PaperlayerView exact revision on arXiv

Source-linked AI summary

Improving Question Answering Model Robustness with Synthetic Adversarial Data Generation

Max Bartolo, Tristan Thrush, Robin Jia, Sebastian Riedel, Pontus Stenetorp, Douwe Kiela

arXiv:2104.08678v3cs.CLcs.LG

TL;DR

Static datasets can harbor spurious patterns, while dynamic adversarial data collection is costly. This paper uses synthetic adversarial QA generation to improve robustness across established evaluations and against human adversaries.

  • Problem

    Static datasets can encode spurious patterns that undermine robustness and generalisation, while dynamic adversarial collection requires more annotator effort and time per example.

    Source: §1 · pp. 1–2

  • Method

    The paper develops a synthetic adversarial data-generation pipeline with methods for answer selection, question generation, filtering, and relabelling.

    Source: §1 · p. 2

  • Results

    Models reach state-of-the-art on AdversarialQA, improve CheckList comprehension learnability and MRQA domain generalisation; crowdworkers fooled the model-in-the-loop 8.8% of the time versus 17.6% for the best baseline.

    Source: §1 · p. 2, §5 · p. 9

  • Takeaways & Limitations

    The findings suggest synthetic adversarial data generation can improve QA robustness under standard measures and direct evaluation against human adversaries.

    Source: §5 · p. 9

    Synthetic examples have similar answers; exploring decoding diversity is left to future work.

    Source: §3.2 · p. 7

Abstract

from arXiv · show

Despite recent progress, state-of-the-art question answering models remain vulnerable to a variety of adversarial attacks. While dynamic adversarial data collection, in which a human annotator tries to write examples that fool a model-in-the-loop, can improve model robustness, this process is expensive which limits the scale of the collected data. In this work, we are the first to use synthetic adversarial data generation to make question answering models more robust to human adversaries. We develop a data generation pipeline that selects source passages, identifies candidate answers, generates questions, then finally filters or re-labels them to improve quality. Using this approach, we amplify a smaller human-written adversarial dataset to a much larger set of synthetic question-answer pairs. By incorporating our synthetic data, we improve the state-of-the-art on the AdversarialQA dataset by 3.7F1 and improve model generalisation on nine of the twelve MRQA datasets. We further conduct a novel human-in-the-loop evaluation to show that our models are considerably more robust to new human-written adversarial examples: crowdworkers can fool our model only 8.8% of the time on average, compared to 17.6% for a model trained without synthetic data.

1 Introduction

Static datasets can harbor spurious patterns, while dynamic adversarial collection is costly. The work proposes synthetic adversarial data generation and reports improved robustness, including against human adversaries.

1 Introduction

  • Static datasets can contain spurious statistical patterns that models exploit, leading to poor robustness and generalisation.The passage cites prior work documenting these problems in statically collected datasets.Source: §1 · p. 1
  • The pipeline selects Wikipedia passages and answer candidates, generates questions with BARTLarge, then filters or relabels examples for downstream QA training.Answer candidates are filtered by model confidence, and relabeling uses self-training.Source: Figure 1 · p. 1
  • Dynamic adversarial collection can cost more per example because writing questions that fool a model requires greater annotator effort and time.The work presents synthetic generation as a way to make dynamic collection more sample efficient.Source: §1 · p. 2
  • 8.8% of the time on average, crowdworkers fooled the model-in-the-loop, versus 17.6% for the best baseline.The evaluation used the macro-averaged validated model error rate.Source: §1 · p. 2

2 Related Work

The related work contrasts human-collected adversarial data with synthetic QA generation and situates self-training and human evaluation as relevant approaches.

2.1 Adversarial Data Collection

  • AdversarialQA uses SQuAD1.1 passages and examples crowdworkers wrote to fool three models; this work seeks further value from such data without more annotation.The subsets are DBiDAF, DBERT, and DRoBERTa.Source: §2.1 · p. 2

2.2 Synthetic Question Generation

  • Prior QA-generation pipelines typically identify an answer before generating a question; this work finds model agreement across random seeds performs better than influence-function or diversity-based filtering.The comparison is for extractive QA.Source: §2.2 · p. 2

2.3 Self-training

  • Because large amounts of unlabelled adversarial-style questions are not readily available, the authors use a question-generation model alongside self-training.Prior work found self-training can complement pretraining and improve robustness to domain shift.Source: §2.3 · p. 2

2.4 Human Evaluation

  • This work compares models using adversarial validated model error rate, bringing human-in-the-loop evaluation to a setting where such evaluation is rarely conducted.The passage frames capturing human judgments as a goal of automatic evaluation.Source: §2.4 · p. 2

3 Synthetic Data Generation

The section develops a four-stage pipeline for generating synthetic QA examples, then examines its components and alternatives. Filtering and re-labelling help synthetic-only training approach human-written adversarial data performance, while the end-to-end approach falls short of the best pipeline.

3 Synthetic Data Generation

  • The pipeline selects passages, identifies candidate answer spans, generates questions conditioned on each answer, then filters or re-labels pairs for quality.The authors study components separately before combining their best approaches.Source: §3 · p. 3, §3.1 · p. 3

3.1.1 Passage Selection

  • Only 0.3% of external Wikipedia passages overlap evaluation sets by 8-gram, and those passages are filtered out.The passages are sourced from SQuAD or external Wikipedia passages.Source: §3.1.1 · p. 3

3.1.2 Answer Candidate Selection

  • Self-Attention Labelling jointly models candidate span starts and ends, predicting whether each passage span is an answer candidate.Its attention scores are converted by sigmoid into probabilities for spans in the context.Source: §3.1.2 · pp. 3–4

3.1.3 Question Generation

  • Generated questions can be well-formed yet inconsistent with their target answers, especially when answering requires resolving passage information.The best generator source data is consistently the combination of SQuAD and AdversarialQA; synthetic-only data performs worse than training with human-written adversarial examples, including a 21.2F1 DBERT drop.Source: §3.1.3 · p. 5

3.1.4 Filtering and Re-labelling

  • Filtering with self-training and answer-candidate confidence brings synthetic-only training close to RSQuAD+AQA, with disparities of 2.2F1 on DBiDAF, 6.6F1 on DBERT, and 8.3F1 on DRoBERTa.The approach practically matches performance on SQuAD.Source: Table 6 · p. 6, §3.1.4 · p. 6
  • A six-model ensemble's count of models predicting the target answer filters examples better than model confidence scores; the best method combines self-training with answer-candidate confidence filtering.The self-training procedure keeps examples with at least five models agreeing with the target, re-labels when at least two agree, and discards the rest.Source: §3.1.4 · p. 6

3.2 End-to-end Synthetic Data Generation

  • End-to-end BART answer-and-question generation falls short of the best pipeline, with results of 62.7/77.9 EM/F1 on DSQuAD, 30.8/47.4 on DBiDAF, 23.6/35.6 on DBERT, and 18.0/28.3 on DRoBERTa.The approach tends to produce synthetic examples with similar answers; exploring decoding diversity is left for future work.Source: §3.2 · p. 7

3.3 Fine-tuning Setup

  • Two-stage fine-tuning on synthetic data followed by SQuAD and AdversarialQA marginally improves performance over standard mixed training.The authors use this approach for subsequent experiments.Source: §3.3 · p. 7

4 Measuring Model Robustness

Synthetic augmentation improves AdversarialQA performance, comprehension-skill results, and domain generalisation. In a live human evaluation, SynQA also reduces the rate at which crowdworkers fool the model compared with RSQuAD+AQA.

4 Measuring Model Robustness

  • Robustness is tested on adversarial datasets, CheckList, domain generalisation, and live human interaction; annotators are randomized, and mvMER averages validated error across annotators.The live evaluation uses an expert to validate model-fooling examples.Source: §4 · p. 7, §4.4 · p. 8

4.1 Adversarially-collected Data

  • 2.3F1 on DBiDAF, 4.1F1 on DBERT, and 4.9F1 on DRoBERTa over baselines establish state-of-the-art AdversarialQA results while retaining good SQuAD performance.The gains are reported with no additional annotation cost.Source: §4.1 · p. 7

4.2 Comprehension Skills

  • Synthetic augmentation improves performance across comprehension skills, with overall gains of 1.7% for SynQA and 3.1% for SynQAExt.External synthetic data particularly improves profession-versus-nationality, his/her coreference, and subject/object distinction skills.Source: §4.2 · pp. 7–8

4.3 Domain Generalisation

  • Synthetic training data improves performance on nine of twelve MRQA tasks, with gains up to 8.8F1 on SearchQA and no significant cost on the other three tasks.Table 8 reports in-domain and out-of-domain MRQA results.Source: §4.3 · p. 8, Table 8 · p. 9

4.4 Adversarial Human Evaluation

  • 17.6% to 8.8%: SynQA roughly halves mvMER versus RSQuAD+AQA, while SynQAExt reaches 12.3% but is easier for humans to beat.The authors report that the effort required for each model-fooling example increases.Source: §4.4 · pp. 8–9
  • The authors suggest that gains on static adversarial benchmarks may underestimate robustness in direct interaction with human adversaries.Greater effort per model-fooling example also motivates expanding extractive QA beyond single answer spans on short passages.Source: §4.4 · p. 9

5 Discussion and Conclusion

The paper combines synthetic adversarial data generation with evaluations of QA robustness, including a human-in-the-loop test. Its findings span benchmark performance and possible ways to scale adversarial annotation.

5 Discussion and Conclusion

  • The final models achieve state-of-the-art results on AdversarialQA, improve CheckList comprehension-skill learnability, and improve domain generalisation across the MRQA suite.The best synthetically augmented model was roughly twice as hard for human adversaries to beat.Source: §5 · p. 9
  • The evaluation puts synthetically augmented models back in the loop to test whether human adversaries can beat them.The paper reports this as a direct human-adversary robustness evaluation alongside standard measures.Source: §5 · p. 9
  • Synthetic generation could reduce the human data needed to train improved QA models and help crowdworkers develop more challenging examples.The authors suggest these methods could also inform work on other tasks with limited data resources or other robustness goals, such as bias mitigation.Source: §5 · p. 9

6 Ethical Considerations

The paper describes its evaluation-data sourcing and ethical considerations, then gives further details on passage selection, answerability, candidate selection, and question diversity.

6 Ethical Considerations

  • The evaluation data uses SQuAD1.1 passages under CC BY-SA 4.0, focuses on English, and was collected with a fair-compensation incentive structure.The authors state they do not foresee risks because the data was not collected to design NLP applications.Source: §6 · p. 9

A Further Details on Passage Selection

  • Training for answer candidate selection and question generation uses 10,000 SQuAD1.1 examples from 2,596 passages, while adversarial human evaluation uses passages unseen during training and validation.DSQuADdev and AdversarialQA dev are used for validation; DSQuADtest and AdversarialQA test are used for reporting results.Source: A Further Details on Passage Selection · p. 13

B Manual Answerability Analysis

  • Manual answerability requires a single continuous answer span, one valid or clearly most valid answer, human solvability, and agreement with the answer used to condition question generation.Source: B Manual Answerability Analysis · p. 13

C Further Details on Answer Candidate Selection

D Further Details on Question Diversity

  • Question decoding yields minimal downstream performance variation; nucleus sampling at topp = 0.75 performs best, but beam search with size 5 is roughly twice as efficient with minimal performance drop.The authors choose standard beam search for following experiments.Source: D Further Details on Question Diversity · p. 13

E Controlling for Data Size

Size-controlled experiments indicate that the benefits of answer selection and filtering persist when dataset size is controlled.

E Controlling for Data Size

  • SAL answer candidate selection and self-training filtering provide considerable downstream benefits in size-controlled experiments, consistent with results on the full generated datasets.The authors note that, at scale, generation quality rather than data quantity becomes the bottleneck.Source: E Controlling for Data Size · p. 13

F A Note on Data Efficiency

Performance begins to converge as RoBERTaLarge trains on more manually collected adversarial examples, while the synthetic approach requires no additional manual annotation. The AdversarialQA validation results are reported separately.

F A Note on Data Efficiency

  • 0.5 F1 is the gain on the overall AdversarialQA test set from training on 10k rather than 8k manually collected examples; performance starts converging around 5–6k.Figure 3 presents F1-scores on the respective test datasets for RoBERTaLarge trained with varying amounts of human-annotated adversarial training data.Source: F A Note on Data Efficiency · p. 13, Figure 3 · p. 14
  • The synthetic data approach requires no additional manual annotation.Source: F A Note on Data Efficiency · p. 14

G AdversarialQA Dev Set Results

H Results on CheckList

The section reports CheckList results by comprehension skill and includes model failure examples.

I Adversarial Human Evaluation

The human evaluation reports results for four final models and describes worker eligibility, evaluation measures, and examples of questions that fooled the models.

J Results for ELECTRALarge

ELECTRALarge with synthetic augmentation shows further gains on challenging questions and domain-generalization results across MRQA datasets. The reported experiments use one initialization and the same synthetic training data and two-stage fine-tuning setup.

  • ELECTRALarge results use a single initialization and the same synthetic training data and two-stage fine-tuning setup as the RoBERTaLarge experiments.Source: J Results for ELECTRALarge · p. 14
  • 94.5F1 on SQuAD was reported for synthetically augmented ELECTRALarge among its domain-generalization results on 12 MRQA datasets.The other reported scores include 66.6F1 on NewsQA and 59.8F1 on TextbookQA.Source: J Results for ELECTRALarge · p. 14
  • Up to 3F1 further performance gains were reported on the most challenging questions when synthetically augmenting ELECTRALarge.ELECTRALarge without augmentation performs similarly to RoBERTaLarge with synthetic augmentation.Source: Table 16 · p. 17

Related papers

Loading 2104.08678v3…