Search papers, labs, and topics across Lattice.
This paper develops a continuous local model of semantic paraphrase perturbations to analyze how semantically equivalent paraphrases can mislead financial sentiment classifiers. By employing a generalized eigenvalue framework, the authors derive an attackability index that quantifies the worst-case displacement of model representations under a two-model threat structure. The findings reveal a closed-form prediction-flip condition and provide robust theoretical guarantees for assessing the vulnerability of classifiers to paraphrastic attacks, significantly enhancing our understanding of model robustness in NLP applications.
The worst-case displacement of model representations can be precisely quantified using a generalized eigenvalue approach, revealing critical vulnerabilities in sentiment classifiers.
Recent empirical work shows that semantically equivalent paraphrases can fool financial sentiment classifiers: although a paraphrase remains close to the original under a strong reference embedding, it may shift the target model's representation enough to change the predicted class. Existing robustness theory either assumes a single-model threat model or focuses mainly on empirical attack algorithms. We develop a continuous local model of semantic paraphrase perturbations that captures this two-model structure. We show that the worst-case local displacement of the target representation, subject to a proxy-model budget, is governed by the largest generalised eigenvalue of a matrix pencil $(A,B)$ constructed from the Jacobians of the two embedding maps. The resulting attackability index $位^*(x)$ is intrinsic to the local paraphrase geometry and the chosen embedders, yields a closed-form prediction-flip condition for affine readouts, and supports conservative population and finite-sample attackability certificates. For uniform control over classes of affine readouts, we derive a distribution-free VC bound for binary attackability indicators and a scale-sensitive margin bound based on an attackability-adjusted margin that subtracts a local geometric penalty from the standard classifier margin. We also connect the continuous theory to discrete paraphrase search, identify an asymmetry between successful and unsuccessful finite searches, and give a covering condition under which the discrete and continuous settings agree. Finally, we propose an empirical verification framework using soft-token relaxations and generated paraphrase sets to assess the local eigenvalue geometry, prediction-flip condition, and finite-search approximation on a deployed financial-text classifier.
