Conversation

Excited to share our preprint, "Explaining NLP Models via Minimal Contrastive Editing (MiCE)"

This is joint work with @anmarasovic and @mattthemathman Link to paper: arxiv.org/pdf/2012.13985 Thread below

1/6

Show this thread

Here is some notation (I tried to stick with the paper's notation): Input: x Edited input: x' = e(x) Model: f Original output/prediction: y = f(x) Contrast(ive) output/prediction: y' Precondition: y' != y 2/n

As I understand, a contrastive edit (CE) must satisfy: 1) f(x') = y' And a CE ideally satisfies: 2) Minimality - x and x' are close (i.e. d(x, x') < epsilon, for some metric d). 3) Fluency - x' is fluent As shorthand, let us call CEs satisfying 2 and 3 an ACE (Amazing CE)

As I understand, a targeted adversarial perturbation (TAP) must satisfy 1 and 2 (perhaps for a small epsilon even), with work that considers fluency, i.e. 3. As you point out, an adversarial perturbation also is expected to 4) have the same true label.

But then, isn't every TAP an ACE? And, therefore, aren't methods to generate TAPs that work also good generators of ACEs (for the conditions you have stated). This seems to contradict your last sentence in Section 6 on Adversarial Examples.

I will say that I implicitly agree that adversarial examples do not (necessarily) feel like compelling explanations (especially if they are disfluent; perhaps also depending on the degree of minimality). But, under the conditions for a CE and ACE, shouldn't TAPs be valid?

Now, I don't closely follow the adversarial literature, but my understanding is that in vision, it is possible to synthesize targeted adversarial attacks (especially with glassbox access). Perhaps given that adversarial attacks are harder to generate in NLP, the emphasis ...

you are placing is on the shortcoming of current adversarial methods (but that you believe sufficiently improved TAP generators are valid ACE generators). If so, I should note that this was at least very unclear to me; my reading was you viewed these as separate but related.

Independent of this, I thought I would point to this recent work of Golan et al. (PNAS 2020; pnas.org/content/117/47), which also proposes (in my mind) a different way of generalizing adversarial examples to better understand models (here, to adjudicate which is more human-like).

Alexis Ross

@alexisjross

Replying to