A Survey of Adversarial Defences and Robustness in NLP

1 INTRODUCTION

• Deep neural networks can be sensitive to slight input perturbations, leaving even high-performing models vulnerable to attacks [2].Source: §1 · p. 2
• Text's discrete nature complicates perturbation generation, and word-level attacks have faced high-dimensional search spaces [160].Source: §1 · p. 2
• The survey classifies NLP defenses as adversarial training-based, perturbation control-based, or certification-based methods.Source: §1 · pp. 2–3
• Adversarial training includes data augmentation, regularization, GAN-based training, VAT, and HITL approaches.Source: §1 · p. 2

1.1 Goals of this survey paper

• The survey reviews defense schemes across NLP tasks and highlights defenses' role as a regularization scheme during training.Source: §1.1 · p. 3
• Unlike prior surveys, this paper focuses exclusively on NLP defenses, proposes a detailed taxonomy, and discusses open issues and future work.Source: §1.1 · p. 3

2 A GENERAL OVERVIEW OF ADVERSARIAL ATTACKS

• Text attacks are harder to make imperceptible than image attacks because character or word changes are more noticeable and can make input less natural.NLP perturbations may operate at character, word, or sentence level, using edits such as deletion, insertion, swapping, and synonym replacement.Source: §2 · p. 4

2.1 Adversarial attacks in deep learning

• The attack objective is to perturb an input from class C1 so it is classified with high confidence as a target class while minimizing perturbation magnitude.The optimization seeks to make the perturbed input less perceptible while steering it to Ctarget [148].Source: §2.1 · p. 4

2.2 Adversarial attacks in NLP

• Character-level attacks insert, delete, or swap characters and can be effective, but spell-checkers can readily detect them.Methods also add natural spelling mistakes or synthetic noise such as randomized characters, keyboard-neighbor substitutions, punctuation, and altered spacing.Source: §2.2 · p. 5
• Adding periods or spaces between words caused Google’s Perspective API to return lower toxicity scores for the perturbed words [42].The passage presents these simple text changes as an attack on the API’s toxicity scoring.Source: §2.2 · p. 5
• Word-level attacks use gradients or word-importance scores to select vulnerable words for perturbation, including greedy synonym replacement with Textfooler [52].Gradient-based methods monitor classification probability, while importance-based methods use attention scores to identify words to perturb.Source: §2.2 · p. 5
• Replacement-based word attacks substitute semantically and syntactically similar words, using word or thought vectors to find candidates or GloVe vectors [3].The described approaches select replacements from vector neighbors that fit the sentence context or affect the objective function.Source: §2.2 · pp. 5–6
• Sentence-level attacks manipulate groups of words and can append grammatically correct sentences; methods include GAN-based adversaries [170] and AdvGen.Some appended sentences preserve the input label, so an attack succeeds when the model changes its output; AdvGen uses greedy search guided by training loss while retaining semantic meaning.Source: §2.2 · p. 6
• Multi-level attacks combine perturbation methods to improve human imperceptibility and attack success, including gradient-guided character swapping with HotFlip.The survey also describes methods that find important words using Jacobian information, including TextBugger [74].Source: §2.2 · p. 6
• The described attacks identify important words in a white-box setting for insertion, deletion, or swapping, and also use reinforcement learning with an encoder-decoder framework.The supplied passages do not specify how the reinforcement-learning approach relates to the word-manipulation methods.Source: §2.2 · p. 6

3 TAXONOMY OF ADVERSARIAL DEFENSES

• The survey's taxonomy groups NLP defenses into adversarial training, perturbation control, certification, and miscellaneous approaches.Figure 1 illustrates the proposed taxonomy.Source: §3 · pp. 6–7, Figure 1 · p. 7
• Adversarial training includes data augmentation, regularization, GAN-based training, virtual adversarial training, and human intervention.Source: §3 · p. 7
• Perturbation-control methods include perturbation identification and correction, as well as perturbation-direction control.Source: §3 · p. 7
• Certification-based methods aim to certify model robustness against adversarial attacks.Source: §3 · pp. 6–7
• Miscellaneous methods combine approaches that do not fit the other categories.Source: §3 · p. 7

4 ADVERSARIAL TRAINING BASED DEFENSES

• Adversarial training adds generated examples to training data or introduces network perturbations as a regularizer, and example strength affects robustness and generalization.Augmentation strategies include word- or character-level changes, model-generated examples, and concatenation with original inputs.Source: §4 · pp. 7–8

4.1 Adversarial training by data augmentation

• Data augmentation generates adversarial inputs by identifying influential text parts and flipping, inserting, deleting, or swapping them; concatenating text is another strategy.The section also notes automatic adversarial-example generation methods.Source: §4.1 · p. 8

4.1.1 Word level data augmentation.

• For text classification, adversarial training augments data with utility-preserving examples in white- and black-box settings; white-box perturbations use the classifier Jacobian to find important words and search nearby Word2Vec neighbors.Source: §4.1.1 · p. 8
• AST addresses OOV challenges with character-level embeddings, while reported stability training improved robustness without reducing original performance [171].Another study found self-attentive models more robust than RNNs.Source: §4.1.1 · pp. 8–9

4.1.2 Concatenation based data augmentation.

• Concatenation-based augmentation includes AddSent [50], which generates adversarial examples for reading comprehension.The supplied passage introduces this approach but provides no further method or outcome details.Source: §4.1.2 · p. 10
• Concatenation-based augmentation appends grammatical sentences and fake answers, while AddSentDiverse [142] varies perturbation placement and expands fake answers to address limitations of AddSent.The examples target comprehension systems and use fake answers with the same part of speech and category as the replaced answers.Source: §4.1.2 · p. 10

4.1.3 Generation based data augmentation.

• Generation-based augmentation uses seq2seq models to create hypotheses from premises for textual entailment [56] and perturbations for structure prediction tasks [39].The structure prediction tasks include POS tagging, parse trees, and noun phrases.Source: §4.1.3 · p. 10
• Other methods generate adversarial text by perturbing task inputs through controllable dataset attributes [134]; predefined templates generate input variations for training robust sentiment models; syntactically controlled paraphrases are another approach [48].Source: §4.1.3 · p. 10

4.2 Adversarial training as regularization technique

• Adversarial training can add input perturbations as a loss regularizer [35], using fast gradient sign perturbations to approximate a model robust to adversarial input.The loss includes an adversarial term and a divergence measurement, with an upper bound on perturbation magnitude.Source: §4.2 · p. 12
• For natural language inference, [88] generates adversarial examples by maximizing a continuous inconsistency loss while constraining sentence perplexity; diversity training [57] aligns ensemble gradients, and ASSC [25] models substitutions as a convex hull of word vectors.Diversity training uses gradient alignment loss to train diverse models with misaligned loss gradients.Source: §4.2 · p. 12
• InfoBERT [132] uses information-bottleneck and anchored-feature regularizers, while FreeLB++ [81] expands the search region to a larger l2-norm and increases search steps.InfoBERT’s regularizers respectively extract minimal downstream-task features while removing vulnerable information, and extract robust local features aligned with global features.Source: §4.2 · pp. 12–13
• Table 2 summarizes adversarial training methods used as a regularization technique.Source: Table 2 · p. 13

4.3 GAN based adversarial training

• GAN-based training pairs a generator of adversarial examples with a discriminator that distinguishes them from clean data; [56] applies it to textual entailment and [110] to text classification.Source: §4.3 · p. 13
• [85] reported improved performance over 16 datasets using learned parameters in both shared and task-specific network parts.The work used GANs for multi-task learning and domain adaptation.Source: §4.3 · pp. 13–14
• [149] mimics GAN training with a lexical-knowledge generator and classifier reward, while [22] uses GAN-style training to defend encoded text against reconstruction attacks.Source: §4.3 · p. 14

4.4 Virtual Adversarial Training (VAT)

• [100] regularizes examples the model predicts incorrectly, while ALUM [86] applies embedding-space perturbations that maximize adversarial loss during pretraining and fine-tuning.Source: §4.4 · p. 15
• For sequence labeling, combines VAT with a CRF decoder, while token-aware VAT [77] uses token-informed rather than random perturbations.Source: §4.4 · p. 15

4.5 Robustness by human in the loop

• Adversarial training-based defenses are described as NLP’s most popular approach, requiring generated adversarial examples for model training.Human-in-the-loop methods include [160] manually selecting valid samples for training and [94] [144] crowd-sourcing ANLI examples for natural language inference.Source: §4.5 · pp. 15–16

5.1.1 Perturbation Identification.

• SEM maps synonym substitutions to unique encodings, while FTML [154] and DNE [173] respectively separate synonym from nonsynonym embeddings and augment training with virtual sentences.DNE samples word embeddings from the convex hull of each word and its synonyms; FTML uses a word-level triplet loss to pull synonyms together and push nonsynonyms apart.Source: §5.1.1 · pp. 16–17
• ADFAR was reported to work better than other defenses on four datasets—MR, SST-2, IMDb, and MNLI; separately, majority-based classification returned sentiment models to their original performance accuracy.Source: §5.1.1 · p. 17
• RS&V [140] flags inputs when labels across random synonym substitutions are inconsistent, while random-perturbation copies use majority voting to classify reviews [127].The review copies include synonym substitution, word dropping, or spell-check correction.Source: §5.1.1 · p. 17
• Over 1.5 million adversarial instances in TCAB support attack detection and labeling, with a benchmark spanning six datasets, three target classifiers, and 12 attacks [147].Its classifier uses text, language-model, and target-model features to detect perturbations and label attack types.Source: §5.1.1 · p. 17
• TextFirewall detects perturbed inputs using word importance, while RDE [158] estimates sentence-feature density and includes a word-level detection benchmark.RDE fits density estimation to features from a pretrained model such as BERT and applies dimensionality reduction.Source: §5.1.1 · pp. 17–18

5.1.2 Perturbation correction.

• ScRNN [116] predicts correct words from semi-character inputs under jumble, deletion, and insertion noise; extension [102] proposes three backoff techniques when its word classifier predicts UNK.Source: §5.1.2 · p. 18
• Other approaches address spell-checker limitations, use BERT tokens and modified Levenshtein distance with context-dependent probabilities to predict tokens, detect hacked inputs by trigger words, and correct perturbations with rule-based methods including Unicode canonicalization.Source: §5.1.2 · p. 18
• TREATED [174] detects adversarial examples across perturbation levels without prior assumptions, using reference models to identify and block them.The reference models are designed around consistency on clean and adversarial data.Source: §5.1.2 · p. 19
• For Chinese text classification, uses neural machine translation to remove noise, then classifies features from semantic, glyph, and phonetic embeddings.The defense detects perturbations in three steps: noise removal, multimodal embedding conversion, and classification.Source: §5.1.2 · p. 19
• Correction defenses mainly target synonym substitution and misspelling attacks, typically in text classification, and block perturbed input, generate clean text, or replace words.Demonstrations largely cover sentiment, news-category, and topic classification.Source: §5.1.2 · p. 19

5.2 Perturbation direction control

• Direction-control defenses aim to limit adversarial space and improve interpretability: [119] restricts perturbations to vocabulary words, while uses CBOW to predict meaning-preserving directions.[166] places a constraint on perturbation direction to preserve sentence meaning.Source: §5.2 · p. 19
• Sequence Squeezing reduces embedding features while preserving semantics, tests the squeezed embeddings against malware-detection attacks, and adds them to training data.The method aims to diminish the space available for generating perturbations and target RNN models and variants.Source: §5.2 · p. 19
• Direction-control methods demonstrate defenses on text-classification tasks including sentiment and malware classification.The survey characterizes direction control as a step toward more interpretable defenses than conventional adversarial training.Source: §5.2 · p. 19

6 ROBUSTNESS BY CERTIFICATION

• Adversarial training and perturbation-control methods may miss unseen, exponentially many word combinations, motivating certificates that bound worst-case loss without exploring adversarial examples.The section notes that existing perturbation-control methods depend on previously seen perturbations and assumptions about attack type.Source: §6 · p. 21

6.1 Interval Bound Propagation based methods

• IBP training minimizes an upper bound on the gap between the classification boundary and perturbation region, keeping the bounded region on one side of the boundary.The survey characterizes this sufficiently tight region as certifiably robust; it also reports limited generalizability to novel contextual embeddings.Source: §6.1 · p. 21
• IBP gives an upper bound over discrete perturbations in word-vector space, while [44] uses a tighter simplex over-approximation in embedding space; [157] proposes structure-free certified robust models applicable to arbitrary models.Source: §6.1 · p. 21

6.2 Certified robustness for RNN networks

• Popqorn [61] certifies LSTMs and GRUs using bounds on cross-nonlinearity, while Cert-RNN preserves inter-variable correlations with zonotopes and is at least 19 times faster than Popqorn.Cert-RNN also achieves tighter bounds than Popqorn.Source: §6.2 · p. 22
• ARC [168] reuses hidden states for shared-prefix perturbations and applies IBP, while PROVER [114] propagates polyhedral perturbations through LSTMs for sequential-data certification.ARC constructs perturbation spaces from programmatically defined string transformations.Source: §6.2 · p. 22
• DeepT certifies larger transformers against synonym replacement, with multi-norm zonotopes yielding robustness radii up to ×28 those of existing methods for longer sentences.Work [121] separately verifies transformers with self-attention by bounding neuron outputs over perturbed input sets, with bounds reported as tighter than IBP.Source: §6.2 · p. 22

6.3 Other convex optimization based methods

• For text classification, [124] certifies an attacker-defender sanitation scheme that removes outliers during training and upper-bounds the worst test loss of attacks that evade removal.The upper bound accounts for possible points that evade outlier removal.Source: §6.3 · pp. 22–23
• A semi-definite relaxation gives a differentiable worst-case-loss certificate for one-hidden-layer networks [104], while differential privacy provides certification against L-adversary word perturbations.The latter treats sentences as databases and words as individual records, with an epsilon-DP threshold for perturbed inputs.Source: §6.3 · p. 23
• These methods have not been shown to generalize across deep neural network types and have been evaluated on a small set of NLP tasks and smaller networks.Source: §6.3 · p. 24

• With 20 adversarial classifiers, 8 of 13 NLI datasets performed better, while 3 had the same performance as with 1 classifier [122].The cited work connects larger sentence embeddings with greater difficulty removing bias and a need for more adversarial classifiers.Source: §7 · p. 24
• For hosted BERT APIs, [40] proposed smoothing output probabilities with a softmax temperature and adding noise with variance sigma to resist transfer attacks.The passage describes API replication as a route to creating adversarial examples for transfer.Source: §7 · p. 24
• [38] generates variable-length adversarial examples using a special BLK token and addition, deletion, and replacement operations, and reports successful attacks on NLU and NAT models.The examples are also proposed for adversarial-training data augmentation.Source: §7 · p. 24
• [176] proposes Stackelberg Adversarial Training, with a model-optimizing leader and adversary-optimizing follower whose equilibrium is found using an unrolled method.The leader uses knowledge of the follower’s strategy, captured in a Stackelberg gradient.Source: §7 · pp. 24–25
• Robust Encodings [53] maps sentences into a smaller discrete token-level space, clustering adversarial typos while balancing cluster size, without changing model architecture.The passage describes RobEn as a framework that guarantees robustness.Source: §7 · p. 25
• For Chinese NLP, AdvGraph [73] uses glyph and phonetic similarity graphs and graph embeddings alongside semantic embeddings for downstream tasks.The method addresses the difficulty of extending existing adversarial defenses to Chinese.Source: §7 · p. 25

• Accuracy after attack, loss, and error rates are used to assess defense performance against clean or attacked predictions.The section treats a rise in post-attack accuracy and lower error after defense as signs of successful defense; loss analysis can indicate error reduction and less overfitting.Source: §8 · pp. 25–26
• Embedding tests use edit distance, Jaccard similarity, and semantic similarity, while human evaluation judges adversarial examples for naturalness.Examples judged to be good quality may be used in adversarial training, followed by robustness evaluation.Source: §8 · p. 26
• Attack success rate measures successful adversarial failures among generated samples, while query counts capture how often an attacker queries the model.A drop in attack success rate after defense implies greater robustness; a higher average query count makes a defense harder to fail.Source: §8 · p. 26
• For natural language generation, BLEU evaluates generated text against ground truth using modified n-gram precision and a brevity penalty.The section identifies candidate-summary length and reference length as relevant to BLEU.Source: §8 · p. 26
• Certification evaluation includes robust radius and certified accuracy; the certified radius is a lower bound on robust radius, whose exact calculation is NP-hard.Certified accuracy counts test examples that are both correct and certified robust for a given perturbation.Source: §8 · p. 27
• CLEVER estimates a local Lipschitz constant as a lower bound on input robustness, and an increased CLEVER score indicates greater resilience after defense.The section describes CLEVER as attack-independent and applicable to arbitrary neural network classifiers.Source: §8 · p. 28

• DailyDialog++ extends DailyDialog with automatically concatenated adversarial sentences that preserve meaning, plus fake answers with the same POS type; HAMLET uses a human-and-model-in-the-loop collection scheme.The resulting adversarial examples are used to improve NLI models through adversarial training.Source: §9 · p. 28
• ANLI provides NLI adversarial examples collected in three iterative human-and-machine rounds, with annotators writing hypotheses for Wikipedia passages.The dataset contains 103k examples.Source: §9 · p. 28
• Adversarial VQA collected 243.0K questions for 37.9K images over three human-and-model competition rounds, supporting robustness evaluation and adversarial training.The questions were written to fool models, and the dataset was used to report higher performance on robust VQA benchmarks.Source: §9 · p. 28
• Adversarial SQuAD and Quizbowl provide adversarial question-answering evaluations, with Quizbowl using human-written questions designed to fool models while appearing ordinary to people.Quizbowl is described as a human-in-the-loop test dataset for state-of-the-art question-answering models.Source: §9 · pp. 28–29
• PAWS uses controlled word swapping and back-translation to create paraphrase-detection examples that probe sensitivity to word order and syntax.The dataset draws sentences from Quora and Wikipedia and has also been used for adversarial training.Source: §9 · p. 29
• TCAB contains 1.5 million attack instances from 12 attacks, targeting three classifiers trained on six sentiment and abuse-classification datasets.It was created to detect and label textual perturbations; its attacks include 216 combinations of attack types.Source: §9 · p. 29
• TextAttack offers 16 attack methods in an end-to-end evaluation framework, while OpenAttack includes 15 attack types, Chinese support, and multiprocessing.“Elephant in the room” combines automatic metrics with crowd-sourced judgments of naturalness, label preservation, and text similarity.Source: §9 · p. 29

• The survey presents an exhaustive review and taxonomy that groups defenses into adversarial-training-based, perturbation-detection, certification-based, and other methods.The taxonomy is the paper’s proposed structure for the reviewed NLP defense methods.Source: §10 · p. 30
• Adversarial training can make models robust to particular attacks while leaving them vulnerable to unseen examples, motivating automatic generation beyond hand-crafted adversaries.The survey describes hand-crafted examples as efficient but limited and recommends more attention to automatic generation.Source: §10 · p. 30
• Text perturbations are discrete and more perceptible than image-pixel changes, so the survey calls for adversarial examples that are less human-perceptible and natural-looking.The section frames this as a practical challenge for NLP defenses.Source: §10 · p. 30
• Exact robustness certificates remain difficult to calculate: the problem is non-convex and inefficient, while convex relaxations can yield lossy bounds.The survey recommends tighter bounds; it also notes that existing work calculates upper and lower bounds rather than exact certificates.Source: §10 · p. 30
• Certification methods are described as small-scale and not scalable to the larger, deeper networks used in practical machine learning.The survey recommends addressing this scalability boundary.Source: §10 · p. 31
• NLP adversarial-training methods are task-specific, and the survey calls for example-generation schemes that work effectively across multiple tasks.It also identifies a lack of explainability and transparency in regularization-based defenses that insert perturbations into the loss.Source: §10 · p. 31
• The survey questions whether adversarial training is interpretable and whether its examples cover the range of attacks models must withstand.It calls for answers about how examples improve performance and whether models resist only specific attack types.Source: §10 · p. 31
• Perturbation detection often assumes spelling or synonym attacks, while defense research covers fewer NLG and other NLP applications than text classification.The section also calls for attack-agnostic detection, alternatives to spell-checking and synonym enumeration, and robustness metrics beyond ordinary performance measures.Source: §10 · p. 31

11 CONCLUSION

• The survey organizes NLP adversarial defenses into adversarial training-based, perturbation control-based, and certification-based categories.It reviews methods proposed for a wide range of NLP tasks.Source: §11 · p. 32
• The survey addresses gaps in prior surveys that focused more on adversarial attacks by presenting a taxonomy of defense methods.Source: §11 · p. 32
• It covers adversarial datasets, frameworks for efficient evaluation of state-of-the-art models, and metrics for quantifying robustness.Source: §11 · p. 32
• The survey highlights literature limitations and gaps and offers recommendations for future research on robust and safe NLP networks.Source: §11 · p. 32

A.1 Text classification

• Text classification assigns text to categories across tasks such as sentiment analysis, natural language inference, malware detection, spam filtering, and topic labeling.The process generates a contextual representation before selecting a classifier, sometimes with preprocessing steps.Source: §A.1 · p. 32

A.2 Named Entity Recognition

• Named entity recognition identifies entities such as organizations, people, locations, and quantities, using rule-based, unsupervised, supervised, or deep-learning approaches.Its applications include question answering, information retrieval, relation extraction, summarization, and machine translation.Source: §A.2 · p. 32

A.3 Part-of-Speech tagging

• Part-of-speech tagging assigns token categories and includes rule-based, stochastic, transformation-based, and HMM-based approaches.Stochastic taggers use probability and frequency information; HMM-based taggers find the most probable tag sequence.Source: §A.3 · pp. 32–33

A.4 Machine comprehension and Question answering

• Question-answering systems generate answers from a given context and can be trained on context, question, and answer datasets such as SQuAD [105].Source: §A.4 · p. 33

A.5 Automatic summarization

• Automatic summarization condenses a document through extractive selection or data-driven abstractive generation; abstractive methods require substantial data.Extractive methods can be useful when training data is limited.Source: §A.5 · p. 33

A.6 Machine translation

• Machine translation converts text between languages, with challenges from diverse domains, written or spoken modes, hallucinations, and adversarial attacks.Source: §A.6 · p. 33

A.7 Dialogue generation; A.8 Question generation

• Dialogue generation covers task-oriented and open-ended systems, while question generation automatically creates assessment questions from text.Generated questions should be well-phrased and answerable from the source text; applications include MOOCs, healthcare, chatbots, and search engines.Source: §A.7 · p. 33, §A.8 · p. 34

B ILLUSTRATIONS OF SOME ADVERSARIAL DEFENSE METHODS IN NLP

• The following section illustrates adversarial defense schemes across the categories proposed in the paper.Source: B ILLUSTRATIONS OF SOME ADVERSARIAL… · p. 34

B.1 AdvEntuRe: Adversarial Training for Textual Entailment with Knowledge-Guided Examples

• AdvEntuRe [56] trains a generator and discriminator end-to-end for textual entailment, with the generator producing adversarial examples using external knowledge or handwritten rules.The seq2seq generator supplies examples on which the discriminator learns textual entailment.Source: §B.1 · p. 34, Figure 2 · p. 34

B.2 Natural Language Adversarial Defense through Synonym Encoding

• The Synonym Encoding Method clusters synonyms in embedding space and maps substitutions to a unique encoding before model input, without adding training data.The approach targets synonym-substitution attacks.Source: §B.2 · pp. 34–35, Figure 3 · p. 35

B.3 Interpretable Adversarial Perturbation in Input Embedding Space for Text

• Interpretable adversarial training [119] restricts perturbation directions to words in the existing vocabulary, so perturbations remain interpretable after training.Unlike AdvT’s unrestricted directions, iAdvT limits perturbations to the direction of input word embeddings.Source: §B.3 · p. 35, Figure 4 · p. 35

B.4 SAFER: A Structure-free Approach for Certified Robustness to Adversarial Word Substitutions

• SAFER [157] provides structure-free certified robust models applicable to arbitrary models, addressing IBP-based methods’ inapplicability to character- and subword-level models.It builds word perturbation sets from synonyms and top-K nearest neighbors by cosine similarity of GloVe vectors, then generates sentence perturbations to train a classifier with robust certification.Source: §B.4 · pp. 35–36

B.5 Certified Robustness to Word Substitution Attack with Differential Privacy

• WordDP treats a sentence as a database and words as individual records; satisfying an epsilon-DP threshold for a perturbed input is used to certify robustness against L-adversary word substitutions.Source: §B.5 · p. 36, Figure 6 · p. 36

B.6 Adversarial NLI: A New Benchmark for Natural Language Understanding

• ANLI [94] provides adversarial examples for natural language inference, collected through a human-and-model-in-the-loop data-collection scheme.The scheme tests examples with state-of-the-art NLI models and then has human annotators verify them.Source: §B.6 · pp. 36–37
• The dataset contains 103k examples built from short multi-sentence Wikipedia passages, with annotators writing adversarial hypotheses.Collection proceeds through three iterative rounds.Source: §B.6 · pp. 36–37
• Collected adversarial examples are used in adversarial training to improve natural language inference model performance.Figure 7 depicts the ANLI data-collection framework.Source: §B.6 · p. 37, Figure 7 · p. 37