Machine-learning robustness
How much can a few words change?
I trained a sentiment classifier and tested its sensitivity to small, constrained token substitutions.
My role
I built the classifier baseline and implemented a HotFlip-style adversarial attack.
Where it stands
LUMS course project from 2023. The result concerns the trained classifier and its experimental setup, not all sentiment models.
What changed.
A comparison between ordinary test predictions and predictions after a small number of token substitutions.
Establish the baseline
I trained a CNN/LSTM sentiment model over normalized movie reviews. The baseline provided a reference for separating the effect of the attack from ordinary classification errors.
Constrain the perturbation
The attack searched nearby candidates in GloVe embedding space while limiting the number of substitutions. That made it possible to inspect how a small textual change altered the classifier's decision.
The stack
- Python
- PyTorch
- CNN
- LSTM
- GloVe
- HotFlip-style attacks