SlowGuess/NAACL_2022_OCR huggingface dataset:
Figure 2 summarizes the average scores on all datasets for each model under the three attacks we consider. We first observe that all models (including the full-context models FC and FC-sup) are mildly affected by AddText-Rand and AddText-Wiki, with score drops of around  $1 - 2\%$ . However, the AddText-Adv attack leads to more significant drops in performance for all models, as high as  $46\%$  for SPECTRA on the Hotel dataset. We break out the AddText-Adv results in a more fine-grained manner in Table 3. Our main observation is that the rationale models (VIB, SPECTRA, VIB-sup) are generally more robust than their non-rationale counterparts (FC, FC-sup) on four out of the five tasks, and in some cases dramatically better. For instance, on the Beer dataset, SPECTRA only suffers a  $5.7\%$  drop  $(95.4 \rightarrow 89.7)$  compared to FC's huge  $34.3\%$  drop  $(93.8 \rightarrow 59.5)$  under attack. The only exception is the Hotel dataset, where both the VIB and SPECTRA models perform worse under attack compared to FC. We analyze this phenomena and provide a potential reason below.
6.2 Robustness Evaluation: GR vs AR
In Table 4, we report the Gold Rationale F1 (GR) and Attack Capture Rate (AR) for all models. When attacks are added, GR consistently decreases for all tasks. However, AR ranges widely across datasets. VIB and SPECTRA have lower AR and higher GR compared to FC-sup across all tasks, which is correlated with their superior robustness to AddText-Adv attacks.
Next, we investigate the poor performance of VIB and SPECTRA on the Hotel dataset by analyzing the choice of words in the attack. Using the template "My car is  $\{\mathrm{ADJ}\}$ ". we measure the percentage of times the rationalizer module selects the adjective as part of its rationale. When the adjectives are "dirty" and "clean", the VIB model selects them a massive  $98.5\%$  of the time. For "old" and "new", VIB still selects them  $50\%$  of the time. On the other hand, the VIB model trained on Beer reviews with attack template "The tea is  $\{\mathrm{ADJ}\}$ ." only selects the adjectives  $20.5\%$  of the time (when the adjectives are "horrible" and "fabulous"). This shows that the bad performance of the rationale models on the Hotel dataset is due to their inability to ignore task-related adjectives in the attack text, hinting that the lexical choices made in constructing the attack can largely impact robustness.
Figure 2: Original performance (Orig) and the three type of attacks AddText-Rand (Rand), AddText-Wiki (Wiki), and AddText-Adv (Adv) evaluated on five datasets and all of the models. FC-sup and VIB-sup models used human rationales during training ( $\S 5.2$ ).
FC VIB SPECTRA FC-sup VIB-sup
FEVER	MultiRC	SQuAD	Beer	Hotel
Ori	Att	Δ↓	Ori	Att	Δ↓	Ori	Att	Δ↓	Ori	Att	Δ↓	Ori	Att	Δ↓
Majority	50.7	-	-	54.8	-	-	-	-	-	68.9	-	-	50.0	-	-
FC	90.7	77.9	12.8	70.7	63.0	7.7	87.2	59.1	28.1	93.8	59.5	34.3	99.5	79.3	20.2
VIB	87.8	82.6	5.2	65.4	63.6	1.8	77.1	56.5	20.6	93.8	88.0	5.8	94.0	59.3	34.8
SPECTRA	84.0	76.5	7.6	63.8	63.3	0.5	65.5	45.5	20.0	95.4	89.7	5.7	94.5	51.3	43.2
FC-sup	91.9	77.1	14.8	71.5	64.0	7.5	87.0	57.3	29.7	-	-	-	-	-	-
VIB-sup	90.2	81.4	8.8	68.7	63.7	5.0	86.5	56.5	30.0	-	-	-	-	-	-
Table 3: Original (Ori) versus attacked (Att) task performance on the five selected datasets under the AddText-Adv attack. We report accuracy for all datasets except for SQuAD, which we report F1. The attacked performance is the average of inserting the attack at the start and at the end of the text input.
FEVER	MultiRC	SQuAD	Beer	Hotel
GR ↑	AR ↓	GR ↑	AR ↓	GR ↑	AR ↓	GR ↑	AR ↓	GR ↑	AR ↓
VIB	36.9→30.3	59.4	15.8→13.9	35.8	86.2→84.9	63.7	20.5→18.1	11.9	23.5→22.6	18.4
SPECTRA	26.9→21.5	40.6	11.9→11.8	22.6	67.1→60.8	52.6	28.6→27.8	15.2	19.5→18.3	31.6
FC-sup	51.5→45.5	65.9	50.0→42.7	55.7	99.6→98.8	97.8	-	-	-	-
VIB-sup	50.6→44.3	67.0	36.1→22.7	58.7	99.5→97.8	97.2	-	-	-	-
Table 4: Gold rationale F1 (GR) (original→perturbed input) and attack capture rate (AR) for the AddText-Adv attack on the five tasks (defined in §4.2). The reported number is the average of inserting the attack at the start and at the end of the text input.
We examine where the rationale model gains robustness by inspecting the generated rationales. Table 5 shows the accuracy breakdown under attack for VIB and VIB-sup models. Intuitively, both models perform best when the gold rationale is selected and the attack is avoided, peaking at 91.1 for VIB and 92.4 for VIB-sup. Models perform much worse when the gold rationale is omitted and the attack is included (73.6 for VIB and 74.1 for VIB-sup), highlighting the importance of choosing good and skipping the bad as rationales.
6.3 Impact of Gold Rationale Supervision
Perhaps surprisingly, adding explicit rationale supervision does not help improve robustness (Ta
ble 3). Across FEVER, MultiRC and SQuAD, VIB-sup consistently has a higher  $\Delta$  between its scores on the original and perturbed instances. We observe that models trained with human rationales generally have higher GR, but they also capture a much higher AR across the board (Table 4). On MultiRC, for instance, the VIB-sup model outperforms VIB in task performance because of its higher GR (36.1 versus 15.8). However, when under attack, VIB-sup's high 58.7 AR, hindering the performance compared to VIB, which has a smaller 35.8 AR. This highlights a potential shortcoming of prior work in only considering metrics like IOU (similar in spirit to GR) to assess rationale models. The finding also points to the risk of straightforwardly
VIB Acc (%)	VIB-sup Acc (%)
Original	87.8	90.2
Overall Attack	83.0 (100%)	84.9 (100%)
G ✓ A ✓	83.3 (34%)	85.5 (77%)
G ✓ A X	91.1 (32%)	92.4 (11%)
G X A ✓	73.6 (22%)	74.1 (12%)
G X A X	77.7 (12%)	68.0 (0%)
incorporating supervised rationale as it could result in the existing model overfitting to them.
6.4 Sensitivity of Attack Positions
We further analyze the effect of attack text on rationale models by varying the attack position. Figure 3 displays the performance of VIB, VIB-sup and FC on FEVER and SQuAD when the attack sentence is inserted into the first, last or any random position in between. We observe performance drops on both datasets when inserting the attack sentence at the beginning of the context text as opposed to the end. For example, when the attack sentence is inserted at the beginning, the VIB model drops from 77.1 F1 to 40.9 F1, but it only drops from 77.1 F1 to 72.1 F1 for a last position attack on SQuAD. This hints that rationale models may implicitly be picking up positional biases from the dataset, similar to their full-context counterparts (Ko et al., 2020). We provide fine-grained plots for AR versus attack positions in §A.4.
Figure 3: Accuracy when attack is inserted at different sentence positions, highlighting the positional bias picked up by the models.
Table 5: Accuracy breakdown of the VIB and VIB-sup models on the FEVER dataset. The attack is inserted at the beginning of the passage.  $\checkmark$  indicates the Gold (G) or Attack (A) sentence is selected as rationale and  $\times$  otherwise. We show the percentage of examples in parenthesis. The highlighted row shows the desirable category and models achieve the highest accuracy.
FEVER	MultiRC
Ori	Att	Δ↓	Ori	Att	Δ↓
FC-sup	91.9	77.1	14.8	71.5	64.0	7.5
+ ART	91.8	78.7	13.1	69.3	64.8	4.5
VIB	87.8	82.6	4.2	65.4	63.6	0.7
+ ART	87.6	87.0	0.6	65.8	65.5	0.3
VIB-sup	90.2	81.4	8.8	68.7	63.7	5.0
+ ART	90.0	86.1	3.9	70.3	65.7	4.6
Table 6: Augmented Rationale Training (ART) reduces the effect of adversarial attacks. Ori: original input, Att: input with attack text.
7 Augmented Rationale Training
From our previous analysis on the trade-off between GR and AR (§6.2), it is clear that avoiding attack sentences in rationales is a viable way to make such models more robust. Note that this is not obvious by construction since the addition of attacks affects other parameters such as position of the original text and discourse structure, which may throw off the 'predictor' component of the model. As a more explicit way of encouraging 'rationalizers' to ignore spurious text, we propose a simple method called augmented rationale training (ART). Specifically, we sample two sentences at random from the Wikitext-103 dataset (Merit et al., 2017) and insert them into the input passage at random position, setting their pseudo rationale labels  $z^{\text{pseudo}} = 1$  and the labels for all other sentences as  $z = 0$ . We limit the addition to only inserting two sentences to avoid exceeding the rationalizer maximal token limit. We then add an auxiliary negative binary cross entropy loss to train the model to not predict the pseudo rationale. This encourages the model to ignore spurious text that is unrelated to the task. Note that this procedure is both model-agnostic and does not require prior knowledge of the type of AddText attack.
Table 6 shows that ART improves robustness across the board for all models (FC-sup, VIB and VIB-sup) in both FEVER and MultiRC, dropping  $\Delta$  scores by as much as  $5.9\%$  (VIB-sup on FEVER). We further analyzed these results to break down performance in terms of attack and gold sentence capture rate. Table 7 shows that ART greatly improves the percentage of sentences under the "Gold Attack  $X^{\prime \prime}$ " category ( $31.8\% \rightarrow 65.4\%$  for VIB and  $11.3\% \rightarrow 63.5\%$  for VIB-sup). This corroborates our expectations for ART and shows its effectiveness.
tiveness at keeping GR high while lowering AR.
Interestingly, the random Wikipedia sentences we added in ART are not topically or contextually related to the original instance text at all, yet they seem to help the trained model ignore adversarially constructed text that is tailored for specific test instances. This points to the promise of ART in future work, where perhaps more complex generation schemes or use of attack information could provide even better robustness.
VIB	VIB-sup	+ART
VIB	VIB-sup
G	A	34.3%	76.7%	6.0%	25.4%
G	A	31.8%	11.3%	65.4%	63.5%
G	A	22.0%	11.5%	3.2%	4.2%
G	A	12.0%	0.4%	25.4%	6.8%
Table 7: The percentage of examples in the development set (in four categories the same way as Table 5) of the VIB and VIB-sup models without (left) and with (right) ART training on the FEVER dataset.
In this work, we investigated whether neural rationale models are robust to adversarial attacks. We constructed a variety of AddText attacks across five different tasks and evaluated several state-of-the-art rationale models. Our findings raise two key messages for future research in both interpretability and robustness of NLP models:
Interpretability We identify an opportunity to use adversarial attacks as a means to evaluate rationale models (especially extractive ones). In contrast to existing metrics like IOU used in prior work (DeYoung et al., 2020; Paranjape et al., 2020), robustness more accurately tests how crucial the predicted rationale is to the model's decision making. Further, our analysis reveals that even state-of-the-art rationale models may not be consistent in focusing on the most relevant parts of the input, despite performing well on tasks they are trained on. This points to the need for better model architectures and training algorithms to better align rationale models with human judgements.
Robustness For adversarial attack research, we show that extractive rationale models are promising for improving robustness, while being sensitive to factors like the attack position or word choices in the attack text. Research that proposes new attacks can use rationale models as baselines to assess their
effectiveness. Finally, the effectiveness of ART points to the potential for data augmentation in improving robustness of NLP systems, even against other types of attacks beyond AddText.
We hope our results can inspire more research at the intersection of interpretability and robustness.
We thank the members of the Princeton NLP group and the anonymous reviewers for their valuable comments and feedback. HC is supported by the Princeton Upton Fellowship. This research is also supported by a Salesforce AI Research Grant.
Alexander Alemi, Ian Fischer, Joshua Dillon, and Kevin Murphy. 2017. Deep variational information bottleneck. In International Conference on Learning Representations (ICLR).
David Alvarez-Melis and Tommi Jaakkola. 2017. A causal framework for explaining the predictions of black-box sequence-to-sequence models. In Empirical Methods in Natural Language Processing (EMNLP), pages 412-421.
David Alvarez-Melis and Tommi S Jaakkola. 2018. On the robustness of interpretability methods. arXiv preprint arXiv:1806.08049.
Jasmijn Bastings, Wilker Aziz, and Ivan Titov. 2019. Interpretable neural predictions with differentiable binary variables. In Association for Computational Linguistics (ACL), pages 2963-2977.
Yonatan Belinkov and Yonatan Bisk. 2018. Synthetic and natural noise both break neural machine translation. In International Conference on Learning Representations (ICLR).
Oana-Maria Camburu, Brendan Shillingford, Pasquale Minervini, Thomas Lukasiewicz, and Phil Blunsom. 2020. Make up your mind! adversarial generation of inconsistent natural language explanations. In *Association for Computational Linguistics (ACL)*.
Shiyu Chang, Yang Zhang, Mo Yu, and Tommi S. Jaakkola. 2020. Invariant rationalization. In International Conference on Machine Learning (ICML).
Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-training of deep bidirectional transformers for language understanding. In North American Association for Computational Linguistics (NAACL), pages 4171-4186.
Jay DeYoung, Sarthak Jain, Nazneen F. Rajani, Eric Lehman, Caiming Xiong, Richard Socher, and Byron C. Wallace. 2020. ERASER: A benchmark to evaluate rationalized nlp models. In Association for Computational Linguistics (ACL).
Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018. Hotflip: White-box adversarial examples for text classification. In Association for Computational Linguistics (ACL), pages 31-36.
Christiane Fellbaum. 1998. WordNet: An Electronic Lexical Database. Bradford Books.
Nuno Miguel Guerreiro and Andre F. T. Martins. 2021. SPECTRA: Sparse structured text rationalization. In Empirical Methods in Natural Language Processing (EMNLP).
Mohit Iyyer, John Wieting, Kevin Gimpel, and Luke Zettlemoyer. 2018. Adversarial example generation with syntactically controlled paraphrase networks. In North American Association for Computational Linguistics (NAACL), pages 1875-1885.
Alon Jacovi and Yoav Goldberg. 2020. Towards faithfully interpretable NLP systems: How should we define and evaluate faithfulness? In Association for Computational Linguistics (ACL).
Sarthak Jain and Byron C Wallace. 2019. Attention is not explanation. In *North American Association for Computational Linguistics (NAACL)*, pages 3543-3556.
Sarthak Jain, Sarah Wiegreffe, Yuval Pinter, and Byron C Wallace. 2020. Learning to faithfully rationalize by construction. In Association for Computational Linguistics (ACL), pages 4459-4473.
Eric Jang, Shixiang Gu, and Ben Poole. 2017. Categorical reparameterization with gumbel-softmax. In International Conference on Learning Representations (ICLR).
Robin Jia and Percy Liang. 2017. Adversarial examples for evaluating reading comprehension systems. In Empirical Methods in Natural Language Processing (EMNLP).
Divyansh Kaushik, Eduard Hovy, and Zachary C. Lipton. 2020. Learning the difference that makes a difference with counterfactually-augmented data. In International Conference on Learning Representations (ICLR).
Daniel Khashabi, Snigdha Chaturvedi, Michael Roth, Shyam Upadhyay, and Dan Roth. 2018. Looking beyond the surface: A challenge set for reading comprehension over multiple sentences. In North American Association for Computational Linguistics (NAACL).
Miyoung Ko, Jinhyuk Lee, Hyunjae Kim, Gangwoo Kim, and Jaewoo Kang. 2020. Look at the first sentence: Position bias in question answering. In Empirical Methods in Natural Language Processing (EMNLP).
Tao Lei, Regina Barzilay, and Tommi Jaakkola. 2016. Rationalizing neural predictions. In Empirical Methods in Natural Language Processing (EMNLP).
Julian McAuley, Jure Leskovec, and Dan Jurafsky. 2012. Learning attitudes and attributes from multi-aspect reviews. In IEEE International Conference on Data Mining (ICDM).
Stephen Merity, Caiming Xiong, James Bradbury, and Richard Socher. 2017. Pointer sentinel mixture models. In International Conference on Learning Representations (ICLR).
Sharan Narang, Colin Raffel, Katherine Lee, Adam Roberts, Noah Fiedel, and Karishma Malkan. 2020. WT5?! training text-to-text models to explain their predictions. arXiv preprint arXiv:2004.14546.
Vlad Niculae and F. T. Andre Martins. 2020. Lp-sparsemap: Differentiable relaxed optimization for sparse structured prediction. In International Conference on Machine Learning (ICML).
Adam Noack, Isaac Ahern, Dejing Dou, and Boyang Li. 2021. An empirical study on the relation between network interpretability and adversarial robustness. SN Computer Science, 2(1):1-13.
Bhargavi Paranjape, Mandar Joshi, John Thickstun, Hannaneh Hajishirzi, and Luke Zettlemoyer. 2020. An information bottleneck approach for controlling conciseness in rationale extraction. In Empirical Methods in Natural Language Processing (EMNLP).
Pranav Rajpurkar, Jian Zhang, Konstantin Lopyrev, and Percy Liang. 2016. SQuAD: 100,000+ questions for machine comprehension of text. In Association for Computational Linguistics (ACL).
Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. 2016. "Why should i trust you?" explaining the predictions of any classifier. In ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), pages 1135-1144.
Sofia Serrano and Noah A Smith. 2019. Is attention interpretable? In Association for Computational Linguistics (ACL), pages 2931-2951.
Lei Sha, Oana-Maria Camburu, and Thomas Lukasiewicz. 2021. Learning from the best: Rationalizing prediction by adversarial information calibration. In Conference on Artificial Intelligence (AAAI).
Dylan Slack, Sophie Hilgard, Emily Jia, Sameer Singh, and Himabindu Lakkaraju. 2020. Fooling lime and shap: Adversarial attacks on post hoc explanation methods. In Conference on Artificial Intelligence (AAAI).
Kyle Swanson, Lili Yu, and Tao Lei. 2020. Rationalizing text matching: Learning sparse alignments via optimal transport. In Association for Computational Linguistics (ACL), pages 5609-5626.
Keyon Vafa, Yuntian Deng, David Blei, and Alexander M Rush. 2021. Rationales for sequential predictions. In Empirical Methods in Natural Language Processing (EMNLP), pages 10314-10332.
Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. 2019. Universal adversarial triggers for attacking and analyzing NLP. In Empirical Methods in Natural Language Processing (EMNLP).
Hongning Wang, Yue Lu, and Chengxiang Zhai. 2010. Latent aspect rating analysis on review text data: A rating regression approach. In ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD).
Sarah Wegreffe, Ana Marasović, and Noah A. Smith. 2021. Measuring association between labels and free-text rationales. In Empirical Methods in Natural Language Processing (EMNLP).
Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumont, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, Mariama Drame, Quentin Lhoest, and Alexander M. Rush. 2020. Transformers: State-of-the-art natural language processing. In In Proceedings of the Conference on Empirical Methods in Natural Language Processing: System Demonstrations (EMNLP Demo Track).
Mo Yu, Shiyu Chang, Yang Zhang, and Tommi Jaakkola. 2019. Rethinking cooperative rationalization: Introspective extraction and complement control. In Empirical Methods in Natural Language Processing (EMNLP), pages 4094-4103.
Yilun Zhou, Serena Booth, Marco Tulio Ribeiro, and Julie Shah. 2020. Do feature attribution methods correctly attribute features? In Conference on Artificial Intelligence (AAAI).
A.1 Model Details
VIB details The sentence or token level logits  $s \in \mathbb{R}^L$  (A.2 describes how the logits are obtained) parameterize a relaxed Bernoulli distribution  $p(z_t \mid x) = \text{RelaxedBernoulli}(s)$  (also known as the Gumbel distribution (Jang et al., 2017)), where  $z_t \in \{0, 1\}$  is the binary mask for sentence  $t$ . The relaxed Bernoulli distribution also allows for sampling a soft mask  $z_t^* = \sigma(\frac{\log s + g}{\tau}) \in (0, 1)$ , where  $g$  is the sampled Gumbel noise. The soft masks  $z^* = (z_1^*, z_2^*, \dots, z_T^*)$  are sampled independently to mask the input sentences such that the latent  $z = m^* \odot x$  for training. The following objective is optimized:
$$
\begin{array}{l} \ell_ {\mathrm {V I B}} (x, y) = \underset {z \sim p (z | x; \theta)} {\mathbb {E}} \left[ - \log p (y \mid z \odot x; \phi) \right] \\ + \beta \mathrm {K L} \left[ p (z \mid x; \theta) | | p (z) \right], \\ \end{array}
$$
where  $\phi$  denotes the parameters of the predictor  $C$ ,  $\theta$  denotes the parameters of the rationalizer  $R$ ,  $p(z)$  is a predefined prior distribution parameterized by a sparsity ratio  $\pi$ , and  $\beta \in \mathbb{R}$  controls the strength of the regularization.
During inference, we take the rationale as  $z_{t} = \mathbb{1}[s_{t}\in \mathrm{top - }k(s)]$ , where  $s\in \mathbb{R}^L$  is the vector of token or sentence-level logits, and  $k$  is determined by the sparsity  $\pi$ .
VIB-sup details With human raitonale supervision  $z^{*}$ , the objective below is optimized:
$$
\begin{array}{l} \ell_ {\mathrm {V I B - s u p}} (x, y) = \underset {z \sim p (z | x; \theta)} {\mathbb {E}} \left[ - \log p (y \mid z \odot x; \phi) \right] \\ + \beta \operatorname {K L} [ p (z \mid x; \theta) | | p (z) ] \\ + \gamma \sum_ {t} - z _ {t} ^ {*} \log p (z _ {t} \mid x; \theta), \\ \end{array}
$$
where  $\beta, \gamma \in \mathbb{R}$  are hyperparameters. During inference, the rationale module generates the mask  $z$  the same way as the VIB model by picking the top- $k$  scored positions as the final hard mask. The third loss term will encourage the model to predict human annotated rationales, which is the ability we expect a robust model should exhibit.
SPECTRA details SPECTRA optimizes the following objective:
$$
\begin{array}{l} \ell_ {\text {S P E C T R A}} (x, y) = - \log p (y \mid z \odot x; \phi), \\ z = \operatorname * {a r g m a x} _ {z ^ {\prime} \in \{0, 1 \} ^ {L}} (\mathrm {s c o r e} (z ^ {\prime}; s; \theta) - \frac {1}{2} \left\| z ^ {\prime} \right\| ^ {2}), \\ \end{array}
$$
where  $s \in \mathbb{R}^L$  is the logit vector of tokens or sentences, and a global score  $(\cdot)$  function that incorporates all constraints in the predefined factor graph. The factors can specify different logical constraints on the discrete mask  $z$ , e.g. a BUDGET factor that enforces the size of the rationale as  $\sum_{t} z_{t} \leq B$ . The entire computation is deterministic and allows for back-propagation through the LP-SparseMAP solver (Niculae and Martins, 2020). We use the BUDGET factor in the global scoring function. To control the sparsity at  $\pi$  (e.g.,  $\pi = 0.4$  for  $40\%$  sparsity), we can choose  $B = L \times \pi$ .
FC-sup details The FC model can be extended to leverage human annotated rationales supervision during training (FC-sup). We add a linear layer on top of the sentence-token representation and obtain the logits  $s \in \mathbb{R}^L$ . The logits are passed through the sigmoid function into mask probabilities to optimize the following objective:
$$
\begin{array}{l} \ell_ {\mathrm {F C - s u p}} (x, y) = - \log p (y \mid x; \phi) \\ + \gamma \sum_ {t} - z _ {t} ^ {*} \log p (z _ {t} \mid x; \phi , \xi), \\ \end{array}
$$
where  $z_{t}^{*}$  is the human rationale,  $\xi$  accounts for the parameters of the extra linear layer, and the hyperparameter  $\gamma$  is selected based on the original performance by tuning on the development set.