SlowGuess/NAACL_2022_OCR huggingface dataset:
We use two BERT-base-uncased (Wolf et al., 2020) as the rationalizer and the predictor components for all the models and one BERT-base for the Full Context (FC) baseline. The rationales for FEVER, MultiRC, SQuAD are extracted at sentence level, and Beer and Hotel are at token-level.
$$
\begin{array}{l} \operatorname {B E R T} (x) = \left(\mathbf {h} _ {[ \mathrm {C L S} ]}, \mathbf {h} _ {0} ^ {1}, \mathbf {h} _ {0} ^ {2}, \dots , \mathbf {h} _ {0} ^ {n _ {0}}, \mathbf {h} _ {[ \mathrm {S E P} ]}, \right. \\ \left. \mathbf {h} _ {1} ^ {1}, \mathbf {h} _ {1} ^ {2}, \dots , \mathbf {h} _ {1} ^ {n _ {1}}, \dots , \mathbf {h} _ {T} ^ {1}, \mathbf {h} _ {T} ^ {2}, \dots , \mathbf {h} _ {T} ^ {n _ {T}}, \mathbf {h} _ {[ S E P ]}\right), \\ \end{array}
$$
where the input text is formatted as query with sentence index 0 and context with sentence index 1 to  $T$ . For sentiment tasks, the 0-th sentence and the first [SEP] token are omitted. For sentence-level representations, we concatenate the start and end vectors of each sentence. For instance, the  $t$ -th sentence representation is  $\mathbf{h}_t = [\mathbf{h}_t^0; \mathbf{h}_t^{n(t)}]$ . For token-level representations, we use the hidden vectors directly. The representations are passed to a linear layer  $\{\mathbf{w}, b\}$  to obtain logit for each sentence  $s = \mathbf{w}^\top \mathbf{h}_t + b$ .
Training Both the rationalizer and the predictor in the rationale models are initialized with pretrained BERT (Devlin et al., 2019). We predetermine rationale sparsity before fine-tuning based on the average rationale length in the development set following previous work (Paranjape et al., 2020; Guerreiro and Martins, 2021). We set  $\pi = 0.4$  for FEVER,  $\pi = 0.2$  for MultiRC,  $\pi = 0.7$  for SQuAD,  $\pi = 0.1$  for Beer, and  $\pi = 0.15$  for Hotel. The hyperparameter  $k$  (for top- $k$  ratioanle extraction) is selected based on the percentage  $\pi$  of the human annotated rationales in the development set (following Paranjape et al. (2020)). During evaluation, for each passage  $k = \pi \times \#$  sentences. We select the model parameters based on the highest fine-tuned task performance on the development set. The models with rationale supervision will select the same amount of text as their no-supervision counterparts. The epoch/learning rate/batch size for the different datasets are described in Table A.2.
Dataset	Epoch	Learing Rate	Batch Size
FEVER	10	5e-5	32
MultiRC	10	5e-5	32
SQuAD	3	1e-5	32
Beer	20	5e-5	64
Hotel	20	5e-5	64
A.3 Qualitative Examples
We provide qualitative examples of the rationale model predictions for each dataset in Table 8.
A.4 Attack Position and Lexical Variation
Figure 4 shows a more fine-grained trend reflecting the sensitivity of AR against inserted attack position. As the attack position move from the beginning of the passage towards the end, AR decreases across all models. With ART training (R6 in §6), the AR also becomes less sensitive to positions. We also experimented with various adjectives related to appearance as the attack and observe the same trend. For example, when inserting "The carpet looks really ugly/beautiful" to the Beer dataset, VIB performance drops  $93.8 \rightarrow 83.1$  while FC drops  $93.8 \rightarrow 61.6$ .
Figure 4: The attack capture rate (AR) changes with respect to different attack positions for FEVER and MultiRC.
Table 8: Examples of predicted rationales (yellow highlight), gold rationale (cyan text), and attack (red text) for passages in different datasets.