# Kinetic Pathway and Micromechanics of Vesicle Fusion/Fission

Luofu Liu  Department of Chemical and Biomolecular Engineering, University of
California Berkeley, Berkeley, California 94720, United States  Chao Duan
Department of Chemical and Biomolecular Engineering, University of California
Berkeley, Berkeley, California 94720, United States  Rui Wang
<EMAIL_ADDRESS>Department of Chemical and Biomolecular Engineering,
University of California Berkeley, Berkeley, California 94720, United States
Materials Sciences Division, Lawrence Berkeley National Lab, Berkeley,
California 94720, United States

###### Abstract

Despite the wide existence of vesicles in living cells as well as their
important applications like drug-delivery, the underlying mechanism of vesicle
fusion/fission remains under debate. Here, we develop a constrained self-
consistent field theory (SCFT) which allows tracking the shape evolution and
free energy as a function of center-of-mass separation distance. Fusion and
fission are described in a unified framework. Both the kinetic pathway and the
mechanical response can be simultaneously captured. By taking vesicles formed
by polyelectrolytes as a model system, we predict discontinuous transitions
between the three morphologies: parent vesicle with a single cavity,
hemifission/hemifusion and two separated child vesicles, as a result of
breaking topological isomorphism. With the increase of inter-vesicle
repulsion, we observe a great reduction of the cleavage energy, indicating
that vesicle fission can be achieved without hemifission, in good agreement
with simulation. The force-extension relationship elucidates typical
plasticity for separating two vesicles. The super extensibility in the
mechanical response of vesicle is in stark contrast to soft particles with
other morphologies such as cylinder and sphere.

Vesicle is one of the most important structures formed via self-assembly [1,
2, 3, 4]. In biology, vesicles widely exist within and outside cells, which
constitutes the basic structure of cells and organelles, governing a variety
of functions of human body. Owing to the unique hollow morphology, vesicles
synthesized by amphiphilic molecules also have a wealth of applications such
as encapsulators, micro/nanoreactors, and drug/gene delivery cargos [5, 6, 7,
8, 9]. Fusion and fission are two vital processes for the functionality of
vesicles. Many biological processes including cell division, endocytosis and
exocytosis are intimately related to vesicle fusion/fission [10, 11, 12, 13].
Fusion/fission also have crucial impacts on the encapsulating and releasing
properties of vesicles as nano/biomadical materials, such as the uptake rate
of lipsome in drug delivery [14, 15, 16, 17].

Despite the ubiquity in nature and the wide applications, understanding the
mechanism of vesicle fusion/fission remains a great challenge. Although
similar intermediate structures were observed in transmission electron
microscopy (TEM) images for both fission and fusion [18], it is generally
accepted that these two processes go through different kinetic pathways [19,
20]. The pioneering picture to describe the vesicle fusion is the “stalk”
model [21, 22, 23], which suggests that the fusion is initiated by forming a
stalk, followed by a radial expansion of the stalk to the hemifusion
diaphragm, and ends up with the pore-opening. However, there is discrepancy
between the assumptions in the stalk model and the observations in simulations
[24, 25, 26, 27, 28, 29]. Whether the stalk undergoes a substantial expansion
and in which direction the stalk grows is still under debate [30, 31, 32]. On
the other hand, the most classic model to describe vesicle fission is the
budding-fission mechanism [33, 34, 35]. It is featured by the formation of the
hemifission where the inner layer of the parent vesicle merges into a neck
followed by cleavage into two child vesicles [36, 37, 38, 39, 40, 41, 42].
Nevertheless, recent simulations showed that hemifission is not necessary: the
parent vesicle can directly split into two child vesicles without neck
formation [26, 43]. Furthermore, micromechanics of the vesicle bilayers in
response to the applied stress also arouses great interest. Using coarse-
grained simulation, Park et al. observed a tubulation with extremely large
extensibility when pulling a vesicle from a membrane [44].

Many theoretical efforts have been made to explain the mechanism of vesicle
fusion/fission. Most descriptions are based on elastic models, which capture
the shape evolution and the corresponding energy of the intermediate states
[30, 31, 36]. It is difficult for this phenomenological treatment to include
molecular structure and interactions on the pathway. For another approach,
Schick et al. applied the self-consistent field theory (SCFT) to study the
bilayers made of diblock copolymers, which allows to capture the coupling
between the molecular conformation and the shape change of the bilayer [45,
46, 47, 48]. Using the radius of stalk as the reaction coordinate, the
stability of intermediates was analyzed. Being focused on a small portion near
the stalk, their method however fails to capture the shape change of the
entire vesicle.

In this work, we develop a constrained SCFT to study the fusion/fission of two
vesicles formed by polyelectrolytes (PE). The molecular structure and
interactions are systematically included. By tracking shape evolution and the
corresponding free energy as a function of center-of-mass (c.m.) separation
distance, we are able to describe the fusion and fission processes in a
unified framework. The kinetic pathway and the mechanical response can be
obtained simultaneously. We predict that the transitions between different
morphologies are discontinuous due to the breaking of topological isomorphism.
We observe super extensibility when separating two vesicles, which resembles
typical plastic materials. Our predictions are in good agreement with
simulation results.

Previous work showed that stable vesicle can be formed by a single uniformly-
charged polyelectrolyte (PE) [49]. Here, we take this vesicle as a model to
study the fusion/fission process. The system we consider is a semicanonical
ensemble consisting of two PEs and $n_{\rm s}$ solvent molecules in the
presence of $n_{+}$ cations and $n_{-}$ anions. The number of PE is fixed
while the solvent and mobile ions are connected with a bulk salt solution of
an ion concentration $c_{\pm}^{\rm b}$ that maintains the chemical potentials
of the solvent $\mu_{\rm s}$ and ions $\mu_{\pm}$. PEs are assumed to be
Gaussian chains of $N$ Kuhn segments with Kuhn length $b$. The backbone charge
density is $\alpha$. Mobile ions are taken as point charges with valency
$z_{\pm}$. The two vesicles are identical but distinguishable, denoted as
Vesicle 1 and Vesicle 2 shown in Fig. 1. The c.m. of the two vesicles are
fixed at position $\boldsymbol{\xi}_{1}$ and $\boldsymbol{\xi}_{2}$,
respectively.

The partition function of the system can be written as:

$\displaystyle\boldsymbol{\Xi}$ $\displaystyle=\frac{1}{v_{\rm
p}^{2N}}\sum_{n_{\gamma}=0}^{\infty}\prod_{\gamma}\frac{e^{\mu_{\gamma}n_{\gamma}}}{n_{\gamma}!v_{\gamma}^{n_{\gamma}}}\prod_{j=1}^{2}\int{\rm\hat{D}}\\{\mathbf{R}_{j}\\}\prod_{\kappa=1}^{n_{\gamma}}\int{\rm
d}\mathbf{r}_{\gamma,\kappa}$ (1)
$\displaystyle\exp(-\mathcal{H})\prod_{\mathbf{r}}\delta\left[\hat{\phi}_{\rm
p}(\mathbf{r})+\hat{\phi}_{\rm s}(\mathbf{r})-1\right]$
$\displaystyle\times\delta\left[\frac{1}{N}\int_{0}^{N}{\rm
d}s\mathbf{R}_{1}(s)-\boldsymbol{\xi}_{1}\right]\delta\left[\frac{1}{N}\int_{0}^{N}{\rm
d}s\mathbf{R}_{2}(s)-\boldsymbol{\xi}_{2}\right]$

where $\gamma={\rm s},\pm$ stands for solvents, cations and anions,
respectively. $\int\hat{D}\\{\mathbf{R}_{j}\\}$ denotes the integration over
the Gaussian-weighted chain configurations. $v_{\rm p}$ and $v_{\gamma}$ are
the volumes of the chain segments and small molecules. We assume $v_{\rm
p}=v_{\rm s}=v$. $\hat{\phi}_{\rm p}=\hat{\phi}_{\rm p1}+\hat{\phi}_{\rm p2}$
is the total instantaneous volume fractions of PE, and $\hat{\phi}_{\rm s}$ is
that of solvent. The $\delta$ functional in the second line of Eq. 1 accounts
for the incompressibility. The Hamiltonian $\mathcal{H}$ is given by

$\mathcal{H}=\frac{\chi}{v}\int{\rm d}{\mathbf{r}}\hat{\phi}_{\rm
p}(\mathbf{r})\hat{\phi}_{\rm s}(\mathbf{r})+\frac{1}{2}\int{\rm
d}{\mathbf{r}}\int{\rm
d}{\mathbf{r^{{}^{\prime}}}}\hat{\rho}(\mathbf{r})C(\mathbf{r},\mathbf{r^{{}^{\prime}}})\hat{\rho}(\mathbf{r}^{{}^{\prime}})$
(2)

where the two contributions come from the short-range polymer-solvent
interaction characterized by the Flory-Huggins $\chi$ parameter and the long-
range electrostatic interaction between all charged species.
$\hat{\rho}(\mathbf{r})=z_{+}\hat{c}_{+}(\mathbf{r})-z_{-}\hat{c}_{-}(\mathbf{r})-\alpha\hat{\phi}_{\rm{}_{p}}(\mathbf{r})/v$
is the instantaneous local charge density, with $\hat{c}_{\pm}(\mathbf{r})$
the instantaneous ion concentration. $C(\mathbf{r},\mathbf{r^{{}^{\prime}}})$
is the Coulomb operator, satisfying $-\nabla\cdot[\epsilon(\mathbf{r})\nabla
C(\mathbf{r},\mathbf{r^{{}^{\prime}}})]=\delta(\mathbf{r}-\mathbf{r^{{}^{\prime}}})$.
$\epsilon(\mathbf{r})=\epsilon_{0}\epsilon_{\rm r}(\mathbf{r})/\beta e^{2}$ is
the rescaled permittivity, where $\epsilon_{0}$ is the vacuum permitivity, $e$
is the elementary charge and $\epsilon_{\rm r}$ is local dielectric constant
[50, 51, 52, 53]. The two $\delta$ functions in the third line of Eq. 1 are
introduced to enforce the c.m. of the Vesicle $j$ at $\xi_{j}$ [54, 55].

Figure 1: Schematic of fusion/fission of two vesicles formed by
polyelectrolytes. The centers of mass of the two vesicles are fixed at
$\boldsymbol{\xi}_{1}$ and $\boldsymbol{\xi}_{2}$ with a separation distance
$L=|\boldsymbol{\xi}_{2}-\boldsymbol{\xi}_{1}|$. External forces
($\mathbf{f}_{1}=-\mathbf{f}_{2}$) are applied to maintain the separation.

We follow the standard SCFT techniques [56] (see the detailed derivation in
Sec. I of the Supplementary Material). The identity transformation of the
$\delta$ functions that account for the constraint of c.m. generates two force
fields $\mathbf{f}_{j}$, conjugating to the deviation of c.m. The force fields
counteract the inter-vesicle interaction, which guarantees the sampling of all
configurations along the kinetic pathway. The resulting self-consistent
equations for PE density $\phi_{{\rm p}j}(\mathbf{r})$, electrostatic
potential $\psi(\mathbf{r})$, and conjugate fields $w_{\rm p,s}(\mathbf{r})$
are:

$\displaystyle w_{\rm p}(\mathbf{r})-w_{\rm
s}(\mathbf{r})=\chi\left[1-2\phi_{\rm
p}(\mathbf{r})\right]-v\frac{\partial\epsilon}{\partial\phi_{\rm
p}}\frac{|\nabla\psi|^{2}}{2}-\alpha\psi(\mathbf{r})$ (3a)
$\displaystyle\phi_{{\rm p}j}(\mathbf{r})=\frac{1}{Q_{{\rm
p}j}}\int_{0}^{N}{\rm d}sq_{j}(\mathbf{r},s)q_{j}(\mathbf{r},N-s)$ (3b)
$\displaystyle 1-\phi_{\rm p}(\mathbf{r})=\exp\left[\mu_{\rm s}-w_{\rm
s}(\mathbf{r})\right]$ (3c)
$\displaystyle-\nabla\cdot\left[\epsilon(\mathbf{r})\nabla\psi(\mathbf{r})\right]=z_{+}c_{+}(\mathbf{r})-z_{-}c_{-}(\mathbf{r})-\frac{\alpha}{v}\phi_{\rm
p}(\mathbf{r})$ (3d) $\displaystyle{\int{\rm d}\mathbf{r}\phi_{{\rm
p}j}(\mathbf{r})\cdot(\mathbf{r}-\boldsymbol{\xi}_{j})}=\mathbf{0}$ (3e)

$c_{\pm}(\mathbf{r})=\lambda_{\pm}\exp(\mp z_{\pm}\psi(\mathbf{r}))$ is the
ion concentration, where $\lambda_{\pm}=\exp(\mu_{\pm})/v_{\pm}$ is the
fugacity of ions determined by $c_{\pm}^{\rm b}$. $Q_{{\rm p}j}=v^{-1}\int{\rm
d}{\mathbf{r}}q_{j}(\mathbf{r},N)$ is the single chain partition function of
Vesicle $j$ in the fields $w_{\rm p}(\mathbf{r})$ and $\mathbf{f}_{j}$.
$q_{j}$ is the propagator satisfying the modified diffusion equation:

$\left\\{\frac{\partial}{\partial s}-\frac{b^{2}}{6}\nabla^{2}+\left[w_{\rm
p}(\mathbf{r})-\frac{\mathbf{f}_{j}}{N}\cdot(\mathbf{r}-\boldsymbol{\xi}_{j})\right]\right\\}q_{j}(\mathbf{r},s)=0$
(4)

It can be seen that the external field is shifted by the force
${\mathbf{f}}_{j}$ as a result of constraining c.m., such that the shape of
vesicles will be deformed from the force-free system. The free energy $F$ of
the two vesicles is:

$\displaystyle F$ $\displaystyle=-e^{\mu_{\rm s}}Q_{\rm s}-\ln Q_{{\rm
p}1}-\ln Q_{{\rm p}2}$ (5) $\displaystyle+\frac{1}{v}\int{\rm
d}{\mathbf{r}}\left[\chi\phi_{\rm p}\left(1-\phi_{\rm p}\right)-w_{\rm
p}\phi_{\rm p}-w_{\rm s}\left(1-\phi_{\rm p}\right)\right]$
$\displaystyle-\int{\rm
d}{\mathbf{r}}\left[c_{+}+c_{-}+\frac{1}{2}\epsilon(\nabla\psi)^{2}+\frac{\alpha}{v}\phi_{\rm
p}\psi\right]$

where $Q_{\rm s}=v^{-1}\int{\rm d}\mathbf{r}\exp[-w_{\rm s}(\mathbf{r})]$ is
the solvent partition function. The vesicle density profile and the free
energy as a function of separation distance $L$ can be obtained by solving
Eqs. 3 and 4 iteratively. For the two vesicle system,
${\mathbf{f}_{1}}=-\mathbf{f}_{2}$; thus only one force is needed in the
iteration. $\mathbf{f}_{j}$ is determined by using Eq. 3e as a Lagrangian
multiplier. The numerical details are provided in Sec. II of the Supplementary
Material.

In the current work, we focus on the dependence of kinetic pathway and
micromechanics of fusion/fission on the essential topological feature of the
vesicle. We take the vesicle formed by PE as a model system. The fundamental
physics obtained here can be applied to other types of vesicles, such as those
formed by sufactants, lipids and block copolymers. Moreover, the constrained
SCFT developed here can be easily generalized to study the interactions,
kinetic process and micromechanics of various soft matter aggregates, such as
polymer chains, coacervates, intrinsically disordered proteins, micelles,
nano/micro gels and polymer-grafted nanoparticles.

Figure 2 shows the free energy in terms of potential of mean force $U(L)$
between two vesicles and the representative morphologies.
$U(L)=F(L)-F(\infty)$, is the free energy at a given $L$ excessive to the
reference state at $L=\infty$. Going along the fission direction, three
different features of morphology can be observed: (1) parent vesicle with a
single cavity, (2) hemifission/hemifusion characterized by a neck connecting
two cavities, and (3) two separated “child” vesicles. From State (a) to State
(c), the parent vesicle is elongated; each of the two constituting vesicles is
polarized to one end. As $L$ reaches a critical value (State (b)), two
opposing inner layers merge into a neck (State (d)), signifying
hemifission/hemifusion. Neck growth spans a long range of $L$ (State (d) to
State (f)), where the neck width remains almost constant and the cavity volume
shrinks. Lastly, the fission process ends up with the fracture of the neck, by
forming two separated child vesicles (State (i)). The morphological evolution
predicted by our theory is in good agreement with the intermediate structures
observed in TEM images [18].

Figure 2: Kinetic pathway of vesicle fission/fusion. Potential of mean force
$U$ along c.m. separation distance $L$ is shown on the top. The three types of
morphology: parent vesicle with a single cavity, hemifission/hemifusion and
two separated child vesicles are represented by red, blue and green curves
respectively. The bottom panel shows 2D visualization of the density profile
for the representative states. The colorbar denotes the PE volume fraction.
The dashed frames of the same color pair the coexistent states in the kinetic
pathway. For each state, the left figure plots the entire volume fraction of
the two vesicles, whereas the right figure plots that of one constituting
vesicle. The ranges for the $r$\- and $z$-axis are $r/b\in[-10,10]$ and
$z/b\in[-40,40]$. $N=200$, $b=1\rm{nm}$, $\chi=1.25$, $\alpha=0.72$,
$\epsilon_{\rm r}=80$, $z_{+}=z_{-}=1$ and $c_{\rm b}=0.10{\rm M}$.

The energy landscape reveals the characteristics of the morphological
transition. Figure 2 shows that both the transition from the elongated parent
vesicle to hemifission/hemifusion and the subsequent transition to two
separated child vesicles are discontinuous, demonstrated by the crossing of
their corresponding free energy curves. Unlike the common first-order phase
transitions as a result of symmetry breaking, the discontinuous transition
here is driven by the change of topological isomorphism belonging to different
morphologies. The morphological transitions hence have to involve a nucleation
process with an activation energy [57, 58]. It should be noted that this
nucleation cannot be captured in our current approach using c.m. separation
distance as the reaction coordinate. It can be accounted for by more
sophisticated transition-path theory such as string method [59, 57, 58].

Another important implication of the discontinuous transition is the existence
of metastable regions beyond the exact transition point, such that the shape
evolution in fusion/fission does not need to exactly follow the minimum free
energy curve. It provides a possibility that fusion and fission undergo
different pathways in the real process, if each includes different portions of
the metastable regions. Therefore, fission and fusion are not reverse to each
other and have to be described differently. Taking the fusion as an example,
the transition from two separated child vesicles to hemifusion is not likely
to occur at State (i). The nucleation barrier for such transition is expected
to be high, because the two vesicles cannot tell each other restricted by the
short-range hydrophobic attraction. To reduce the nucleation barrier, the
fusion would rather proceed along the metastable path (from State (i) to (g))
until the two vesicles get sufficiently approached. As a result, the long neck
predicted by our theory in State (f) and also observed in the simulation of
fission [44] would not appear in fusion.

For another example, the metastable state of the two separated child vesicles
can transit to the morphology of either the hemifusion or the elongated parent
vesicle. This is confirmed by the existence of all three morphologies as the
equilibrium structure (either stable or metastable) at the same $L=12b$. If
the former transition occurs, there is a window for stalk growth prior to
pore-opening, in line with the original stalk model [21, 22, 23]. If the
latter transition occurs, pore will open without substantial stalk growth,
consistent with modified stalk model [31, 30]. Which of the two transitions is
preferred depends on their corresponding nucleation barriers. There is a long-
time debate on the intrinsic mechanism of vesicle fusion. Our theory provides
a unified description of different mechanisms.

The classical pathway of fission observed in many experiments and simulations
follows the budding-fission mechanism involving a necking process. However,
this is challenged by the findings that the intermediate hemifission step can
be bypassed: the parent vesicle is directly cleaved into two child vesicles
[26, 43]. This alternative mechanism can also be captured by our theory.
Figure 3 shows the expansion of the metastable region of the parent vesicle as
the electrostatic repulsion increases. The parent vesicle with a single cavity
can be elongated to a much larger $L$ before it gets unstable. The vesicle
shell becomes extremely thin with a much lower PE density inside as shown in
the inset of Fig. 3, implying a smaller elastic modulus upon deformation and
hence a lower resistance to fracture. The cleavage energy $\Delta F_{\rm
clv}$, defined by the energy gap between the two states at the fracture point,
is also greatly reduced. $\Delta F_{\rm clv}$ is much lower than $k_{\rm B}T$
for the case of very strong repulsion. Therefore, the thin shell of the
elongated parent vesicle is easy to be fractured by thermal fluctuation, which
induces a direct transition to two child vesicles. Both Li et al. [26] and
Yamamoto et al. [43] observed that fission without necking occurs in the
presence of strong repulsive interactions, in good agreement with our
theoretical prediction.

Figure 3: Effect of electrostatic repulsion on the fission mechanism. $U$ is
plotted against $L$ for $c_{\rm b}=0.08{\rm M}$, where the case of weak
repulsion ($c_{\rm b}=0.10{\rm M}$) is shown in comparison. The dash line
indicates the energy gap $\Delta F_{\rm clv}$ between the elongated parent
vesicle and the two child vesicles at the fracture point, where the insets
visualize the corresponding morphology of the parent vesicle.

Our constrained SCFT simultaneously captures the kinetic pathway and the
microscopic mechanical response. Figure 4 quantifies the tensile force $f$
needed to separate two associated vesicles as a function of $L$, which
presents a microscopic analog to the stress-strain characterization in
material mechanics. For comparison, we also show the behavior of another two
types of soft particles, cylinders and spheres, which are formed by the same
type of PE as vesicle but with different $\alpha$ and $c_{\rm b}$ [49]. The
three soft particles show exact different mechanical response to the applied
force. Pure elasticity is observed for cylinders. Force increases almost
linearly with the elongation before an abrupt breaking, resembling pure
elastic materials such as brittle ceramics. Yielding feature is observed for
spheres: $f$ increases for small deformation, reaches maximum and drops until
fracture. This resembles ductile materials such as common metals. In stark
contrast, vesicle exhibits typical plastic behavior. A long plateau with
almost constant force appears after yielding, which resembles plastic
materials such as crystalline polymers [60]. Furthermore, Fig. 4 also
elucidates the super extensibility of vesicle in response to the tensile force
compared to cylinder and sphere. The two associated vesicles can be elongated
to more than 4 times the diameter of the single vesicle before fracture. The
super extensibility predicted here is in good agreement with recent simulation
by Park et al. when pulling a vesicle from a bilayer membrane [44]. It is
interesting to note that the mechanics for different macroscopic materials can
also be applied to soft nanoparticles at microscopic level.

Figure 4: Micromechanics in vesicle fission compared to the cases of cylinder
and sphere. The left panel plots the rescaled tensile forces $f/f_{\rm max}$
for separating two soft particles against the normalized c.m. separation
distance $L/L_{0}$. $f_{\rm max}$ are the maximum values of the force. $L_{0}$
are the characteristic lengths of a single force-free particle, i.e. the
diameter of vesicle and sphere, and the axial length of cylinder. The symbols
denote the fracture points. The right panel visualizes super extensibility of
vesicle. The morphologies of the two associated particles at the fracture
point are shown in right figures in comparison with those of a single force-
free particle (left figures). $\alpha=0.72$, $c_{\rm b}=0.10{\rm M}$ for
vesicle, $\alpha=0.50$, $c_{\rm b}=0.05{\rm M}$ for cylinder, and
$\alpha=0.72$, $c_{\rm b}=0.15{\rm M}$ for sphere.

The super extensibility exhibited in vesicle fission can be understood as
follows. Geometrically, the increase of surface area during the neck growth is
negligible for vesicle compared to cylinder and sphere (see Sec. III in the
Supplementary Material). The reduction of the area from both the outer and
inner surfaces of the vesicle shells compensates the increase of the area from
neck, resulting in little penalty in surface energy during neck growth.
Mechanically, the very low surface tension of vesicle imposes small resistance
to the expansion of surface area when pulling two vesicles apart [10, 61].
Materials continuously flow from cavity shells to neck (manifested as “in-
plane flow” [62]), resembling the alignment of chain segments in crystalline
polymers under tension. Thermodynamically, the stable regimes of vesicle and
cylinder are adjacent in phase diagram, which holds for all kinds of vesicles
regardless of the constituting molecules, e.g. surfactants [63], block
copolymers [4], PEs [49]. The transition from vesicle to cylinder involves the
breaking of both spherical symmetry and topological isomorphism, which
necessities a two-step nucleation with the existence of an intermediate state
[64]. Previous work found a metastable intermediate named ”vesicle-necklace”
near the phase boundary [49]. The highly extensible necking structure formed
during vesicle fission is essentially a vesicle-necklace and thus can be
stabilized against fracture.

In this Letter, we develop a constrained SCFT to study vesicle fusion/fission.
The theory systematically includes molecular structure and interactions. By
tracking the shape evolution and the corresponding free energy as a function
of c.m. separation distance, our theory simultaneously captures the kinetic
pathway and the mechanical response. We observe three features of morphology
along the pathway: parent vesicle with a single cavity,
hemifusion/hemifission, and two separated child vesicles. The transitions
between these morphologies are discontinuous as a result of breaking
topological isomorphism. The existence of metastable regions implies that
fusion and fission can undergo different kinetic pathways in the real process.
Our theory provides a unified description of both the original and modified
stalk model in vesicle fusion. With the increase of inter-vesicle repulsion,
we observe a significant reduction of the cleavage energy, indicating that
vesicle fission can be achieved without hemifission. The force-extension
relationship for separating two vesicles shows a long plateau, a typical
feature of plastic materials. This is in stark contrast to other soft
particles, where cylinder shows pure elasticity and sphere resembles ductile
metals. Our theoretical predictions on morphology, kinetics and mechanics are
in good agreement with the observations in experiments and simulations.
Although the PE vesicle is taken as a model system, we believe that the
fundamental physics based on the intrinsic topological features is universal
for vesicles formed by other constituting molecules, like surfactants, lipids,
block copolymers, etc. Furthermore, our constrained SCFT can be generalized to
study the interactions, kinetic process and micromechanics of various soft
matter systems such as polymer chains, coacervates, intrinsically disordered
proteins, micelles, nano/micro- gels and polymer-grafted nanoparticles.

Acknowledgment is made to the donors of the American Chemical Society
Petroleum Research Fund for partial support of this research. This research
used the computational resources provided by the Kenneth S. Pitzer Center for
Theoretical Chemistry.

## References

  * Mai and Eisenberg [2012] Y. Mai and A. Eisenberg, Chem. Soc. Rev. 41, 5969 (2012).
  * Karayianni and Pispas [2021] M. Karayianni and S. Pispas, J. Polym. Sci. 59, 1874 (2021).
  * Blanazs  _et al._ [2009] A. Blanazs, S. P. Armes, and A. J. Ryan, Macromol. Rapid Commun. 30, 267 (2009).
  * Discher and Eisenberg [2002] D. E. Discher and A. Eisenberg, Science 297, 967 (2002).
  * Jiang  _et al._ [2022] X. C. Jiang, T. Zhang, and J. Q. Gao, Adv. Drug Delivery Rev. 187, 114324 (2022).
  * Wang  _et al._ [2018] J. Wang, Y. Dong, Y. Li, W. Li, K. Cheng, Y. Qian, G. Xu, X. Zhang, L. Hu, P. Chen, W. Du, X. Feng, Y.-D. Zhao, Z. Zhang, B.-F. Liu, J. Wang, Y. Dong, W. Li, K. Cheng, Y. Qian, G. Xu, X. Zhang, P. Chen, W. Du, X. Feng, Y. d Zhao, Z. Zhang, B. f Liu, Y. Li, and L. Hu, Adv. Funct. Mater. 28, 1707360 (2018).
  * Lv  _et al._ [2022] W. Lv, Y. Liu, S. Li, L. Lv, H. Lu, and H. Xin, J. Nanobiotechnol. 20, 248 (2022).
  * Axthelm  _et al._ [2008] F. Axthelm, O. Casse, W. H. Koppenol, T. Nauser, W. Meier, and C. G. Palivan, J. Phys. Chem. B 112, 8211 (2008).
  * Palivan  _et al._ [2012] C. G. Palivan, O. Fischer-Onaca, M. Delcea, F. Itel, and W. Meier, Chem. Soc. Rev. 41, 2800 (2012).
  * Gelbart  _et al._ [2012] W. M. Gelbart, A. Ben-Shaul, and D. Roux,  _Micelles, membranes, microemulsions, and monolayers_ (Springer, 2012).
  * Johnson  _et al._ [2002] A. Johnson, J. Lewis, and B. ALBERTS,  _Molecular biology of the cell_ (Garland Science, 2002).
  * Jahn and Südhof [2003] R. Jahn and T. C. Südhof, Annu. Rev. Neurosci. 17, 219 (2003).
  * Jahn and Fasshauer [2012] R. Jahn and D. Fasshauer, Nature 490, 201 (2012).
  * Düzgüneş and Nir [1999] N. Düzgüneş and S. Nir, Adv. Drug Delivery Rev. 40, 3 (1999).
  * Poon  _et al._ [2020] W. Poon, B. R. Kingston, B. Ouyang, W. Ngo, and W. C. Chan, Nat. Nanotechnol. 15, 819 (2020).
  * Shen  _et al._ [2019] Z. Shen, H. Ye, M. Kröger, S. Tang, and Y. Li, Nanoscale 11, 15971 (2019).
  * Ho  _et al._ [2021] N. T. Ho, M. Siggel, K. V. Camacho, R. M. Bhaskara, J. M. Hicks, Y.-C. Yao, Y. Zhang, J. Köfinger, G. Hummer, and A. Noy, Proc. Natl. Acad. Sci. U.S.A. 118, e2016974118 (2021).
  * Luo and Eisenberg [2001] L. Luo and A. Eisenberg, Langmuir 17, 6804 (2001).
  * Smeijers  _et al._ [2006] A. F. Smeijers, A. J. Markvoort, K. Pieterse, and P. A. J. Hilbers, J. Phys. Chem. B 110, 13212 (2006).
  * Markvoort  _et al._ [2007] A. J. Markvoort, A. F. Smeijers, K. Pieterse, R. A. V. Santen, and P. A. Hilbers, J. Phys. Chem. B 111, 5719 (2007).
  * Markin  _et al._ [1984] V. S. Markin, M. M. Kozlov, and V. L. Borovjagin, Gen. Physiol. Biophys. 3, 361 (1984).
  * Chernomordik  _et al._ [1987] L. V. Chernomordik, G. B. Melikyan, and Y. A. Chizmadzhev, Biochim. Biophys. Acta, Rev. Biomembr. 906, 309 (1987).
  * Chernomordik  _et al._ [1995] L. Chernomordik, M. M. Kozlov, and J. Zimmerberg, J. Membr. Biol. 146, 1 (1995).
  * Grafmüller  _et al._ [2007] A. Grafmüller, J. Shillcock, and R. Lipowsky, Phys. Rev. Lett. 98, 218101 (2007).
  * Gao  _et al._ [2008] L. Gao, R. Lipowsky, and J. Shillcock, Soft Matter 4, 1208 (2008).
  * Li  _et al._ [2009] X. Li, Y. Liu, L. Wang, M. Deng, and H. Liang, Phys. Chem. Chem. Phys. 11, 4051 (2009).
  * Risselada  _et al._ [2012] H. J. Risselada, G. Marelli, M. Fuhrmans, Y. G. Smirnova, H. Grubmüller, S. J. Marrink, and M. Müller, PLoS One 7, e38302 (2012).
  * Marrink and Mark [2003] S. J. Marrink and A. E. Mark, J. Am. Chem. Soc. 125, 11144 (2003).
  * Shillcock and Lipowsky [2005] J. C. Shillcock and R. Lipowsky, Nat. Mater. 4, 225 (2005).
  * Siegel [1999] D. P. Siegel, Biophys. J. 76, 291 (1999).
  * Siegel [1993] D. P. Siegel, Biophys. J. 65, 2124 (1993).
  * Noguchi and Takasu [2001] H. Noguchi and M. Takasu, J. Chem. Phys. 115, 9547 (2001).
  * Matsuoka  _et al._ [1998] K. Matsuoka, L. Orci, M. Amherdt, S. Y. Bednarek, S. Hamamoto, R. Schekman, and T. Yeung, Cell 93, 263 (1998).
  * Spang  _et al._ [1998] A. Spang, K. Matsuoka, S. Hamamoto, R. Schekman, and L. Orci, Proc. Natl. Acad. Sci. U.S.A. 95, 11199 (1998).
  * Takei  _et al._ [1998] K. Takei, V. Haucke, V. Slepnev, K. Farsad, M. Salazar, H. Chen, and P. D. Camilli, Cell 94, 131 (1998).
  * Kozlovsky and Kozlov [2003] Y. Kozlovsky and M. M. Kozlov, Biophys. J. 85, 85 (2003).
  * Shemesh  _et al._ [2003] T. Shemesh, A. Luini, V. Malhotra, K. N. Burger, and M. M. Kozlov, Biophys. J. 85, 3813 (2003).
  * Zimmerberg and Kozlov [2005] J. Zimmerberg and M. M. Kozlov, Nat. Rev. Mol. Cell Biol. 7, 9 (2005).
  * Atilgan and Sun [2007] E. Atilgan and S. X. Sun, J. Chem. Phys. 126, 095102 (2007).
  * Campelo  _et al._ [2008] F. Campelo, H. T. Mc.m.ahon, and M. M. Kozlov, Biophys. J. 95, 2325 (2008).
  * Kozlov  _et al._ [2010] M. M. Kozlov, H. T. Mc.m.ahon, and L. V. Chernomordik, Trends Biochem. Sci. 35, 699 (2010).
  * Kozlov and Taraska [2022] M. M. Kozlov and J. W. Taraska, Nat. Rev. Mol. Cell Biol. , 1 (2022).
  * Yamamoto and Hyodo [2003] S. Yamamoto and S. A. Hyodo, J. Chem. Phys. 118, 7937 (2003).
  * Park  _et al._ [2019] S. Y. Park, J. S. Yang, Z. Li, P. Deng, X. Zhu, D. Young, M. Ericsson, R. L. Andringa, A. J. Minnaard, C. Zhu, F. Sun, D. B. Moody, A. J. Morris, J. Fan, and V. W. Hsu, Nat. Commun. 10, 1 (2019).
  * Katsov  _et al._ [2004] K. Katsov, M. Müller, and M. Schick, Biophys. J. 87, 3277 (2004).
  * Katsov  _et al._ [2006] K. Katsov, M. Müller, and M. Schickz, Biophys. J. 90, 915 (2006).
  * Lee and Schick [2007] J. Y. Lee and M. Schick, Biophys. J. 92, 3938 (2007).
  * Lee and Schick [2008] J. Lee and M. Schick, Biophys. J. 94, 1699 (2008).
  * Duan  _et al._ [2022] C. Duan, W. Li, and R. Wang, Macromolecules 55, 906 (2022).
  * Nakamura and Wang [2012] I. Nakamura and Z.-G. Wang, Soft Matter 8, 9356 (2012).
  * Wang and Wang [2011] R. Wang and Z.-G. Wang, J. Chem. Phys. 135 (2011).
  * Sing  _et al._ [2014] C. E. Sing, J. W. Zwanikken, and M. Olvera de La Cruz, Nat. Mater. 13, 694 (2014).
  * Hou and Qin [2018] K. J. Hou and J. Qin, Macromolecules 51, 7463 (2018).
  * Liu  _et al._ [2022] L. Liu, C. Duan, and R. Wang, Polymer 258, 125312 (2022).
  * Grosberg and Kuznetsov [1992] A. Y. Grosberg and D. Kuznetsov, Macromolecules 25, 1991 (1992).
  * Fredrickson [2006] G. Fredrickson,  _The equilibrium theory of inhomogeneous polymers_ (Oxford University Press, 2006).
  * Xu  _et al._ [2014] X. Xu, C. L. Ting, I. Kusaka, and Z.-G. Wang, Annu. Rev. Phys. Chem. 65, 449 (2014).
  * Bottacchiari  _et al._ [2022] M. Bottacchiari, M. Gallo, M. Bussoletti, and C. M. Casciola, Commun. Phys. 5, 1 (2022).
  * E and Vanden-Eijnden [2010] W. E and E. Vanden-Eijnden, Annu. Rev. Phys. Chem. 61, 391 (2010).
  * Ward and Sweeney [2012] I. M. Ward and J. Sweeney,  _Mechanical properties of solid polymers_ (John Wiley & Sons, 2012).
  * Brochard  _et al._ [1976] F. Brochard, P. De Gennes, and P. Pfeuty, J. Phys. 37, 1099 (1976).
  * Arroyo and DeSimone [2009] M. Arroyo and A. DeSimone, Phys. Rev. E 79, 031915 (2009).
  * Steed and Gale [2012] J. W. Steed and P. A. Gale,  _Supramolecular chemistry: from molecules to nanomaterials_ (John Wiley & Sons, 2012).
  * Duan and Wang [2023] C. Duan and R. Wang, Phys. Rev. Lett. 130, 158401 (2023).


# TREATED: Towards Universal Defense against Textual Adversarial Attacks

1st Bin Zhu  Cyberspace Institute of Advanced
Technology
Guangzhou University
Guangzhou, China
<EMAIL_ADDRESS>2nd Zhaoquan Gu  Cyberspace Institute of Advanced
Technology
Guangzhou University
Guangzhou, China
<EMAIL_ADDRESS>3th Le Wang  Cyberspace Institute of Advanced
Technology
Guangzhou University
Guangzhou, China
<EMAIL_ADDRESS>4th Zhihong Tian  Cyberspace Institute of Advanced
Technology
Guangzhou University
Guangzhou, China
<EMAIL_ADDRESS>
###### Abstract

Recent work shows that deep neural networks are vulnerable to adversarial
examples. Much work studies adversarial example generation, while very little
work focuses on more critical adversarial defense. Existing adversarial
detection methods usually make assumptions about the adversarial example and
attack method (e.g., the word frequency of the adversarial example, the
perturbation level of the attack method). However, this limits the
applicability of the detection method. To this end, we propose TREATED, a
universal adversarial detection method that can defend against attacks of
various perturbation levels without making any assumptions. TREATED identifies
adversarial examples through a set of well-designed reference models.
Extensive experiments on three competitive neural networks and two widely used
datasets show that our method achieves better detection performance than
baselines. We finally conduct ablation studies to verify the effectiveness of
our method.

###### Index Terms:

Deep learning, Natural Language Processing, Adversarial Examples, Adversarial
Detection

##  I Introduction

Through powerful expressive abilities, deep neural networks(DNNs) have
achieved great success in many areas [1, 2]. However, recent work has revealed
the fragility of DNNs. They are vulnerable to adversarial examples [3, 4]. By
adding invisible perturbations to the original examples, attackers can create
adversarial examples which render the input misclassified. An increasing
number of studies have shown that adversarial examples exist widely in
computer vision(CV), natural language processing(NLP) and other domains. The
existence of adversarial examples threatens the security-critical models and
has garnered widespread attention[5, 6].

In NLP, most work focuses on the generation of natural language adversarial
examples to understand their nature [7, 8, 9, 10, 11]. On the other hand, how
to defend against textual adversarial attacks is a relatively more important
and challenging problem. Existing defensive methods can be divided into two
categories, adversarial training and adversarial detection.

Adversarial training refers to mixing adversarial examples with clean examples
and retraining the model to improve the model’s robustness[12, 13].
Adversarial training is widely used, but it is resource-consuming to retrain
the model. Moreover, such defence methods make strong assumptions about attack
methods(e.g., the strategy of word substitution, the perturbation level and so
on), which limit their defensive capabilities and scope of application[14,
15].

Adversarial detection typically uses auxiliary components to recover or reject
adversarial examples in the input to defend against adversarial attacks[16,
17]. In adversarial detection, retraining is not required. But the defender
needs to make assumptions about the characteristic of adversarial
examples(e.g., the word frequency) so that they can distinguish adversarial
and clean examples. Since adversarial examples have not been thoroughly
studied, these assumptions make adversarial detection more empirical.

In this paper, we do not directly make assumptions about attack methods or
adversarial examples but use a carefully constructed set of reference models
to reflect the nature of adversarial examples indirectly. To be specific, we
use the different predictions of reference models on clean and adversarial
examples to distinguish them accurately and block adversarial attacks.

Through empirical analysis, we argue that these reference models need to meet
two criteria, 1.their predictions are consistent on clean examples, and
2.their predictions are inconsistent on the adversarial examples against the
victim model.

Through theoretical analysis, we prove the upper and lower bounds of detection
accuracy that our method can achieve.

In practice, by decomposing the embeddings of the victim model, we obtain
reference models that meet the above conditions to block adversarial attacks.

Our contributions are summarized as follows:

  * 1)

We propose TREATED, a universal method for blocking textual adversarial
attacks without any assumption about attack methods or adversarial examples.
Thus it can be applied in more realistic and complicated environments.

  * 2)

We empirically and theoretically illustrate the superiority of our method.
Comprehensive experiments show that TREATED significantly outperforms two
advanced defense methods. We will release our implementations for the
convenience of future benchmarking.

Figure 1: (a) Under the prior of $C$, the probability that $X$ is an
adversarial example at different $p$ and $q$. (b) Under the prior of $D$, the
probability that $X$ is an adversarial example at different $p$ and $q$.

##  II Background and Related Work

###  II-A Adversarial Attacks

Given a classifier $F$ and an input-label pair $(x,y)$, the attacker aims to
craft an adversarial example $x_{adv}$ misclassified by $F$ while $x_{adv}$ is
in the $\epsilon$ neighborhood of $x$ as

$F(x_{adv})\neq y,s.t.~{}\left\|x-x_{adv}\right\|\leq\epsilon.$ (1)

Many works have leveraged the loss function of the classifier and the gradient
ascent method to find qualified adversarial examples[4, 18, 19]. However, this
is not compatible with NLP tasks because the word embedding obtained by
gradient information cannot correspond to a valid word. The valid words close
to it can only be found by the projection method[20, 21], which reduces the
effectiveness of the attack.

Considering that the input of the NLP model is usually discrete tokens, the
addition, deletion and replacement of tokens have naturally become common
methods of textual adversarial attacks[22, 8]. For example, first, rank the
tokens by importance and determine the replacement order; then use different
strategies to find the best replacement for each token, thereby significantly
reducing the time complexity of the search and forming an adversarial example.
In addition, some works use paraphrasing[23, 24], text generation[25, 26],
generative adversarial networks(GAN)[27], reinforcement learning[28] and other
methods[29] to generate adversarial examples.

###  II-B Adversarial Defense

Adversarial Training. Adversarial training is widely used to improve the
robustness of DNNs[4, 30, 31]. By adding perturbations in the gradient
direction to the training samples, adversarial training has achieved great
success in many tasks. Recent studies have shown that adversarial training
also helps to improve the generalization ability of DNNs[13, 32].

However, compared to standard training, adversarial training usually takes
several times longer because the gradient of the training samples is
repeatedly calculated, which is unacceptable in resource-constrained
scenarios.

Adversarial Detection. The goal of adversarial detection is to identify the
existence of adversarial examples, thereby rejecting them. Most work aims to
learn a representation to discriminate adversarial and benign inputs from the
victim model[33, 34, 35, 36, 37]. However, in NLP, whether the examples are
adversarial is challenging to judge, so some methods try to recover all
inputs[16, 38]. Nevertheless, this will inevitably destroy the original inputs
and may cause the model’s performance to decrease.

Spelling Correction and Grammar Error Correction. Spelling correction[39, 40]
and grammar error correction[41, 42] are also used for blocking textual
adversarial attacks. However, these methods can only deal with attacks that
bring grammatical and spelling errors and cannot identify adversarial examples
crafted by word substitution.

##  III TREATED

###  III-A Empirical Analysis

Given a perfect classify $F_{p}$ which always classifies correctly, and the
victim model $F_{v}$, we can always identify whether $F_{v}$ classifies
correctly on input $X$(whether adversarial or not), blocking adversarial
attacks because $F_{p}$ can always give the ground truth label $y_{true}$ of
$X$.

Note that $y_{true}$ is not necessary here. We only need to know whether the
predictions of $F_{p}$ and $F_{v}$ are consistent. Then we can identify
whether the prediction of $F_{v}$ is correct without knowing the ground truth
label. It means that as long as there exists a set of reference models
$\\{F_{r}\\}$ so that $F_{r_{i}}$ have consistent predictions on clean
examples and inconsistent predictions on adversarial examples against $F_{v}$,
we can identify whether $X$ is adversarial.

###  III-B Theoretical Analysis

Mark event $A$ as $\\{F_{r}\\}$ have consistent predictions on clean examples,
event $B$ as $\\{F_{r}\\}$ have consistent predictions on adversarial examples
against $F_{v}$. We assume that $P(A)=p$ and $P(B)=q$. For an input $X$, mark
event $C$($D$) as $\\{F_{r}\\}$ have consistent(inconsistent) predictions on
$X$ and event $E$ as $X$ is adversarial. We have

$\displaystyle P(E|C)=\frac{P(B)}{P(A)+P(B)}=\frac{q}{p+q},$ (2)
$\displaystyle P(E|D)=\frac{1-P(B)}{(1-P(A))+(1-P(B))}=\frac{1-q}{2-(p+q)}.$

In our case, we expect $P(E|C)$ to be as small as possible and $P(E|D)$ to be
as large as possible so that we can identify if $X$ is adversarial. For
example, if $p=0.95$ and $q=0.1$, then $P(E|C)\approx 0.095$ and
$P(E|D)\approx 0.947$. It means that we have a very high probability of making
a correct judgment on whether $X$ is an adversarial example. Figure.1 shows
the probability of X is adversarial under prior $C$ and $D$ at different $p$
and $q$.

###  III-C Design of Reference Models

We expect the reference models $\\{F_{r}\\}$ have a high $p$ and a low $q$ so
that we can identify if $X$ is adversarial with a high accuracy.

However, these two criteria seem to be contradictory. A high $p$ means that
the models have similar parameter distributions and share a lot of knowledge,
which also shares vulnerabilities, significantly enhancing the transferability
of adversarial examples. In other words, adversarial examples can reduce the
accuracy of $\\{F_{r}\\}$ to a low level so that the outputs of $\\{F_{r}\\}$
on the adversarial examples are also consistent, which hinders the detection
of adversarial examples. Conversely, a low $q$ means that there are
significant differences among $\\{F_{r}\\}$, and it is not easy to ensure
consistent predictions on clean examples. So the key lies in how to construct
$\\{F_{r}\\}$.

Recall the goal of textual adversarial attacks. It aims to find suitable
perturbations and apply them to the original input. Essentially, this changes
the embeddings that are finally input to the model. It inspires us to
decompose the embedding layer of $F_{v}$ into $N$ parts and share the
subsequent layers to construct $N$ reference models(i.e., $\\{F_{r}\\}$). In
this way, we argue that $\\{F_{r}\\}$ have a very high $p$ since they are
jointly trained. Moreover, adversarial examples act on the embedding layer of
$F_{v}$, which is decomposed to construct $\\{F_{r}\\}$. Therefore
$\\{F_{r}\\}$ share the increased loss caused by adversarial examples, thereby
reducing their transferability, and thus have a low $q$.

Note that the same accuracy does not mean consistent predictions. Models may
make different predictions on different samples but have the same accuracy.

##  IV Experiments

We attack three text classification models on two popular datasets using
TextAttack[43]. We also make reliable evaluations by automatic evaluation.

###  IV-A Experimental Setup

####  IV-A1 Baselines

We choose FGWS[17] as defense baselines since it achieves state-of-the-art
performance in textual adversarial detection. Follow [16, 17], we use two word
level attack methods, PWWS[8] and Genetic[22], to make a fair comparison.

PWWS generated adversarial texts against classification models by two
strategies: 1) the word substitution strategy, and 2) the replacement order
strategy. The word substitution strategy used the synonym substitution method.
Through the named entity analysis techniques, it could improve the semantic
similarity and reduce grammatical errors.

Genetic utilize the population-based optimization algorithm to reorganize the
original sentence, yielding sentences with good attack effects.

Since TREATED is a universal defense method that can defend against attacks of
multiple perturbation levels, we further utilize TextBugger[29],
DeepWordBug[44] and TextFooler[10] to evaluate its defensive ability against
attacks of different perturbation levels.

####  IV-A2 Victim Models and Datasets

Follow [16, 17], we conduct experiments on two classification datasets.

Table I: Summary of the datasets Dataset | Classes | Train | Test | Avg Len
---|---|---|---|---
SST-2 | 2 | 67,349 | 872 | 17
IMDb | 2 | 25,000 | 25,000 | 201
Table II: Parameters of the models. | CNN | LSTM | RoBERTa
---|---|---|---
Embedding dim. | 300 | 300 | 768
Filters | 128 | - | -
Kernel size | 3 | - | -
LSTM units | - | 128 | -
Hidden dim. | 100 | 100 | 100

The Stanford Sentiment Treebank(SST-2)[45] is a sentence-level sentiment
analysis dataset. The movie reviews are given by professionals.

The IMDb reviews dataset[46] is a document-level sentiment analysis dataset
containing 50,000 non-professional movie reviews, of which 25,000 are
positive, and 25,000 are negative reviews.

We perform adversarial attacks on three neural networks, WordCNN[1], LSTM[47]
and RoBERTa[48].

Table III: Adversarial detection performances of FGWS and TREATED, including the accuracy increased after adversarial detection(Increased acc.), the true positive rate and false positive rate(TPR, FPR) and F1. Dataset/Model | Attack | Increased acc. | TPR(FPR) | F1
---|---|---|---|---
FGWS | TREATED | FGWS | TREATED | FGWS | TREATED
SST-2/LSTM | PWWS | +30.0 | +35.7 | - | 62.2(20.49) | 63.9 | 68.1
Genetic | +29.2 | +33.5 | - | 61.0(21.47) | 60.3 | 65.0
IMDb/CNN | PWWS | +60.0 | +84.8 | - | 91.9(0.05) | 83.9 | 93.2
Genetic | +57.8 | +66.3 | - | 90.5(0.14) | 83.5 | 88.4

Both the datasets and networks are widely used in adversarial learning in NLP.
Details can be found in Table. I and Table. II.

###  IV-B Experimental Results

We generate 1,000 adversarial examples for each model, dataset, and attack
method as part of the detection set. The corresponding clean examples are used
as the other part of the detection set. We report the increased accuracy of
the model after adversarial detection and the true positive rate(TPR), false
positive rate(FPR) and F1 of the detection method to make a comprehensive
evaluation.

We make a detailed comparison with FGWS, the state-of-the-art detecting
method. Table. III shows the overall defense performance on CNN and LSTM
models. As can be seen, TREATED can restore the models to higher accuracy. The
defense performance decline on the SST-2 dataset. But it still outperforms
FGWS. Our method performs better in detection accuracy, improving the F1 score
by up to 9.3% on the CNN model and IMDb dataset.

We report the results of defending against more attacks on the RoBERTa model
in Table.IV. TREATED performs well against attacks of different perturbation
levels, such as word-level, char-level and multi-level. It can always increase
the accuracy of the models by more than 40% in the face of various attacks.

Table IV: Defense performances on IMDb dataset and RoBERTa against more attacks. Attack | Increased acc. | TPR(FPR) | F1
---|---|---|---
PWWS | +64.7 | 69.4(14.47) | 75.5
Genetic | +40.0 | 71.4(35.71) | 69.0
DeepWordBug | +40.4 | 58.6(16.11) | 67.1
TextBugger | +45.0 | 49.9(12.65) | 61.4

##  V Discussion

###  V-A Influence on Unperturbed Data

We further study the effect of TREATED on the original accuracy of the models.
We use the original test set as the detection set to observe whether the
accuracy decrease significantly.

As can be seen in Table. V, the accuracy of WordCNN and RoBERTa drop by 3.5%
and 2.6%, respectively, which are almost negligible. It shows that TREATED can
block adversarial attacks without affecting the original performance of the
model.

Table V: Influence of TREATED on unperturbed data. Dataset/Model | Orinigal acc. | Detecting acc.
---|---|---
IMDb/CNN | 89.3 | 85.8
IMDb/RoBERTa | 90.9 | 88.3

###  V-B Ablation Study

We construct $\\{F_{r}\\}$ by decomposing the embedding layer of the victim
model. In order to illustrate its effectiveness, we conduct thorough ablation
studies. We use standard training models(STM) as reference models to detect
adversarial examples.

Table. VI shows the detection performance of STM and TREATED. Under word- and
char-level attacks, TREATED can increase the accuracy of victim models by more
than 88%, which means that TREATED completely prevents adversarial attacks. On
the most difficult multi-level to defend, treated increases the accuracy of
the victim model by 77.4%. TREATED also maintains a TPR above 96%, an FPR
below 6% and an F1 above 95%, indicating very few misjudgments.

Then we replace the reference models with STM. The defense performance
significantly decreases, which fully illustrates the superiority of
decomposition of the embedded layer.

In order to further verify the advantages of decomposition of the embedding
layer, we report $p$ and $q$ under different conditions. As shown in table
VII, our method always has a higher $p$ and a lower $q$, verifying that our
method will have a higher detection accuracy.

Table VI: Ablation study on adversarial detection performances for TREATED and STM against attacks of different perturbation levels. The victim model is WordCNN trained on IMDb. Attack | Level | Defense | Increased acc. | TPR(FPR) | F1
---|---|---|---|---|---
TextFooler | word | STM | +58.7 | 63.6(15.82) | 70.9
TREATED | +88.6 | 96.0(5.20) | 95.4
DeepWordBug | char | STM | +68.6 | 70.5(18.16) | 74.8
TREATED | +88.5 | 96.2(5.22) | 95.5
TextBugger | multi | STM | +61.2 | 66.2(15.87) | 72.7
TREATED | +77.4 | 96.3(5.97) | 95.2
Table VII: Ablation study on $p$ and $q$ on different victim models and test sets between TREATED and STM. The attack method is PWWS. | SST-2/LSTM | IMDb/CNN | IMDb/RoBERTa
---|---|---|---
| STM | TREATED | STM | TREATED | STM | TREATED
$p\uparrow$ | 0.7052 | 0.7951 | 0.7842 | 0.8723 | 0.8422 | 0.8840
$q\downarrow$ | 0.6471 | 0.3777 | 0.3142 | 0.0813 | 0.5483 | 0.5006

##  VI Conclusion and Future Work

We propose TREATED, a universal adversarial detection method to defend against
textual adversarial attacks with multiple perturbation levels through
empirical and theoretical analysis. By decomposing the embedding layer, we
construct a set of reference models that can make consistent predictions on
clean examples and inconsistent predictions on adversarial examples. Thus we
can identify adversarial examples and block attacks via these reference
models. Extensive experiments prove the effectiveness of TREATED. Compared
with the state-of-the-art defense method, our method has higher detection
accuracy without harming the original performance. Ablation studies illustrate
the superiority of our embedding decomposition method.

Further improving the defense performance on large-scale pre-training
model(e.g., RoBERTa) is one of our future works. Besides, it is also promising
to find other ways to construct $\\{F_{r}\\}$.

## References

  * [1] Y. Kim, “Convolutional neural networks for sentence classification,” in _Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP)_ , Oct. 2014, pp. 1746–1751.
  * [2] J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “BERT: Pre-training of deep bidirectional transformers for language understanding,” in _Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers)_ , Jun. 2019, pp. 4171–4186.
  * [3] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. J. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” in _2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings_ , 2014.
  * [4] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in _3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings_ , Y. Bengio and Y. LeCun, Eds., 2015.
  * [5] I. Evtimov, K. Eykholt, E. Fernandes, T. Kohno, B. Li, A. Prakash, A. Rahmati, and D. Song, “Robust physical-world attacks on machine learning models,” _CoRR_ , vol. abs/1707.08945, 2017.
  * [6] W. E. Zhang, Q. Z. Sheng, A. A. F. Alhazmi, and C. Li, “Adversarial attacks on deep-learning models in natural language processing: A survey,” _ACM Trans. Intell. Syst. Technol._ , vol. 11, no. 3, pp. 24:1–24:41, 2020\.
  * [7] J. Ebrahimi, A. Rao, D. Lowd, and D. Dou, “HotFlip: White-box adversarial examples for text classification,” in _Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers)_ , Jul. 2018, pp. 31–36.
  * [8] S. Ren, Y. Deng, K. He, and W. Che, “Generating natural language adversarial examples through probability weighted word saliency,” in _Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics_ , Jul. 2019, pp. 1085–1097.
  * [9] Y. Zang, F. Qi, C. Yang, Z. Liu, M. Zhang, Q. Liu, and M. Sun, “Word-level textual adversarial attacking as combinatorial optimization,” in _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_ , Jul. 2020, pp. 6066–6080.
  * [10] D. Jin, Z. Jin, J. T. Zhou, and P. Szolovits, “Is BERT really robust? A strong baseline for natural language attack on text classification and entailment,” in _The Thirty-Fourth AAAI Conference on Artificial Intelligence, AAAI 2020, New York, NY, USA, February 7-12, 2020_ , 2020.
  * [11] L. Li, R. Ma, Q. Guo, X. Xue, and X. Qiu, “BERT-ATTACK: Adversarial attack against BERT using BERT,” in _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)_ , Nov. 2020, pp. 6193–6202.
  * [12] T. Miyato, A. M. Dai, and I. J. Goodfellow, “Adversarial training methods for semi-supervised text classification,” in _5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings_ , 2017.
  * [13] C. Zhu, Y. Cheng, Z. Gan, S. Sun, T. Goldstein, and J. Liu, “Freelb: Enhanced adversarial training for natural language understanding,” in _8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020_ , 2020.
  * [14] M. Sato, J. Suzuki, H. Shindo, and Y. Matsumoto, “Interpretable adversarial perturbation in input embedding space for text,” in _Proceedings of the Twenty-Seventh International Joint Conference on Artificial Intelligence, IJCAI 2018, July 13-19, 2018, Stockholm, Sweden_ , J. Lang, Ed., 2018.
  * [15] X. Dong, A. T. Luu, R. Ji, and H. Liu, “Towards robustness against natural language word substitutions,” in _9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021_ , 2021.
  * [16] Y. Zhou, J.-Y. Jiang, K.-W. Chang, and W. Wang, “Learning to discriminate perturbations for blocking adversarial attacks in text classification,” in _Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP)_ , Nov. 2019, pp. 4904–4913.
  * [17] M. Mozes, P. Stenetorp, B. Kleinberg, and L. D. Griffin, “Frequency-guided word substitutions for detecting textual adversarial examples,” in _Proceedings of EACL 2021, Online, April 19 - 23, 2021_ , P. Merlo, J. Tiedemann, and R. Tsarfaty, Eds., 2021.
  * [18] A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial machine learning at scale,” in _5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings_ , 2017.
  * [19] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in _6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings_ , 2018.
  * [20] N. Papernot, P. D. McDaniel, A. Swami, and R. E. Harang, “Crafting adversarial input sequences for recurrent neural networks,” in _2016 IEEE Military Communications Conference, MILCOM 2016, Baltimore, MD, USA, November 1-3, 2016_ , J. Brand, M. C. Valenti, A. Akinpelu, B. T. Doshi, and B. L. Gorsic, Eds., 2016.
  * [21] S. Samanta and S. Mehta, “Towards crafting text adversarial samples,” _CoRR_ , vol. abs/1707.02812, 2017.
  * [22] M. Alzantot, Y. Sharma, A. Elgohary, B.-J. Ho, M. Srivastava, and K.-W. Chang, “Generating natural language adversarial examples,” in _Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing_ , Oct.-Nov. 2018, pp. 2890–2896.
  * [23] M. Iyyer, J. Wieting, K. Gimpel, and L. Zettlemoyer, “Adversarial example generation with syntactically controlled paraphrase networks,” in _Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long Papers)_ , Jun. 2018, pp. 1875–1885.
  * [24] Y. Zhang, J. Baldridge, and L. He, “PAWS: Paraphrase adversaries from word scrambling,” in _Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers)_ , Jun. 2019, pp. 1298–1308.
  * [25] T. Wang, X. Wang, Y. Qin, B. Packer, K. Li, J. Chen, A. Beutel, and E. Chi, “CAT-gen: Improving robustness in NLP models via controlled adversarial text generation,” in _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)_ , Nov. 2020, pp. 5141–5146.
  * [26] B. Wang, H. Pei, B. Pan, Q. Chen, S. Wang, and B. Li, “T3: Tree-autoencoder constrained adversarial text generation for targeted attack,” in _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)_. Online: Association for Computational Linguistics, Nov. 2020, pp. 6134–6150. [Online]. Available: https://www.aclweb.org/anthology/2020.emnlp-main.495
  * [27] Z. Zhao, D. Dua, and S. Singh, “Generating natural adversarial examples,” in _6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings_ , 2018\.
  * [28] P. Vijayaraghavan and D. Roy, “Generating black-box adversarial examples for text classifiers using a deep reinforced model,” in _Machine Learning and Knowledge Discovery in Databases - European Conference, ECML PKDD 2019, Würzburg, Germany, September 16-20, 2019, Proceedings, Part II_ , ser. Lecture Notes in Computer Science, vol. 11907, 2019.
  * [29] J. Li, S. Ji, T. Du, B. Li, and T. Wang, “Textbugger: Generating adversarial text against real-world applications,” in _26th Annual Network and Distributed System Security Symposium, NDSS 2019, San Diego, California, USA, February 24-27, 2019_ , 2019.
  * [30] A. Shafahi, M. Najibi, A. Ghiasi, Z. Xu, J. P. Dickerson, C. Studer, L. S. Davis, G. Taylor, and T. Goldstein, “Adversarial training for free!” in _NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada_ , 2019, pp. 3353–3364.
  * [31] D. Zhang, T. Zhang, Y. Lu, Z. Zhu, and B. Dong, “You only propagate once: Accelerating adversarial training via maximal principle,” in _NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada_ , 2019.
  * [32] H. Jiang, P. He, W. Chen, X. Liu, J. Gao, and T. Zhao, “SMART: Robust and efficient fine-tuning for pre-trained natural language models through principled regularized optimization,” in _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_ , Jul. 2020, pp. 2177–2190.
  * [33] X. Li and F. Li, “Adversarial examples detection in deep networks with convolutional filter statistics,” in _IEEE International Conference on Computer Vision, ICCV 2017, Venice, Italy, October 22-29, 2017_ , 2017.
  * [34] K. Grosse, P. Manoharan, N. Papernot, M. Backes, and P. D. McDaniel, “On the (statistical) detection of adversarial examples,” _CoRR_ , vol. abs/1702.06280, 2017.
  * [35] X. Ma, B. Li, Y. Wang, S. M. Erfani, S. N. R. Wijewickrema, G. Schoenebeck, D. Song, M. E. Houle, and J. Bailey, “Characterizing adversarial subspaces using local intrinsic dimensionality,” in _6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings_ , 2018.
  * [36] R. Feinman, R. R. Curtin, S. Shintre, and A. B. Gardner, “Detecting adversarial samples from artifacts,” _CoRR_ , vol. abs/1703.00410, 2017.
  * [37] J. H. Metzen, T. Genewein, V. Fischer, and B. Bischoff, “On detecting adversarial perturbations,” in _5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings_ , 2017.
  * [38] J. Li, T. Du, S. Ji, R. Zhang, Q. Lu, M. Yang, and T. Wang, “Textshield: Robust text classification based on multimodal embedding and neural machine translation,” in _29th USENIX Security Symposium, USENIX Security 2020, August 12-14, 2020_ , 2020.
  * [39] E. Mays, F. J. Damerau, and R. L. Mercer, “Context based spelling correction,” _Inf. Process. Manag._ , vol. 27, no. 5, pp. 517–522, 1991\.
  * [40] S. Zhang, H. Huang, J. Liu, and H. Li, “Spelling error correction with soft-masked BERT,” in _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_ , Jul. 2020, pp. 882–890.
  * [41] Y. Wang, Y. Wang, J. Liu, and Z. Liu, “A comprehensive survey of grammar error correction,” _CoRR_ , vol. abs/2005.06600, 2020.
  * [42] K. Sakaguchi, M. Post, and B. Van Durme, “Grammatical error correction with neural reinforcement learning,” in _Proceedings of the Eighth International Joint Conference on Natural Language Processing (Volume 2: Short Papers)_ , Nov. 2017, pp. 366–372.
  * [43] J. Morris, E. Lifland, J. Y. Yoo, J. Grigsby, D. Jin, and Y. Qi, “Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp,” in _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations_ , 2020, pp. 119–126.
  * [44] J. Gao, J. Lanchantin, M. L. Soffa, and Y. Qi, “Black-box generation of adversarial text sequences to evade deep learning classifiers,” in _2018 IEEE Security and Privacy Workshops, SP Workshops 2018, San Francisco, CA, USA, May 24, 2018_. IEEE Computer Society, 2018, pp. 50–56.
  * [45] R. Socher, A. Perelygin, J. Wu, J. Chuang, C. D. Manning, A. Ng, and C. Potts, “Recursive deep models for semantic compositionality over a sentiment treebank,” in _Proceedings of EMNLP_. Seattle, Washington, USA: Association for Computational Linguistics, Oct. 2013, pp. 1631–1642.
  * [46] A. L. Maas, R. E. Daly, P. T. Pham, D. Huang, A. Y. Ng, and C. Potts, “Learning word vectors for sentiment analysis,” in _Proceedings of ACL_. Portland, Oregon, USA: Association for Computational Linguistics, Jun. 2011, pp. 142–150.
  * [47] S. Hochreiter and J. Schmidhuber, “Long short-term memory,” _Neural Comput._ , vol. 9, no. 8, pp. 1735–1780, 1997.
  * [48] Y. Liu, M. Ott, N. Goyal, J. Du, M. Joshi, D. Chen, O. Levy, M. Lewis, L. Zettlemoyer, and V. Stoyanov, “Roberta: A robustly optimized BERT pretraining approach,” _CoRR_ , vol. abs/1907.11692, 2019.