Source-linked AI summary
Robust Machine Comprehension Models via Adversarial Training
Yicheng Wang, Mohit Bansal
TL;DR
SQuAD models can be vulnerable to AddSent adversaries, and AddSent-based retraining has limited robustness to modified distractors. The paper combines more varied adversarial training with semantic-relation features. The combined approach increases performance on the AddSent evaluation set by 36.46%.
Problem
SQuAD models can lose nearly 50% in F1 under AddSent, while AddSent-based retraining is sensitive to changes in distractor placement and fake answers.
Source: §1 · p. 1Method
The paper varies distractor placement and fake-answer selection in adversarial training, and adds semantic-relation features to address antonym-style perturbations.
Source: §1 · pp. 1–2, §3 · p. 3, §3.2 · p. 3Results
36.46%: the combined adversarial-training method and model improvement increased a state-of-the-art model’s performance on the AddSent evaluation set.
Source: §1 · p. 2Takeaways & Limitations
The authors conclude that diverse adversarial data and semantic-relation knowledge together can improve robustness to insertion-based Q&A adversaries.
Source: §5 · p. 5Of the final model’s remaining AddSent errors, 33.3% occurred within distractors, mainly from named-entity replacements not directly addressed or malformed distractors that answered the question.
Source: §4.7 · p. 5
Abstract
from arXiv · showhide
It is shown that many published models for the Stanford Question Answering Dataset (Rajpurkar et al., 2016) lack robustness, suffering an over 50% decrease in F1 score during adversarial evaluation based on the AddSent (Jia and Liang, 2017) algorithm. It has also been shown that retraining models on data generated by AddSent has limited effect on their robustness. We propose a novel alternative adversary-generation algorithm, AddSentDiverse, that significantly increases the variance within the adversarial training data by providing effective examples that punish the model for making certain superficial assumptions. Further, in order to improve robustness to AddSent's semantic perturbations (e.g., antonyms), we jointly improve the model's semantic-relationship learning capabilities in addition to our AddSentDiverse-based adversarial training data augmentation. With these additions, we show that we can make a state-of-the-art model significantly more robust, achieving a 36.5% increase in F1 score under many different types of adversarial evaluation while maintaining performance on the regular SQuAD task.
1 Introduction
SQuAD models can rely on question–context syntactic similarity, leaving them vulnerable to AddSent distractors; retraining on AddSent alone is sensitive to changes in distractor placement and fake answers. The paper proposes more varied adversarial training and semantic features, reporting improved AddSent robustness.
1 Introduction
- AddSent exposes models’ reliance on syntactic similarity: many state-of-the-art models lose nearly 50% in F1 when distractors resemble questions but do not answer them.SQuAD often places answers in sentences syntactically similar to questions, while AddSent retraining is sensitive to changes in distractor placement or fake-answer sets.Source: §1 · p. 1
- 24.22%: AddSentDiverse-trained models improved average F1 over AddSent-trained models across three adversarial test sets.AddSentDiverse varies distractor locations and expands fake answers to punish superficial assumptions during training.Source: §1 · p. 2
- Even with diverse adversarial training, models remain vulnerable to AddSent-style semantic perturbations such as antonyms, motivating added semantic-relationship features.The authors report these features increase robustness only when the model is adversarially trained.Source: §1 · p. 2
- 36.46%: the combined adversarial-training method and model improvement increased a state-of-the-art model’s performance on the AddSent evaluation set.The authors also argue the approach generalizes to similar insertion-based Q&A adversaries.Source: §1 · p. 2
2 Related Work
Prior work uses adversarial examples to test robustness in vision and Q&A, while AddSent exposes a distinct Q&A weakness: failure to detect semantic-altering distractors. Earlier AddSent-based retraining had limited transfer to modified adversaries.
2 Related Work
- In Q&A, AddSent tests overstability by appending syntactically similar but semantically irrelevant distractors; in vision, adversarial examples commonly test oversensitivity to semantic-preserving noise.The passage attributes the Q&A framing to Jia and Liang (2017), and the vision examples to Szegedy et al. (2014) and Goodfellow et al. (2015).Source: §2 · p. 2
- Earlier adversarial evaluation reported 46.6% F1 for Mnemonic Reader and 51.4% F1 for FusionNet, with FusionNet still 30% below its regular-task performance.The paper contrasts these prior results with retraining using higher-variance adversarial data and semantic feature additions.Source: §2 · p. 2
- AddSentMod caused a retrained BiDAF model’s F1 to drop by more than 30% relative to its AddSent performance, despite changes limited to fake answers and distractor placement.The authors propose more varied training examples to reduce reliance on such superficial trends.Source: §2 · p. 2
3 Methods
AddSentDiverse changes distractor placement and fake-answer selection to reduce training-set cues, while semantic-relation indicators address lexical information the model inputs may miss.
3 Methods
- AddSentDiverse modifies AddSent’s adversary-generation pipeline, which perturbs questions, selects type-matched fake answers, constructs distractors, and appends them to contexts.The original algorithm’s fixed placement and fake-answer set can create superficial cues; the proposed changes randomize placement and diversify fake answers.Source: §3 · pp. 2–3
3.1 Random Distractor Placement
- Random insertion makes the updated correct-answer location distributions X′ and Y′ nearly match the original X and Y distributions, unlike end insertion, which skews Y′.The authors argue this avoids introducing a location–answer correlation that models could exploit.Source: §3.1 · p. 3
3.2 Dynamic Fake Answer Generation
- Dynamic fake-answer generation selects a different answer of the same type from the SQuAD training answers, rather than using AddSent’s fixed fake answer for each type.This expands the fake-answer set and reduces correlation between particular words and distractors.Source: §3.2 · p. 3
3.3 Semantic Feature Enhanced Model
- WordNet synonym and antonym indicators are added to question and context word inputs to expose lexical relations that embeddings may not capture.The authors state that diverse training data alone does not resolve all semantics-based adversaries.Source: §3.3 · pp. 3–4
4 Experiments And Results
The experiments evaluate BSAE on regular and adversarial SQuAD data, comparing original training with AddSent- and AddSentDiverse-augmented training. They examine distractor placement, fake-answer generation, semantic features, and remaining errors.
4.1 Model and Training Details
- The study uses the BSAE architecture and evaluates soft F1 on the original SQuAD dev set and four AddSent adversarial datasets, including variants of distractor placement and fake answers.AddSentRandom randomizes distractor placement; the evaluation records each model’s worst performance among generated adversary variants.Source: §4.1 · p. 4, §4.2 · p. 4
4.3 Primary Experiment Results
- AddSentDiverse-augmented training significantly boosts BSAE performance across all adversarial datasets, while AddSent training performs poorly when distractors are not appended at the end.The augmented sets use randomly selected adversarial examples for 20% of total training data.Source: §4.3 · p. 4
4.4 Distractor Placement Results
- InsRandom gives optimal performance on AddSent and AddSentPrepend, while InsFirst- and InsLast-trained models perform well mainly when test placement is similar.The comparison tests four distractor placement strategies; 77.0% of the remaining errors in the cited 59.03% accuracy case predicted a span within the randomly inserted distractor.Source: §4.4 · pp. 4–5
4.5 Fake Answer Generation Results
- Fixed-FakeAns training loses approximately 3% on a test set with different fake answers, whereas this gap is absent with Dynamic-FakeAns training.The comparison uses AddSentPrepend and AddSentMod, which differ in the fake-answer set.Source: §4.5 · p. 5, Table 3 · p. 5
4.6 Semantic Feature Enhancement Results
- Adversarially trained BSAE+SA avoids the original SQuAD performance decrease seen with BSAE, while regular training with semantic features performs similarly to BSAE.The authors attribute the latter result to insufficient negative examples for learning to use semantic features; adversarial examples address this issue.Source: §4.6 · p. 5, Table 4 · p. 5
4.7 Error Analysis
- Of BSAE+SA’s remaining AddSent errors, 33.3% (46 cases) were predictions within distractors and 63.7% (88 cases) were questions already missed on original SQuAD dev.Distractor-span errors mainly involved named-entity replacements or malformed distractors that in fact answered the question.Source: §4.7 · p. 5
5 Conclusion
The conclusion argues that diverse adversarial training can address model overstability by eliminating latent data correlations. It also states that adversarial training is more effective when paired with semantic-relation knowledge.
5 Conclusion
- Diverse adversarial data can reduce model overstability by eliminating latent data correlations, and adversarial training is more effective when paired with semantic-relation knowledge.The authors hope these methods generalize to other insertion-based adversaries for Q&A.Source: §5 · p. 5
A Appendix: Distractor Placement Strategies
This appendix models how distractor-placement strategies shape sentence-level distractor probabilities and uses those distributions to anticipate adversarial-test performance. Random insertion is near-uniform, while middle insertion underweights paragraph beginnings and ends; fixed-position predictions are confirmed by Table 5.
A Appendix: Distractor Placement Strategies
- The framework represents distractor location as X from the front and Y from the back, with their distributions depending on the insertion strategy.It defines Psa as P(X = a) + P(Y = n − a), ideally uniform so no sentence is favored by location.Source: A Appendix: Distractor Placement… · p. 6, Figure 2 · p. 6
- The appendix compares distributions of paragraph lengths in SQuAD training data to contextualize the selected sentence counts n = 3, 5, and 7.The text identifies those counts as typical context lengths.Source: A Appendix: Distractor Placement… · p. 6, Figure 4 · p. 7
- Random insertion yields a near-uniform distractor probability distribution, while middle insertion underweights paragraph beginnings and ends, helping explain its weaker performance on both AddSent variants.The appendix examines n = 3, 5, and 7 as typical SQuAD context lengths.Source: A Appendix: Distractor Placement… · pp. 6–7, Figure 3 · p. 7
- Fixed-position training predicts that InsFront-3 performs slightly better on appended-distractor tests than prepended ones, while InsFront-6 performs much better; Table 5 confirms these predictions.The predictions are based on the learned Psa distributions for the two training datasets.Source: A Appendix: Distractor Placement… · p. 7, Figure 5 · p. 7, Table 5 · p. 7