Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 2752–2765July 5 - 10, 2020. c©2020 Association for Computational Linguistics

2752

Robust Encodings: A Framework for Combating Adversarial Typos

Erik Jones Robin Jia∗ Aditi Raghunathan∗ Percy LiangComputer Science Department, Stanford University

{erjones,robinjia,aditir,pliang}@stanford.edu

AbstractDespite excellent performance on many tasks,NLP systems are easily fooled by small adver-sarial perturbations of inputs. Existing pro-cedures to defend against such perturbationsare either (i) heuristic in nature and suscep-tible to stronger attacks or (ii) provide guar-anteed robustness to worst-case attacks, butare incompatible with state-of-the-art mod-els like BERT. In this work, we introduce ro-bust encodings (RobEn): a simple frameworkthat confers guaranteed robustness, withoutmaking compromises on model architecture.The core component of RobEn is an encodingfunction, which maps sentences to a smaller,discrete space of encodings. Systems usingthese encodings as a bottleneck confer guaran-teed robustness with standard training, and thesame encodings can be used across multipletasks. We identify two desiderata to constructrobust encoding functions: perturbations of asentence should map to a small set of encod-ings (stability), and models using encodingsshould still perform well (fidelity). We instan-tiate RobEn to defend against a large familyof adversarial typos. Across six tasks fromGLUE, our instantiation of RobEn paired withBERT achieves an average robust accuracy of71.3% against all adversarial typos in the fam-ily considered, while previous work using atypo-corrector achieves only 35.3% accuracyagainst a simple greedy attack.

1 Introduction

State-of-the-art NLP systems are brittle: small per-turbations of inputs, commonly referred to as ad-versarial examples, can lead to catastrophic modelfailures (Belinkov and Bisk, 2018; Ebrahimi et al.,2018b; Ribeiro et al., 2018; Alzantot et al., 2018).For example, carefully chosen typos and word sub-stitutions have fooled systems for hate speech de-tection (Hosseini et al., 2017), machine translation

∗Authors contributed equally.

Positive

Positive

Inspired acting

Inspikred ating

Complete flop

Copmlete fljop

Irnspired atcing

Negative

Inspired acting

Complete flop

Inspikred ating

Sentences Encodings Predictions

Figure 1: Example of a defense using RobEn. Anadversary can perturb sentences (blue, underlined)to many different perturbations (red, not-underlined)within the attack surface (red, ovals). We define an en-coding function α such that each perturbation of theinput sentences maps to one of a few encodings (grey,rounded rectangles). We can then use any model g tomake predictions given the encodings.

(Ebrahimi et al., 2018a), and spam filtering (Leeand Ng, 2005), among others.

We aim to build systems that achieve high ro-bust accuracy: accuracy against worst-case attacks.Broadly, existing methods to build robust mod-els fall under one of two categories: (i) adversar-ial training, which augments the training set withheuristically generated perturbations and (ii) cer-tifiably robust training, which bounds the changein prediction between an input and any of its al-lowable perturbations. Both these approaches havemajor shortcomings, especially in NLP. Adversar-ial training, while quite successful in vision (Madryet al., 2018), is challenging in NLP due to thediscrete nature of textual inputs (Ebrahimi et al.,2018b); current techniques like projected gradi-ent descent are incompatible with subword tok-enization. Further, adversarial training relies onheuristic approximations to the worst-case pertur-bations, leaving models vulnerable to new, strongerattacks. Certifiably robust training (Jia et al., 2019;Huang et al., 2019; Shi et al., 2020) circumvents

2753

the above challenges by optimizing over a convexouter-approximation of the set of perturbations, al-lowing us to lower bound the true robust accuracy.However, the quality of bounds obtained by thesemethods scale poorly with the size of the network,and are vacuous for state-of-the-art models likeBERT. Moreover, both approaches require sepa-rate, expensive training for each task, even whendefending against the same type of perturbations.

Ideally we would like a “robustness” modulethat we can reuse across multiple tasks, allowingus to only worry about robustness once: during itsconstruction. Indeed, reusable components havedriven recent progress in NLP. For example, wordvectors are a universal resource that are constructedonce, then used for many different tasks. Canwe build a reusable robust defense that can easilywork with complex, state-of-the-art architectureslike BERT? The recent work of Pruthi et al. (2019),which uses a typo-corrector to defend against adver-sarial typos, is such a reusable defense: it is trainedonce, then reused across different tasks. However,we find that current typo-correctors do not performwell against even heuristic attacks, limiting theirapplicability.

Our primary contribution is robust encodings(RobEn), a framework to construct encodings thatcan make systems using any model robust. Thecore component of RobEn is an encoding functionthat maps sentences to a smaller discrete spaceof encodings, which are then used to make pre-dictions. We define two desiderata that a robustencoding function should satisfy: stability and fi-delity. First, to encourage consistent predictionsacross perturbations, the encoding function shouldmap all perturbations of a sentence to a small setof encodings (stability). Simultaneously, encod-ings should remain expressive, so models trainedusing encodings still perform well on unperturbedinputs (fidelity). Because systems using RobEnare encoding-based we can compute the exact ro-bust accuracy tractably, avoiding the lower boundsof certifiably robust training. Moreover, these en-codings can make any downstream model robust,including state-of-the-art transformers like BERT,and can be reused across different tasks.

In Section 4, we apply RobEn to combat adver-sarial typos. In particular, we allow an attacker toadd independent edit distance one typos to eachword in an input sentence, resulting in exponen-tially more possible perturbations than previous

ThisThus…Tihs

fulmfllm…fim

This delightful film …

dlightfuldeliightful…delirhtful

xTihs dlightful fllm …

Pos

Neg

Input x

Perturbation set

Perturbation xBERT

BERT

Figure 2: Attack model allowing independent perturba-tions of each token. The original input, x is classifiedby the model as positive while the perturbation x̃ =,obtained by choosing perturbations of “This”, “delight-ful”, and “film” independently, is classified as negative.Independent perturbations of each word results in anexponentially large perturbation space B(x).

work (Pruthi et al., 2019; Huang et al., 2019). Weconsider a natural class of token-level encodings,which are obtained by encoding each token in asentence independently. This structure allows us toexpress stability and fidelity in terms of a clusteringobjective, which we optimize.

Empirically, our instantiation of RobEn achievesstate-of-the-art robust accuracy, which we com-pute exactly, across six classification tasks fromthe GLUE benchmark (Wang et al., 2019). Ourbest system, which combines RobEn with a BERTclassifier (Devlin et al., 2019), achieves an averagerobust accuracy of 71.3% across the six tasks. Incontrast, a state-of-the-art defense that combinesBERT with a typo corrector (Pruthi et al., 2019)gets 35.3% accuracy when adversarial typos areinserted, and a standard data augmentation defensegets only 12.2% accuracy.

2 Setup

Tasks. We consider NLP tasks that require clas-sifying textual input x ∈ X to a class y ∈ Y . Forsimplicity, we refer to inputs as sentences. Eachsentence x consists of tokens x1, . . . , xL from theset of all strings T . Let ptask denote the distributionover inputs and labels for a particular task of inter-est. The goal is to learn a model f : X → Y thatmaps sentences to labels, given training examples(x, y) ∼ ptask.

Attack surface. We consider an attack surface inwhich an adversary can perturb each token xi of asentence to some token x̃i ∈ B(xi), where B(xi)is the set of valid perturbations of xi. For example,B(xi) could be a set of allowed typos of xi. We

2754

define B(x) as the set of all valid perturbationsof the set x, where every possible combination oftoken-level typos is allowed:

B(x) = {(x̃1, . . . , x̃L) | x̃i ∈ B(xi) ∀ i} (1)

The size of the attack surface |B(x)| grows expo-nentially with respect to number of input tokens, asshown in Figure 2. In general xi ∈ B(xi), so somewords could remain unperturbed.

Model evaluation. In this work, we use threeevaluation metrics for any given task.

First, we evaluate a model on its standard accu-racy on the task:

accstd(f) = E(x,y)∼ptask1[f(x) = y]. (2)

Next, we are interested in models that also havehigh robust accuracy, the fraction of examples(x, y) for which the model is correct on all valid per-turbations x̃ ∈ B(x) allowed in the attack model:

accrob(f) = E(x,y)∼ptask minx̃∈B(x)

1 [f(x̃) = y] .

(3)

It is common to instead compute accuracy againsta heuristic attack a that maps clean sentences x toperturbed sentences a(x) ∈ B(x).

accattack(f ; a) = E(x,y)∼ptask1[f(a(x)) = y]. (4)

Typically, a(x) is the result of a heuristic search fora perturbation x̃ ∈ B(x) that f misclassifies. Notethat accattack is a (possibly loose) upper bound ofaccrob because there could be perturbations that themodel misclassifies but are not encountered duringthe heuristic search (Athalye et al., 2018).

Additionally, since robust accuracy is generallyhard to compute, some existing work computes cer-tified accuracy (Huang et al., 2019; Jia et al., 2019;Shi et al., 2020), which is a potentially conserva-tive lower bound for the true robust accuracy. Inthis work, since we use robust encodings, we cantractably compute the exact robust accuracy.

3 Robust Encodings

We introduce robust encodings (RobEn), a frame-work for constructing encodings that are reusableacross many tasks, and pair with arbitrary modelarchitectures. In Section 3.1 we describe the keycomponents of RobEn, then in Section 3.2 we high-light desiderata RobEn should satisfy.

3.1 Encoding functions

A RobEn classifier fα : X → Y using RobEn de-composes into two components: a fixed encodingfunction α : X → Z , and a model that accepts en-codings g : Z → Y .1 For any sentence x, our sys-tem makes the prediction fα(x) = g(α(x)). Giventraining data {(xi, yi)}ni=1 and the encoding func-tion α, we learn g by performing standard trainingon encoded training points {(α(xi), yi)}ni=1. Tocompute the robust accuracy of this system, wenote that for well-chosen α and an input x fromsome distribution Px, the set of possible encodingsα(x̃) for some perturbation x̃ ∈ B(x) is both smalland tractable to compute quickly. We can thus com-pute accrob(fα) quickly by generating this set ofpossible encodings, and feeding each into g, whichcan be any architecture.

3.2 Encoding function desiderata

In order to achieve high robust accuracy, a classifierfα that uses α should make consistent predictionson all x̃ ∈ B(x), the set of points described by theattack surface, and also have high standard accu-racy on unperturbed inputs. We term the formerproperty stability, and the latter fidelity, give intu-ition for both in this section, and provide a formalinstantiation in Section 4.

Stability. For an encoding function α and somedistribution over inputs Px, the stability Stab(α)measures how often α maps sentences x ∼ Px tothe same encoding as all of their perturbations.

Fidelity. An encoding function α has high fi-delity if models that use α can still achieve highstandard accuracy. Unfortunately, while we want tomake task agnostic encoding functions, standard ac-curacy is inherently task dependent: different taskshave different expected distributions over inputsand labels. To emphasize this challenge considertwo tasks: for an integer n, predict n mod 2, andn mod 3. The information we need encodings topreserve varies significantly between these tasks:for the former, 2 and 6 can be identically encoded,while for the latter they must encoded separately.

To overcome this challenge, we consider a sin-gle distribution over the inputs Px that we believecovers many task-distributions ptask. Since it ishard to model the distribution over the labels, wetake the more conservative approach of mapping

1We can set Z ⊆ X when g accepts sentences.

2755

the different sentences sampled from Px to differ-ent encodings with high probability. We call thisFid(α), and give an example in Section 4.5.

Tradeoff. Stability and fidelity are inherentlycompeting goals. An encoding function that mapsevery sentence to the same encoding trivially max-imizes stability, but is useless for any non-trivialclassification task. Conversely, fidelity is maxi-mized when every input is mapped to itself, whichhas very low stability. In the following section,we construct an instantiation of RobEn that bal-ances stability and fidelity when the attack surfaceconsists of typos.

4 Robust Encodings for Typos

In this section, we focus on adversarial typos,where an adversary can add typos to each tokenin a sentence (see Figure 2). Since this attack sur-face is defined at the level of tokens, we restrictattention to encoding functions that encode eachtoken independently. Such an encoding does notuse contextual information; we find that even suchrobust encodings achieve greater attack accuracyand robust accuracy in practice than previous work.

First, we will reduce the problem of generat-ing token level encodings to assigning vocabularywords to clusters (Section 4.1). Next, we use an ex-ample to motivate different clustering approaches(Section 4.2), then describe how we handle out-of-vocabulary tokens (Section 4.3). Finally, we in-troduce two types of token-level robust encodings:connected component encodings (Section 4.4) andagglomerative cluster encodings (Section 4.5).

4.1 Encodings as clustersWe construct an encoding function α that encodesx token-wise. Formally, α is defined by a token-level encoding function π that maps each tokenxi ∈ T to some encoded token π(xi) ∈ ZTok:

α(x) = [π(x1), π(x2), . . . π(xL)]. (5)

In the RobEn pipeline, a downstream model g istrained on encodings (Section 3.1). If π maps manywords and their typos to the same encoded token,they become indistinguishable to g, conferring ro-bustness. In principle, the relationship between dif-ferent encoded tokens is irrelevant: during training,g learns how to use the encoded tokens to performa desired task. Thus, the problem of finding a goodπ is equivalent to deciding which tokens shouldshare the same encoded token.

at

aunt

abet

abrupt

about

aut

aet

auet

abot

aboupt

Maximal stability

Maximal fidelityBalanced

Figure 3: Visualization of three different encodings.Vocabulary words (large font, blue) share an edge ifthey share a common perturbation (small font, red).The maximal stability cluster (thick solid line) clustersidentically, the maximal fidelity clusters (thin dottedline) encodes all words separately, while the balancedclusters (thin solid line) trade off the two.

Since the space of possible tokens T is in-numerable, we focus on a smaller set of wordsV = {w1, . . . , wN} ⊆ T , which contains the Nmost frequent words over Px. We will call elementsof V words, and tokens that are perturbations ofsome word typos. We view deciding which wordsshould share an encoded token as assigning wordsto clusters C1, . . . , Ck ⊆ V . For all other tokensnot in the vocabulary, including typos, we define aseparate πOOV. Thus, we decompose π as follows:

π(xi) =

{πV (xi) xi ∈ VπOOV(xi) xi /∈ V

, (6)

Here, πV is associated with a clustering C of vo-cabulary words, where each cluster is associatedwith a unique encoded token.

4.2 Simple exampleWe use a simple example to illustrate how a token-level encoding function can achieve the RobEndesiderata: stability and fidelity defined in Section3.2. We will formally define the stability and fi-delity of a clustering in Sections 4.3 and 4.5.

Consider the five words (large font, blue) in Fig-ure 3, along with potential typos (small font, red).We illustrate three different clusterings as boxesaround tokens in the same cluster. We may put allwords in the same cluster (thick box), each wordin its own cluster (dashed boxes), or somethingin between (thin solid boxes). For now, we groupeach typo with a word it could have been perturbedfrom (we will discuss this further in Section 4.3).

To maximize stability, we need to place all wordsin the same cluster. Otherwise, there would be two

2756

words (say “at” and “aunt”) that could both beperturbed to the same typo (“aut”) but are in dif-ferent clusters. Therefore, “aut” cannot map tothe same encoded token as both the possible vocabwords. At the other extreme, to maximize fidelity,each word should be in its own cluster. Both map-pings have weaknesses: the stability-maximizingmapping has low fidelity since all words are iden-tically encoded and thus indistinguishable, whilethe fidelity-maximizing mapping has low stabil-ity since the typos of words “aunt”, “abet”, and

“abrupt” could all be mapped to different encodedtokens than that of the original word.

The clustering represented by the thin solidboxes in Figure 3 balances stability and fidelity.Compared to encoding all words identically, it hashigher fidelity, since it distinguishes between someof the words (e.g., “at” and “about” are encodeddifferently). It also has reasonably high stability,since only the infrequent “abet” has typos thatare shared across words and hence are mapped todifferent encoded tokens.

4.3 Encoding out-of-vocab tokensGiven a fixed clustering of V , we now study howto map out-of-vocabulary tokens, including typos,to encoded tokens without compromising stability.

Stability. Stability measures the extent to whichtypos of words map to different encoded tokens.We formalize this by defining the set of tokens thatsome typo of a word w could map to, Bπ(w):

Bπ(w) = {π(w̃); w̃ ∈ B(w)}, (7)

where B(w) is the set of allowable typos of w.Since we care about inputs drawn from Px, wedefine Stab on the clustering C using ρ(w), thenormalized frequency of word w based on Px.

Stab(C) = −N∑i=1

ρ(wi)|Bπ(wi)| (8)

For a fixed clustering, the size of Bπ(w) dependson where πOOV maps typos thatw shares with otherwords; for example in Figure 3, “aet” could be aperturbation of both “at” and “abet”. If we mapthe typo the encoded token of “at”, we increasethe size of Bπ(”abet”) and vice-versa. In order tokeep the size of Bπ(w) smaller for the more fre-quent words and maximize stability (Equation 8),we map a typo to the same encoded token as itsmost frequent neighbor word (in this case “at”).

Finally, when a token is not a typo of any vocabwords, we encode it to a special token OOV.

4.4 Connected component encodings

We present two approaches to generate robusttoken-level encodings. Our first method, connectedcomponent encodings, maximizes the stability ob-jective (8). Notice that Stab is maximized when foreach word w, Bπ(w) contains one encoded token.This is possible only when all words that share atypo are assigned to the same cluster.

To maximize Stab, define a graph G with allwords in V as vertices, and edges between wordsthat share a typo. Since we must map words thatshare an edge in G to the same cluster, we definethe cluster Ci to be the set of words in the ith

connected component of G. While this stability-maximizing clustering encodes many words to thesame token (and hence seems to compromise onfidelity), these encodings still perform surprisinglywell in practice (see Section 5.4).

4.5 Agglomerative cluster encodings

Connected component encodings focus only sta-bility and can lead to needlessly low fidelity. Forexample, in Figure 3, “at” and “about” are in thesame connected component even though they don’tshare a typo. Since both words are generally fre-quent, mapping them to different encoded tokenscan significantly improve fidelity, with only a smalldrop in stability: recall only the infrequent word

“abet” can be perturbed to multiple encoded tokens.To handle such cases, we introduce agglomera-

tive cluster encodings, which we construct by trad-ing off Stab with a formal objective we define forfidelity: Fid. We then approximately optimize thiscombined objective Φ using an agglomerative clus-tering algorithm.

Fidelity objective. Recall from Section 3.2 thatan encoding has high fidelity if it can be used toachieve high standard accuracy on many tasks. Thisis hard to precisely characterize: we aim to designan objective that could approximate this.

We note that distinct encoded tokens are arbi-trarily related: the model g learns how to use dif-ferent encodings during training. Returning to ourexample, suppose “at” and “abet” belong to thesame cluster and share an encoded token z. Dur-ing training, each occurrence of “at” and “abet”is replaced with z. However, since “at” is muchmore frequent, classifiers treat z similarly to “at ′′

2757

in order to achieve good overall performance. Thisleads to mostly uncompromised performance onsentences with “at”, at the cost of performance onsentences containing the less frequent “abet”.

This motivates the following definition: let ~vibe a the indicator vector in R|V | corresponding toword i. In principle ~vi could be a word embedding;we choose indicator vectors to avoid making addi-tional assumptions. We define the encoded token~µj associated with words in cluster Cj as follows:

~µj =

∑wi∈Cj ρ(wi)~vi∑wi∈Cj ρ(wi)

(9)

We weight by the frequency ρ to capture the effectof training on the encodings, as described above.

Fidelity is maximized when each word has adistinct encoded token. We capture the drop instandard accuracy due to shared encoded tokens bycomputing the distance between the original em-beddings of the word its encoded token. Formally,let c(i) be the cluster index of word wi. We definethe fidelity objective Fid as follows:

Fid(C) = −N∑i=1

ρ(wi)‖~vi − ~µc(i)‖2. (10)

Fid is high if frequent words and rare words arein the same cluster and is low when when multiplefrequent words are in the same cluster.

Final objective. We introduce a hyperparameterγ ∈ [0, 1] that balances stability and fidelity. Weapproximately minimize the following weightedcombination of Stab (8) and Fid (10):

Φ(C) = γ Fid(C) + (1− γ) Stab(C). (11)

As γ approaches 0, we get the connected compo-nent clusters from our baseline, which maximizestability. As γ approaches 1, we maximize fidelityby assigning each word to its own cluster.

Agglomerative clustering. We approximate theoptimal value of Φ using agglomerative clustering;we start with each word in its own cluster, then iter-atively combine the pair of clusters whose resultingcombination increases Φ the most. We repeat untilcombining any pair of clusters would decrease Φ.Further details are provided in Appendix A.1.

5 Experiments

5.1 SetupToken-level attacks. The primary attack surfacewe study is edit distance one (ED1) perturbations.

For every word in the input, the adversary is al-lowed to insert a lowercase letter, delete a charac-ter, substitute a character for any letter, or swaptwo adjacent characters, so long as the first and lastcharacters remain the same as in the original token.The constraint on the outer characters, also used byPruthi et al. (2019), is motivated by psycholinguis-tic studies (Rawlinson, 1976; Davis, 2003).

Within our attack surface, “the movie was miser-able” can be perturbed to “thae mvie wjs misreable”but not “th movie as miserable”. Since each to-ken can be independently perturbed, the numberof perturbations of a sentence grows exponentiallywith its length; even “the movie was miserable”has 431,842,320 possible perturbations. Our attacksurface contains the attack surface used by (Pruthiet al., 2019), which allows ED1 perturbations to atmost two words per sentence. Reviews from SST-2have 5 million perturbations per example (PPE) onaverage under this attack surface, while our attacksurface averages 1097 PPE. We view the size ofthe attack surface as a strength of our approach:our attack surface forces a system robust to subtleperturbations (“the moviie waas misreable”) thatsmaller attack surfaces miss.

In Section 5.7, we additionally consider the in-ternal permutation attacks studied in Belinkov andBisk (2018) and Sakaguchi et al. (2017), whereall characters, except the first and the last, may bearbitrarily reordered.

Attack algorithms. We consider two attack algo-rithms: the worst-case attack (WCA) and a beam-search attack (BSA). WCA exhaustively tests ev-ery possible perturbation of an input x to see anychange in the prediction. The attack accuracy ofWCA is the true robust accuracy since if there ex-ists some perturbation that changes the prediction,WCA finds it. When instances of RobEn have highstability, the number of possible encodings of per-turbations of x is often small, allowing us to exhaus-tively test all possible perturbations in the encodingspace.2 This allows us to tractably run WCA. UsingWCA with RobEn, we can obtain computationallytractable guarantees on robustness: given a sen-tence, we can quickly compute whether or not anyperturbation of x that changes the prediction.

For systems that don’t use RobEn, we cannottractably run WCA. Instead, we run a beam search

2When there are more than 10000 possible encodings,which holds for 0.009% of our test examples, we assumethe adversary successfully alters the prediction.

2758

attack (BSA) with beam width 5, perturbing tokensone at a time. For efficiency, we sample at mostlen(xi) perturbations at each step of the search (seeApendix A.2). Even against this very limited attack,we find that baseline models have low accuracy.

Datasets. We use six of the nine tasks fromGLUE (Wang et al., 2019): SST-2, MRPC, QQP,MNLI, QNLI, and RTE. We do not use STS-B andCoLA as they are evaluated on correlation, whichdoes not decompose as an example-level loss. Weadditionally do not use WNLI, as most submittedGLUE models cannot even outperform the major-ity baseline, and state-of-the-art models are rely onexternal training data (Kocijan et al., 2019). Weevaluate on the test sets for SST-2 and MRPC, andthe publicly available dev sets for the remainingtasks. More details are provided in Appendix A.3.

5.2 Baseline models.We consider three baseline systems. Our first is thestandard base uncased BERT model (Devlin et al.,2019) fine-tuned on the training data for each task.3

Data augmentation. For our next baseline, weaugment the training dataset with four random per-turbations of each example, then fine-tune BERTon this augmented data. Data augmentation hasbeen shown to increase robustness to some types ofadversarial perturbations (Ribeiro et al., 2018; Liuet al., 2019). Other natural baselines all have severelimitations. Adversarial training with black-box at-tacks offers limited robustness gains over data aug-mentation (Cohen et al., 2019; Pruthi et al., 2019).Projected gradient descent (Madry et al., 2017), theonly white-box adversarial training method that isrobust in practice, cannot currently be applied toBERT since subword tokenization maps differentperturbations to different numbers of tokens, mak-ing gradient-based search impossible. Certifiablyrobust training (Huang et al., 2019; Shi et al., 2020)does not work with BERT due to the same tokeniza-tion issue and BERT’s use of non-monotonic acti-vation functions, which make computing boundsintractable. Moreover the bounds computed withcertifiably robust training, which give guarantees,become loose as model depth increases, hurtingrobust performance (Gowal et al., 2018).

Typo-corrector. For our third baseline, we usethe most robust method from Pruthi et al. (2019). In

3https://github.com/huggingface/pytorch-transformers

particular, we train a scRNN typo-corrector (Sak-aguchi et al., 2017) on random perturbations ofeach task’s training set. At test time inputs are“corrected” using the typo corrector, then fed intoa downstream model. We replace any OOV out-putted by the typo-corrector with the neutral word

“a” and use BERT as our downstream model.

5.3 Models with RobEn

We run experiments using our two token-levelencodings: connected component encodings(CONNCOMP) and agglomerative cluster encod-ings (AGGCLUST). To form clusters, we use theN = 100, 000 most frequent words from the Cor-pus of Contemporary American English (Davies,2008) that are also in GloVe (Pennington et al.,2014). For AGGCLUST we use γ = 0.3, whichmaximizes robust accuracy on SST-2 dev set.

Form of encodings. Though unnecessary whentraining from scratch, to leverage the inductive bi-ases of pre-trained models like BERT (Devlin et al.,2019), we define the encoded token of a cluster tobe the cluster’s most frequent member word. Inthe special case of the out-of-vocab token, we mapOOV to [MASK]. Our final encoding, α(x), is theconcatenation of all of these words. For both encod-ings, we fine-tune BERT on the training data, usingα(x) as input. Further details are in Appendix A.4.

5.4 Robustness gains from RobEn

Our main results are shown in Table 1. We showall three baselines, as well as models using ourinstances of RobEn: CONNCOMP and AGGCLUST.

Even against the heuristic attack, each baselinesystem suffers dramatic performance drops. Thesystem presented by Pruthi et al. (2019), Typo Cor-rector + BERT, only achieves 35.3% attack accu-racy, compared to its standard accuracy of 78.2%.BERT and Data Augmentation + BERT performeven worse. Moreover, the number of perturbationsthe heuristic attack explores is a tiny fraction of ourattack surface, so the robust accuracy of Typo Cor-rector + BERT, the quantity we’d like to measure,is likely far lower than the attack accuracy.

In contrast, simple instances of RobEn are muchmore robust. AGGCLUST + BERT achieves av-erage robust accuracy of 71.3%, 36 points higherthan the attack accuracy of Typo Corrector + BERT.AGGCLUST also further improves on CONNCOMP

in terms of both robust accuracy (by 1.3 points)and standard accuracy (by 2.8 points).

2759

Accuracy System SST-2 MRPC QQP MNLI QNLI RTE Avg

Standard

BaselinesBERT 93.8 87.7 91.3 84.6 88.6 71.1 86.2Data Aug. + BERT 92.2 84.3 88.7 83.0 87.4 63.5 83.1Typo Corr. + BERT 89.6 80.9 87.6 75.9 80.5 54.9 78.2

RobEnCon. Comp. + BERT 80.6 79.9 84.2 65.7 73.3 52.7 72.7Agg. Clust. + BERT 83.1 83.8 85.0 69.1 76.6 59.2 76.1

Attack

BaselinesBERT 8.7 10.0 17.4 0.7 0.7 1.8 6.6Data Aug. + BERT 17.1 1.0 27.6 15.4 10.7 1.4 12.2Typo Corr. + BERT 53.2 30.1 52.0 23.0 32.3 21.3 35.3

RobEnCon. Comp. + BERT 80.3 79.4 82.7 62.6 71.5 47.3 70.6Agg. Clust. + BERT 82.1 82.8 83.2 65.3 74.5 52.7 73.4

RobustRobEnCon. Comp. + BERT 80.1 79.4 82.2 61.4 70.5 46.6 70.0Agg. Clust. + BERT 80.7 80.9 81.4 62.8 71.9 49.8 71.3

Table 1: Standard, attack, and robust accuracy on six GLUE tasks against ED1 perturbations. For baseline modelswe only compute attack accuracy, an upper bound on robust accuracy, since robust accuracy cannot be tractablycomputed. Using RobEn, we get robustness guarantees by computing robust accuracy, which we find outperformsa the typo corrector in (Pruthi et al., 2019) by at least 36 points.

Standard accuracy. Like defenses against adver-sarial examples in other domains, using RobEndecreases standard accuracy (Madry et al., 2017;Zhang et al., 2019; Jia et al., 2019). Our agglomer-ative cluster encodings’s standard accuracy is 10.1points lower then that of normally trained BERT.However, to the best of our knowledge, our stan-dard accuracy is state-of-the-art for approaches thatguarantee robustness. We attribute this improve-ment to RobEn’s compatibility with any model.

Comparison to smaller attack surfaces. Wenote that RobEn also outperform existing methodson their original, smaller attack surfaces. On SST-2,Pruthi et al. (2019) achieves an accuracy of 75.0%defending against a single ED1 typo, which is 5.7points lower than AGGCLUST’s robust accuracyagainst perturbations of all tokens: a superset of theoriginal perturbation set. We discuss constrainedadversaries further in Appendix A.5. AGGCLUST

also outperforms certified training: Huang et al.(2019), which offers robustness guarantees to threecharacter substitution typos (but not insertions ordeletions), achieves a robust accuracy of 74.9%on SST-2. Certified training requires strong as-sumptions on model architecture; even the robustaccuracy of AGGCLUST outperforms the standardaccuracy of the CNN used in Huang et al. (2019).

5.5 Reusable encodings

Each instance of RobEn achieves consistently highstability across our tasks, despite reusing a single

Size of Bα

0

0.2

0.4

0.6

0.8

1.0

Frac

tion

ofE

xam

ples

1 2 3–4 5–8 9+

Size of Bα on SST-2

1 2 3–4 5–8 9+

0.2

0.4

0.6

0.8

Size of Bα on RTE

CONNCOMP

AGGCLUST

Figure 4: Histogram of |Bα(x)| for SST-2 and RTE.SST-2 has the highest percentage of inputs x where|Bα(x)| = 1, while RTE has the least. On bothdatasets, |Bα(x)| < 9 for most x, and |Bα(x)| = 1on a plurality of inputs.

function. Figure 4 plots the distribution of |Bα(x)|,across test examples in SST-2 and RTE, whereBα(x) is the set of encodings that are mapped to bysome perturbation of x. Over AGGCLUST encod-ings, |Bα(x)| = 1 for 25% of examples in RTE and66% in SST-2, with the other four datasets fallingbetween these extremes (see Appendix A.6). Asexpected, these numbers are even higher for theconnected component encodings. Note that when|Bα(x)| = 1, every perturbation of x maps to thesame encoding. When |Bα(x)| is small, robustaccuracy can be computed quickly.

5.6 Agglomerative Clustering Tradeoff

In Figure 5, we plot standard and robust accuracyon SST-2 for AGGCLUST encodings, using differ-

2760

0.0 0.2 0.4 0.6Fidelity Objective Weight (γ)

0.7

0.8

0.9

Acc

urac

y

SST-2 Standard and Robust Accuracies

Standard accuracyRobust accuracy

Figure 5: Standard and robust accuracies on SST-2 withAGGCLUST using different values of γ. While the gapbetween standard and robust accuracy increases mono-tonically, robust accuracy increases before decreasing.

ent values of γ. Recall that γ = 0 maximizesstability (CONNCOMP), and γ = 1 maximizes fi-delity. At γ = 0, the gap between standard androbust accuracy, due to out-of-vocabulary tokens,is negligible. As γ increases, both standard ac-curacy and the gap between standard and robustaccuracy increase. As a result, robust accuracy firstincreases, then decreases.

5.7 Internal permutation attacks

RobEn can also be used to defend against the in-ternal perturbations described in Section 5.1. Fornormally trained BERT, a heuristic beam searchattack using internal permutations reduces aver-age accuracy from 86.2% to 15.7% across our sixtasks. Using CONNCOMP with the internal permu-tation attack surface, we achieve robust accuracyof 81.4%. See Appendix A.7 for further details.

6 Discussion

Additional related work. In this work, we intro-duce RobEn, a framework to construct systems thatare robust to adversarial perturbations. We then useRobEn to achieve state-of-the-art robust accuracywhen defending against adversarial typos. Besidestypos, other perturbations can also be applied totext. Prior attacks consider semantic operations,such as replacing a word with a synonym (Alzantotet al., 2018; Ribeiro et al., 2018). Our frameworkextends easily to these perturbations. Other attacksurfaces involving insertion of sentences (Jia andLiang, 2017) or syntactic rearrangements (Iyyeret al., 2018) are harder to pair with RobEn, and areinteresting directions for future work.

Other defenses are based on various forms ofpreprocessing. Gong et al. (2019) apply a spell-

corrector to correct typos chosen to create ambi-guity as to the original word, but these typos arenot adversarially chosen to fool a model. Edizelet al. (2019) attempt to learn typo-resistant wordembeddings, but focus on common typos, ratherthan worst-case typos. In computer vision, Chenet al. (2019) discretizes pixels to compute exactrobust accuracy on MNIST, but their approach gen-eralizes poorly to other tasks like CIFAR-10. Garget al. (2018) generate functions that map to robustfeatures, while enforcing variation in outputs.

Incorporating context. Our token-level robustencodings lead to strong performance, despite ig-noring useful contextual information. Using con-text is not fundamentally at odds with the idea ofrobust encodings, and making contextual encod-ings stable is an interesting technical challenge anda promising direction for future work.

In principle, an oracle that maps every word witha typo to the correct unperturbed word seems tohave higher fidelity than our encodings, withoutcompromising stability. However, existing typocorrectors are far from perfect, and a choosing anincorrect unperturbed word from a perturbed inputleads to errors in predictions of the downstreammodel. This mandates an intractable search overall perturbations to compute the robust accuracy.

Task-agnosticity. Many recent advances in NLPhave been fueled by the rise of task-agnostic rep-resentations, such as BERT, that facilitate the cre-ation of accurate models for many tasks. Robust-ness to typos should similarly be achieved in atask-agnostic manner, as it is a shared goal acrossmany NLP tasks. Our work shows that even simplerobust encodings generalize across tasks and aremore robust than existing defenses. We hope ourwork inspires new task-agnostic robust encodingsthat lead to more robust and more accurate models.

AcknowledgmentsThis work was supported by NSF Award Grant no.1805310 and the DARPA ASED program underFA8650-18-2-7882. A.R. is supported by a GooglePhD Fellowship and the Open Philanthropy ProjectAI Fellowship. We thank Pang Wei Koh, ReidPryzant, Ethan Chi, Daniel Kang, and the anony-mous reviewers for their helpful comments.

ReproducibilityAll code, data, and experiments are available onCodaLab at https://bit.ly/2VSZI2e.

2761

ReferencesM. Alzantot, Y. Sharma, A. Elgohary, B. Ho, M. Srivas-

tava, and K. Chang. 2018. Generating natural lan-guage adversarial examples. In Empirical Methodsin Natural Language Processing (EMNLP).

A. Athalye, N. Carlini, and D. Wagner. 2018. Obfus-cated gradients give a false sense of security: Cir-cumventing defenses to adversarial examples. arXivpreprint arXiv:1802.00420.

Y. Belinkov and Y. Bisk. 2018. Synthetic and natu-ral noise both break neural machine translation. InInternational Conference on Learning Representa-tions (ICLR).

J. Chen, X. Wu, V. Rastogi, Y. Liang, and S. Jha.2019. Towards understanding limitations of pixeldiscretization against adversarial attacks. In IEEEEuropean Symposium on Security and Privacy (Eu-roS&P).

J. M. Cohen, E. Rosenfeld, and J. Z. Kolter. 2019. Cer-tified adversarial robustness via randomized smooth-ing. In International Conference on Machine Learn-ing (ICML).

M. Davies. 2008. The corpus of contemporary amer-ican english (coca): 560 million words, 1990-present. https://www.english-corpora.org/faq.asp.

M. Davis. 2003. Psycholinguistic evidence on scram-bled letters in reading. https://www.mrc-cbu.cam.ac.uk/.

J. Devlin, M. Chang, K. Lee, and K. Toutanova. 2019.BERT: Pre-training of deep bidirectional transform-ers for language understanding. In Associationfor Computational Linguistics (ACL), pages 4171–4186.

W. B. Dolan and C. Brockett. 2005. Automatically con-structing a corpus of sentential paraphrases. In Inter-national Workshop on Paraphrasing (IWP).

J. Ebrahimi, D. Lowd, and D. Dou. 2018a. On adver-sarial examples for character-level neural machinetranslation. In International Conference on Compu-tational Linguistics (COLING).

J. Ebrahimi, A. Rao, D. Lowd, and D. Dou. 2018b. Hot-flip: White-box adversarial examples for text classi-fication. In Association for Computational Linguis-tics (ACL).

B. Edizel, A. Piktus, P. Bojanowski, R. Ferreira,E. Grave, and F. Silvestri. 2019. Misspelling oblivi-ous word embeddings. In North American Associa-tion for Computational Linguistics (NAACL).

S. Garg, V. Sharan, B. H. Zhang, and G. Valiant. 2018.A spectral view of adversarially robust features. InAdvances in Neural Information Processing Systems(NeurIPS).

H. Gong, Y. Li, S. Bhat, and P. Viswanath. 2019.Context-sensitive malicious spelling error correc-tion. In World Wide Web (WWW), pages 2771–2777.

S. Gowal, K. Dvijotham, R. Stanforth, R. Bunel,C. Qin, J. Uesato, T. Mann, and P. Kohli. 2018. Onthe effectiveness of interval bound propagation fortraining verifiably robust models. arXiv preprintarXiv:1810.12715.

H. Hosseini, S. Kannan, B. Zhang, and R. Pooven-dran. 2017. Deceiving Google’s Perspective APIbuilt for detecting toxic comments. arXiv preprintarXiv:1702.08138.

P. Huang, R. Stanforth, J. Welbl, C. Dyer, D. Yo-gatama, S. Gowal, K. Dvijotham, and P. Kohli. 2019.Achieving verified robustness to symbol substitu-tions via interval bound propagation. In EmpiricalMethods in Natural Language Processing (EMNLP).

M. Iyyer, J. Wieting, K. Gimpel, and L. Zettlemoyer.2018. Adversarial example generation with syntac-tically controlled paraphrase networks. In NorthAmerican Association for Computational Linguistics(NAACL).

R. Jia and P. Liang. 2017. Adversarial examples forevaluating reading comprehension systems. In Em-pirical Methods in Natural Language Processing(EMNLP).

R. Jia, A. Raghunathan, K. Gksel, and P. Liang. 2019.Certified robustness to adversarial word substitu-tions. In Empirical Methods in Natural LanguageProcessing (EMNLP).

V. Kocijan, A. Cretu, O. Camburu, Y. Yordanov, andT. Lukasiewicz. 2019. A surprisingly robust trickfor the Winograd schema challenge. In Associationfor Computational Linguistics (ACL).

H. Lee and A. Y. Ng. 2005. Spam deobfuscation usinga hidden Markov model. In Conference on Emailand Anti-Spam (CEAS).

N. F. Liu, R. Schwartz, and N. A. Smith. 2019. Inocu-lation by fine-tuning: A method for analyzing chal-lenge datasets. In North American Association forComputational Linguistics (NAACL).

A. Madry, A. Makelov, L. Schmidt, D. Tsipras, andA. Vladu. 2017. Towards deep learning modelsresistant to adversarial attacks (published at ICLR2018). arXiv.

A. Madry, A. Makelov, L. Schmidt, D. Tsipras, andA. Vladu. 2018. Towards deep learning models re-sistant to adversarial attacks. In International Con-ference on Learning Representations (ICLR).

J. Pennington, R. Socher, and C. D. Manning. 2014.GloVe: Global vectors for word representation. InEmpirical Methods in Natural Language Processing(EMNLP), pages 1532–1543.

2762

D. Pruthi, B. Dhingra, and Z. C. Lipton. 2019. Combat-ing adversarial misspellings with robust word recog-nition. In Association for Computational Linguistics(ACL).

P. Rajpurkar, J. Zhang, K. Lopyrev, and P. Liang. 2016.SQuAD: 100,000+ questions for machine compre-hension of text. In Empirical Methods in NaturalLanguage Processing (EMNLP).

G. E. Rawlinson. 1976. The significance of letter posi-tion in word recognition. Ph.D. thesis, University ofNottingham.

M. T. Ribeiro, S. Singh, and C. Guestrin. 2018. Se-mantically equivalent adversarial rules for debug-ging NLP models. In Association for ComputationalLinguistics (ACL).

K. Sakaguchi, K. Duh, M. Post, and B. V. Durme. 2017.Robsut wrod reocginiton via semi-character recur-rent neural network. In Association for the Advance-ment of Artificial Intelligence (AAAI).

Z. Shi, H. Zhang, K. Chang, M. Huang, and C. Hsieh.2020. Robustness verification for transformers. InInternational Conference on Learning Representa-tions (ICLR).

R. Socher, A. Perelygin, J. Y. Wu, J. Chuang, C. D.Manning, A. Y. Ng, and C. Potts. 2013. Recursivedeep models for semantic compositionality over asentiment treebank. In Empirical Methods in Nat-ural Language Processing (EMNLP).

A. Wang, A. Singh, J. Michael, F. Hill, O. Levy, andS. R. Bowman. 2019. Glue: A multi-task bench-mark and analysis platform for natural language un-derstanding. In International Conference on Learn-ing Representations (ICLR).

A. Williams, N. Nangia, and S. Bowman. 2018. Abroad-coverage challenge corpus for sentence under-standing through inference. In Association for Com-putational Linguistics (ACL), pages 1112–1122.

H. Zhang, Y. Yu, J. Jiao, E. P. Xing, L. E. Ghaoui, andM. I. Jordan. 2019. Theoretically principled trade-off between robustness and accuracy. In Interna-tional Conference on Machine Learning (ICML).

A Appendix

A.1 Aggloemrative clusteringRecall that any πV induces a clustering of V , whereeach cluster contains a set of words mapped by πVto the same encoded token. We use an agglomer-ative clustering algorithm to approximately mini-mize Φ. We initialize πV by setting πV (w) = wfor each w ∈ V , which corresponds to placingeach word in its own cluster. We then examineeach pair of clusters Ci, Cj such that there existsan edge between a node in Ci and a node in Cj , in

the graph from Section 4.2. For each such pair, wecompute the value of Φ if Ci and Cj were replacedby Ci ∪ Cj . If no merge operation causes Φ todecrease, we return the current πV . Otherwise, wemerge the pair that leads to the greatest reductionin Φ, and repeat. To merge two clusters Ci andCj , we first compute a new encoded token r asthe w ∈ Ci ∪ Cj with largest ρ(w). We then setπV (w) = r for all w ∈ Ci ∪ Cj . Our algorithmthus works as follows

Algorithm 1 Objective-minimizing agglomerativeclustering

1: C ← V2: for i in range(|V |) do3: Cnext ← Get Best Combination(C)4: if C = Cnext then5: return C6: end if7: C ← Cnext8: end for9: return C

Now, we simply have to define the procedure weuse to get the best combination.

Algorithm 2 Get Best Combination(C)

1: Copt ← C2: Φopt ← Φ(C)3: for (Ci, Cj) ∈ Adjacent Pairs(C) do4: Ccomb ← Ci ∪ Cj5: Cnew ← C ∪ Ccomb \ {Ci, Cj} {New clus-

ters}6: Φnew ← Φ(Cnew)7: if Φnew < Φopt then8: Φopt ← Φnew

9: Copt ← Cnew10: end if11: end for12: return Copt

Recall our graph G = (G,E) used to definethe connected component clusters. We say twoclusters Ci and Cj are adjacent, and thus returnedby Adjacent Pairs, if there exists a vi ∈ Ci and avj ∈ Cj such that (vi, vj) ∈ GE . The runtime ofour algorithm is O(N2E) since at each of a pos-sible N total iterations, we compute the objectivefor one of at most E pairs of clusters. Computationof the objective can be reframed as computing thedifference between Φ and Φnew, where the latter is

2763

computed using new clusters, which can be donein O(N) time.

A.2 Attacks

We use two heuristic attacks to compute an upperbound for robust accuracy: one for ED1 pertur-bations and one for internal permutations. Eachheuristic attack is a beam search, with beam width5. However, because |B(xi)| is very large formany tokens xi, even the beam search is intractable.Instead, we run a beam search where the allow-able perturbations are B′(xi) ⊆ B(xi), where|B′(xi)| << B(xi) for sufficiently long xi. Forour ED1 attack, we define B′(xi) to be four ran-domly sampled perturbations from B(xi) whenthe length of xi is less than five, and all deletionswhen xi is greater than five. Thus, the number ofperturbations of each word is bounded above bymin{4, len(xi)−2}. For our internal permutations,B′(xi) is obtained by sampling five permutationsat random.

A.3 Datasets

We use six out of the nine tasks from GLUE:SST, MRPC, QQP, MNLI, QNLI, and RTE, allof which are classification tasks measured by ac-curacy. The Stanford Sentiment Treebank (SST-2) (Socher et al., 2013) contains movie reviewsthat are classified as positive and negative. TheMicrosoft Research Paraphrase Corpus (MRPC)(Dolan and Brockett, 2005) and the Quora Ques-tion Pairs dataset4 contain pairs of input which areclassified as semantically equivalent or not; QQPcontains question pairs from Quora, while MRPCcontains pairs from online news sources. MNLI,and RTE are entailment tasks, where the goal is topredict whether or not a premise sentence entailsa hypothesis (Williams et al., 2018). MNLI gath-ers premise sentences from ten different sources,while RTE gathers premises from entailment chal-lenges. QNLI gives pairs of sentences and ques-tions extracted from the Stanford Question Answer-ing Dataset (Rajpurkar et al., 2016), and the task isto predict whether or not the answer to the questionis in the sentence.

We use the GLUE splits for the six datasetsand evaluate on test labels when available (SST-2,MRPC), and otherwise the publicly released de-velopment labels. We tune hyperparameters by

4data.quora.com/First-Quora-Dataset-Release-Question-Pairs

training on 80% of the original train set and usingthe remaining 20% as a validation set. We thenretrain using the chosen hyperparameters on thefull training set.

A.4 Experimental details

For our methods using transformers, we start withthe pretrained uncased BERT (Devlin et al., 2019),using the same hyperparameters as the pytorch-transformers repo.5. In particular, we use the baseuncased version of BERT. We use a batch size of8, and learning rate 2e−5. For examples where|Bα(x)| > 10000, we assume the prediction is notrobust to make computation tractible. Each typocorrector uses the defaults for training from6; it istrained on a specific task using perturbations of thetraining data as input and the true sentence (up toOOV) as output. The vocabulary size of the typocorrectors is 10000 including the unknown token,as in (Pruthi et al., 2019). The typo corrector ischosen based on word-error rate on the validationset.

A.5 Constrained adversaries

Using RobEn, since we can tractably compute ro-bust accuracy, it is easy to additionally consideradversaries that cannot perturb every input token.We may assume that an attacker has a budget ofb ≤ L words that they may perturb as in (Pruthiet al., 2019). Exiting methods for certification (Jiaet al., 2019; Huang et al., 2019) require attack to befactorized over tokens, and cannot give tighter guar-antees in the budget-constrained case compared tothe unconstrained setting explored in previous sec-tions. However, our method lets us easily computerobust accuracy exactly in this situation: we justenumerate the possible perturbations that satisfythe budget constraint, and query the model.

Figure 6 plots average robust accuracy acrossthe six tasks using AGGCLUST as a function ofb. Note that b = 0 is simply standard accuracy.Interestingly, for each dataset there is an attack onlyperturbing 4 tokens with attack accuracy equal torobust accuracy.

A.6 Number of representations

We include here histograms for the datasets we didnot cover in the main body. The histograms for

5https://github.com/huggingface/pytorch-transformers

6https://github.com/danishpruthi/Adversarial-Misspellings

2764

0 1 2 3 4Allowable token perturbations (b)

0.71

0.72

0.73

0.74

0.75

0.76

Roc

usta

ccur

acy

Robust Accuracy for Constrained Adversaries

Figure 6: Robust accuracy averaged across all tasksbased on different adversarial budgets b. b = 0 corre-sponds to clean performance, and robust performanceis reached at b = 4

Size of Bα

0

0.2

0.4

0.6

0.8

1.0

Frac

tion

ofE

xam

ples

1 2 3–4 5–8 9+

Sizes of Bα on MRPC

1 2 3–4 5–8 9+

0.2

0.4

0.6

0.8

Sizes of Bα on QQP

CONNCOMP

AGGCLUST

(a) Size of Bα over MRPC and QQP

Size of Bα

0

0.2

0.4

0.6

0.8

1.0

Frac

tion

ofE

xam

ples

1 2 3–4 5–8 9+

Sizes of Bα on MNLI

1 2 3–4 5–8 9+

0.2

0.4

0.6

0.8

Sizes of Bα on QNLI

CONNCOMP

AGGCLUST

(b) Size of Bα over MNLI and QNLI

Figure 7: Histograms showing sizes of Bα for MRPC,QQP, MNLI, and QNLI.

MRPC and QQP are shown in Figure 7(a), whilethe histograms for MNLI and QNLI are shown inFigure 7(b). The fraction of x such that |Bα(x)| =1 for each dataset and each set of encodings isprovided in Table 2.

A.7 Internal Permutation ResultsWe consider the internal permutation attack sur-face, where interior characters in a word can bepermuted, assuming the first and last charactersare fixed. For example, “perturbation” can be per-muted to “peabreuottin” but not “repturbation”.Normally, context helps humans resolve these ty-pos. Interestingly, for internal permutations it isimpossible for an adversary to change the clusterassignment of both in-vocab and out of vocab to-kens since a cluster can be uniquely representedby the first character, a sorted version of the inter-nal characters, and the last character. Therefore,using CONNCOMP encodings, robust, attack, andstandard accuracy are all equal. We use the attackdescribed in A.2 to attack the clean model. Theresults are in Table 3.

2765

Encodings SST-2 MRPC QQP MNLI QNLI RTE AvgCon. Comp. 86.9 71.6 72.7 45.3 54.6 40.4 61.9Agg. Clust. 65.6 50.0 62.7 35.4 36.6 25.2 45.9

Table 2: Percentage of test examples with |Bα(x)| = 1 for each dataset.

Accuracy System SST-2 MRPC QQP MNLI QNLI RTE Avg

Standard BERT 93.8 87.7 91.2 84.3 88.9 71.1 86.2Con. Comp. + BERT 93.2 87.7 86.9 75.9 83.4 61.4 81.4

Attack BERT 28.1 15.9 33.0 4.9 6.2 5.8 15.7Con. Comp. + BERT 93.2 87.7 86.9 75.9 83.4 61.4 81.4

Robust Con. Comp. + BERT 93.2 87.7 86.9 75.9 83.4 61.4 81.4

Table 3: Results from internal permutation attacks. Internal permutation attacks bring the average performancefor BERT across the six listed tasks from 86.2 to 15.7. Our CONNCOMP encodings, generated using the internalpermutation attack surface, achieve a robust accuracy of 81.4, which is only 4.8 points below standard accuracy.