Question: What has been found by comparing automatic evaluation and human evaluation results?
Evidence: We present the percentage of answers to each question in Figure FIGREF38. The green bars illustrate how well the adversarial examples paraphrase the original ones; blue how natural the adversarial examples read; and red whether the sentiment of the adversarial examples is consistent compared to the original.
Looking at the performance of the original sentences (“(a) Original samples”), we see that their language is largely fluent and their sentiment is generally consistent to the original examples', although it's worth noting that the review sentiment of imdb400 can be somewhat ambiguous (63% agreement). We think this is due to movie reviews being more descriptive and therefore creating potential ambiguity in their expression of sentiment.
On content preservation (criterion (b); green bars), all methods produce poor paraphrases on yelp50. For imdb400, however, the results are more promising; adversarial examples generated by HotFlip, in particular, are good, even at T2.
Next we look at fluency (criterion (c); blue bars). We see a similar trend: performance in imdb400 is substantially better than yelp50. In fact we see almost no decrease in fluency in the adversarial examples compared to the original in imdb400. In yelp50, HotFlip and AutoEncoder are fairly competitive, producing adversarial examples that are only marginally less fluent compared to the original at T0. At T2, however, these methods begin to trade off fluency. All in all, the paraphrasability and fluency surveys suggest that imdb400 is an easier dataset for adversarial experiments, and it is the predominant dataset used by most studies.
Lastly, we consider sentiment preservation (criterion (d); red bars). All methods perform poorly at preserving the original sentiment on both yelp50 and imdb400 datasets. The artifact is arguably more profound on shorter inputs, as the original examples in imdb400 have lower agreement in the first place (yelp50 vs. imdb400: 86% vs. 63%). Again both HotFlip and AutoEncoder are the better methods here (interestingly, we observe an increase in agreement as their attacking performance increases from T0 and T2).
Summarising our findings, HotFlip is generally the best method across all criteria, noting that its adversarial examples, however, have poor transferability. TYC generates good black-box adversarial examples but do not do well in terms of content preservation and fluency. AutoEncoder produces comparable results with HotFlip for meeting the four criteria and generates examples that generalise reasonably, but it is very sensitive to the increase of training examples for the target classifier. The ACPT metric appears to be effective in evaluating fluency, as we see good agreement with human evaluation. All said, we found that all methods tend to produce adversarial examples that do not preserve their original sentiments, revealing that these methods in a way “cheat” by simply flipping the sentiments of the original sentences to fool the classifier, and therefore the adversarial examples might be ineffective for adversarial training, as they are not examples that reveal potential vulnerabilities in the classifier.
Comparing automatic evaluation and human evaluation results, we found that the SEM scores are generally consistent with the human evaluation results on semantic preservation, while the BLEU score is less effective as evidenced by the high BLEU score of HOTFLIP on yelp50 and poor paraphrasing performance in the same settings. The ACPT metric appears to be a solid metric in evaluating fluency, as we see a good agreement with human evaluation across the three attacking methods.
Answer: They found that the SEM scores are generally consistent with the human evaluation results on semantic preservation, while the BLEU score is less effective as evidenced by the high BLEU score of HOTFLIP on yelp50 and poor paraphrasing performance in the same settings. The ACPT metric appears to be a solid metric in evaluating fluency.