{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/achieving-verified-robustness-to-symbol","title":"Achieving Verified Robustness to Symbol Substitutions via Interval Bound Propagation","arxiv_id":"1909.01492","date":"2019-09-03","proceeding":"IJCNLP 2019 11","authors":["Po-Sen Huang","Robert Stanforth","Johannes Welbl","Chris Dyer","Dani Yogatama","Sven Gowal","Krishnamurthy Dvijotham","Pushmeet Kohli"],"abstract":"Neural networks are part of many contemporary NLP systems, yet their empirical successes come at the price of vulnerability to adversarial attacks. Previous work has used adversarial training and data augmentation to partially mitigate such brittleness, but these are unlikely to find worst-case adversaries due to the complexity of the search space arising from discrete text perturbations. In this work, we approach the problem from the opposite direction: to formally verify a system's robustness against a predefined class of adversarial attacks. We study text classification under synonym replacements or character flip perturbations. We propose modeling these input perturbations as a simplex and then using Interval Bound Propagation -- a formal model verification method. We modify the conventional log-likelihood training objective to train models that can be efficiently verified, which would otherwise come with exponential search complexity. The resulting models show only little difference in terms of nominal accuracy, but have much improved verified accuracy under perturbations and come with an efficiently computable formal guarantee on worst case adversaries.","url_abs":"https://arxiv.org/abs/1909.01492v2","url_pdf":"https://arxiv.org/pdf/1909.01492v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"achieving-verified-robustness-to-symbol","repo_url":"https://github.com/deepmind/interval-bound-propagation","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"Apache-2.0"}}],"tasks":[{"task_slug":"data-augmentation","task_name":"Data Augmentation"},{"task_slug":"text-classification","task_name":"Text Classification"},{"task_slug":"text-classification-1","task_name":"text-classification"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1909.01492","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1909.01492"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/deepmind/interval-bound-propagation","reach":{"status":"ok","spdx":"Apache-2.0"}}],"summary":{"unverified":7},"by_repo_kind":{"official":{"samples":7,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"2e105c9e60e20558","entry":"build_dataset","repo":"deepmind/interval-bound-propagation","repo_kind":"official","path":"interval_bound_propagation/src/utils.py","file_url":"https://github.com/deepmind/interval-bound-propagation/blob/HEAD/interval_bound_propagation/src/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"2e105c9e60e20558"}},{"code_sha256_prefix":"d22d23d5d83cc957","entry":"conv_output_shape","repo":"deepmind/interval-bound-propagation","repo_kind":"official","path":"interval_bound_propagation/src/layer_utils.py","file_url":"https://github.com/deepmind/interval-bound-propagation/blob/HEAD/interval_bound_propagation/src/layer_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"d22d23d5d83cc957"}},{"code_sha256_prefix":"a60e232adbec82fd","entry":"linear_schedule","repo":"deepmind/interval-bound-propagation","repo_kind":"official","path":"interval_bound_propagation/src/utils.py","file_url":"https://github.com/deepmind/interval-bound-propagation/blob/HEAD/interval_bound_propagation/src/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"a60e232adbec82fd"}},{"code_sha256_prefix":"70efb0e927ae7e5a","entry":"materialise_conv","repo":"deepmind/interval-bound-propagation","repo_kind":"official","path":"interval_bound_propagation/src/layer_utils.py","file_url":"https://github.com/deepmind/interval-bound-propagation/blob/HEAD/interval_bound_propagation/src/layer_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"70efb0e927ae7e5a"}},{"code_sha256_prefix":"cde1139d55d20376","entry":"pgd_attack","repo":"deepmind/interval-bound-propagation","repo_kind":"official","path":"interval_bound_propagation/src/attacks.py","file_url":"https://github.com/deepmind/interval-bound-propagation/blob/HEAD/interval_bound_propagation/src/attacks.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"cde1139d55d20376"}},{"code_sha256_prefix":"e912de699162590e","entry":"randomize","repo":"deepmind/interval-bound-propagation","repo_kind":"official","path":"interval_bound_propagation/src/utils.py","file_url":"https://github.com/deepmind/interval-bound-propagation/blob/HEAD/interval_bound_propagation/src/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"e912de699162590e"}},{"code_sha256_prefix":"6c96553a1753aaa9","entry":"wrap_optimizer","repo":"deepmind/interval-bound-propagation","repo_kind":"official","path":"interval_bound_propagation/src/attacks.py","file_url":"https://github.com/deepmind/interval-bound-propagation/blob/HEAD/interval_bound_propagation/src/attacks.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"6c96553a1753aaa9"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}