction, and thus we
expect a larger bias for the wider photo-z range.

###  4.1 A Wide Photo-z Range

Figure 2: The $g$ prefactors on each flux bin and each band for the wide
photo-z sample. Figure 3: The weights obtained by Eq. 14 for individual bands
are presented in solid lines. The dashed lines are the weights for the
combined data with $i,r,g$ bands. Figure 4: The Modified ILC performance is
presented for three individual bands and the combined data for a wide photo-z
range $0.8<z^{P}<1.2$. The error bars are the statistical uncertainty scaled
to sky coverage of $20\,000\ \mathrm{deg}^{2}$. We observe $~{}5\%$ systematic
bias in all cases due to the residual intrinsic clustering.

First we chose a wide photo-z bin range as $0.8<z^{P}<1.2$. The detailed
galaxy number density depends on the band, and for the $r$-band the number
density reaches $12\ \rm{arcmin}^{-2}$. For each band, we divide the galaxies
into eight flux bins with the same number in each bin. We measure the $g$
prefactors for all the bins according to Equations 5 and 16. The result is
presented in Fig. 2. The behavior for different bands has the same tendency
with slight differences. The galaxy overdensity is measured for all the flux
bins and for all the bands. We use $4096^{2}$ meshes to perform the analysis.
This resolution is sufficient to obtain reliable statistics for the range of
interest.

We first test the performance for each band individually. The resulting
weights from Eq. 14 is shown in solid lines in Fig. 3. The weights of
different bands have a similar dependence on the flux. For each band, the
lensing signal is reconstructed by adding the lensed galaxy overdensities in
these flux bins with the corresponding weights. The reconstruction performance
is presented in the first three panels of Fig. 4.

We observe a $\sim 5\%$ underestimation of the lensing signal over the whole
$\ell$ range we investigate. The detailed number depends on the scale and
band. The error bars are calculated from the 200 sky portions and scaled to a
survey with area of $20\,000\ \mathrm{deg}^{2}$. The uncertainty is larger at
larger scales due to cosmic variance. The error bar reduces from $\sim 5\%$ to
$1\%$ on the scales $\ell=160$ to $\ell=10\,000$. This bias is significant
compared to the statistical power. Since the number density, the true galaxy
distribution and the weights for different bands are similar, it is expected
that both the systematics and the statistical uncertainty are similar for all
bands.

Given that we have flux measurement on multiple bands, a natural and optimal
way is to perform the Modified ILC reconstruction on the combined data from
all the bands. Since the $g$ dependence on the flux is slightly different for
each band (Fig. 2), we gain information from the combined sample, and thus the
reconstruction is expected to be better. We keep the binning scheme in each
band and totally we have 24 flux bins. The resulting weights are presented in
dashed line in Fig. 3. The reconstruction performance is presented in the
bottom right panel of Fig. 4.

The performance is better when combining all bands. It has less fluctuations
at different scales, and the statistical uncertainty is smaller due to the
larger number of galaxies. However, combining the data from all bands does not
alleviate the underestimation. This also implies that the source of the
underestimation is the residual intrinsic clustering.

This residual noise has weak correlation with the lensing signal. We can
reduce this correlation by simply using a narrow photo-z bin.

###  4.2 A Narrow Photo-z Range

Figure 5: The Modified ILC performance for a narrow photo-z bin is presented.
The four panels show the result for three individual bands and the combined
data. A narrow photo-z bin reduces the residual intrinsic clustering, and thus
the systematic underestimation is suppressed, at the cost of slightly large
statistical error.

The disadvantage of a narrow photo-z bin is the low number of galaxies, which
increases the statistical uncertainty in the reconstruction. The number
density in this case is reduced to $\sim 6\ \rm{arcmin}^{-2}$. As shown in
Fig. 1, $r_{\kappa g}^{2}$ is reduced by a factor of $2-3$.

Again, we test the performance for each band individually and for combined
sample. The result is presented in Fig. 5. Compared with the wide photo-z bin
result, we observe large fluctuations in the reconstruction performance at
different scales and in different bands. As expected, the statistical
uncertainty is large in this case. For single band, at the large scale the
statistical uncertainty is about $8\%$ and for combined sample it is reduced
to $5\%$. However, there is no obvious underestimation of the lensing signal.
The deviation from 1 is within $1\sigma$ error for the combined sample.

We present the result for the case that the galaxies are divided into four
flux bins for each band in Appendix C. The performance is similar.

###  4.3 Comparison with a Straightforward Weighting Scheme

Figure 6: We compare two weighting schemes used to reconstruct the lensing
convergence. The left and right panels show the $r$-band result for
$0.8<z^{P}<1.2$ and $0.9<z^{P}<1.1$. The yellow lines correspond to the
Modified ILC method, and the blue lines correspond to the weighting
$w_{i}=g_{i}/\sum g_{i}^{2}$. The Modified ILC method has a much better
performance.

From $\delta_{g,i}^{L}=b_{i}\delta_{m}+g_{i}\kappa$, one can construct a
straightforward weighting scheme, $w_{i}=g_{i}/\sum g_{i}^{2}$. This weighting
also has the property $\sum_{i}w_{i}g_{i}=1$. Similar to the traditional ILC
method, no constraint to suppress the intrinsic clustering is made. In the
case that the galaxy distribution has non-negligible correlation with the
lensing signal, the residual noise $\sum_{i}g_{i}\delta_{i}/\sum_{i}g_{i}^{2}$
leads to systematics in the reconstruction.

Here we test the performance of the $w_{i}=g_{i}/\sum g_{i}^{2}$ weighting for
the $r$-band in Fig. 6. We observe severe systematic bias in the result for
both wide photo-z bin (left panel) and narrow photo-z bin (right panel) cases.
The bias is larger for wider photo-z bin. The residual intrinsic clustering
has a large impact on this straightforward weighting scheme, even a narrow
photo-z bin is adopted. Also plotted is the result from the Modified ILC
method on the same data. The Modified ILC method has well suppressed
systematics thanks to the requirement $\sum w_{i}=0$.

##  5 Conclusion and discussion

In this work, weak lensing magnification signal is reconstructed by the
Modified ILC method on a realistic $i,r,g$ photometric mock data constructed
from FASTPM simulations and cosmoDC2 mock catalogue. The lensing fields are
generated from theory and Modified to have realistic correlation with the
galaxy distribution. Then, the cosmic magnification effects are added to the
galaxy sample. We quantify the performances for two photo-z bin selections,
and for cases using data from individual bands and from the combined sample.

The sample for the wide photo-z bin ($0.8<z^{P}<1.2$) has a number density
$\sim 12\ \mathrm{arcmin}^{-2}$ for each band. We obtain $5\%$ reconstruction
uncertainty at the large scale for a survey with sky coverage $20\,000\
\mathrm{deg}^{2}$. Towards small scale the statistical error decreases to
$1\%$. However, the reconstruction underestimates the lensing power at level
of $\sim 5\%$. Using the combined sample reduces the error bars but the
underestimation is unchanged. This systematic bias is the result of the
correlation between the galaxy distribution and lensing signal.

Using a narrow photo-z bin ($0.9<z^{P}<1.1$) can reduce the correlation
between the signal we want to extract and the noise we want to remove.
$r_{\kappa g}^{2}$ is reduced by a factor of $2-3$ depending on the scale. We
observe no obvious systematic underestimation for the cases using individual
bands. The statistical uncertainty at the large scale is increased to $\sim
8\%$ due to the low source number density ($\sim 6\ \mathrm{arcmin}^{-2}$).
Due to the same reason, the performances for individual bands show slightly
large fluctuations on different scales. The performance for the combined data
is stable and has small statistical uncertainty.

In the Modified ILC method we made a rough assumption that galaxy bias is
constant in all flux bins. Future work will include the construction of new
weight scheme considering the galaxy bias dependence on the flux. In the
construction of the source galaxy catalogue, we assigned one galaxy to each
halo. The true Universe has the complexity that one massive halo can hold
several galaxies and very small halo may contain no galaxy. In other words, we
approximated the galaxy bias as halo bias. This simplification will influence
the detailed performances at the small scales. However, thanks to the extra
constraint, the impact is not expected to be large. We will use more realistic
galaxy sample mock in future validation.

In this work, we use the flux limit 27 for all bands, similar to the future
LSST survey. Including the faint galaxies decreases the shot noise and samples
$g$ over a wider flux range, leading to a better performance. We presumably
will use all the available galaxies for a given flux-limited sample. Thus, we
do not test performance dependence on the flux cuts. In this work, galaxies
are divided into flux bins with the same number of galaxies in each bin. This
might not be an optimal choice since the brightest flux bin is very wide and
the faintest bin is very narrow. The dependence of $g$ on the flux is not well
sampled. We will explore to search for an optimal binning scheme in flux
space.

In real observation, the measurement suffers the effects of survey geometry
and mask. The reconstructed lensing field is a linear combination of the
galaxy density field, and thus suffers from the same effect. One should take
the mask effect in the theoretical prediction in the analysis. On the other
side, the Modified ILC method can also be developed in real space. We leave
this to the future work. Besides the mask effect, the gray dust may change the
flux of the source galaxies, and add complexities in the Modified ILC method.

###### Acknowledgements.

This work was supported by the National Key Basic Research and Development
Program of China (No. 2018YFA0404504), the National Natural Science Foundation
of China (grants No. 11773048, 11621303 and 11890691), the science research
grants from the China Manned Space Project (No. CMS-CSST-2021-B01), and the
”111” Project of the Ministry of Education under grant No. B20019.

##  Appendix A Necessity of Extra Constraint in the Reconstruction

Figure 7: Reconstruction with the traditional ILC method (no constraint
$\sum_{i=1}^{N_{F}}w_{i}=0$) on the $r$-band. The photo-z range is
$0.8<z^{P}<1.2$.

Our modified ILC method includes an extra constraint
$\sum_{i=1}^{N_{F}}w_{i}=0$ to suppress to intrinsic clustering. When the
extra constraint is not included, the performance of reconstruction is bad as
shown in Figure 7.
$\frac{\langle\hat{\kappa}(\ell)\kappa^{*}(\ell)\rangle}{\langle\kappa(\ell)\kappa^{*}(\ell)\rangle}$
decreases from $\sim+0.7$ to $\sim-1.5$ towards increasing $\ell$. The
influence of intrinsic clustering on magnification reconstruction with the
tradition ILC method is catastrophic and cannot be ignored. So we add the
extra constraint $\sum_{i=1}^{N_{F}}w_{i}=0$.

##  Appendix B Resolution Dependence

Figure 8: The left and right panels are $C^{L}_{\kappa g}/2C_{\kappa\kappa}$
and $C_{gg}^{L}/4C_{\kappa\kappa}$ used to diagnose the resolution dependence
in the process of adding lensing effects. The green, blue and red lines show
the result of $1024^{2}$, $2048^{2}$ and $4096^{2}$ meshes, respectively. The
result using $4096^{2}$ meshes shows no bias for all the scales we
investigate.

We use an iterative method to solve for the lensed galaxy position where the
inverse deflected position overlaps with the original galaxy position.
Interpolation is adopted to calculate the deflection angle at given positions.
In weak lensing regime, the deflection angle is small. Thus this process is
suspicious to resolution effects. We use the following convergence test to
validate the process of adding lensing effects.

We only test whether we can recover the input lensing signal from the lensed
galaxy positions. We construct an unrealistic galaxy sample, with high number
density $\sim 40\ \mathrm{arcmin}^{-2}$ and no intrinsic clustering. Lensing
fields are generated on $1024^{2},2048^{2}$ and $4096^{2}$ meshes for
$10^{\circ}\times 10^{\circ}$ maps. We solve for the lensed galaxy positions
from these lensing deflection maps with different resolutions. Theoretically,
the power spectrum of the lensed sample directly related to the input lensing
signal, $C_{gg}^{L}=4C_{\kappa\kappa}$ and $C_{\kappa
g}^{L}=2C_{\kappa\kappa}$.

In Figure 8, the left panel shows the ratio $C_{\kappa
g}^{L}/2C_{\kappa\kappa}$ and the right panel shows
$C_{gg}^{L}/4C_{\kappa\kappa}$. The error bars are the r.m.s. of 200
realizations. We find that for the two cases with low resolution, both the
auto power spectrum and the cross power spectrum are underestimated at small
scales. There is no bias observed in the result using $4096^{2}$ meshes. From
this convergence test, we determine to use $4096^{2}$ meshes in the analysis.

##  Appendix C Dependence on the number of flux bins

We test the dependence on the number of flux bins used in the Modified ILC
method. Generally, the density measurement for each flux bin becomes noisy
when a large number of bins is adopted. However, the reconstruction takes use
of the measurement over all flux bins. We do not expect a large difference as
long as the choice is reasonable. The number of bins is chosen to be
sufficiently large to sample the flux dependence of the clustering, and small
enough to obtain a reliable clustering measurement for each bin. Finding the
optimal binning strategy is a non-trivial task.

We compare the result of four bins in each band to the one with eight bins in
Figure 9. The galaxies have $0.9<z^{P}<1.1$ and all bands are used. We only
observe a very mild difference between the two cases. The result from eight
bins has slightly smaller statistical uncertainty due to a better sampling of
the flux dependence.

Figure 9: The performance of the Modified ILC method for the combined data
when $N_{F}=4$ (the blue line) and $N_{F}=8$ (the yellow line). The photo-z
range is $0.9<z^{P}<1.1$.

## References

  * Bacon et al. (2000) Bacon, D. J., Refregier, A. R., & Ellis, R. S. 2000, MNRAS, 318, 625
  * Bartelmann (1995) Bartelmann, M. 1995, A&A, 298, 661
  * Bartelmann & Schneider (1993) Bartelmann, M., & Schneider, P. 1993, A&A, 268, 1
  * Bartelmann & Schneider (2001) Bartelmann, M., & Schneider, P. 2001, Phys. Rep., 340, 291
  * Basak & Delabrouille (2012) Basak, S., & Delabrouille, J. 2012, MNRAS, 419, 1163
  * Bennett et al. (2003) Bennett, C. L., Halpern, M., Hinshaw, G., et al. 2003, ApJS, 148, 1
  * Broadhurst et al. (1995) Broadhurst, T. J., Taylor, A. N., & Peacock, J. A. 1995, ApJ, 438, 49
  * Chiu et al. (2016) Chiu, I., Dietrich, J. P., Mohr, J., et al. 2016, MNRAS, 457, 3050
  * Delabrouille & Cardoso (2007) Delabrouille, J., & Cardoso, J. F. 2007, arXiv e-prints, astro
  * Feng et al. (2016) Feng, Y., Chu, M.-Y., Seljak, U., & McDonald, P. 2016, MNRAS, 463, 2273
  * Garcia-Fernandez et al. (2018) Garcia-Fernandez, M., Sanchez, E., Sevilla-Noarbe, I., et al. 2018, MNRAS, 476, 1071
  * Hamana (2001) Hamana, T. 2001, MNRAS, 326, 326
  * Hildebrandt et al. (2009) Hildebrandt, H., van Waerbeke, L., & Erben, T. 2009, A&A, 507, 683
  * Hoekstra & Jain (2008) Hoekstra, H., & Jain, B. 2008, Annual Review of Nuclear and Particle Science, 58, 99
  * Huff & Graves (2014) Huff, E. M., & Graves, G. J. 2014, ApJ, 780, L16
  * Jain & Lima (2011) Jain, B., & Lima, M. 2011, MNRAS, 411, 2113
  * Kilbinger (2015) Kilbinger, M. 2015, Reports on Progress in Physics, 78, 086901
  * Korytov et al. (2019) Korytov, D., Hearin, A., Kovacs, E., et al. 2019, ApJS, 245, 26
  * Lewis et al. (2000) Lewis, A., Challinor, A., & Lasenby, A. 2000, ApJ, 538, 473
  * Limber (1954) Limber, D. N. 1954, ApJ, 119, 655
  * LSST Dark Energy Science Collaboration (2012) LSST Dark Energy Science Collaboration. 2012, arXiv e-prints, arXiv:1211.0310
  * Ménard et al. (2010) Ménard, B., Scranton, R., Fukugita, M., & Richards, G. 2010, MNRAS, 405, 1025
  * Morrison et al. (2012) Morrison, C. B., Scranton, R., Ménard, B., et al. 2012, MNRAS, 426, 2489
  * Okumura et al. (2009) Okumura, T., Jing, Y. P., & Li, C. 2009, ApJ, 694, 214
  * Rhodes et al. (2007) Rhodes, J. D., Massey, R. J., Albert, J., et al. 2007, ApJS, 172, 203
  * Saha et al. (2008) Saha, R., Prunet, S., Jain, P., & Souradeep, T. 2008, Phys. Rev. D, 78, 023003
  * Scranton et al. (2005) Scranton, R., Ménard, B., Richards, G. T., et al. 2005, ApJ, 633, 589
  * Seldner & Peebles (1979) Seldner, M., & Peebles, P. J. E. 1979, ApJ, 227, 30
  * Troxel & Ishak (2015) Troxel, M. A., & Ishak, M. 2015, Phys. Rep., 558, 1
  * Yang et al. (2017) Yang, X., Zhang, J., Yu, Y., & Zhang, P. 2017, ApJ, 845, 174
  * Yang & Zhang (2011) Yang, X., & Zhang, P. 2011, MNRAS, 415, 3485
  * Yu et al. (2015) Yu, Y., Zhang, P., Lin, W., & Cui, W. 2015, ApJ, 803, 46
  * Zhang & Pen (2006) Zhang, P., & Pen, U.-L. 2006, MNRAS, 367, 169
  * Zhang et al. (2018) Zhang, P., Yang, X., Zhang, J., & Yu, Y. 2018, ApJ, 864, 10


# Using Random Perturbations to Mitigate Adversarial
Attacks on Sentiment Analysis Models

Abigail Swenor  Jugal Kalita
University of Colorado Colorado Springs
1420 Austin Bluffs Pkwy
Colorado Springs, CO 80918
<EMAIL_ADDRESS>
###### Abstract

Attacks on deep learning models are often difficult to identify and therefore
are difficult to protect against. This problem is exacerbated by the use of
public datasets that typically are not manually inspected before use. In this
paper, we offer a solution to this vulnerability by using, during testing,
random perturbations such as spelling correction if necessary, substitution by
random synonym, or simply dropping the word. These perturbations are applied
to random words in random sentences to defend NLP models against adversarial
attacks. Our Random Perturbations Defense and Increased Randomness Defense
methods are successful in returning attacked models to similar accuracy of
models before attacks. The original accuracy of the model used in this work is
80% for sentiment classification. After undergoing attacks, the accuracy drops
to accuracy between 0% and 44%. After applying our defense methods, the
accuracy of the model is returned to the original accuracy within statistical
significance.

##  1 Introduction

Deep learning models have excelled in solving difficult problems in machine
learning, including Natural Language Processing (NLP) tasks like text
classification (Zhang et al., 2015; Kim, 2014) and language understanding
(Devlin et al., 2019). However, research has discovered that inputs can be
modified to cause trained deep learning models to produce incorrect results
and predictions (Szegedy et al., 2014). Models in computer vision are
vulnerable to these attacks (Goodfellow et al., 2015), and studies have found
that models in the NLP domain are also vulnerable (Kuleshov et al., 2018; Gao
et al., 2018; Garg and Ramakrishnan, 2020). One use of these adversarial
attacks is to test and verify the robustness of NLP models.
With the potential for adversarial attacks, there comes the need for
prevention and protection. There are three main categories of defense methods:
identification, reconstruction, and prevention (Goldblum et al., 2020).
Identification methods rely on detecting either poisoned data or the poisoned
model (Chen et al., 2019). While reconstruction methods actively work to
repair the model after training (Zhu et al., 2020), prevention methods rely on
input preprocessing, majority voting, and other techniques to mitigate
adversarial attacks (Goldblum et al., 2020; Alshemali and Kalita, 2020).
Although most NLP adversarial attacks are easily detectable, some new forms of
adversarial attacks have become more difficult to detect like concealed data
poisoning attacks (Wallace et al., 2021) and backdoor attacks (Chen et al.,
2021). The use of these concealed and hard-to-detect attacks has revealed new
vulnerabilities in NLP models. Considering the increasing difficulty in
detecting attacks, a more prudent approach would be to work on neutralizing
the effect of potential attacks rather than solely relying on detection. Here
we offer a novel and highly effective defense solution that preprocesses
inputs by random perturbations to mitigate potential hard-to-detect attacks.

##  2 Related Work

The work in this paper relates to the attack on NLP models using the
TextAttack library (Morris et al., 2020), the current state-of-the-art defense
methods for NLP models, and using randomness against adversarial attacks.
The TextAttack library and the associated GitHub repository (Morris et al.,
2020) represent current efforts to centralize attack and data augmentation
methods for the NLP community. The library supports attack creation through
the use of four components: a goal function, a search method, a
transformation, and constraints. An attack method uses these components to
perturb the input to fulfill the given goal function while complying with the
constraints and the search method finds transformations that produce
adversarial examples. The library contains a total of 16 attack model recipes
based on literature. The work reported in this paper pertains to the 14 ready-
to-use classification attack recipes from the TextAttack library. We believe
that successful defense against such attacks will provide guidelines for the
general defense of deep learning NLP classification models.
There are many methods to defend NLP models against adversarial attacks,
including input preprocessing. Input preprocessing defenses require inserting
a step between the input and the given model that aims to mitigate any
potential attacks. Alshemali and Kalita (2020) use an input preprocessing
defense that employs synonym set averages and majority voting to mitigate
synonym substitution attacks. Their method is deployed before the input is run
through a trained model. Another defense against synonym substitution attacks,
Random Substitution Encoding (RSE) encodes randomly selected synonyms to train
a robust deep neural network (Wang and Wang, 2020). The RSE defense occurs
between the input and the embedding layer.
Randomness has been deployed in computer vision defense methods against
adversarial attacks. Levine and Feizi (2020) use random ablations to defend
against adversarial attacks on computer vision classification models. Their
defense is based on a random-smoothing technique that creates certifiably
robust classification. Levine and Feizi defend against sparse adversarial
attacks that perturb a small number of features in the input images. They
found their random ablation defense method to produce certifiably robust
results on the MNIST, CIFAR-10, and ImageNet datasets.

##  3 Input Perturbation Approach & Adversarial Defense

The use and availability of successful adversarial attack methods reveal the
need for defense methods that do not rely on detection and leverage intuitions
gathered from popular attack methods to protect NLP models. In particular, we
present a simple but highly effective defense against attacks on deep learning
models that perform sentiment analysis.
The approach taken is based on certain assumptions about the sentiment
analysis task. Given a short piece of text, we believe that a human does not
need to necessarily analyze every sentence carefully to get a grasp on the
sentiment. Our hypothesis is that humans can ascertain the expressed sentiment
in a text by paying attention to a few key sentences while ignoring or
skimming over the others. This thought experiment led us to make intermediate
classifications on individual sentences of a review in the IMDB dataset and
then combining the results for a collective final decision.
This process was refined further by considering how attackers actually perturb
data. Usually, they select a small number of characters or tokens within the
original data to perturb. To mitigate those perturbations, we choose to
perform our own random perturbations. Because the attacking perturbations
could occur anywhere within the original data, and we do not necessarily know
where they are, it is prudent to randomly select tokens for us to perturb.
This randomization has the potential to negate the effect the attacking
perturbations have on the overall sentiment analysis.
We wish to highlight the importance of randomness in our approach and in
possible future approaches for defenses against adversarial attacks. Positive
impact of randomness in classification tasks with featured datasets can be
found in work using Random Forests (Breiman, 2001). Random Forests have been
useful in many domains to make predictions, including disease prediction
(Lebedev et al., 2014; Corradi et al., 2018; Paul et al., 2017; Khalilia et
al., 2011) and stock market price prediction (Basak et al., 2019; Ballings et
al., 2015; Nti et al., 2019). The use of randomness has made these methods of
prediction robust and useful. We have chosen to harness the capability of
randomness in defense of adversarial attacks in NLP. We demonstrate that the
impact randomness has on our defense method is highly positive and its use in
defense against adversarial attacks of neural networks should be explored
further. We present two algorithms below—first with two levels of randomness,
and the second with three.

###  3.1 Random Perturbations Defense

Our algorithm is based on random processes: the randomization of perturbations
of the sentences of a review $R$ followed by majority voting to decide the
final prediction for sentiment analysis. We consider each review $R$ to be
represented as a set $R$ = $\\{r_{1},r_{2},...,r_{i},...,r_{N}\\}$ of
sentences $r_{i}$. Once $R$ is broken down into its sentences (Line 1 of
Algorithm 1), we create $l$ replicates of sentence $r_{i}$:
$\\{\hat{r}_{i1},...,\hat{r}_{ij},...,\hat{r}_{il}\\}$. Each replicate
$\hat{r}_{ij}$ has $k$ number of perturbations made to it. Each perturbation
is determined randomly (Lines 4-7).
In Line 5, a random token $t$ where $t\in\hat{r}_{ij}$ is selected, and in
Line 6, a random perturbation is performed on $t$. This random perturbation
could be a spellcheck with correction if necessary, a synonym substitution, or
dropping the word. These perturbations were selected as they are likely to be
the same operations an attacker performs, and they may potentially even
counter the effect of a large portion of perturbations in attacked data. A
spellcheck is performed using SpellChecker which is based in Pure Python Spell
Checking. If a spellcheck is performed on a token without spelling error, then
the token will not be changed. The synonym substitution is also performed in a
random manner. A synonym set for token $t$ is found using the WordNet synsets
(Fellbaum, 1998). Once a synonym set is found, it is processed to remove any
duplicate synonyms or copies of token $t$. Once the synonym set is processed,
a random synonym from the set is chosen to replace token $t$ in
$\hat{r}_{ij}$. A drop word is when the randomly selected token $t$ is removed
from the replicate altogether and replaced with a space. Conceptually
speaking, the random perturbations may be chosen from an extended set of
allowed changes.
Once $l$ replicates have been created for the given sentence $r_{i}$ and
perturbations made to tokens, they are put together to create replicate review
set $\hat{R}$ (Line 8). Then, in Line 9, each $\hat{r}_{ij}\in\hat{R}$ is
classified individually as $f(\hat{r}_{ij})$ using classifier $f()$. After
each replicate has been classified, we perform majority voting with function
$V()$. We call the final prediction that this majority voting results in as
$\hat{f}(R)$. This function can be thought of as follows (Line 12):

$\hat{f}(R)=V(\\{f(\hat{r}_{ij})\ |\ \hat{r}_{ij}\in\hat{R}\\}).$

The goal is to maximize the probability that $\hat{f}(R)=f(R)$ where $f(R)$ is
the classification of the original review $R$. In this paper, this
maximization is done through tuning of the parameters $l$ and $k$. The
certainty $T$ for $\hat{f}(R)$ is also determined for each calculation of
$\hat{f}(R)$. The certainty represents how sure the algorithm is of the final
prediction it has made. In general, the certainty $T$ is determined as follows
(Lines 13-17):

$T=count(f(\hat{r}_{ij})==\hat{f}(R))\ /\ N*l.$

The full visual representation of this algorithm can be seen in Algorithm 1
and in Figure 1.

Figure 1: Visual representation of Algorithm 1.

Result: $\hat{f}(R)$, the classification of $R$ after defense

Input : Review $R=\\{r_{1},r_{2},...,r_{N}\\}$ where $r_{i}$ is a sentence

Parameters : $l$ = number of copies made of each $r$, $k$ = number of
corrections made per $r_{i}$, $C=\\{c_{1},c_{2},...,c_{k}\\}$, set of
corrections

1 $\hat{R}=\emptyset$

2 for  _$r_{i}\ \epsilon\ R$_ do

3 for  _j = 1 to l_ do

4 $\hat{r}_{ij}=r_{i}$

5 for  _k_ do

6 Select random token $t$ where $t\ \epsilon\ \hat{r}_{ij}$

7 Perform random correction $c\ \epsilon\ C$ to $t$

8 end for

9 Append $\hat{r}_{ij}$ to $\hat{R}$

10 Classify: $f(r_{ij})$

11 end for

12

13 end for

14$\hat{f}(R)=V(\\{f(\hat{r}_{ij})\ |\ \hat{r}_{ij}\epsilon\hat{R}\\})$, $V()$
is a voting function

15if  _$f(\hat{R})==negative$_ then

16 $T=count(f(\hat{r}_{ij})==negative)\ /\ N*l$

17 else

18 $T=count(f(\hat{r}_{ij}==positive)\ /\ N*l$

19 end if

Algorithm 1 Random Perturbation Defense

###  3.2 Increasing Randomness

Our first algorithm represented in Algorithm 1 and in Figure 1 shows
randomness in two key points in the decision making process for making the
perturbations. This is the main source of randomness for our first algorithm.
In our next algorithm, we introduce more randomness into our ideas from our
original algorithm to create a modified algorithm. This more random algorithm
is visually represented in Figure 2 and presented in Algorithm 2. This new
defense method adds a third random process before making random corrections to
a sentence. Randomly chosen $r_{i}$ from $R$ are randomly corrected to create
replicate $\hat{r}_{j}$ which is placed in $\hat{R}$ (Lines 2-6). The original
sentence $r_{i}$ is placed back into $R$ and a new sentence is randomly
selected; this is random selection with replacement. This process of random
selection is repeated until there is a total of $k$ replicates $\hat{r}_{j}$
in $\hat{R}$. This algorithm follows the spirit of Random Forests more closely
than the first algorithm.
In Line 2, we randomly select a sentence $r_{i}$ from $R$. This is one of the
main differences between Algorithm 1 for Random Perturbations Defense and
Algorithm 2 for Increased Randomness Defense. That extra random element allows
for more randomization in the corrections we make to create replicates
$\hat{r}_{j}$. In Lines 3 and 4, the process is practically identical to Lines
5 and 6 in Algorithm 1. The only difference is that only one random correction
is being made to get the final replicate $\hat{r}_{j}$ for Increased
Randomness Defense, while Random Perturbations Defense makes $k$ random
corrections to get the final replicate $\hat{r}_{ij}$.

Result: $\hat{f}(R)$, the classification of $R$ after defense

Input : Review $R=\\{r_{1},r_{2},...,r_{N}\\}$ where $r_{i}$ is a sentence

Parameters : $k$ = number of replicates $\hat{r}_{j}$ made for $\hat{R}$,
$C=\\{c_{1},c_{2},...,c_{k}\\}$, set of corrections

1 $\hat{R}=\emptyset$, $P=[]$

2 for  _j = 1 to k_ do

3 Randomly select $r_{i}\in R$

4 Select random token $t$ where $t\in r_{i}$

5 Perform random correction $c\ \epsilon\ C$ to $t$ to get $\hat{r}_{j}$

6 Append $\hat{r}_{j}$ to $\hat{R}$

7 end for

8for  _j = 1 to k_ do

9 Classify: $f(\hat{r}_{j})$

10 Append results to predictions array $P$

11 end for

12$\hat{f}(R)=V(P)$, $V()$ is a voting function

13if  _$f(\hat{R})==negative$_ then

14 $T=count(f(\hat{r}_{ij})==negative)\ /\ N*l$

15 else

16 $T=count(f(\hat{r}_{ij}==positive)\ /\ N*l$

17 end if

Algorithm 2 Increased Randomness Defense Figure 2: Visual representation of
Algorithm 2 that includes more randomness.

###  3.3 Overcoming the Attacks

We define an attack as making random perturbations to an input, specifically
for this work, a review $R$. We assume a uniform distribution for randomness.
We interpret these random changes to occur throughout each review $R$ with
probability $\frac{1}{W}$ or $\frac{1}{N*m}$, where $W$ is the number of words
in $R$, $N$ is the number of sentences in $R$, and $m$ is the average length
of each sentence in $R$. We refer to this probability that an attack makes
changes to the review text as $P_{attack}$ where $a$ is the total number of
perturbations made by the attack:

$P_{attack}=\frac{a}{W}=\frac{a}{N*m}.$

If each random perturbation performed by the attack has a probability of
$\frac{1}{N*m}$, then our defense method needs to overcome that probability to
overcome the attack.
Our two defense methods, Random Perturbations Defense and Increased Randomness
Defense, both offer ways to overcome the attack, i.e., undo the attack change,
with a probability greater than $\frac{a}{N*m}$.

###### Proposition 1

Random Perturbations Defense overcomes an attack that makes a small number of
random perturbations to a review document by having a probability greater than
the attack probability $P_{attack}$.

Our Random Perturbations Defense picks a random token $t$ from each sentence
$r_{i}\in R$ and repeats $k$ times to get a final replicate $\hat{r}_{ij}$.
This gives an initial probability that the defense picks a certain token from
the text, or $P_{RPD}$, to be:

$P_{RPD}=\frac{N*l*m!}{k!(m-k)!}.$

We find this probability from choosing $k$ tokens from $r_{i}$ with length $m$
which breaks down to a binomial coefficient
$\binom{m}{k}=\frac{m!}{k!(n-k)!}$. This is then repeated $l$ times for each
sentence in $R$ which equates to that initial probability being multiplied by
$l$ and $N$. After doing some rearranging of the probabilities, we can see
that for certain values of $l$ and $k$ where $k<m$:

$P_{RPD}=\frac{N^{2}m^{2}l(m-1)(m-2)...(m-k+1)}{k!}>a.$

$P_{RPD}$ now is the total probability that the defense makes random changes
to $lN$ tokens. We know that $W=N*m$, that $a=<W$ for the attack methods we
are testing against, and that $k$ should be selected so that $k<<W$. This
means that we know $W^{2}>a$, $W^{2}>k!$, and $l(m-1)(m-2)...(m-k+1)>0$ for
the selected attack methods, which gives us the necessary conditions to assert
that $P_{RPD}>P{attack}$. Therefore, our Random Perturbations Defense will
overcome the $P_{attack}$ and should overcome the given attack method as
stated in Proposition 1.

###### Proposition 2

Increased Randomness Defense overcomes an attack that makes a small number of
random perturbations to a review document by having a probability greater than
the attack probability $P_{attack}$.

Our Increased Randomness Defense first chooses a random sentence $r_{i}$ which
is selected with probability $\frac{1}{N}$. Next, we choose a random word
within that sentence which is selected with probability $\frac{1}{m}$. This
gives us a probability for changes as follows:

$P_{IRD}=\frac{1}{N}*\frac{1}{m}=\frac{1}{N*m}.$

We can see that $P_{IRD}*a=P_{attack}$. We need to overcome the attack
probability and we do this in two ways: we either find the attack perturbation
by chance and reverse it, or we counterbalance the attack perturbation with
enough replicates $\hat{r}_{j}$. With each replicate $\hat{r}_{j}$ created, we
increase our probability $P_{IRD}$ so that our final probability for our
Increased Randomness Defense is as follows:

$P_{IRD}=\frac{k}{N*m}.$

As long as our selected parameter value for $k$ is greater than the number of
perturbation changes made by the attack method $a$, then $P_{IRD}>P_{attack}$
and our Increased Randomness Defense method will overcome the given attack
method as stated in Proposition 2.

##  4 Experiments & Results

###  4.1 Dataset & Models

We used the IMDB dataset (Maas et al., 2011) for our experiments. Each attack
was used to perturb 100 reviews from the dataset. The 100 reviews were
selected randomly from the dataset with a mix of positive and negative
sentiments. Note that the Kuleshov attack data (Kuleshov et al., 2018) only
had 77 reviews.
The models used in this research are from the TextAttack (Morris et al., 2020)
and HuggingFace (Wolf et al., 2020) libraries. These libraries offer many
different models to use for both attacked data generation and general NLP
tasks. For this research, we used the _bert-base-uncased-imdb_ model that
resides in both the TextAttack and HuggingFace libraries. This model was fine-
tuned and trained with a cross-entropy loss function. This model was used with
the API functions of the TextAttack library to create the attacked reviews
from each of the attacks we used. We chose this model because BERT models are
useful in many NLP tasks and this model specifically was fine-tuned for text
classification and was trained on the dataset we wanted to use for these
experiments.
The HuggingFace library was also used in the sentiment-analysis classification
of the attacked data and the defense method. We used the HuggingFace
transformer pipeline for sentiment-analysis to test our defense method. This
pipeline returns either “negative” or “positive” to classify the sentiment of
the input text and a score for that prediction (Wolf et al., 2020). This
pipeline was used to classify each replicate $\hat{r}_{ij}$ in our algorithm
and is represented as the function $f()$.

###  4.2 Experiments

The attacks from the TextAttack library were used to generate attack data.
Attack data was created from 7 different models from the library: BERT-based
Adversarial Examples (BAE) (Garg and Ramakrishnan, 2020), DeepWordBug (Gao et
al., 2018), FasterGeneticAlgorithm (Jia et al., 2019), Kuleshov (Kuleshov et
al., 2018), Probability Weighted Word Saliency (PWWS) (Ren et al., 2019),
TextBugger (Li et al., 2019), and TextFooler (Jin et al., 2020) (Morris et
al., 2020). Each of these attacks were used to create 100 perturbed sentences
from the IMDB dataset (Maas et al., 2011). These attacks were chosen from the
14 classification model attacks because they represent different kinds of
attack methods, including misspelling, synonym substitution, and antonym
substitution.
Each attack method used for our experiments has a slightly different approach
to perturbing the input data. Each perturbation method is unique and follows a
specific distinct pattern and examples of these can be found in Figure 3. The
BAE attack determines the most important token in the input and replaces that
token with the most similar replacement using a Universal Sentence Encoder.
This helps the perturbed data remain semantically similar to the original
input (Garg and Ramakrishnan, 2020). The DeepWordBug attack identifies the
most important tokens in the input and performs character-level perturbations
on the highest-ranked tokens while minimizing edit distance to create a change
in the original classification (Gao et al., 2018). The FasterGeneticAlgorithm
perturbs every token in a given input while maintaining the original
sentiment. It chooses each perturbation carefully to create the most effective
adversarial example (Jia et al., 2019). The Kuleshov attack is a synonym
substitution attack that replaces 10% - 30% of the tokens in the input with
synonyms that do not change the meaning of the input (Kuleshov et al., 2018).
The PWWS attack determines the word saliency score of each token and performs
synonym substitutions based on the word saliency score and the maximum
effectiveness of each substitution (Ren et al., 2019). The TextBugger attack
determines the important sentences from the input first. It then determines
the important words in those sentences and generates 5 possible “bugs” through
different perturbation methods: insert, swap, delete, sub-c (visual similarity
substitution), sub-w (semantic similarity substitution). The attack will
implement whichever of these 5 generated bugs is the most effective in
changing the original prediction (Li et al., 2019). Finally, the TextFooler
attack determines the most important tokens in the input using synonym
extraction, part-of-speech checking, and semantic similarity checking. If
there are multiple canididates to substitute with, the most semantically
similar substitution will be chosen and will replace the original token in the
input (Jin et al., 2020).

Figure 3: Example of what original data looks like and how the BAE Garg and
Ramakrishnan (2020) and TextBugger Li et al. (2019) attack methods perturb
data. The BAE attack method uses semantic similarity, while the Textbugger
attack method uses visual similarity.

After each attack had corresponding attack data, the TextAttack functions gave
the results for the success of the attack. The accuracy of the sentiment-
analysis task under attack, without the defense method, is reported in the
first column in Table 1. Each attack caused a large decrease in the accuracy
of the model. The model began with an average accuracy of 80% for the IMDB
dataset. Once the attack data was created and the accuracy under attack was
reported, the attack data was run through our Random Perturbations and
Increased Randomness defense methods. All of the experiments were run on
Google Colaboratory using TPUs and the Natural Language Toolkit (Loper and
Bird, 2002).

###  4.3 Results

We began by testing on the HuggingFace sentiment analysis pipeline with the
original IMDB dataset. This gave an original accuracy of 80%. This percentage
represents the goal for our defense method accuracy as we aim to return the
model to its original accuracy, or higher. The accuracy under each attack is
listed in Table 1 in the first column. These percentages show how effective
each attack is at causing misclassification for the sentiment analysis task.
The attacks range in effectiveness with PWWS (Ren et al., 2019) and Kuleshov
(Kuleshov et al., 2018) with the most successful attacks at 0% accuracy under
attack and FasterGeneticAlgorithm (Jia et al., 2019) with the least successful
attack at 44% accuracy under attack, which is still almost a 40% drop in
accuracy.

Attack | w/o Defense | w/ Defense
---|---|---
BAE | 33% | 80.80%$\pm$1.47
DeepWordBug | 34% | 76.60%$\pm$1.85
FasterGeneticAlgo | 44% | 82.20%$\pm$1.72
Kuleshov* | 0% | 60.00%$\pm$2.24
PWWS | 0% | 81.80%$\pm$1.17
TextBugger | 6% | 79.20%$\pm$2.32
TextFooler | 1% | 83.20%$\pm$2.48

Table 1: Accuracy for each of the attack methods under attack, and under
attack with the defense method from Algorithm 1 deployed with $l=7$ and $k=5$.
The accuracy prior to attack is 80%.

####  4.3.1 Random Perturbations Defense

For the Random Perturbations Defense to be successful, it is necessary to
obtain values of the two parameters, $l$ and $k$. Each attack was tested
against our Random Perturbations Defense 5 times. The accuracy was averaged
for all 5 tests and the standard deviation was calculated for the given mean.
The mean accuracy with standard deviation is presented for each attack in the
second column of Table 1. The results presented are for $l=7$ and $k=5$. These
parameters were chosen after testing found greater values of $l$ and $k$
resulted in a longer run time and too many changes made to the original input;
with lower values for $l$ and $k$, the model had lower accuracy and not enough
perturbations to outweigh any potential adversarial attacks. The values behind
this logic can be seen in Table 2.

Attack | l | k | Accuracy w/ Defense
---|---|---|---
BAE | 5 | 2 | 55%
BAE | 10 | 5 | 50%
BAE | 7 | 5 | 79%
Table 2: This table explains values of $l$ and $k$

The defense method was able to return the model to original accuracy within
statistical significance while under attack for most of the attacks with the
exception of the Kuleshov method (Kuleshov et al., 2018). The accuracy for the
other attacks all were returned to the original accuracy ranging from 76.00%
to 83.20% accuracy with the Random Perturbations defense deployed. This shows
that our defense method is successful at mitigating most potential adversarial
attacks on sentiment classification models. Our defense method was able to
increase the accuracy of model while under attack for the
FasterGeneticAlgorithm, PWWS, and TextFooler. These three attack methods with
our defense achieved accuracy that was higher than the original accuracy with
statistical significance.

####  4.3.2 Increased Randomness Defense

The Increased Randomness Defense was also tested on all seven of the attacks.
Each attack was tested against this defense 5 times. The results for these
experiments can be seen in Table 4. There were tests done to determine what
the proper value for $k$ should be. These tests were performed on the BAE
(Garg and Ramakrishnan, 2020) attack and the results can be found in Table 3.
These tests revealed that 40-45 replicates $\hat{r}_{j}$ was ideal for each
$\hat{R}$ with $k=41$ being the final value used for the tests on each attack.
This defense method was more efficient to use.

Attack | k | Accuracy w/ Defense
---|---|---
BAE | 10 | 67%
BAE | 20 | 76%
BAE | 25 | 72%
BAE | 30 | 76%
BAE | 35 | 74%
BAE | 40 | 82%
BAE | 45 | 74%
BAE | 41 | 77%
Table 3: This table shows the results for the tests for different values of
$k$ for the increased randomness experiments.

The runtime and the resources used for this method were lower than the
original random perturbations defense method with the runtime for the Random
Perturbations Defense being nearly 4 times longer than this increased random
method. A comparison of the two defense methods on the seven attacks tested
can be seen in Figure 4. This defense was successful in returning the model to
the original accuracy, within statistical significance, for most of the
attacks with the exception of the Kuleshov attack (Kuleshov et al., 2018). A
t-test was performed to determine the statistical significance of the
difference in the defense method accuracy to the original accuracy.

Attack | w/o Defense | w/ Defense
---|---|---
BAE | 33% | 78.40%$\pm$3.14
DeepWordBug | 34% | 76.80%$\pm$2.64
FasterGeneticAlgo | 44% | 82.80%$\pm$2.48
Kuleshov* | 0% | 66.23%$\pm$4.65
PWWS | 0% | 79.20%$\pm$1.72
TextBugger | 6% | 77.00%$\pm$2.97
TextFooler | 1% | 80.20%$\pm$2.48

Table 4: Accuracy for increased randomness defense from Algorithm 2 against
each attack method with $k=41$. The accuracy prior to attack is 80%. Figure 4:
Comparing the average accuracy of the Random Perturbations Defense and the
Increased Randomness Defense methods to the under attack accuracy without
defense on the seven attacks.

###  4.4 Comparison to Recent Defense Methods

Our defense methods are comparable to some recent defense methods created for
text classification. Our defense method returns the model to the original
accuracy within statistical significance. This is comparable to the work done
by Zhou et al. (2021) in their Dirichlet Neighborhood Ensemble (DNE) defense
method. They were able to bring the model within 10% of the original accuracy
for CNN, LSTM, and BOW models for the IMDB dataset. However, their work is
only applicable to synonym-substitution based attacks. Since our defense
methods apply equally well to seven attacks, it is general and can be applied
without determining the exact type of attack (assuming it is one of the
seven).
Another recent defense method, Synonym Encoding Method (SEM), was tested on
synonym-substitution attacks on Word-CNN, LSTM, Bi-LSTM and BERT models (Wang
et al., 2021b). This defense method was most successful on the BERT model and
was able to return to the original accuracy within 3% for the IMDB dataset.
Our work is comparable to both DNE and SEM which represent recent work in
defending NLP models against adversarial attacks and more specifically
synonym-substitution based attacks.
WordDP is another recent defense method for adversarial attacks against NLP
models (Wang et al., 2021a). This defense method used Differential Privacy
(DP) to create certified robust text classification models against word
substitution adversarial attacks. They tested their defense on the IMDB and
found that their WordDP method was successful at raising the accuracy within
3% of the original clean model. This method outperformed other defense methods
including DNE. This is similar to our defense method, but they do not include
whether these results are statistically significant.
We also compare our defense methods, RPD and IRD, against these recent defense
methods on cost and efficiency. Our RPD and IRD methods have comparable time
complexity of $O(cn)$, where $c$ is the time it takes for classification and
$n$ is the number of reviews. Each method has a similar constant that
represents the number of perturbations and replicates made. We cannot directly
compare the time complexity of our defense methods with the SEM, DNE, and
WordDP methods. These recent defense methods require specialized training
and/or encodings. Our RPD and IRD methods do not require specialized training
or encodings, so they cannot be directly compared on time complexity. This
means that the comparison between our methods and recent defense methods comes
in the form of specialized training vs. input preprocessing. Training and
developing new encodings tends to be more time consuming and expensive than
input preprocessing methods that can occur during the testing phases.

##  5 Conclusion

The work in this paper details a successful defense method against adversarial
attacks generated from the TextAttack library. These attack methods use
multiple different perturbation approaches to change the predictions made by
NLP models. Our Random Perturbations Defense was successful in mitigating 6
different attack methods. This defense method returned the attacked models to
their original accuracy within statistical significance. Our second method,
Increased Randomness Defense, used more randomization to create an equally
successful defense method that was 4 times more efficient than our Random
Perturbations Defense. Overall, our defense methods are effective in
mitigating a range of NLP adversarial attacks, presenting evidence for the
effectiveness of randomness in NLP defense methods. The work done here opens
up further study into the use of randomness in defense of adversarial attacks
for NLP models including the use of these defense methods for multi-class
classification. This work also encourages a further mathematical and
theoretical explanation to the benefits of randomness in defense of NLP
models.

## Acknowledgement

The work reported in this paper is supported by the National Science
Foundation under Grant No. 2050919. Any opinions, findings and conclusions or
recommendations expressed in this work are those of the author(s) and do not
necessarily reflect the views of the National Science Foundation.

## References

  * Alshemali and Kalita (2020) Basemah Alshemali and Jugal Kalita. 2020.  Generalization to mitigate synonym substitution attacks.  In _Proceedings of Deep Learning Inside Out (DeeLIO): The First Workshop on Knowledge Extraction and Integration for Deep Learning Architectures_ , pages 20–28.
  * Ballings et al. (2015) Michel Ballings, Dirk Van den Poel, Nathalie Hespeels, and Ruben Gryp. 2015.  Evaluating multiple classifiers for stock price direction prediction.  _Expert systems with Applications_ , 42(20):7046–7056.
  * Basak et al. (2019) Suryoday Basak, Saibal Kar, Snehanshu Saha, Luckyson Khaidem, and Sudeepa Roy Dey. 2019.  Predicting the direction of stock market prices using tree-based classifiers.  _The North American Journal of Economics and Finance_ , 47:552–567.
  * Breiman (2001) Leo Breiman. 2001.  Random forests.  _Machine Learning_ , 45(1):5–32.
  * Chen et al. (2019) Huili Chen, Cheng Fu, Jishen Zhao, and Farinaz Koushanfar. 2019.  Deepinspect: A black-box trojan detection and mitigation framework for deep neural networks.  In _Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence, IJCAI-19_ , pages 4658–4664.
  * Chen et al. (2021) Xiaoyi Chen, Ahmed Salem, Michael Backes, Shiqing Ma, and Yang Zhang. 2021.  Badnl: Backdoor attacks against nlp models.  In _ICML 2021 Workshop on Adversarial Machine Learning_.
  * Corradi et al. (2018) John P Corradi, Stephen Thompson, Jeffrey F Mather, Christine M Waszynski, and Robert S Dicks. 2018.  Prediction of incident delirium using a random forest classifier.  _Journal of Medical Systems_ , 42(12):1–10.
  * Devlin et al. (2019) Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019.  BERT: Pre-training of deep bidirectional transformers for language understanding.  In _2019 Annual Conference of the National American Chapter of the Association for Computational Linguistics: Human Language Technologies_ , page 4171–4186.
  * Fellbaum (1998) Christiane Fellbaum, editor. 1998.  _WordNet: An Electronic Lexical Database_.  Language, Speech, and Communication. MIT Press, Cambridge, MA.
  * Gao et al. (2018) Ji Gao, Jack Lanchantin, Mary Lou Soffa, and Yanjun Qi. 2018.  Black-box generation of adversarial text sequences to evade deep learning classifiers.  In _2018 IEEE Security and Privacy Workshops (SPW)_ , pages 50–56.
  * Garg and Ramakrishnan (2020) Siddhant Garg and Goutham Ramakrishnan. 2020.  BAE: BERT-based adversarial examples for text classification.  In _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)_ , pages 6174–6181.
  * Goldblum et al. (2020) Micah Goldblum, Dimitris Tsipras, Chulin Xie, Xinyun Chen, Avi Schwarzschild, Dawn Song, Aleksander Madry, Bo Li, and Tom Goldstein. 2020.  Data security for machine learning: Data poisoning, backdoor attacks, and defenses.  _arXiv preprint arXiv:2012.10544_.
  * Goodfellow et al. (2015) Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015.  Explaining and harnessing adversarial examples.  _stat_ , 1050:20.
  * Jia et al. (2019) Robin Jia, Aditi Raghunathan, Kerem Göksel, and Percy Liang. 2019.  Certified robustness to adversarial word substitutions.  In _Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP)_ , pages 4129–4142.
  * Jin et al. (2020) Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2020.  Is BERT really robust? a strong baseline for natural language attack on text classification and entailment.  In _Proceedings of the AAAI conference on artificial intelligence_ , volume 34, pages 8018–8025.
  * Khalilia et al. (2011) Mohammed Khalilia, Sounak Chakraborty, and Mihail Popescu. 2011.  Predicting disease risks from highly imbalanced data using random forest.  _BMC Medical Informatics and Decision Making_ , 11(1):1–13.
  * Kim (2014) Yoon Kim. 2014.  Convolutional neural networks for sentence classification.  In _Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP)_ , pages 1746–1751, Doha, Qatar. Association for Computational Linguistics.
  * Kuleshov et al. (2018) Volodymyr Kuleshov, Shantanu Thakoor, Tingfung Lau, and Stefano Ermon. 2018.  Adversarial examples for natural language classification problems.  In _Open Review Net_.
  * Lebedev et al. (2014) AV Lebedev, Eric Westman, GJP Van Westen, MG Kramberger, Arvid Lundervold, Dag Aarsland, H Soininen, I Kłoszewska, P Mecocci, M Tsolaki, et al. 2014.  Random forest ensembles for detection and prediction of alzheimer’s disease with a good between-cohort robustness.  _NeuroImage: Clinical_ , 6:115–125.
  * Levine and Feizi (2020) Alexander Levine and Soheil Feizi. 2020.  Robustness certificates for sparse adversarial attacks by randomized ablation.  In _Proceedings of the AAAI Conference on Artificial Intelligence_ , volume 34, pages 4585–4593.
  * Li et al. (2019) J Li, S Ji, T Du, B Li, and T Wang. 2019.  Textbugger: Generating adversarial text against real-world applications.  In _26th Annual Network and Distributed System Security Symposium_.
  * Loper and Bird (2002) Edward Loper and Steven Bird. 2002.  Nltk: The natural language toolkit.  In _In Proceedings of the ACL Workshop on Effective Tools and Methodologies for Teaching Natural Language Processing and Computational Linguistics. Philadelphia_ , pages 69–72.
  * Maas et al. (2011) Andrew L. Maas, Raymond E. Daly, Peter T. Pham, Dan Huang, Andrew Y. Ng, and Christopher Potts. 2011.  Learning word vectors for sentiment analysis.  In _Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics: Human Language Technologies_ , pages 142–150, Portland, Oregon, USA.
  * Morris et al. (2020) John Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, Di Jin, and Yanjun Qi. 2020\.  Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in NLP.  In _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations_ , pages 119–126.
  * Nti et al. (2019) Kofi O Nti, Adebayo Adekoya, and Benjamin Weyori. 2019.  Random forest based feature selection of macroeconomic variables for stock market prediction.  _American Journal of Applied Sciences_ , 16(7):200–212.
  * Paul et al. (2017) Desbordes Paul, Ruan Su, Modzelewski Romain, Vauclin Sébastien, Vera Pierre, and Gardin Isabelle. 2017.  Feature selection for outcome prediction in oesophageal cancer using genetic algorithm and random forest classifier.  _Computerized Medical Imaging and Graphics_ , 60:42–49.
  * Ren et al. (2019) Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. 2019.  Generating natural language adversarial examples through probability weighted word saliency.  In _Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics_ , pages 1085–1097.
  * Szegedy et al. (2014) Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2014.  Intriguing properties of neural networks.  In _2nd International Conference on Learning Representations, ICLR 2014_.
  * Wallace et al. (2021) Eric Wallace, Tony Zhao, Shi Feng, and Sameer Singh. 2021.  Concealed data poisoning attacks on NLP models.  In _Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies_ , pages 139–150.
  * Wang et al. (2021a) Wenjie Wang, Pengfei Tang, Jian Lou, and Li Xiong. 2021a.  Certified robustness to word substitution attack with differential privacy.  In _Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies_ , pages 1102–1112.
  * Wang et al. (2021b) Xiaosen Wang, Hao Jin, Yichen Yang, and Kun He. 2021b.  Natural language adversarial defense through synonym encoding.  In _Conference on Uncertainty in Artificial Intelligence_.
  * Wang and Wang (2020) Zhaoyang Wang and Hongtao Wang. 2020.  Defense of word-level adversarial attacks via random substitution encoding.  In _Knowledge Science, Engineering and Management_ , pages 312–324.
  * Wolf et al. (2020) Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, Mariama Drame, Quentin Lhoest, and Alexander M. Rush. 2020.  Transformers: State-of-the-art natural language processing.  In _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations_ , pages 38–45.
  * Zhang et al. (2015) Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015.  Character-level convolutional networks for text classification.  _Advances in Neural Information Processing Systems_ , 28:649–657.
  * Zhou et al. (2021) Yi Zhou, Xiaoqing Zheng, Cho-Jui Hsieh, Kai-Wei Chang, and Xuanjing Huang. 2021\.  Defense against synonym substitution-based adversarial attacks via Dirichlet neighborhood ensemble.  In _Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers)_ , pages 5482–5492.
  * Zhu et al. (2020) Liuwan Zhu, Rui Ning, Cong Wang, Chunsheng Xin, and Hongyi Wu. 2020.  Gangsweep: Sweep out neural backdoors by gan.  In _Proceedings of the 28th ACM International Conference on Multimedia_ , MM ’20, page 3173–3181, New York, NY, USA.