Defensive Dual Masking for Robust Adversarial Defense

Jie Yang; Johan Barthelemy; Wangli Yang; Yi Guo

REVIEW 6 major objections 4 minor 14 references

Defensive Dual Masking for Robust Adversarial Defense

T0 review · 6 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read By inserting [MASK] tokens during training and swapping suspected attacked words for [MASK] at test time, a standard BERT classifier gains about 5.0 absolute accuracy points under four adversarial text attacks.

desk verdict Incremental follow-up to MI4D with a plausible masking trick, but the table arithmetic doesn't check out and the reported 5-point gain isn't reproducible. read the letter →

arxiv 2412.07078 v1 pith:UNAFJL6K submitted 2024-12-10 cs.CL cs.AI

Wangli Yang , Jie Yang , Yi Guo , Johan Barthelemy This is my paper · ORCID

classification cs.CLcs.AI

keywords adversarialdefensetextclassification[MASK]tokeninsertionBERTFoolerBERT-AttackDeepWordBugBugger

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Defensive Dual Masking (DDM) is a way to harden text classifiers against adversarial attacks by using the [MASK] token in two places: inserted into training inputs and substituted for suspicious words at inference. The paper's claim is that this dual masking improves accuracy under attack by an average of about 5.0 absolute points over recent state-of-the-art defenses on AGNews and MR, across TextFooler, BERT-Attack, DeepWordBug, and TextBugger, without changing the model architecture or loss function and without generating extra training data. The method also keeps clean accuracy at the level of ordinary fine-tuning, and the authors report that the same recipe strengthens large language models. The paper offers a geometric explanation: masking the attacked token keeps the reconstructed [CLS] representation closer to the original than the adversarial replacement does.

What carries the argument

The central object is the [MASK] token, the masked-language-modeling placeholder, used in two roles. In training, the paper inserts M = ceil(|x| * b_M) consecutive [MASK] tokens immediately after [CLS], sets their position embeddings to zero, and fine-tunes the unchanged architecture on these masked sequences. In inference, it uses the frequency-guided word substitution score (FGWS) to estimate each token's perturbation probability and replaces the lowest-frequency tokens with [MASK] up to the same budget. The theoretical machinery is a convex-hull analysis of attention: after attention, the reconstructed [CLS] token lies in the convex hull (the set of all weighted averages) of the contributing token vectors, and under Assumption 1 (uniform distribution within that hull), Lemma 3.1 and Lemma 3.2 give exact expected squared distances; Theorem 3.3 states a sufficient condition on vector norms and cosine similarities under which the expected distance from the original [CLS] reconstruction is smallest for the masked version, intermediate for the masked-plus-replacement version, and largest for the adversarial replacement, which is Eq. (3.1).

What would settle it

Run DDM and every compared baseline in one shared codebase with identical 1,000-sample attacked test sets, identical attack implementations of all four attacks, the same BERT-base initialization, and the same fine-tuning budget; if the average 5.0-point CAA advantage over the strongest baseline shrinks below statistical significance, the claimed state-of-the-art improvement is not established. A complementary check is to compute the vectors in Theorem 3.3 from real BERT hidden states and test whether the norm condition in Eq. (3.2) actually holds for the tokens DDM chooses to mask.

Watch

Extended reading notes

Core claim

The central discovery is a two-stage masking recipe that turns the [MASK] token into a defensive tool rather than a reconstruction target. During fine-tuning, DDM prepends a block of M consecutive [MASK] tokens to each clean sequence and trains on the obscured sequence alone with the standard cross-entropy loss. During inference, it scores each token by its frequency in the training corpus and replaces the lowest-frequency tokens, those most likely to be adversarial, with [MASK], then classifies the masked sequence directly. The authors report that this procedure, evaluated on BERT-base with a 30% masking budget, outperforms data-augmentation, model-enhancement, and randomized-smoothing baselines on every dataset and attack combination in their table, achieving accuracy under attack (CAA) of 82.3% on AGNews under TextFooler and 85.8% under DeepWordBug, with an average 5.0-point gain over the next-best defenses.

Load-bearing premise

The reported superiority over state-of-the-art defenses assumes that the baseline numbers taken from the original papers were produced under the same evaluation protocol as DDM, namely the same 1,000 attacked test samples, the same attack implementations, the same training budget, and the same metric definitions, so that the differences reflect method quality rather than evaluation setup.

Editorial extensions

If this is right

If the reported results hold, a defender can harden an existing fine-tuned classifier by changing only the input preprocessing, leaving the network architecture, loss function, and weights untouched.
Because DDM does not need to generate adversarial examples or run an ensemble of masked copies at inference, it avoids the main computational costs of data-augmentation and randomized-smoothing defenses.
The dual masking recipe transfers to large language models, implying that the same preprocessing can be applied as inputs enter an LLM to improve resilience without retraining the model.
Clean accuracy stays on par with regular fine-tuning, so the defense does not trade robustness for performance on unmodified inputs.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Beyond the paper: the frequency-based token detector could be replaced by a gradient- or saliency-based detector; if DDM's gains come from the dual-masking scheme rather than the detector, then matching the detector to each attack type should yield further robustness gains.
Beyond the paper: the convex-hull condition in Theorem 3.3 suggests a testable selection rule, namely mask a token only when its adversarial replacement vector is long and sufficiently dissimilar from the original; measuring these quantities on real hidden states would show when masking helps or hurts.
Beyond the paper: since training inserts [MASK] tokens rather than replacing text, DDM may also confer robustness to naturally missing input, such as noisy automatic-speech-recognition transcripts or OCR gaps, not just adversarial substitutions.
Beyond the paper: a natural extension is to test DDM on instruction-tuned LLMs against prompt injection and jailbreak perturbations, where token-frequency statistics differ from classification corpora and the masking budget may need to adapt.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: this is an incremental follow-up to the authors' own MI4D work, with a real but small delta, and the empirical evidence as reported doesn't back the headline claim. The method inserts consecutive [MASK] tokens after [CLS] during training and, at inference, replaces the lowest-frequency tokens with [MASK]. That specific configuration (plus zero position embeddings for [MASK]) is not in the prior literature, so there is something new. The paper is also transparent: Table 1 lists MI4D as doing dual masking, and MI4D shares three co-authors. Credit where due: the idea is simple, architecture-agnostic, and cheap to try, and the reported gains are consistent with the intuition that rare tokens are the attack surface.

The soft spots are not minor. The evaluation table is internally inconsistent. Section 4.1 says the 1,000 test samples are "successfully attacked." If that's true, the no-defense baseline's CAA on those samples should be near zero, but Table 3 reports 15.8 on AGNews/TextFooler. If instead the samples are random attack attempts, then CAA+SUCC should be roughly 100 for each row; the baseline rows sum to about 99, but DDM rows sum to 92.9 (AGNews/TextFooler) and 93.1 (MR/TextFooler). No single interpretation reconciles the table. And the claimed "average 5.0 improvement" is not reproducible: recomputing against the best baseline per cell gives something like 10–12 points. That's a correctness gap in the main evidence.

The theory also has issues. Theorem 3.3's condition, Eq. 3.2, is garbled—the typesetting makes it unreadable—and the proof relies on a uniform-distribution assumption (Assumption 1) that is asserted without validation. That said, the lemmas are correct given that assumption, so the theory is not vacuous; it just needs cleanup and an honest statement that the assumption is an idealization. The abstract promises LLM experiments; the body has none. Section 1 also promises an ablation study, but no ablation appears in the paper.

Who is this for? Researchers working on cheap adversarial defenses who want a candidate baseline. The paper deserves a serious referee because the method is testable and the flaws are fixable, but as it stands the empirical claims are not reliable. My recommendation: send back for major revision with a demand for re-running baselines under identical protocols, code/data release, an ablation of the two masking components, and a corrected table that actually matches the metric definitions. If that's done, the paper could be a useful incremental contribution.

Referee Report

6 major / 4 minor

Summary. The paper proposes Defensive Dual Masking (DDM), an adversarial defense for text classifiers that inserts M consecutive [MASK] tokens after [CLS] during fine-tuning and, at inference, replaces the M lowest-frequency tokens with [MASK] before classification. The authors provide a theoretical analysis based on attention geometry and convex hulls, claiming that masking adversarial tokens brings the reconstructed [CLS] representation closer to the clean one. They evaluate DDM on AGNews and MR against TextFooler, BERT-Attack, DeepWordBug, and TextBugger, and report consistent improvements over state-of-the-art defenses, including an average gain of 5.0 absolute accuracy points.

Significance. If the empirical claims held under a controlled protocol, DDM would be an attractive defense because it preserves the model architecture and loss function, requires no extra training data, and avoids ensemble inference. The theoretical framing, which tries to justify the masking rule through attention-based convex hull geometry, is also a useful direction. The paper ships no code and the proofs are not machine-checked, but the method itself is simple and falsifiable. However, as presented, the theoretical condition is not parseable, the central assumption is unvalidated, and the empirical evaluation has internal inconsistencies that prevent verification of the headline improvement.

major comments (6)

[Section 3.2, Theorem 3.3, Eq. (3.2)] The success condition in Eq. (3.2) is not syntactically well-formed: the expression contains missing parentheses, missing norm brackets, and ambiguous indicator-function disjunctions. For example, the term "9/8 (∥va(lar + 4 p ∆1)" appears to be missing a closing parenthesis and a norm sign, and the role of the indicators 1(∆1 ≥ 0) and 1(∆2 ≥ 0) in the max expression is unclear. As written, the theorem cannot be checked, and no precise statement of the condition is available.
[Section 3.2, Assumption 1 and Lemmas 3.1-3.2] The entire theoretical result rests on Assumption 1, which states that the reconstructed [CLS] token is uniformly distributed within the convex hull of the relevant tokens. This is a strong distributional assumption that is neither derived from the attention mechanism nor empirically validated in the paper. The proof of Theorem 3.3 also depends on the earlier reduction of all unchanged tokens to a single contracted point s; the paper gives only a heuristic argument for this reduction. Since the main theoretical claim is used to justify the inference masking rule, this omission is load-bearing.
[Section 4.1 and Table 3] The evaluation protocol described in Section 4.1 is inconsistent with the numbers in Table 3. The text says that 1,000 samples that were successfully attacked are selected, but under that definition the baseline CAA should be near zero and SUCC should be near 100. Instead, Table 3 reports baseline CAA values such as 15.8 on AGNews/TextFooler and SUCC values such as 83.2. If the selected samples are instead random attack attempts, then CAA plus SUCC should approximate 100 minus the clean error rate, but this relationship does not hold for all rows either. The table's arithmetic cannot be reconciled with the stated definitions, so the empirical evidence is not internally verifiable.
[Section 4.2, Table 3 and abstract] The headline claim of an average 5.0 absolute accuracy improvement is not reproducible from Table 3. No aggregation rule is given: it is not specified which baselines are included in the average, whether the average is across all attacks and datasets, or how ties and missing entries are handled. A direct comparison against the best baseline per attack and dataset gives a substantially larger gap, roughly 10-12 absolute points. The paper should state the exact averaging procedure and, if possible, provide per-cell differences.
[Section 4.1, Defense Algorithms] All baseline results are said to be "directly drawn from the respective original papers." This means the comparison assumes that every baseline was evaluated under the same protocol: the same set of 1,000 test samples, the same attack implementations, the same training budgets, and the same metric definitions. Without rerunning the baselines under the DDM protocol, the claimed improvements over methods such as MI4D, RSMI, and RanMASK may reflect evaluation differences rather than method superiority. This is a central issue because the main empirical conclusion is a ranking against those baselines.
[Sections 1, 4, and 5] The introduction and conclusion promise a comprehensive ablation study and claim that DDM improves the robustness of large language models, but neither an ablation section nor any LLM experiment appears in the manuscript. The only empirical content is the main results table. These claims should either be supported by the corresponding experiments or removed from the abstract and conclusion.

minor comments (4)

[Section 3.2, attention derivation] In the displayed equation for the reconstructed token, the expression "xs3 + w′p3 / 1 + w′" is missing the parentheses that would make the fraction unambiguous; it should read (xs3 + w′p3)/(1 + w′).
[Section 3.1 and Table 1] Table 1 is garbled: the row for "Replace-then-predict" contains stray text such as "Replace only InsertReplace-then-predict", and the columns are not visually aligned. This makes the comparison of masking strategies difficult to read.
[Throughout] There are multiple typos and wording errors, including "second momentum" for "second moment", "varitions" for "variations", "competetive" for "competitive", "defensing" for "defense", "performanc" for "performance", and "textse" for "texts".
[Section 4.1, Evaluation Metrics] The paper states that all experiments are repeated five times and marks results with p < 10^-3, but it does not describe the statistical test, the comparison procedure, or the variance across seeds. Reporting standard deviations or confidence intervals would make the significance claims interpretable.

Circularity Check

0 steps flagged · score 0.0 of 10

No constructional circularity: the empirical comparison is benchmark-based and the theoretical analysis is a conditional geometric lemma, not a fitted restatement of the results.

full rationale

I examined the derivation chain. DDM's training and inference rules are fixed procedures (insert M consecutive masks after [CLS], replace lowest-frequency tokens via the FGWS statistic), not parameters fitted to the test-attack metrics, so the claimed '5.0-point improvement' is an empirical summary rather than a prediction forced by construction. The theoretical Section 3.2 is conditional: Assumption 1 posits uniform placement in a convex hull, and Theorem 3.3 derives Eq. (3.1) only when Eq. (3.2) holds. Eq. (3.2) is expressed in terms of unmeasured token vectors and is never shown to be satisfied by the frequency-based selection rule, so the theory under-determines the method but does not define DDM's success in terms of itself. The citation to MI4D (Hu et al. 2023), which shares three authors with this paper, is used only to justify the geometric convex-hull picture ('which follows the MI4D process'); that geometric claim is also supported by the attention-softmax argument in the same section, and the lemmas are proved in-paper rather than imported as an external theorem. The baseline numbers are taken from prior papers under potentially different protocols, and the reported 5.0 average improvement is not reproducible from Table 3 without an unreported aggregation rule; those are correctness and evidence-quality concerns, not circularity. The central claim therefore does not reduce, by construction or by a self-citation chain, to its inputs.

Assumptions & free parameters 1 free parameters · 3 assumptions · 0 invented entities

DDM's theoretical analysis is not a derivation of the method from first principles; it rests on an unstated uniform-distribution assumption and a contraction of all unchanged tokens. The only free parameter is the masking budget, set without a reported sensitivity study.

free parameters (1)

masking budget bM = 0.3
Set to 30% for both training and inference; no sensitivity analysis or ablation is reported, so this value appears chosen by hand rather than derived.

assumptions (3)

ad hoc to paper Assumption 1: The reconstructed [CLS] token is uniformly distributed within the convex hull formed by the relevant tokens.
Introduced in Section 3.2 as the basis for Lemma 3.1, Lemma 3.2, and Theorem 3.3. No empirical or theoretical justification is given for the uniformity.
domain assumption Unchanged tokens can be collapsed into a single contracted point s within the attention mechanism.
Section 3.2 uses this contraction to apply the convex-hull analysis; it is a substantial simplification of multi-token attention and is not validated.
domain assumption Attention projection flexibility allows the weight w' to take any non-negative real value.
Section 3.2 relies on this to claim the reconstructed token lies in a convex hull; in practice the parameterization is constrained by training, so the claim is a capacity argument, not a proven property of a trained model.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Defensive Dual Masking for Robust Adversarial Defense." pith.science (2026). https://pith.science/paper/UNAFJL6K

@misc{pith2026241207078,
  author       = {Pith},
  title        = {Pith review of: Defensive Dual Masking for Robust Adversarial Defense},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/UNAFJL6K}},
  note         = {Machine review of arXiv:2412.07078}
}

read the original abstract

The field of textual adversarial defenses has gained considerable attention in recent years due to the increasing vulnerability of natural language processing (NLP) models to adversarial attacks, which exploit subtle perturbations in input text to deceive models. This paper introduces the Defensive Dual Masking (DDM) algorithm, a novel approach designed to enhance model robustness against such attacks. DDM utilizes a unique adversarial training strategy where [MASK] tokens are strategically inserted into training samples to prepare the model to handle adversarial perturbations more effectively. During inference, potentially adversarial tokens are dynamically replaced with [MASK] tokens to neutralize potential threats while preserving the core semantics of the input. The theoretical foundation of our approach is explored, demonstrating how the selective masking mechanism strengthens the model's ability to identify and mitigate adversarial manipulations. Our empirical evaluation across a diverse set of benchmark datasets and attack mechanisms consistently shows that DDM outperforms state-of-the-art defense techniques, improving model accuracy and robustness. Moreover, when applied to Large Language Models (LLMs), DDM also enhances their resilience to adversarial attacks, providing a scalable defense mechanism for large-scale NLP applications.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

14 extracted references · 11 canonical work pages

[5]

Frequency-guided word substitutions for detecting textual adversarial examples. In Proceedings of the 16th Conference of the European Chapter of the Association for Computational Linguistics: Main Volume, pages 171–186, Association for Computational Linguistics, Online. Pang, Bo and Lillian Lee. 2005. Seeing stars: Exploiting class relationships for senti...

work page 2005
[6]

In Findings of the Association for Computational Linguistics: NAACL 2024, pages 3795–3809, Association for Computational Linguistics, Mexico City, Mexico

RobustSentEmbed: Robust sentence embeddings using adversarial self-supervised contrastive learning. In Findings of the Association for Computational Linguistics: NAACL 2024, pages 3795–3809, Association for Computational Linguistics, Mexico City, Mexico. Raman, Mrigank, Pratyush Maini, J Kolter, Zachary Lipton, and Danish Pruthi. 2023. Model-tuning via pr...

work page 2024
[7]

In International Conference on Learning Representations

InfoBERT: Improving robustness of language models from an information theoretic perspective. In International Conference on Learning Representations. Wang, Xiaosen, Yichen Yang, Yihe Deng, and Kun He. 2020. Adversarial training with fast gradient projection method against synonym substitution based text attacks. Wang, Zhaoyang, Zhiyue Liu, Xiaopeng Zheng,...

work page 2020
[8]

RMLM: A flexible defense framework for proactively mitigating word-level adversarial attacks. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 2757–2774, Association for Computational Linguistics, Toronto, Canada. Xu, Jianhan, Cenyuan Zhang, Xiaoqing Zheng, Linyang Li, Cho-Jui Hsieh,...

work page
[9]

In Findings of the Association for Computational Linguistics: ACL 2022, pages 1694–1707, Association for Computational Linguistics, Dublin, Ireland

Towards adversarially robust text classifiers by learning to reweight clean examples. In Findings of the Association for Computational Linguistics: ACL 2022, pages 1694–1707, Association for Computational Linguistics, Dublin, Ireland. Yang, Yichen, Xin Liu, and Kun He. 2024. Fast adversarial training against textual adversarial attacks. arXiv preprint arX...

arXiv 2022
[11]

arXiv preprint arXiv:2401.03514

Roic-dm: Robust text inference and classification via diffusion model. arXiv preprint arXiv:2401.03514. Zeng, Jiehang, Jianhan Xu, Xiaoqing Zheng, and Xuanjing Huang. 2023. Certified robustness to text adversarial attacks by randomized [MASK]. Computational Linguistics, 49(2):395–427. Zhan, Pengwei, Jing Yang, He Wang, Chao Zheng, Xiao Huang, and Liming Wang

arXiv 2023
[12]

In Findings of the Association for Computational Linguistics: ACL 2023, pages 7891–7906, Association for Computational Linguistics, Toronto, Canada

Similarizing the influence of words with contrastive learning to defend word-level adversarial text attack. In Findings of the Association for Computational Linguistics: ACL 2023, pages 7891–7906, Association for Computational Linguistics, Toronto, Canada. Zhang, Cenyuan, Xiang Zhou, Yixin Wan, Xiaoqing Zheng, Kai-Wei Chang, and Cho-Jui Hsieh. 2022. Impro...

work page 2023
[14]

Defense against synonym substitution-based adversarial attacks via Dirichlet neighborhood ensemble. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), pages 5482–5492, Association for Computational Linguistics, Online...

work page 2020

Show all 14 references

[2015]

In Proceedings of the 28th International Conference on Neural Information Processing Systems - Volume 1, NIPS’15, page 649–657, MIT Press, Cambridge, MA, USA

Character-level convolutional networks for text classification. In Proceedings of the 28th International Conference on Neural Information Processing Systems - Volume 1, NIPS’15, page 649–657, MIT Press, Cambridge, MA, USA. Zhang, Zeliang, Wei Yao, Susan Liang, and Chenliang Xu...

2024
[2020]

In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 3465–3475, Association for Computational Linguistics, Online

SAFER: A structure-free approach for certified robustness to adversarial word substitutions. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 3465–3475, Association for Computational Linguistics, Online. Yoo, Jin Yong and Yanjun...

2021
[2021]

In Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021, pages 3248–3258, Association for Computational Linguistics, Online

Defending pre-trained language models from adversarial word substitution without performance sacrifice. In Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021, pages 3248–3258, Association for Computational Linguistics, Online. Devlin, Jacob, Ming-Wei Ch...

2021
[2022]

SHIELD: Defending textual neural networks against multiple black-box adversarial attacks with stochastic multi-expert patcher. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 6661–6674, Association for C...

2019
[2023]

Text adversarial purification as defense against adversarial attacks. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 338–350, Association for Computational Linguistics, Toronto, Canada. Li, Zhenhao, Mar...
[2024]

arXiv preprint arXiv:2407.00248

Diffusedef: Improved robustness to adversarial attacks. arXiv preprint arXiv:2407.00248. Li, Zongyi, Jianhan Xu, Jiehang Zeng, Linyang Li, Xiaoqing Zheng, Qi Zhang, Kai-Wei Chang, and Cho-Jui Hsieh. 2021. Searching for an effective defender: Benchmarking defense against advers...

2021 arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [5]

Frequency-guided word substitutions for detecting textual adversarial examples. In Proceedings of the 16th Conference of the European Chapter of the Association for Computational Linguistics: Main Volume, pages 171–186, Association for Computational Linguistics, Online. Pang, Bo and Lillian Lee. 2005. Seeing stars: Exploiting class relationships for senti...

work page 2005

[2] [6]

In Findings of the Association for Computational Linguistics: NAACL 2024, pages 3795–3809, Association for Computational Linguistics, Mexico City, Mexico

RobustSentEmbed: Robust sentence embeddings using adversarial self-supervised contrastive learning. In Findings of the Association for Computational Linguistics: NAACL 2024, pages 3795–3809, Association for Computational Linguistics, Mexico City, Mexico. Raman, Mrigank, Pratyush Maini, J Kolter, Zachary Lipton, and Danish Pruthi. 2023. Model-tuning via pr...

work page 2024

[3] [7]

In International Conference on Learning Representations

InfoBERT: Improving robustness of language models from an information theoretic perspective. In International Conference on Learning Representations. Wang, Xiaosen, Yichen Yang, Yihe Deng, and Kun He. 2020. Adversarial training with fast gradient projection method against synonym substitution based text attacks. Wang, Zhaoyang, Zhiyue Liu, Xiaopeng Zheng,...

work page 2020

[4] [8]

RMLM: A flexible defense framework for proactively mitigating word-level adversarial attacks. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 2757–2774, Association for Computational Linguistics, Toronto, Canada. Xu, Jianhan, Cenyuan Zhang, Xiaoqing Zheng, Linyang Li, Cho-Jui Hsieh,...

work page

[5] [9]

In Findings of the Association for Computational Linguistics: ACL 2022, pages 1694–1707, Association for Computational Linguistics, Dublin, Ireland

Towards adversarially robust text classifiers by learning to reweight clean examples. In Findings of the Association for Computational Linguistics: ACL 2022, pages 1694–1707, Association for Computational Linguistics, Dublin, Ireland. Yang, Yichen, Xin Liu, and Kun He. 2024. Fast adversarial training against textual adversarial attacks. arXiv preprint arX...

arXiv 2022

[6] [11]

arXiv preprint arXiv:2401.03514

Roic-dm: Robust text inference and classification via diffusion model. arXiv preprint arXiv:2401.03514. Zeng, Jiehang, Jianhan Xu, Xiaoqing Zheng, and Xuanjing Huang. 2023. Certified robustness to text adversarial attacks by randomized [MASK]. Computational Linguistics, 49(2):395–427. Zhan, Pengwei, Jing Yang, He Wang, Chao Zheng, Xiao Huang, and Liming Wang

arXiv 2023

[7] [12]

In Findings of the Association for Computational Linguistics: ACL 2023, pages 7891–7906, Association for Computational Linguistics, Toronto, Canada

Similarizing the influence of words with contrastive learning to defend word-level adversarial text attack. In Findings of the Association for Computational Linguistics: ACL 2023, pages 7891–7906, Association for Computational Linguistics, Toronto, Canada. Zhang, Cenyuan, Xiang Zhou, Yixin Wan, Xiaoqing Zheng, Kai-Wei Chang, and Cho-Jui Hsieh. 2022. Impro...

work page 2023

[8] [14]

Defense against synonym substitution-based adversarial attacks via Dirichlet neighborhood ensemble. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), pages 5482–5492, Association for Computational Linguistics, Online...

work page 2020