Improving Robustness of Intent Detection Under Adversarial Attacks: A Geometric Constraint Perspective

• Published in: IEEE transaction on neural networks and learning systems Vol. 35; no. 5; pp. 6133 - 6144
• Main Authors: Qi, Biqing, Zhou, Bowen, Zhang, Weinan, Liu, Jianxing, Wu, Ligang
• Format: Journal Article
• Language: English
• Published: United States IEEE 01.05.2024; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Artificial neural networks; Dialog system; Geometric constraints; Manifolds; Manifolds (mathematics); Measurement; Natural language processing; Neural networks; Optimization; Perturbation methods; representation learning; Robustness; Task analysis; Training
• ISSN: 2162-237X; 2162-2388
• DOI: 10.1109/TNNLS.2023.3267460

Deep neural networks (DNNs)-based natural language processing (NLP) systems are vulnerable to being fooled by adversarial examples presented in recent studies. Intent detection tasks in dialog systems are no exception, however, relatively few works have been attempted on the defense side. The combination of linear classifier and softmax is widely used in most defense methods for other NLP tasks. Unfortunately, it does not encourage the model to learn well-separated feature representations. Thus, it is easy to induce adversarial examples. In this article, we propose a simple, yet efficient defense method from the geometric constraint perspective. Specifically, we first propose an M-similarity metric to shrink variances of intraclass features. Intuitively, better geometric conditions of feature space can bring lower misclassification probability (MP). Therefore, we derive the optimal geometric constraints of anchors within each category from the overall MP (OMP) with theoretical guarantees. Due to the nonconvex characteristic of the optimal geometric condition, it is hard to satisfy the traditional optimization process. To this end, we regard such geometric constraints as manifold optimization processes in the Stiefel manifold, thus naturally avoiding the above challenges. Experimental results demonstrate that our method can significantly improve robustness compared with baselines, while retaining the excellent performance on normal examples.