Source-linked AI summary
Unpacking Robustness in Inflectional Languages: Adversarial Evaluation and Mechanistic Insights
Paweł Walkowiak, Marek Klonowski, Marcin Oleksy, Arkadiusz Janz
TL;DR
The paper addresses limited evidence on adversarial robustness in inflectional languages. It evaluates attacks across languages and analyzes circuits using parallel data, finding that inflection-specific components in Polish circuits were associated with improved robustness under attack.
Problem
How adversarial attacks behave in inflectional languages remains underexplored, including whether training-language inflectional complexity relates to model robustness.
Source: §1 · p. 1Method
The paper evaluates four attacks across Polish, Czech, and English and uses EAP-IG with parallel task-specific data to analyze inflection-related model circuits.
Source: §1 · pp. 1–2, §5.1 · p. 5, §5.3 · p. 6Results
TextBugger had the highest attack success rate and corresponding accuracy decrease; in Polish, circuits with inflection-specific components showed improved robustness, unlike the reference circuit.
Source: §6.1 · p. 7Takeaways & Limitations
Inflection-specific components at the circuit level may play a role in model resilience to adversarial perturbations.
Source: §6.1 · p. 7Producing parallel datasets for circuit discovery is costly and labor-intensive, requiring token alignment and often linguistic expertise and manual intervention.
Source: §6.2 · p. 7
Abstract
from arXiv · showhide
Various techniques are used in the generation of adversarial examples, including methods such as TextBugger which introduce minor, hardly visible perturbations to words leading to changes in model behaviour. Another class of techniques involves substituting words with their synonyms in a way that preserves the text's meaning but alters its predicted class, with TextFooler being a prominent example of such attacks. Most adversarial example generation methods are developed and evaluated primarily on non-inflectional languages, typically English. In this work, we evaluate and explain how adversarial attacks perform in inflectional languages. To explain the impact of inflection on model behaviour and its robustness under attack, we designed a novel protocol inspired by mechanistic interpretability, based on Edge Attribution Patching (EAP) method. The proposed evaluation protocol relies on parallel task-specific corpora that include both inflected and syncretic variants of texts in two languages -- Polish and English. To analyse the models and explain the relationship between inflection and adversarial robustness, we create a new benchmark based on task-oriented dataset MultiEmo, enabling the identification of mechanistic inflection-related elements of circuits within the model and analyse their behaviour under attack.
1 Introduction
The introduction identifies an evidence gap around adversarial robustness in inflectional languages and asks whether training-language inflectional complexity matters. It proposes cross-language attack evaluation and mechanistic analysis of inflection-related model components.
1 Introduction
- The behavior of adversarial attacks in inflectional languages remains unexplored, including whether a model’s training-language inflectional complexity relates to its robustness.The paper frames this as a question about language-specific vulnerabilities and mechanisms.Source: §1 · p. 1
- The work evaluates four adversarial example generation methods across topic classification and sentiment analysis in Polish, Czech, and English.The languages include two highly inflectional languages and English as a non-inflectional reference.Source: §1 · pp. 1–2
- The paper introduces a parallel dataset and uses Edge Attribution Patching to identify inflection-related components in task-specific model circuits.The dataset is designed to support mechanistic identification and analysis of model robustness.Source: §1 · pp. 1–2
2 Related Work
The related work situates the study in text classification, adversarial attacks, inflectional language processing, and mechanistic interpretability. It describes a range of attack strategies and motivates examining model internals alongside predictions.
Text Classification
- Text classification maps input samples to one or more classes, and pretrained BERT representations can be fine-tuned for such tasks.The passage highlights BERT’s effectiveness and its usefulness when labeled data are limited.Source: §2 · p. 2
- Despite questions about whether BERT remains state of the art, cited studies report BERT-based models outperforming decoder-only architectures on text classification tasks.The passage presents this as a reason to continue evaluating BERT robustness.Source: §2 · p. 2
Adversarial Examples in Text Classification
Inflection
- Inflectional endings can give a morpheme multiple functions, making meaning-preserving text modification more challenging in inflectional languages.The passage also notes that relatively free word order permits paraphrasing while preserving semantic content.Source: §2 · p. 2
Mechanistic Interpretability
- Mechanistic interpretability seeks to uncover internal structures behind model behavior, and a circuit is a subset of components performing a narrow task.Edge Attribution Patching is described as an efficient approximation of activation patching for circuit discovery.Source: §2 · p. 2
3 Adversarial Examples Generation Methods
The section describes four BERT-oriented attack methods that select vulnerable or important words and replace them with perturbed forms or candidate substitutions.
TextFooler
- TextFooler ranks words by their impact on model decisions and replaces them with synonyms selected using uncontextualized GloVe embeddings.It evaluates masked words to identify important words for modification.Source: §3 · p. 2
TextBugger
- TextBugger perturbs selected words through insertion, deletion, adjacent-character swaps, visually similar character substitutions, or nearest-neighbor word replacement.The passage describes ranking important words before introducing perturbations.Source: §3 · p. 3
WordNetTextFooler
- WordNetTextFooler uses Shapley values to rank word importance and replaces candidates with synonyms from Polish WordNet, accounting for inflectional variation.Its approach combines aspects of TextFooler and TextBugger.Source: §3 · p. 3
BERT-Attack
- BERT-Attack uses a pretrained BERT-type model to generate contextualized replacement tokens for words identified by masking-based prediction changes.The passage contrasts its contextual substitutions with earlier methods relying on simple perturbations or word-vector synonyms.Source: §3 · p. 3
4 Experiments
The experiments compare adversarial attacks across Polish, Czech, and English classification tasks, then assess how similarity metrics characterize the resulting examples. They also examine whether attack effects differ by language and task.
4 Experiments
- The experiments had two aims: compare attack effectiveness across languages and identify inflection-processing components and assess their robustness under attack.Attack effectiveness was measured by comparing baseline accuracy on original test data with accuracy under adversarial examples; Table 2 presents accuracy changes.Source: §4 · p. 3, §4.2 · p. 3, Table 2 · p. 4
4.1 Datasets
- The evaluation covered topic classification and sentiment analysis using Polish, Czech, and English datasets and language-specific BERT-based classifiers.The datasets were Wiki_PL and MultiEmo, Czech Text Document Corpus v 2.0 and CSFD, and AG_News and IMDB; the classifiers were HerBERT, RobeCzech, and BERT, respectively.Source: §4.1 · p. 3
4.2 Adversarial Examples Performance
- TextBugger caused the greatest accuracy drop; English sentiment models were less robust, while English topic models were more robust than Polish and Czech models.The sentiment-analysis comparison reverses the topic-classification pattern for language-specific models.Source: §4.2 · pp. 3–4, Table 2 · p. 4
4.3 How to Measure Adversarial Examples Quality?
- WordNetTextFooler examples were highly similar to originals, ranking highest in ROUGE and first or second in semantic similarity depending on the dataset.TextBugger, despite being more effective, showed lower statistical similarity than less successful attacks.Source: §4.3 · p. 4
- NLI similarity varied substantially across examples; long-tailed distributions of low-scoring examples accounted for high standard deviations in the examined datasets.This pattern appeared for TextFooler, WordNetTextFooler, and BERT-Attack in AG_News, and for TextFooler and WordNetTextFooler in CSFD.Source: §4.3 · p. 4
5 Mechanistic Interpretability of BERT-based classifiers
The section builds an inflection-focused circuit benchmark and uses EAP-IG to examine circuit behavior under adversarial attack.
5 Mechanistic Interpretability of BERT-based classifiers
- The authors trained XLM-RoBERTa on Polish and English MultiEmo sentiment data, using 334,960 training examples and 41,710 test examples; test accuracy was 94%.The circuit-detection analysis is illustrated in Figure 4.Source: §5 · p. 4, Figure 4 · p. 5
5.1 Inflectional Circuit Detection Dataset
- The detection dataset contains three parallel versions, each with 244 examples, contrasting syncretic, regularly inflected, and English synonym substitutions.Pairs were excluded when the model predictions did not change between clean and corrupted runs.Source: §5.1 · p. 5
5.2 Edge Attribution Patching
- EAP-IG extends Edge Attribution Patching with integrated gradients to improve circuit recognition in zero-gradient regions between clean and corrupted responses.EAP estimates connection impact with minimal computational passes through the model.Source: §5.2 · p. 6
5.3 Circuits Detection
- EAP-IG scores edges between attention heads and MLP layers using correct-class predictive confidence, then selects components connected to the highest-scoring edges.Circuits were constructed at six sizes; adding edges did not always improve performance because examples may rely on different edge subsets.Source: §5.3 · p. 6, Table 4 · p. 6
- The Polish inflectional circuit repeatedly included Layer 0 attention heads a0.h3, a0.h5, a0.h6, a0.h7, and a0.h11 across circuit sizes.The authors suggest these heads may be inflection-specific because they are selectively activated by inflectional changes in corrupted texts.Source: §5.3 · p. 6
5.4 Circuits Robustness against Adversarial Examples
- Inflectional circuits achieved the highest average robustness across graph sizes and attack methods, although syncretic circuits performed better at some sizes.The authors relate this pattern to attacks that modify word components and inflectional morphology.Source: Table 5 · p. 6, §5.4 · pp. 6–7
6 Discussion
The conclusion links inflection-aware training and Polish circuit components with improved robustness, while TextBugger is the strongest evaluated attack but produces lower-quality examples. The authors also identify dataset constraints and costly alignment work, and propose further study of model circuits.
6.1 Conclusion
- Inflection in training corpora can increase robustness against adversarial examples that modify individual characters in words.Source: §6.1 · p. 7
- TextBugger had the highest attack success rate and corresponding decrease in model accuracy; character-level edits may disrupt models more than whole-word substitutions.Source: §6.1 · p. 7
- TextBugger produced statistically lower-quality attacks, while Semantic Similarity and ROUGE were stable and NLI scores varied widely, including near-zero scores for some examples.Source: §6.1 · p. 7
- Including inflection-specific components in Polish task circuits contributed to improved robustness under adversarial perturbations; corresponding components were not observed in the English reference circuit.The authors attribute the English contrast probably to English’s relatively low morphological variability.Source: §6.1 · p. 7
6.2 Limitations
- Limited high-quality annotated datasets constrain research on Czech; model accuracy was 83% on CTDC and 86% on CSFD, versus above 94% on Polish and English datasets.Source: §6.2 · p. 7
- Circuit discovery requires costly parallel datasets whose clean and corrupted samples have identical token counts, making construction time-consuming and labor-intensive.Source: §6.2 · p. 7
6.3 Future Works
- Future work will examine additional robustness dimensions through the structural and functional properties of circuits, using datasets tailored to linguistic phenomena and preserving token-level alignment.Creating such datasets demands considerable linguistic expertise, manual effort, and computational resources.Source: §6.3 · pp. 7–8