It has been shown that many Authorship Identification systems are vulnerable to adversarial attacks, where an author actively tries to fool the classifier. We propose to tackle the adversarial Authorship Verification task by augmenting the training set with synthetic textual examples. In this ongoing study, we present preliminary results using two learning algorithms (SVM and Neural Network), and two generation strategies (based on language modeling and GAN training) for two generator models, on three datasets. We empirically show that data augmentation may help improve the performance of the classifier in an adversarial setup.
Authorship Identification (AId) is the branch of Authorship Analysis concerned with uncovering the
true identity of the author of a written document whose paternity is unknown or debated. Authorship
Verification (AV) is one of the main tasks of AId in which, given a single candidate author and a target
document , the goal is to infer whether is the real author of or not [
However, the performance of the classifier might be negatively afected when an “adversary” is at play,
i.e., when an agent (a human or a computer) actively tries to mislead the classifier, either by concealing
their own writing style or by imitating someone else’s [
In this ongoing work, we investigate ways for improving the performance of an AV classifier by augmenting the training set with synthetically generated examples. The intuition is that, if a classifier has been exposed to textual examples that mimic an adversarial setting during training, it may develop resiliency toward cases of forgery. In this short paper, we present some preliminary results of our study. All the experiments are implemented in Python; the code to reproduce our experiments is available at:
The annual PAN shared tasks [
The use of data augmentation for improving classification performance is not a novelty. Researchers
have explored various techniques for generating synthetic textual examples, such as the random
combination of real texts [
The work by Hatua et al. [20] bears some similarities with our methodology: in their experiments tackling the fact-checking task, data augmentation with a GAN-based generator proved useful. Note that, unlike this work, we cannot employ the generated examples as synthetic positive instances, but rather as particularly dificult instances for the negative class. Otherwise, the AV classifier would learn to label fraudulent instances as if written by the author of interest.
The datasets we consider are described below. For each dataset, we split each document into nonoverlapping chunks of 100 tokens (words and punctuation symbols); chunks with less than 25 words are discarded. We exclude authors with less than 10 chunks in the training set.
• T w e e p F a k e . This dataset was created and made publicly available1 by Fagni et al. [
We experiment with two architectures for generating adversarial examples. The first one is DistilGPT2 [23] (hereafter simply denoted as GPT), a distilled variant of OpenAI GPT-2, made available as part of the Huggingface’s t r a n s f o r m e r s library.4 The second one, denoted TRA1h, is based on the T r a n s f o r m e r E n c o d e r module by Pytorch5 [24], and operates with one-hot vectors. The inputs are processed by a linear layer (without bias) that converts the sparse one-hot vectors into dense embeddings.
We experiment with two diferent training strategies for the generators: • Language Model Training (LM). The model is trained to predict the next word given a sequence.
More formally, given a real sentence [ 1, 2, … , ] of tokens, the model aims to maximize the conditional probability ( | 1, 2, … , −1 ). In our case, following [25], we train the model only using the written examples of (our author of interest). The generator thus is expected to act as an imitator of ’s writing style. • Generative Adversarial Network Training (GAN). A Generative Adversarial Network (GAN) [26] has two components: a Generator ( ), that produces fake new examples, and a Discriminator ( ), that labels examples either as “real” (i.e., coming from the real-world distribution) or “fake” (i.e., produced by ). Both components play a min-max game, where tries to correctly discover the forgeries issued by , while at the same time tries to produce examples that manage to fool . We explore various configurations inspired by GANs, in which we vary the generator and the discriminator. In particular, we use one of the NN classifiers (NN gpt or NN1h) explained in Section 3.3 as our discriminator , while we use GPT or TRA1h as our generator . The generator is thus trained to generate examples that are supposed to be particularly dificult for the classifier. In order to generate sequences of tokens, one typically resorts to the a r g m a x of the posterior distribution over the token vocabulary. However, the a r g m a x operator breaks the flow of the gradient throughout the network, thus obstructing the GAN training. In order to avoid this, we either generate sequences of hidden states in the case of GPT, or apply the Gumbel-Softmax [ 27] in the case of TRA1h6.
We consider two diferent learning algorithms, Support Vector Machine (SVM) and Convolutional Neural Networks (NN) as methods for training the AV classifier.
For SVM, we employ the SVC implementation from the s c i k i t - l e a r n package7, with hyper-parameter
optimization. We employ a combination of features including the normalized relative frequency of
function words and the POS-tags, and the word lengths; we call these features B a s e F e a t u r e s . We also
extract all character -grams (with in the range [
For NN, we develop an architecture with two parallel branches. In one branch, when the input is a real example, words are converted to one-hot vectors that are simply embedded through a linear layer (without bias); when the input is a fake example, the embeddings are either generated by feedforwarding the “quasi” one-hot vectors resulting from the Gumbel-Softmax in the case of TRA 1h (we call this setting NN1h), or are instead directly taken from the hidden states of GPT(we call this setting NNgpt). The rest of the branch is composed of two parallel convolutional blocks, each with two convolutional layers with kernel size equal to 3 and 5 respectively. The other branch is made of two linear layers and receives the same B a s e F e a t u r e s as the SVM classifier as input; this branch is simply skipped when the inputs are taken from hidden states, and thus cannot be converted into sentences. The outputs of 4Documentation available at: https://huggingface.co/distilgpt2. 5Documentation available at: https://pytorch.org/docs/stable/generated/torch.nn.TransformerEncoder.html. 6This means that the examples we generate at training time are not comprehensible for a human. However, note this is not a problem since they are solely intended to imitate the input format that the discriminator receives as input in the GAN training. Viceversa, the trained generators do indeed produce examples that can be human-readable. 7Documentation available at: https://scikit-learn.org/stable/modules/generated/sklearn.svm.SVC.html the two branches are finally concatenated and fed into two linear layers, that produce the posterior probabilities for the classes and . For the training process, we employ the A d a m W optimizer [28] with a learning rate of 0.001, a batch size of 32, and Cross Entropy as the loss function.
Given a dataset, we sequentially take each author in the training set as the author of interest and all other authors as . We focus on evaluating the improvement obtained by augmenting the training data fed to the classifier (SVM, NN gpt, and NN1h). We first evaluate the classifier trained without any augmentation, and use it as baseline to asses the contribution of the generated samples when added to the training as negative instances. We define the classifiers trained via data augmentation with the nomenclature + , where is the classifier, is the generator and is the generator training strategy.
Each time we generate examples (this happens for each epoch in the GAN training, and for generating the final data augmentation when the generator training is over), we produce min{5 × , 500} examples, where is the number of training examples by . The tokens are generated by prompting the first 5 original tokens from a randomly chosen example by until the length of the original text is reached. We use vanilla accuracy and 1 as our evaluation metrics, and report averaged results across all AV experiments. For each evaluation metric, we also report the relative improvement (Δ%) with respect to the classifiers without data augmentation. We also carry out tests of statistical significance for the performance diference ( M) via the McNemar’s paired non-parametric test [29] at a confidence value of 0.05. The results are reported in Table 1.
Although it is not possible to identify one single approach that positively afects the classification of every dataset, the results are indeed encouraging. Data augmentation leads to a significant improvement in performance (both in accuracy and 1) in 10 cases out of 24, while it leads to a significant detriment for both metrics only in 3 cases. The best overall result is always attained by the GPT-based augmentation. Understandably, the efect on the Victoria dataset is less pronounced, likely due to the fact that this dataset does not contain forgers, and since the number of documents per author is fairly high.
In this study, we present preliminary experiments regarding the idea of improving the performance of an Authorship Verification system by enhancing the training set with additional examples purposefully generated to simulate an adversary. Despite not being conclusive, the results we have obtained are promising, and encourage us to continue this research.
In future work, we plan to extend the experimentation to other datasets representative of diferent settings, and explore the suitability of simpler architectures and diferent training strategies [ 30] that might be better attuned to the typically limited number of available examples. [16] X. Zhang, J. Zhao, Y. LeCun, Character-level convolutional networks for text classification, in: Proceedings of the 28th International Conference on Neural Information Processing Systems, volume 1 of NIPS’15, MIT Press, Cambridge, MA, USA, 2015, pp. 649–657. [17] S. Kobayashi, Contextual augmentation: Data augmentation by words with paradigmatic relations, in: Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, volume 2, ACL, 2018, pp. 452–457.
URL: https://aclanthology.org/N18-2072. doi:1 0 . 1 8 6 5 3 / v 1 / N 1 8 - 2 0 7 2 . [18] I. J. Goodfellow, J. Shlens, C. Szegedy, Explaining and harnessing adversarial examples, arXiv e-prints (2014) arXiv:1412.6572. a r X i v : 1 4 1 2 . 6 5 7 2 . [19] W. Zhai, J. Rusert, Z. Shafiq, P. Srinivasan, A girl has a name, and it’s... adversarial authorship attribution for deobfuscation, arXiv preprint arXiv:2203.11849 (2022). [20] A. Hatua, A. M. Mukherjee, R. Verma, On the feasibility of using GANs for claim verificationexperiments and analysis, in: Proceedings of the 2021 Workshop on Reducing Online Misinformation Through Credible Information Retrieval, 2021. [21] A. Riddell, H. Wang, P. Juola, A call for clarity in contemporary authorship attribution evaluation, in: Proceedings of the International Conference on Recent Advances in Natural Language Processing (RANLP 2021), 2021, pp. 1174–1179. [22] A. Gungor, Benchmarking Authorship Attribution Techniques Using Over a Thousand Books by
Fifty Victorian Era Novelists, Ph.D. thesis, Purdue University, 2018. [23] V. Sanh, L. Debut, J. Chaumond, T. Wolf, DistilBERT, a distilled version of BERT: Smaller, faster, cheaper and lighter, in: NeurIPS EMC2 Workshop, 2019. [24] A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, I. Polosukhin, Attention is all you need, in: I. Guyon, U. V. Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, R. Garnett (Eds.), Advances in Neural Information Processing Systems 30, Curran Associates, Inc., 2017, pp. 5998––6008. URL: https://papers.nips.cc/paper/7181-attention-is-all-you-need. [25] K. Jones, J. R. C. Nurse, S. Li, Are you Robert or RoBERTa? Deceiving online authorship attribution models using neural text generators, in: Proceedings of the International AAAI Conference on Web and Social Media, volume 16, 2022, pp. 429–440. [26] I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, Y. Bengio,
Generative adversarial networks, Communications of the ACM 63 (2020) 139–144. [27] M. J. Kusner, J. M. Hernández-Lobato, GANs for sequences of discrete elements with the Gumbelsoftmax distribution, arXiv e-prints (2016) arXiv–1611. [28] I. Loshchilov, F. Hutter, Decoupled weight decay regularization, in: International Conference on
Learning Representations, 2018. [29] Q. McNemar, Note on the sampling error of the diference between correlated proportions or percentages, Psychometrika 12 (1947) 153–157. [30] M. Arjovsky, S. Chintala, L. Bottou, Wasserstein generative adversarial networks, in: International Conference on Machine Learning, PMLR, 2017, pp. 214–223.