{"push_id":2774178995,"size":7,"distinct_size":7,"ref":"refs/heads/master","head":"3cf7e54570d806145c29cc311b5e7f656812efe5","before":"bc830a30f4508ef2fed389ef58bdaf450178935e","commits":[{"sha":"acf18b3c3599a8347a3ac8d10309f9a12c632eb3","author":{"name":"Paul Michel","email":"f360eb269e4642a6fdcc0b34a56c0c4aecea8edb@fb.com"},"message":"Access `LSTMSequenceEncoder` and `TransformerEncoder` input word vectors variable.\n\nSummary:\nThis makes it possible to track variables within a model (for re-use, e.g. to get gradients wrt. inputs).\n\nThis is the base for a new stack for adversarial examples generation.\n\nThose are the only changes that aren't confined to `research/adversarial`.\n\nReviewed By: xianxl\n\nDifferential Revision: D8957045\n\nfbshipit-source-id: 99993c5a92f452d4f4663daf9a87f24561a430e4","distinct":true,"url":"https://api.github.com/repos/pytorch/translate/commits/acf18b3c3599a8347a3ac8d10309f9a12c632eb3"},{"sha":"1f7c821d5a0ef9075822d592cef62317129a5884","author":{"name":"Paul Michel","email":"f360eb269e4642a6fdcc0b34a56c0c4aecea8edb@fb.com"},"message":"Whitebox attack with random adversary\n\nSummary:\nThis introduces the bulk of the whitebox adversarial attack framework. It consists of:\n\n- `AdversarialTrainer`: a subclass Trainer with methods to generate adversarial inputs on-the-fly.\n- `Adversary` classes: responsible for generating adversarial inputs given a sample and gradients of the adversarial criterion wrt. the word vectors. One \"baseline\" adversary is provided:\n  - `RandomSwapAdversary`: swaps words at random (or according to the gradient magnitude)\n- `PytorchTranslateAdversarialTask`: a subclass of `PytorchTranslateTask` handling those new components\n- A command line script to generate adversarial examples (`whitebox.py`)\n\nReviewed By: xianxl\n\nDifferential Revision: D8962639\n\nfbshipit-source-id: 7368b94fa26fe01985ace449ad5cdd656fbb26f3","distinct":true,"url":"https://api.github.com/repos/pytorch/translate/commits/1f7c821d5a0ef9075822d592cef62317129a5884"},{"sha":"7ef5839ca135bbc31b42db731372d6b84a5ad300","author":{"name":"Paul Michel","email":"f360eb269e4642a6fdcc0b34a56c0c4aecea8edb@fb.com"},"message":"Brute force gradient-based attack\n\nSummary:\nAdds an adversary for gradient-based attacks.\n\nIt finds the optimal `(p, w)` pair such that replacing the word at position `p` with word `w` will move the input word embeddings in the direction that aligns best with the gradient of the adversarial criterion.\n\nReviewed By: xianxl\n\nDifferential Revision: D8997242\n\nfbshipit-source-id: 54c792b6ed9da8e3f340135e895b9507b076604b","distinct":true,"url":"https://api.github.com/repos/pytorch/translate/commits/7ef5839ca135bbc31b42db731372d6b84a5ad300"},{"sha":"0ed77880c58e7a5cccc531b3033790a1aa0b35f7","author":{"name":"Paul Michel","email":"f360eb269e4642a6fdcc0b34a56c0c4aecea8edb@fb.com"},"message":"Unit-tests for adversaries\n\nSummary: Adds unit-tests to check fo correctness of the gradient-based adversaries mostly\n\nReviewed By: xianxl\n\nDifferential Revision: D9003664\n\nfbshipit-source-id: 0da86fbc716179a46ae84626d52de6744bf3320e","distinct":true,"url":"https://api.github.com/repos/pytorch/translate/commits/0ed77880c58e7a5cccc531b3033790a1aa0b35f7"},{"sha":"ae7b6f147feb6c703dd59f66f600d7d9fca23284","author":{"name":"Paul Michel","email":"f360eb269e4642a6fdcc0b34a56c0c4aecea8edb@fb.com"},"message":"Add adversarial criteria\n\nSummary:\nThis adds two criterions geared towards adversarial attacks:\n\n- `all_bad_words`: log probability of **not** generating the correct word at each timestep. This is different from `cross_entropy --reverse-criterion`. The latter can be seen as maximizing `P[NOT (w1 AND w2 ...)]=P[(NOT w1) OR (NOT w2) ...]` whereas this criterion maximizes P[(NOT w1) AND (NOT w2) ...]\n- `force_words`: log probability of generating a specific set of words (eg. force the model to generate profanities).\n- `force_words_hinge`: Same as `force_words` but with a hinge-like loss inspired by https://arxiv.org/abs/1803.01128\n ---\n\nAll experiments are run on the first 1000 samples of IWSLT de-en. The complete details of the model can be found below. I used greedy decoding with a length penalty of 1.0.\n\nIn this first experiment I show that this criterion is better than the reversed NLL criterion (`cross_entropy --reverse-criterion`). All experiments are run with `--max-swaps=1`.\n\nHere are the BLEU scores. Lower BLEU = bigger degradation = better.\n\n|Adversary\\Criterion|`cross_entropy` (reversed)|`all_bad_words`|\n|--|\n|Baseline (no adversary)|24.01|24.01|\n|`random_swap`|**19.14**|19.14|\n|`random_swap --by-gradient-norm --temperature 10`|19.17|19.13|\n|`brute_force`|20.75|**18.67**|\n|`brute_force --normalize-directions`|20.94|20.90|\n\nThis criterion is better for gradient based attacks\n\nI now show that the `force_words` criterion can be used to force the model to generate specific words. I force the model to generate words from the following list:\n\n`apfel banane birne ananas orange` (`apple banana pear ananas orange`)\n\nWe then count the number of occurrences of the target words in the generated sentences.\n\nThis attack works better when the original target sentence is replaced with the sentence generated by the model (because we want to deviate from the model output)\n\n|Adversary\\counts|# apfel |# banane |# birne |# ananas |# orange|# all|\n|--|\n|Baseline (no adversary)|0|0|0|0|0|0|\n|`random_swap`|0|0|0|0|0|0|\n|`random_swap --by-gradient-norm --temperature 10`|0|0|0|0|0|0|\n|`brute_force`|1|0|0|0|1|2|\n|`brute_force --normalize-directions`|**6**|0|0|0|**5**|**11**|\n\nIt is possible (albeit difficult) to force the model to generate specific words. In this case, a gadient based brute force attack (*with normalized directions* works better).\n\nThe setting is the same as experiment 2. except the adversary is now fixed (`brute_force --normalize-directions`) and I vary the criteria used.\n\n|Criterion\\counts|# apfel |# banane |# birne |# ananas |# orange|# all|\n|--|\n|`force_words`|6|0|0|0|5|11|\n|`force_words --any-position`|**20**|0|0|0|**7**|**27**|\n|`force_words_hinge`|3|0|0|0|1|4|\n|`force_words_hinge --any-position`|4|0|0|0|1|5|\n\nThe probabilistic approach (`force_words`) with logsumexp reduction (`--any-position`) works much better than the other options. In particular this is an improvement over the hinge-like loss proposed in https://arxiv.org/abs/1803.01128 (however their search for adversarial examples is different so the results are not directly comparable).\n\nWith the following criterion: `force_words --force-not --words-list </s>` I am able to decrease the BLEU score to 17.53 which is worse than every other approach in experiment 1.\n\nMore precisely the length ration hyp/ref goes from 1.126 to 1.401. Although this doesn't change the brevity pernalty (capped to 1.0 anyway), this decreases the precisions a lot.\n\nThis experiment was still conducted with a beam size of 1. For a beam size of 5 the BLEU score degrades from 25.21 to 20.31 (ratio 1.091 -> 1.267). However in this setting random swapping results in a similar if not better degradation in BLEU (but not in length ratio).\n\nReviewed By: xianxl\n\nDifferential Revision: D8624012\n\nfbshipit-source-id: 94fdd4fe478893024576430aa2138f26881a7650","distinct":true,"url":"https://api.github.com/repos/pytorch/translate/commits/ae7b6f147feb6c703dd59f66f600d7d9fca23284"},{"sha":"a8276f22dd584f7f1695fed9dab55fcea718ea37","author":{"name":"Paul Michel","email":"f360eb269e4642a6fdcc0b34a56c0c4aecea8edb@fb.com"},"message":"More options/constraints for the adversaries\n\nSummary:\nThis introduces `AdversarialConstraints`, an abstraction to represent the operarions that the adversary can or cannot do.\n\nAlso rewrites the adversaries a little bit to accomodate for the new constraints.\n\nRight now there are two ways of specifying constraints:\n\n- `nearest-neighbors`: kNN in the source embedding space\n- `alternatives-file`: manually specified bvalid alternative for each word (synonyms, typos, etc...)\n- `forbidden-words` specify a list of words that the adversary cannot use in the source.\n\nExperiments:\n\nSee https://fb.quip.com/1Z98AkRhgliD for experiments\n\nReviewed By: xianxl\n\nDifferential Revision: D8705047\n\nfbshipit-source-id: c0ef4f34e1baa2df4cdca5c11b202d1028856463","distinct":true,"url":"https://api.github.com/repos/pytorch/translate/commits/a8276f22dd584f7f1695fed9dab55fcea718ea37"},{"sha":"3cf7e54570d806145c29cc311b5e7f656812efe5","author":{"name":"Paul Michel","email":"f360eb269e4642a6fdcc0b34a56c0c4aecea8edb@fb.com"},"message":"Adversarial training\n\nSummary: On-the-fly data augmentation with adversarial samples\n\nReviewed By: xianxl\n\nDifferential Revision: D8792703\n\nfbshipit-source-id: 73b74e3493a2f2a11363259e741835fd985c4588","distinct":true,"url":"https://api.github.com/repos/pytorch/translate/commits/3cf7e54570d806145c29cc311b5e7f656812efe5"}]}
{"actor":{"display_login":"facebook-github-bot"}}