Precisely the Point Adversarial Augmentations for Faithful and Informative Text Generation Wenhao Wu1 Wei Li2 Jiachen Liu2 Xinyan Xiao2 Sujian Li1y Yajuan Lyu2

2025-05-02 0 0 455.39KB 17 页 10玖币

侵权投诉

Precisely the Point: Adversarial Augmentations for Faithful and

Informative Text Generation

Wenhao Wu1∗

, Wei Li2, Jiachen Liu2, Xinyan Xiao2, Sujian Li1†

, Yajuan Lyu2

1Key Laboratory of Computational Linguistics, MOE, Peking University

2Baidu Inc., Beijing, China

{waynewu,lisujian}@pku.edu.cn

{liwei85,liujiachen,xiaoxinyan, lvyajuan}@baidu.com

Abstract

Though model robustness has been extensively

studied in language understanding, the ro-

bustness of Seq2Seq generation remains un-

derstudied. In this paper, we conduct the

ﬁrst quantitative analysis on the robustness

of pre-trained Seq2Seq models. We ﬁnd

that even current SOTA pre-trained Seq2Seq

model (BART) is still vulnerable, which leads

to signiﬁcant degeneration in faithfulness and

informativeness for text generation tasks. This

motivated us to further propose a novel adver-

sarial augmentation framework, namely Ad-

vSeq, for generally improving faithfulness and

informativeness of Seq2Seq models via en-

hancing their robustness. AdvSeq automati-

cally constructs two types of adversarial aug-

mentations during training, including implicit

adversarial samples by perturbing word rep-

resentations and explicit adversarial samples

by word swapping, both of which effectively

improve Seq2Seq robustness. Extensive ex-

periments on three popular text generation

tasks demonstrate that AdvSeq signiﬁcantly

improves both the faithfulness and informa-

tiveness of Seq2Seq generation under both au-

tomatic and human evaluation settings.

1 Introduction

Recently, text generation has made signiﬁcant

progress thanks to the development of pre-trained

sequence-to-sequence (Seq2Seq) models (Lewis

et al.,2020;Zhang et al.,2020;Roller et al.,2021).

Despite being able to generate ﬂuent and gram-

matical text, current state-of-the-art models tend

to generate low-informative and unfaithful outputs

that hallucinated with the given inputs (Welleck

et al.,2019;Maynez et al.,2020). One major rea-

son is that Seq2Seq models, generally trained with

Negative Log-Likelihood (NLL), are still not robust

enough to handle perturbations in the input (Kang

∗Work is done during an internship at Baidu Inc.

†Corresponding author.

Original Input x

: Police said the incident hap-

pened near the village of Tockwith. North York-

shire Police said it was believed the aeroplane

had suffered engine failure. Sgt Andy Graham,

who attended the crash, praised the "great pilot-

ing skills resulting in no injuries".

Output from x

: A light aircraft has crashed

into a ﬁeld in Yorkshire, but no-one was injured.

Adversarial Input x0:

Police said the incident

happened near the village of Tockwith. North

Yorkshire Police said it was believed the aero-

planes had suffered engine failure. Sgt Andy Gra-

ham, who attended the crash, praised the "great

piloting skills resulting in no accident".

Output from x0

: Two aeroplanes have crashed

in North Yorkshire, with one of them landing

safely on its roof.

Table 1: A sample of the XSum dataset for text summa-

rization generated by ﬁne-tuned BART, where minor

perturbations (words in blue) cause low-informative

and unfaithful generation (span in red).

and Hashimoto,2020). This vulnerability can lead

to signiﬁcant degeneration of the generalization

performance for text generation tasks (Cheng et al.,

2019). Table 1provides a typical example to show

the vulnerability of the model to perturbations. We

can see that the words “aeroplane” and “injuries”

in the original text are revised as “aeroplanes” and

“accident” respectively, which do not alter the mean-

ing of the input. However, the output generated by

BART obviously hallucinates the input.

The model robustness problem has been exten-

sively studied in language understanding, however,

it is still understudied in language generation, es-

pecially for pre-trained Seq2Seq models (Li et al.,

2021). The popular adversarial learning methods

for language understanding, such as FreeLB (Zhu

et al.,2020), are not effective on Seq2Seq gener-

ation tasks (as shown in Table 4). Although few

arXiv:2210.12367v1 [cs.CL] 22 Oct 2022

previous work have attempted to craft adversarial

samples for Seq2Seqs on machine translation (Be-

linkov and Bisk,2018;Cheng et al.,2020), they

have not been extensively studied across various

generation tasks. Furthermore, they have not been

studied on current pre-trained Seq2Seq models.

To address this problem, we provide the ﬁrst

quantitative analysis on the robustness of pre-

trained Seq2Seqs. Speciﬁcally, we quantitatively

analyze the robustness of BART across three gen-

eration tasks, i.e., text summarization, table-to-text,

and dialogue generation. Through slightly mod-

ifying the input content, we ﬁnd that the corre-

sponding output signiﬁcantly drops in both infor-

mativeness and faithfulness, which also demon-

strate the close connection between the robustness

of Seq2Seq models and their informativeness and

faithfulness on generation tasks.

Based on the analysis above, we further propose

a novel

Adv

ersarial augmentation framework for

Seq

uence-to-Sequence generation (AdvSeq) to en-

hance its robustness against perturbations and thus

obtain an informative and faithful text generation

model. AdvSeq constructs challenging and factu-

ally consistent adversarial samples and learns to

defend against their attacks. To increase the diver-

sity of the adversarial samples, AdvSeq applies two

types of perturbation strategies, implicit adversarial

samples (AdvGrad) and explicit token swapping

(AdvSwap), efﬁciently utilizing the back-propagate

gradient during training. AdvGrad directly perturbs

word representations with gradient vectors, while

AdvSwap utilizes gradient directions for searching

for token replacements. To alleviate the vulnera-

bility of NLL, AdvSeq adopts a KL-divergence-

based loss function to train with those adversarial

augmentation samples, which promotes higher in-

variance in the word representation space (Miyato

et al.,2019).

We evaluate AdvSeq by extensive experiments

on three generation tasks: text summarization,

table-to-text, and dialogue generation. Our exper-

iments demonstrate that AdvSeq can effectively

improve Seq2Seq robustness against adversarial

samples, which result in better informativeness

and faithfulness on various text generation tasks.

Comparing to existing adversarial training meth-

ods for language understanding and data augmen-

tation methods for Seq2Seqs, AdvSeq can more

effectively improve both the informativeness and

faithfulness for text generation tasks.

We summarize our contributions as follows:

•

To the best of our knowledge, we are the ﬁrst

to conduct quantitative analysis on the robust-

ness of pre-trained Seq2Seq models, which

reveal its close connection with their informa-

tiveness and faithfulness on generation tasks.

•

We propose a novel adversarial argumenta-

tion framework for Seq2Seq models, namely

AdvSeq, which effectively improves their in-

formativeness and faithfulness on various gen-

eration tasks via enhancing their robustness.

•

Automatic and human evaluations on three

popular text generation tasks validate that Ad-

vSeq signiﬁcantly outperforms several strong

baselines in both informativeness and faithful-

ness.

2 Seq2Seq Robustness Analysis

In this section, we analyze the robustness of the

Seq2Seq by evaluating its performance on adversar-

ial samples. In brief, after the input contexts are mi-

norly modiﬁed, we check whether the model main-

tains its informativeness and faithfulness. A robust

model should adaptively generate high-quality texts

corresponding to the modiﬁed inputs.

Following the deﬁnition of adversarial exam-

ples on Seq2Seq models, adversarial examples

should be meaning-preserving on the source side,

but meaning-destroying on the target side (Michel

et al.,2019). Formally, given an input context

and its reference text

yref

from the test set of a

task, and a Seq2Seq model

fθ

trained on the train-

ing set, we ﬁst collect the original generated text

y=fθ(x)

. We measure its faithfulness and infor-

mativeness by

Ef(x, y)

and

Ei(x, y, yref )

, where

and

are the faithfulness and informativeness

metrics, respectively. Then, we craft an adversarial

sample

by slightly modifying

trying not to

alter its original meaning and generate

grounded

. Finally, we measure the target relative score

decrease (Michel et al.,2019) of faithfulness after

attacks by:

d=Ef(x, y)−Ef(x0, y0)

Ef(x, y)(1)

We calculate the decrease of informativeness sim-

ilarly. We also report the entailment score of

towards

S(x, x0)

to check whether the modiﬁca-

tion changes the meaning.

Task S EiEf

Summarization EntS ROURGE-L CC/QE

Table-to-text - PARENT PARENT

Dialogue NLI EntS PPL PPL/Ranking

Table 2: Evaluation metrics for different tasks, where

we apply entailment score (EntS) for S, FactCC (CC),

QuestEval (QE) for Efof summarization and ROUGE-

L (R-L) for Eiof summarization. PPL is the abbrevia-

tion for perplexity.

Evaluation Settings

We apply BART as

fθ

and

conduct evaluations on three datasets, XSum for

text summarization, WIKIPERSON for table-to-

text, and Dialogue NLI for dialogue generation,

with 2,000 samples sampled from each dataset.

Evaluation metrics for different tasks are listed in

Table 2, and the details are introduced in §4.

As a preliminary study of robustness, we design

a simple word swapping-based method for craft-

ing adversarial samples. For word

wi∈x

, we

ﬁrst calculate its salience score as

fθ(yref |x)−

fθ(yref |x\wi)

, where

fθ(y|x)

is the validation

score of generating

given

, and

x\wi

is input

with word

deleted. We then sort the salient

score to get the swapping orders of words in

, giv-

ing priority to those with higher scores. Following

the orders, we iteratively swap each word with its

top 10 nearest neighbors in the word embedding

space and keep the replacement if the output BLEU

score decreases after swapping. For better meaning

preservation, we hold the maximum difference in

edit distance to a constant of 30 for each sample.

The details of algorithm and evaluation metrics are

introduced in Appendix A.

Attack Results

Reported in Table 3, for infor-

mativeness, text summarization drops by 8.75%

in ROUGE-L, dialogue generation increases by

16.48% on the reference perplexity, table-to-text

drops by 4.41% and 6.11% on the PATENT recall

and F-1, respectively. For faithfulness, text sum-

marization drops by 15.53% and 5.67% in FactCC

and QuestEval, table-to-text generation drops in

PARENT precision by 6.24%, dialogue generation

increase in the perplexity of entailed candidates by

5.67%

. Overall, BART is still not robust enough to

tackle minor perturbations in the input, which lead

to degeneration of the generalization performance

of both informativeness and faithfulness.

Input PARENT

Precision Recall F-1

Ori. 57.61 97.54 71.56

Adv. 54.01 93.17 67.19

d6.24†4.41†6.11†

(a) Table-to-text (WIKIPERSON)

Input Perplexity Hit@1↑

Ref↓Ent.↓Con.↑

Ori. 10.30 22.08 16.15 37.64

Adv. 12.01 22.75 16.60 35.62

d−16.48†−2.95†0.25 5.67†

(b) Dialogue Generation (Dialogue NLI)

EntS R-L CC. QE

Ori. - 35.96 16.74 43.46

Adv. 83.6 32.83 14.18 41.20

d - 8.75†15.53†5.20†

Table 3: Evaluation performance of ﬁne-tuned BART

on original samples (Ori.) vs adversarial samples

(Adv.), dis the target relative score decrease of every

metric. †: signiﬁcantly decrease (p < 0.01) by t-test.

3 AdvSeq Framework

Inspired by the ﬁndings in the previous section,

we propose to improve the informativeness and

faithfulness of a Seq2Seq model via enhancing its

robustness. We propose our framework AdvSeq for

robustly ﬁne-tuning pre-trained Seq2Seq models.

During training, AdvSeq utilizes gradient informa-

tion to automatically construct challenging but fac-

tually consistent augmentation samples. For better

diversity, we construct two kinds of augmentation

samples, implicit adversarial sample (AdvGrad)

and explicit token replacement (AdvSwap). In the

following, we introduce AdvSeq in detail.

Given an input sample (x, y), a Seq2Seq model

with parameters

learns to generate ﬂuent text by

training with NLL loss. Considering the vulner-

ability of NLL, we further measure and optimize

probability distribution changes caused by small

random perturbations via KL divergence. The over-

all loss function w.r.t. the clean sample

(x, y)

then deﬁned as:

Lo(x+δx, y +δy, θ) = −X

yt∈y

log p(yt|x, y<t)

(2)

+KLS(p(yt|y<t +δy, x +δx), p(yt|y<t, x))

where the ﬁrst term is NLL,

KLS1

is the symme-

1KLS(x, y) = KL(x|y) + KL(y|x)

try of KL divergence, and perturbations

δx, δy

are

sampled from a uniform distribution and added on

word embeddings as default. After that, we back-

propagate

and apply its gradient to construct

AdvGrad and AdvSwap.

AdvGrad

Directly utilizing back-propagated

gradient of

as perturbations, we construct im-

plicit adversarial samples. Instead of randomly per-

turbing word representations like

, AdvGrad fur-

ther searches for stronger perturbations that mostly

affect the generation process by solving:

min

θ(x,y)[max

δx,δy

Lo(x+δx, y +δy, θ)] (3)

s.t.||δx||F≤, ||δy||F≤

where we constrain the Frobenius norm of a se-

quence by



. Because it is intractable to solve this

equation, we perform gradient ascent (Madry et al.,

2018) on the δxto approximate the solution:

δ0

x= Π||δx||F≤(δx+α∗gx/||gx||F)(4)

gx=∇δxLo(x+δx, y +δy)(5)

where

δ0x

is the updated adversarial perturbation,

is the learning rate of the update,

Π||δx||F≤

performs a projection onto the



-ball.

δ0

is ap-

proximated though similar steps. Though previ-

ous works apply multi-step updates for a closer

approximation (Madry et al.,2018;Zhu et al.,

2020), we ﬁnd one-step update is effective and

efﬁcient enough for AdvGrad. By perturbing the

word embeddings with the adversarial perturba-

tions:

x0=x+δ0

y0=y+δ0

, we get a pair of

parallel augmentation samples,

(x0, y0)

. Because

the perturbations are implicit and minor (within a



-ball ), we consider

(x0, y0)

to be meaning preserv-

ing. We then train with

(x0, y0)

by optimizing the

KL divergence between its output word distribu-

tions p(y0|x0)with the original p(y|x)by:

Li=X

yt∈y

KLS(p(yt|y0

<t, x0), p(yt|y<t, x)) (6)

AdvSwap

Simultaneously utilizing gradient di-

rections of

, we construct explicit adversarial

samples by token swapping. The core idea is to

identify and swap salient tokens in

without or mi-

norly changing the original meaning of

. The ﬁrst

procedure is to identify a set of salient tokens in x

that attributed most to the generation. We formulate

this procedure as a causal inference problem (Yao

et al.,2021;Xie et al.,2021b). Concretely, given

target context

, which can either be the whole

reference text

or sampled spans from it, we need

to infer a set of most relevant tokens

from

that

contribute most for generating

. Because the dif-

ﬁculties of this procedure depend on speciﬁc tasks,

we apply two strategies for searching

in different

tasks:

•Gradient Ranking

: Select tokens

{xt∈

with highest

two-norm of gradient

||∇xiLo(x, Y)||.

•Word Overlapping

: Find tokens in

that

overlap with Y:x∩ Y.

For tasks like table-to-text that word overlapping

is enough to infer the precise causality, we ran-

domly sample several spans from

and ﬁnd

the corresponding

by word overlapping. While,

for highly abstractive generation like text summa-

rization, we use the global information

and

infer

by gradient ranking, which measures the

salience of a token by gradient norm (Simonyan

et al.,2014;Li et al.,2016).

After the

is inferred, we search around the

neighbors of word embedding space for meaning

preserving swapping, utilizing the semantic textual

similarity of word embeddings (Li et al.,2020a).

To make the adversarial samples more challenging,

we search at the direction of gradient ascent to

replace xt∈ X with ˆxt:

ˆxt= argmax

xi6=xt

cos(exi−ext,∇xiLo(x, Y)) (7)

where

exi

is the word embedding of

in the vo-

cabulary list, and

cos(·,·)

is the cosine similarity

of two vectors. After word swapping is done for

all the tokens in

, we get the adversarial sample

x00

. We train the explicit adversarial sample

(x00,Y)

with KL divergence:

Le=X

yt∈Y

KLS(p(yt|y<t, x00), p(yt|y<t, x))

(8)

Overall Training

For efﬁciently utilizing the

ﬁrst back-propagate step of

, we apply the “Free”

Large-Batch Adversarial Training (FreeLB) (Zhu

et al.,2020). For every training step, we ﬁrst

forward and back-propagate

for constructing

AdvGrad and AdvSwap while saving the gradient

∇θLo

with respect to

. Next, we forward and

back-propagate the loss function of two augmen-

tations:

Li+Le

and accumulate its gradient with

文档加载中……请稍候！
如果长时间未打开，您也可以点击刷新试试。

下载文档到电脑，查找使用更方便

10 玖币 0人已下载

立即下载

摘要：

PreciselythePoint:AdversarialAugmentationsforFaithfulandInformativeTextGenerationWenhaoWu1,WeiLi2,JiachenLiu2,XinyanXiao2,SujianLi1y,YajuanLyu21KeyLaboratoryofComputationalLinguistics,MOE,PekingUniversity2BaiduInc.,Beijing,China{waynewu,lisujian}@pku.edu.cn{liwei85,liujiachen,xiaoxinyan,lvyajuan}@b...

展开>> 收起<<

Precisely the Point Adversarial Augmentations for Faithful and Informative Text Generation Wenhao Wu1 Wei Li2 Jiachen Liu2 Xinyan Xiao2 Sujian Li1y Yajuan Lyu2.pdf

共17页,预览4页

还剩页未读，继续阅读

声明：本站为文档C2C交易模式，即用户上传的文档直接被用户下载，本站只是中间服务平台，本站所有文档下载所得的收益归上传人(含作者)所有。玖贝云文库仅提供信息存储空间，仅对用户上传内容的表现方式做保护处理，对上载内容本身不做任何修改或编辑。若文档所含内容侵犯了您的版权或隐私，请立即通知玖贝云文库，我们立即给予删除！

Precisely the Point Adversarial Augmentations for Faithful and Informative Text Generation Wenhao Wu1 Wei Li2 Jiachen Liu2 Xinyan Xiao2 Sujian Li1y Yajuan Lyu2

相关推荐

开通VIP享超值会员特权

作者详情

相关内容

热门标签

举报选择: