Venue: NAACL 2024

# Whispers of Doubt Amidst Echoes of Triumph in NLP Robustness

Ashim Gupta &Rishanth Rajendhran &Nathan Stringham Vivek Srikumar &Ana Marasovic

Kahlert School of Computing

University of Utah ashim@cs.utah.edu

###### Abstract

_Do larger and more performant models resolve NLP's longstanding robustness issues?_ We investigate this question using over 20 models of different sizes spanning different architectural choices and pretraining objectives. We conduct evaluations using (a) out-of-domain and challenge test sets, (b) behavioral testing with CheckLists, (c) contrast sets, and (d) adversarial inputs. Our analysis reveals that not all out-of-domain tests provide insight into robustness. Evaluating with CheckLists and contrast sets shows significant gaps in model performance; merely scaling models does not make them adequately robust. Finally, we point out that current approaches for adversarial evaluations of models are themselves problematic: they can be easily thwarted, and in their current forms, do not represent a sufficiently deep probe of model robustness. We conclude that not only is the question of robustness in NLP as yet unresolved, but even some of the approaches to measure robustness need to be reassessed.

+
Footnote †: _Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers)_, pages 5533–5590 June 16-21, 2024 ©2024 Association for Computational Linguistics

## 1 Introduction

The versatility and consumer growth of commercial LLMs like ChatGPT give the impression that robustness evaluations such as out-of-domain (OOD) and stress testing are no longer relevant. We argue that they remain important. Many applications do not need the broad range of skills offered by general-purpose models, from writing clinical notes to drawing LaTeX unicorns Bubeck et al. (2023). Specializing moderate-scale models with finetuning still works better when a model must perform a specific task.1 Some NLP research embraces this view, but takes it to an extreme. Bowman Bowman (2022) highlights the continued use of the 2018 BERT-base model as a baseline, even though larger and better-pretrained models can be fine-tuned on a single GPU today. The rush to innovate upon general-purpose models and the disregard of stronger baselines make it unclear where the field stands in terms of established robustness evaluations. We seek to address this gap.

Footnote 1: For example, see this blogpost retrieved Nov 15, 2023): Fine-Tuning Lima-2: A Comprehensive Case Study for Tailoring Models to Unique Applications.

We first point to popular experimental setups that, while of interest, may be outdated for robustness studies. Specifically, we record the train-test splits of 177 ACL publications that include keywords in Figure 1. After filtering, 101 splits remain that we use to finetune and evaluate 19 models that differ in (i) transformer type (encoder-/decoder-only, encoder-decoder), (ii) model size (60M to 13B), and (iii) pretraining objectives (LM/MLM only, additional multitask pretraining). Table 1 lists the models we finetune, and for focused evaluations about the in-context setting and scaling, we looked at Mistral, TuLU, and LLaMA-2.

We show that for 14 train/OOD-test pairs, a finetuned model that is over 90% accuracy on the standard test set does not break on the OOD test set. Further research with these data splits is less likely to advance our understanding of OOD robustness. We also show that a few challenge sets continue to break NLI and reading comprehension models, but sentiment classifiers are robust to stress tests.

Through behavioral testing with the CheckList methodology Ribeiro et al. (2020), we show that highly accurate models still struggle with the most basic task phenomena. Larger models help, but do not fully resolve the issue; there is scant evidence that increasing size further would be beneficial. Next, we employ contrast set evaluations Gardner et al. (2020), which measure model accuracy in a set of subtly different and differently labeled examples. These evaluations continue to expose major model weaknesses, raising the question of why they are not more widely used. Finally, we stress a crucial finding -- some robustness evaluations can themselves be fragile. We demonstrate this by re

vealing that the success of adversarial attacks is exaggerated. We define a more reliable metric for assessing adversarial attacks, but the overarching lesson is broader than the new metric: be cautious about assuming that prevailing evaluation methods are well-designed.

As the LLM landscape evolves, new challenges arise such as preventing the generation of text that assists unlawful or harmful activities. While these challenges are important, we show that many longstanding robustness issues in NLP remain relevant and unresolved. If we cared about these challenges before, why should we stop now? 2

Footnote 2: We release the code at: [https://github.com/utahnlp/scaling_robustness/](https://github.com/utahnlp/scaling_robustness/)

## 2 Rethinking Common OOD Splits

This section investigates the robustness of models in two scenarios: a) when the train and test data sources differ (_OOD evaluation_), and b) when inputs are designed to challenge models (_challenge set_ or _stress_ test; Naik et al., 2018). We focus on experimental setups from recent ACL publications to determine if they still present challenges.

Common OOD/Challenge Data Splits.We manually collate train-test splits mentioned in 177 ACL publications from the years 2020-2022, containing one of the keywords listed in Figure 1.3 From these, we select 13 training datasets (spanning 6 task types) that appear in at least 4 papers reporting an OOD or challenge set evaluation (Figure 1, middle). Upon filtering to splits containing those training datasets, 101 splits remain; they are listed in Table 4 in the Appendix. Some splits have been used both for OOD and challenge set testing.

Models.We separately finetune the 19 models from Table 1 on the training datasets4 and report average performance across 3 random seeds. In addition, we assess the robustness of few-shot in-context learning in these settings using the base Mistral-7B model Jiang et al. (2023).5

Footnote 4: See Appendix A for more details.

Finetuning the original, non-quantized version of models up to 13B parameters with a dataset with hundreds of thousands of examples such as MNLI or AGNews requires model parallelism even with the largest GPUs like NVIDIA A100 80 GB. This is approaching the resource limits for many organizations. Future work could use our findings to further investigate the impact of quantization on robustness in fine-tuning scenarios.

Q1: Do commonly used OOD splits remain a valid choice for investigating OOD robustness?No, 14 splits involving an OOD test set may not adequately evaluate the accuracy of _finetuned_ models under distributional shifts. The upper right of Figure 2 lists train-test splits where at least one finetuned model obtains in-domain accuracy over 90% (right of the vertical line) that does not drop more than 3% OOD (above the dotted line). We

\begin{table}
\begin{tabular}{l l r r} \hline \multicolumn{2}{c}{**Model**} & \multicolumn{1}{r}{**Size**} & \multicolumn{1}{r}{**PT**} \\ \cline{3-5}  & RoBERTa-Base & 124M & MLM \\  & RoBERTa-Large & 355M & MLM \\  & DeBERTa-v3-Base & 184M & MLM \\  & DeBERTa-v3-Large & 435M & MLM \\ \hline \multirow{5}{*}{\begin{tabular}{} \end{tabular} } & OPT-125M & 125M & \multirow{5}{*}{LM} \\  & OPT-35OM & 331M & \\  & OPT-1.3B & 1.3B & \\  & OPT-2.7B & 2.7B & \\  & OPT-6.7B & 6.7B & \\  & OPT-13B & 12.8B & \\  & GPT-2 & 124M & \\  & GPT-2-Medum & 354M & LM \\  & GPT-2. Large & 774M & \\  & GPT-2-XL & 1.6B & \\ \hline \multirow{5}{*}{
\begin{tabular}{} \end{tabular} } & T-Small & 60M & \multirow{5}{*}{LM} \\  & T-Sase & 222M & \\ \cline{1-1}  & T-Large & 737M & \\ \cline{1-1}  & T-XL (3B) & 2.8B & \\ \cline{1-1}  & T-XXL (11B) & 11.3B & \\ \hline \end{tabular}
\end{table}
Table 1: Finetuning models.

Figure 1: Finetuning and evaluation datasets determined by analyzing train-test splits in *ACL/EMNLP publications from 2020–2022 (§2). Individual train-test splits are reported in Table 5. They represent the most common data setups for studying two popular aspects of NLP robustness.

 

allow a 3% drop to account for variations due to randomness. These results are detailed in Tables 6-7 (Appendix). Close in-domain and OOD accuracy suggests that the model is robust [15]. If accuracy also exceeds 90%, supposed OOD issues are unlikely and concern over them is overstated -- especially when achieved by a small model, as seen in most upper-right data splits.

In contrast to these 14 successes, many OOD test sets remain robustness failures, corresponding to results below the dotted line. They are the most fitting choices for research on OOD robustness. They include almost all splits used for claim verification and paraphrase identification. Moreover, no reading comprehension model --_finetuned or fewshot_ -- achieves an F1 score over 90% while also maintaining similar OOD and in-domain scores (Tables 8-11, Appendix). Sentiment classification and NLI offer limited opportunities for breakthroughs in OOD robustness compared to other tasks.

Splits with very low OOD accuracy (\(<\)44%) have challenge sets as test sets. Arora et al. (2021) show that challenge sets represent an OOD type not fully captured by changes in background features (e.g., genre) or semantic features (e.g., unseen classes). We echo their recommendation to explicitly state the targeted OOD type; challenge sets may not reflect typical domain shifts, like genre change, and broader OOD concerns may not apply.

The suitability of splits that are above the dotted line but to the left of the vertical 90% line is uncertain. They do not show OOD concerns now, but might as in-domain accuracy improves. The few-shot setting with Mistral-7B exemplifies this, with similarly low in-domain and OOD accuracies (Tables 8-11, Appendix).

Q2: Are challenge sets still "stressful"?To answer this question, we consider models that are at least 85% accurate in-domain: these highly accurate models are candidates for deployment, and require stress-testing. Table 2 shows the best accuracy on each challenge set (and their subparts) among these models, and also the difference between that model's in-domain and challenge set accuracy. In contrast to sentiment classifiers, we observe that NLI, paraphrase identification, and reading comprehension models, finetuned or few-shot, are not robust to many of their challenge sets. The discussion below focuses on NLI.

For models finetuned on MNLI, QNLI, or SNLI, the following datasets are still challenging: ANLI, HANS, SNLI CAD, SNLI-hard, and some of the tests in the NLI Diagnostic and Stress Test collections. None of these models reach 85% accuracy on challenge sets, except SNLI-hard, which shows notable disparity between its in-domain and challenge set accuracies. Table 14 (Appendix) provides a breakdown of NLI Diagnostics and Stress Test results. We also observe that when a challenge set ceases to be "stressful", various model types across different sizes are robust. Figure 10 (Appendix) illustrates this with "Breaking NLI".

Popular NLI datasets have several issues (Bow

Figure 2: In-domain vs. OOD accuracy of 19 models finetuned for 4 types of _classification_ tasks across 9 training datasets and 1–14 OOD datasets per training set. The dashed line is where OOD accuracy equals in-domain and the dotted where it is at most 3% lower. min(#P) is the number of parameters of the smallest model that achieves the latter. The gray points below the dotted line are linked with data splits that do not appear in the upper right region.

 

man and Dahl, 2021), to the point that they are commonly used to study data shortcuts (e.g., Ross et al., 2022; Wu et al., 2022). Why should we expect models trained on them be robust? To study the robustness of models trained on higher quality data, we train T5-11B on the WANLI dataset Liu et al. (2022), with an in-domain accuracy of 78.3%. Table 13 (Appendix) reports its challenge set accuracies. Ignoring the above criterion about the model's readiness for stress testing, we analyze its effectiveness under stress testing in terms of the difference between its in-domain and challenge set accuracies. We see that it is more robust on several challenge sets than models trained on previous NLI datasets. Specifically, it does not break on any HANS partition, SNLI CAD, or SNLI-hard. Training on higher-quality data appears to be a promising approach towards robust NLI and future work should focus on stress testing such NLI models.

In the few-shot setting, Mistral-7B achieves in-domain NLI accuracies \(<\)70% and reading comprehension F1 \(<\)85%; neither meet our criterion for stress testing. Table 12 (Appendix) compares its in-domain and challenge set accuracies. Most NLI challenge sets result in failures.

## 3 Highly Accurate Models Still Stumble On The Basics

Even task-specialized models that are accurate on standard datasets may fall short on basic task-related skills. We examine if this holds for models based on different architectures and pretraining objectives, and scaled up to 100\(\times\) larger sizes.

Background.The CheckList Ribeiro et al. (2020) methodology helps test whether models have capabilities that are expected for a given task. Ribeiro et al. suggest considering the following capabilities: "Vocabulary+POS (important words or word types for the task), Taxonomy (synonyms, antinorms, etc), Robustness (to typos, irrelevant changes, etc), NER (appropriately understanding named entities), Fairness, Temporal (understanding order of events), Negation, Coreference, Semantic Role Labeling (understanding roles such as agent, object, etc), and Logic (ability to handle symmetry, consistency, and conjunctions)." To categorize potential capability failures, they introduce three test types: (i) minimum functionality tests (MFTs), (ii) invariance tests (INVs), and (iii) directional expectation tests (DIRs). MFTs check that a model works on simple examples, akin to unit testing in software engineering. INVs confirm that minor label-preserving input changes do not change model predictions. If such modifications do alter labels, DIRs validate that the model predictions also change. Tables 15-16 show examples of 53 tests for the task of identifying duplicate questions. Ribeiro et al.'s models achieve accuracy above 90, but CheckList reveals that these seemingly accurate models often lack key capabilities.

Q1: Are we at a stage where accurate models meet the expectations for their capabilities?No. Comparing task accuracies with CheckList accuracies of 19 models finetuned for QQP and SQuAD in Figure 3 reveals notable discrepancies. QQP accuracies are consistently high across mod

\begin{table}
\begin{tabular}{l l r c} \hline \hline  & **Test (Category)** & **Acc/F1** & **Diff** \\ \hline \multirow{4}{*}{_NLI_} & C-IMDB & 94.5 & 2.1 \\  & IMDD Contrast (all) & 99.6 & -4.3 \\  & IMDB Contrast (contrast) & 95.7 & 0.3 \\  & IMDB Contrast (original) & 99.6 & -4.3 \\ \cline{2-4}  & ANLI (r1) & 66.0 & 26.1 \\  & ANLI (r2) & 53.5 & 38.6 \\  & ANLI (r3) & 49.6 & 42.5 \\ \cline{2-4}  & Breaking NLI & 97.9 & -6.7 \\  & HANS (all) & 98.9 & -6.8 \\  & HANS (constituent) & 71.2 & 21.1 \\  & HANS (lexical overlap) & 98.9 & -6.8 \\  & HANS (subsequence) & 70.3 & 21.9 \\ \cline{2-4}  & MNLI-hard (val matched) & 88.4 & 3.0 \\  & MNLI-hard (val mismatched) & 88.2 & 3.3 \\ \cline{2-4}  & NLI Diagnostics (min-max) & 30.0-95.0 & 61.5/-3.5 \\ \cline{2-4}  & Stress Test (min-max) & 76.8–90.6 & 14.4/ 0.9 \\ \cline{2-4}  & SNLICAD & 82.9 & 9.2 \\  & SNLI-hard & 85.5 & 6.6 \\ \hline \multicolumn{2}{c}{PAWS-QQP} & 50.9 & 42.2 \\ \hline \multirow{4}{*}{_NLI_} & AddOneSent & 85.0 & 8.8 \\  & AddSent & 84.1 & 9.7 \\ \cline{2-4}  & Adversarial Paraphraased & 85.9 & 8.1 \\ \cline{2-4}  & BooIQ CAD & 78.1 & 11.1 \\ \cline{2-4}  & BoolO Contrast Set & 79.3 & 9.9 \\ \cline{2-4}  & MultiRc & 71.8 & 14.3 \\ \cline{2-4}  & NaturalQuestions & 66.5 & 26.4 \\ \cline{2-4}  & NewsQA & 66.6 & 24.9 \\ \cline{2-4}  & Non-Adversarial Paraphrased & 92.6 & 1.4 \\ \cline{2-4}  & Quoref & 64.1 & 27.7 \\ \cline{2-4}  & SQuAD-hard & 92.5 & 1.3 \\ \hline \hline \end{tabular}
\end{table}
Table 2: The max. challenge set performance for models with 85+% in-domain accuracy (classification) or F1 (reading comprehension). **Diff** shows the gap between in-domain and challenge set results (higher means poorer generalization). Shaded rows mark datasets that remain challenging for associated models.

 

els (\(>\)89%), but CheckList accuracies vary and are substantially lower, even as low as 51% (OPT-125M). It is reasonable to expect that these seemingly performant models will excel at relatively simple CheckList tests. Yet QQP models achieve \(>\)95% accuracy for fewer than 45% of the tests; see Table 17, row 1 (Appendix). The same table also shows that for many tests (15-35% of all tests), the accuracy is lower than 60%. Moreover, no QQP model achieves \(>\)60% accuracy on tests {6,12,23,26,40,42,48} that span 5 capabilities.

Q2: Are larger models more capable?Generally yes, but with limits and irregularities. Checklist improvements across model sizes for each model group (separated by vertical lines in Figure 3) level off suboptimally.

On specific QQP tests, accuracy does not always monotonically improve with model size (Figures 11-15, Appendix). A 10% accuracy drop occurs for several tests when scaling from one model size to another (Table 17, row 6). Also, a substantial fraction of tests where a model version achieves 95+% accuracy is when the model accuracy is flat across sizes, not where scaling helps (rows 2, 3).

This does not negate the advantages of scaling altogether. For example, T5-3B/11B have better checklist accuracies than their smaller variants. Table 17 also reports the fraction of tests where the accuracy of the smallest and largest model versions differ by 10% or more, without notable drops during scaling. To check if T5-11B's performance is surpassed by newer models, we also finetune TuLU-2-13B (Ivison et al., 2023) and LLAMA-2-13B (Touvron et al., 2023) on QQP; we do not observe improvements. In summary, scaling helps but is not a holistic solution, and how to finetune specialized models that have the necessary skills to do a given task robustly remains open.

## 4 Better Evaluation Paradigms Exist

Evaluating with sets of mutually dependent examples can uncover model fragility. Yet, models' continue to be assessed by their performance on benchmarks such as MMLU (Hendrycks et al., 2021) that consist solely of i.i.d. instances. Are evaluations that go beyond the i.i.d. assumption unnecessary, or simply overlooked?

Figure 3: The task performance on the standard test set vs. CheckList performance.

 

Background.Motivated by the ongoing challenge of creating artifact-free NLP benchmarks, Gardner et al. (2020) propose to evaluate with sets of examples that are minimally different from each other. They report _contrast set consistency_, a measure of how often a model correctly addresses every example in a set. Models that succeed on standard benchmarks by exploiting data shortcuts can do this rarely. Gardner et al. (2020) create contrast sets for 10 datasets, one of which is multimodal. Ravichander et al. (2022) introduce CondaQA, another contrastive dataset.

Experimental Setup.Instead of training 10 (unimodal datasets) \(\times\) 19 (models) \(\times\) 3 (seeds) = 570 models, we reexamine contrast set evaluation with Flan-T5-11B Chung et al. (2022) whose instruction finetuning includes training data of all datasets in question except CondaQA. We prompt Flan-T5 with an instruction and 8 demonstrations (Tables 18-25, Appendix). Since Flan models are instruction finetuned with chain-of-thought (CoT) prompting Wei et al. (2022) and self-consistency Wang et al. (2023), we also try these reasoning-boosting addons to get the highest consistency possible.6

Footnote 6: Explanations are written by one of the authors.

Q1: Is there still a gap between original test sets and their contrastive counterparts?Yes, Figure 4 shows that Flan-T5-11B's performance on only the original instances in contrast sets is much higher than its consistency for each contrast set.7 Surprisingly, the benefits of including explanations are negligible -- relative to the standard greedy decoding, chain-of-thoughts do not improve consistency in a single case, and self-consistency improves it only for MCTACO and MATRES.

Gardner et al. (2020) demonstrate the feasibility of creating a high-quality contrast set with 1K examples from an existing dataset in just a week's work by an expert. Given the confirmed benefits of contrast datasets in robust reasoning evaluation, the development of contrastive versions of popular benchmarks such as BBH Suzgun et al. (2023) and MMLU seems beneficial. Mindful of the challenges in evaluating across multiple benchmarks, each with dozens of sub-tasks, we deem it is more strategic to direct a portion of resources to evaluations that extend beyond benchmarks i.i.d. with test sets than having more of the same.

Footnote 7: We do not report UD Parsing results. We do not get a reasonable performance with prompting.

### Q2: Has consistency improved despite gaps?

Only in some cases. The consistency values for Ropes, Quoref, MCTACO, and IMDB show large gains over Gardner et al. (2020). Yet, they remain low across the board (except for IMDB). Moreover, although Flan-T5-11B's standard task performance exceeds the results reported by Gardner et al. (2020) across almost all tasks, these improvements do not uniformly translate into increased consistency (e.g., BoolQ and DROP). We also experimented with more recent LLMs like Llama

Figure 4: Flan-T5-11B performance with standard measures (accuracy, F1, token-F1) vs. contrast set consistency. The model’s instruction finetuning data includes training data for all tasks except CondaQA. Prompts include an instruction, 8 examples, and optionally explanations for chain-of-thought prompting and self-consistency decoding.

 

2 (Touvron et al., 2023) and Tulu-2 (Ivison et al., 2023), but found them, on average, to be less consistent than Flan-T5 (see Appendix C.1 for results). In summary, building models that are consistently robust in local neighborhoods remains a challenge.

## 5 Evaluating the Evaluators: The True Success of Adversarial Attacks

Previous sections highlight the robustness and fragility of today's models. Here we bring to light a meta-issue: even some methods for evaluating robustness need improvements to ensure our conclusions are valid.

Background.Adversarial attacks (prevalent in 2020-2022 NLP papers) make imperceptible changes to task inputs that fool models into making mistakes. In computer vision, "imperceptibility" is realized by adding a small noise to the image without altering its appearance (Goodfellow et al., 2015). Applying this idea to text is harder: nearest neighbors of noisy token embeddings could be tokens that change the original meaning. The challenge of adversarially attacking text, studying their potential harm, and designing countermeasures has been a major research focus.

Attacks & Defense.We analyze the following attack methods for NLP models: TextFoolerJin et al. (2020), BAE Garg and Ramakrishnan (2020), TextBuggerLi et al. (2019), PWWS Ren et al. (2019), and DeepWordBugGao et al. (2018); see Appendix B.1 for details. All attacks edit until the prediction is altered and find edits in a black-box setting, i.e., model internals are not accessible.

Following Raina and Gales (2022), we train a binary classifier that distinguishes real from adversarial examples. We finetune BERT-base Devlin et al. (2019) with a task's training examples and their adversarial versions generated by TextFooler and use this defense against all attacks.8

Footnote 8: Since attackers can perturb tokens and/or characters, training against a mix of both could mount a stronger defense.

Rigorously Determining Success of an Attack.Attacks are evaluated with _attack success rate_ -- a fraction of instances for which an edit that alters the model's correct prediction is found:

\[{\rm ASR}_{\text{prev}}=\frac{1}{|\mathcal{C}|}\sum_{x\in\mathcal{C}}\mathbbm{ 1}_{\{y_{p}(\mathrm{pert}(x))\neq y_{g}(x)\}} \tag{1}\]

where \(\mathcal{C}=\{x\in\mathcal{X}:y_{p}(x)=y_{g}(x)\}\), \(y_{g}(\cdot)\) are gold labels, \(y_{p}(\cdot)\) predicted, and \(\mathrm{pert}\) is a method that alters examples. However, this metric ignores the well-formedness of attacks and the effectiveness of any defenses against them. We enhance the measurement to account for these.

Foremost, \(\mathrm{pert}\) should be imperceptible with respect to the gold label, i.e., \(y_{g}(\mathrm{pert}(x))=y_{g}(x),\forall x\in\mathcal{X}\). Moreover, we expect that an AI system has a defense that first detects whether an input is an attack: \(\mathrm{detect}(\cdot)\in\{\mathtt{real},\mathtt{attack}\}\). We redefine attack success rate as:

\[{\rm AS}_{\text{our}} =\frac{1}{|\mathcal{C}|}\sum_{x\in\mathcal{C}}{\rm AS}(x) \tag{2}\] \[{\rm AS}(x) =\begin{cases}1,&\big{(}y_{p}(\mathrm{pert}(x))\neq y_{g}(x) \big{)}\!\wedge\\ &\big{(}\,\mathrm{detect}(\mathrm{pert}(x))=\mathtt{real}\big{)}\!\wedge\\ &\big{(}y_{g}(\mathrm{pert}(x))=y_{g}(x)\big{)}\\ 0,&\mbox{otherwise}\end{cases}\]

The challenge in properly calculating \({\rm ASR}\) is ensuring that the assumption that \(y_{g}(\mathrm{pert}(x))=y_{g}(x)\) truly holds. In our initial analysis of perturbed examples, we found that this is often not fulfilled. Since assessing \(y_{g}(\mathrm{pert}(x))\) manually requires recruiting and training annotators, we suggest using a highly accurate model for the task.

\({\rm ASR}\) trivially becomes zero if \(\mathrm{detect}\) labels everything as an attack. Thus, \({\rm ASR}\) must be complemented with the _defense failure rate_, the rate at which the defense marks real examples as attacks:

\[{\rm DFR}=\frac{1}{|\mathcal{X}|}\sum_{x\in\mathcal{X}}\mathbbm{1}_{\{\mathrm{ detect}(x)=\mathtt{attack}\}} \tag{3}\]

If the attack success rate or defense failure rate is high, we deem the attacker successful.

Q1: How successful are the attacks?Less than expected. We test the five attacks to deceive the models in Table 1 finetuned for AGNews and MNLI. The \({\rm DFR}\) is only 6.61 on MNLI and 0.83 on AGNews, i.e., the system is still functional.9 Tables 26-35 (Appendix) show generated adversarial examples.

Footnote 9: We average DFR on the matched and mismatched MNLI splits. We use the full val/test MNLI/AGNews data for \({\rm DFR}\).

We measure \({\rm ASR}\) on 100 examples sampled from MNLI-matched validation and AGNews test sets. We use GPT-4 OpenAI (2023) to determine \(y_{g}(\mathrm{pert}(x))\) for these, and estimate that it has an error of 10-20%; see Appendix B for details. Figure 5 shows the \({\rm ASR}_{\text{prev}}\rightarrow{\rm ASR}_{\text{our}}\) decline for \({\tt DeepWordBug}\). The drops for the other four attacks are given in Figures 16-17 in the Appendix.

 

DeepWordBug modifies characters, not tokens like TextFooler, and exhibits the smallest decline in effectiveness among attacks for MNLI; but the drop is still substantial. It compromises 51.5% MNLI examples fewer than indicated by the prior ASR, and 20.3% fewer AGNews examples. As expected, the drop is more pronounced for TextFooler which was used for training the defense; see (a)a and (a)a. For instance, its actual success rate when attacking GPT-XL (MNLI) falls to just 6%, a stark contrast to the 94.9% suggested by the prior ASR.

Q2: Why do attacks rarely succeed?To better isolate the factors that lead to lower ASR, we report two additional measurements. First, _label altering rate_ -- a rate at which the true label of the perturbed examples, \(y_{g}(\mathrm{pert}(x))\), is changed:

\[\mathrm{LAR}=\frac{1}{|\mathcal{C}|}\sum_{x\in\mathcal{C}}\mathbbm{1}_{\{y_{ g}(\mathrm{pert}(x))\neq y_{g}(x)\}} \tag{4}\]

Second, _defense success rate_ -- a rate at which the defense detects well-formed attacks:

\[\mathrm{DSR}=\frac{1}{|\mathcal{C}|}\sum_{\begin{subarray}{c}x\in\mathcal{C} \\ \mathrm{A}(\mathrm{pert}(x))=1\end{subarray}}\mathbbm{1}_{\{\mathrm{detect}( \mathrm{pert}(x))=\mathrm{attack}\}} \tag{5}\]

Attackers cannot fool models on original examples they cannot handle correctly, so \(\mathrm{DSR}\) is checked only for examples in \(\mathcal{C}\). Note that \(\mathrm{DSR}\) and \(\mathrm{DFR}\) do not sum to 100.10

Footnote 10: Another measurement to consider is the rate at which the true label of the perturbed examples is unchanged, but the attacker does not fool the model into making a wrong prediction. However, given that \(\mathrm{ASR}_{\text{prev}}\) is high, we know that this rate is low and thus does not explain the drop in \(\mathrm{ASR}\).

Figure 6 and Figure 7 (Appendix) show \(\mathrm{LAR}\) and \(\mathrm{DSR}\) for MNLI and AGNews respectively. The \(\mathrm{LAR}\) and \(\mathrm{DSR}\) together underscore the need for multiple criteria to be met for an attack to be truly successful. The average \(\mathrm{LAR}\) across 19 models for 3/5 attacks is 40%, even higher for BAE. These findings show that assuming labels remain unchanged under perturbations is not justified. Although DeepWordBug exhibits a lower rate of label change, its robust ASR measurement is also low. This is because a defense trained with TextFooler's perturbations also detects 40-84% of attacks that were not part of its training; except BAE's, which manages to bypass the defense more effectively. AGNews is less affected by label changes: \(\mathrm{LAR}\) for AGNews ranges from 11% to 32%. However, the defense is effective: across models, it catches over 75% of perturbations from all attacks except BAE's.

## 6 Related Work

Several efforts address the question of NLP robustness through surveys Wang et al. (2022); Hupkes et al. (2023), new benchmarks Ye et al. (2021);

Figure 5: The change in the attack success rate (ASR) as measured in prior work (1) vs. our robust modification (2). TextFooler is used to train the defense and DeepWordBug to fool 19 finetuned models in Table 1.

 

Yang et al., 2023; Yuan et al., 2023), toolkits Goel et al. (2021), etc. Unlike studies like GLUE-X Yang et al. (2023), and BOSS Yuan et al. (2023) which propose new benchmarks for OOD assessment, our focus is not on new benchmarks. Instead, we identify OOD data splits that are no longer challenging. Our results, detailed in SS2, reveal that NLI models trained on MNLI demonstrate robust generalization to examples from MNLI-mismatched, and SNLI, but struggle with those from DNLI. This suggests that future evaluations should use this challenging train-test split. Notably, GLUE-X includes the two datasets already addressed for OOD evaluation but excludes DNLI.

HELM Liang et al. (2022) advocates evaluating NLP models across dimensions like fairness, bias, robustness, and efficiency, emphasizing breadth and leaving room for more detailed exploration. For instance, its robustness assessments only involve small, semantics-preserving automatic transformations. In contrast, our evaluation is more comprehensive, encompassing domain generalization (SS2), behavioral testing through Checklists (SS3), consistency evaluations (via contrast sets in SS4), and adversarial robustness (SS5). Additionally, while Awadalla et al. (2022) explore distributional robustness for QA models trained on SQuAD Rajpurkar et al. (2016), our analysis extends further, encompassing two diverse QA tasks: Reading Comprehension on SQuAD, NewsQA Trischler et al. (2017), and NaturalQuestions Kwiatkowski et al. (2019), as well as BoolQ Clark et al. (2019).

We are not the first to discuss challenges with adversarial attack evaluations in NLP. For instance, Morris et al. (2020a) suggest additional constraints for filtering out adversarial examples. Our SS5 proposal establishes a new protocol for systematically evaluating adversarial attacks.

## 7 Conclusions

We thoroughly investigate robustness of finetuned models up to 13B parameters from four perspectives: generalization under distributional shifts, checklist-based behavioral analysis, contrast set consistency, and robustness to adversarial attacks. Our results collectively show that the current state of NLP robustness is multifaceted:

* We identify experimental setups, such as certain train-OOD test splits and challenge set evaluations of finetuned sentiment classifiers (SS2), that seem largely resolved. We caution against robustness research that does not advance beyond these areas.
* Our findings illustrate progress post-BERT. In SS3, we show that larger models generally exhibit more basic necessary task skills, and in SS4, that contrast sets consistency has improved since their inception in 2020. We caution against robustness research that relies solely on BERT-era models as baselines.
* Despite the progress, larger models are still not flawless. How to finetune specialized models that have the necessary skills to do a given task, that are robust in local neighborhoods, when stress tested, and in the presence of certain distribution shifts, remains open.
* With adversarial attacks (SS5), we demonstrate that established and popular methods for evaluating robustness need improvements to ensure our conclusions are valid.

Figure 6: Label altering rate (\({\rm LAR}\); 4) and defense success rate (\({\rm DSR}\); 5) obtained in the MNLI setting. Higher values of these measurements contribute to worse effectiveness of attacks, i.e., lower attack success rate.

 



## 8 Limitations

Although we present an extensive analysis, we still focus on the robustness of models that can be fine-tuned with moderate computing resources for free. Therefore, we do not cover extremely large models, like those with hundreds of billions of parameters as PaLM Chowdhery et al. (2023), or proprietary models finetuned with paid services like OpenAI's. Additionally, despite extending our analysis beyond typical classification tasks, we note that the robustness for many other less-explored tasks remains largely unexamined.

Prior work on adversarial attacks reports additional metrics: (i) the average percentage of original tokens/characters that are edited, and (ii) the average number of queries per sample. Smaller values of these two metrics mean that the edit of the original instance is small (i.e., the edit is "imperceptible") and that the attack is efficient. Another condition that requires that \(x\) and \({\rm pert}(x)\) are paraphrases and/or that the edit size is minimal can be included in Eq (2). The former is easier to verify with GPT-4 because there is no universal threshold for the edit size. With this requirement, we expect \({\rm ASR}\) to reduce even more.

Finally, although we address the goal of illuminating where the field stands in terms of established evaluations, we recognize there is an opportunity to expand our analysis into a benchmark or to collaborate with existing ones.

## Acknowledgements

We thank the anonymous reviewers and the metareviewer for their helpful feedback. We also thank Kyle Lo, Luca Soldaini, and members of the UtahNLP group for valuable insights, Luca Soldaini for retrieving ACL publications for us, and users of the CHPC cluster who were patient with us. The support and resources from the Center for High Performance Computing at the University of Utah are gratefully acknowledged. Ashim Gupta is supported by the Bloomberg Data Science Ph.D. Fellowship. This material is based in part upon work supported by the National Science Foundation under Grants #2007398 and #2217154.

## References

* Arora et al. (2021) Udit Arora, William Huang, and He He. 2021. Types of out-of-distribution texts and how to detect them. In _Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing_, pages 10687-10701, Online and Punta Cana, Dominican Republic. Association for Computational Linguistics.
* Artetxe et al. (2020) Mikel Artetxe, Sebastian Ruder, and Dani Yogatama. 2020. On the cross-lingual transferability of monolingual representations. In _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, ACL 2020, Online, July 5-10, 2020_, pages 4623-4637. Association for Computational Linguistics.
* Awadalla et al. (2022) Anas Awadalla, Mitchell Wortsman, Gabriel Ilharco, Sewon Min, Ian Magnussson, Hannaneh Hajishirzi, and Ludwig Schmidt. 2022. Exploring the landscape of distributional robustness for question answering models. In _Findings of the Association for Computational Linguistics: EMNLP 2022_, pages 5971-5987, Abu Dhabi, United Arab Emirates. Association for Computational Linguistics.
* Bowman (2022) Samuel Bowman. 2022. The dangers of underclaiming: Reasons for caution when reporting how NLP systems fail. In _Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)_, pages 7484-7499, Dublin, Ireland. Association for Computational Linguistics.
* Bowman et al. (2015) Samuel R. Bowman, Gabor Angeli, Christopher Potts, and Christopher D. Manning. 2015. A large annotated corpus for learning natural language inference. In _Proceedings of the 2015 Conference on Empirical Methods in Natural Language Processing_, pages 632-642, Lisbon, Portugal. Association for Computational Linguistics.
* Bowman and Dahl (2021) Samuel R. Bowman and George Dahl. 2021. What will it take to fix benchmarking in natural language understanding? In _Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies_, pages 4843-4855, Online. Association for Computational Linguistics.
* Bubeck et al. (2023) Sebastien Bubeck, Varun Chandrasekaran, Ronen Eldan, Johannes Gehrke, Eric Horvitz, Ece Kamar, Peter Lee, Yin Tat Lee, Yuanzhi Li, Scott M. Lundberg, Harsha Nori, Hamid Palangi, Marco Tulio Ribeiro, and Yi Zhang. 2023. Sparks of artificial general intelligence: Early experiments with GPT-4. _CoRR_, abs/2303.12712.
* Choi et al. (2018) Gunsol Choi, He He, Mohit Iyyer, Mark Yatskar, Wentau Yih, Yejin Choi, Percy Liang, and Luke Zettlemoyer. 2018. QuAC: Question answering in context. In _Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing_, pages 2174-2184, Brussels, Belgium. Association for Computational Linguistics.
* Chowdhory et al. (2018) Akanksha Chowdhory, Sharan Narang, Jacob Devlin, Maarten Bosma, Gaurav Mishra, Adam Roberts, Paul Barham, Hyung Won Chung, Charles Sutton, Sebastian Gehrmann, Parker Schuh, Kensen Shi, Sasha Tsvyashchenko, Joshua Maynez, Abhishek Rao, Parker Barnes, Yi Tay, Noam Shazeer, Vinodokumar Prabhakaran, Emily Reif, Nan Du, Ben

Hutchinson, Reiner Pope, James Bradbury, Jacob Austin, Michael Isard, Guy Gur-Ari, Pengcheng Yin, Toju Duke, Anselm Levskaya, Sanjay Ghemawat, Sunipa Dev, Henryk Michalewski, Xavier Garcia, Vedant Misra, Kevin Robinson, Lian Fedus, Denny Zhou, Daphne Ippolito, David Luan, Hyeontaek Lim, Barret Zoph, Alexander Spiridonov, Ryan Sepassi, David Dohan, Shivani Agrawal, Mark Omernick, Andrew M. Dai, Thanunulayan Sankaranarayana Pilali, Marie Pellat, Aitor Lewkovyze, Erica Moreira, Rewon Child, Oleksandr Polozov, Katherine Lee, Zongwei Zhou, Xuezhi Wang, Brennan Saeta, Mark Diaz, Orhan Firat, Michele Catasta, Jason Wei, Kathy Meier-Hellstern, Douglas Eck, Jeff Dean, Slav Petrov, and Noah Fiedel. 2023. Palm: Scaling language modeling with pathways. _J. Mach. Learn. Res._, 24:240:1-113.
* Wong Chung et al. (2022) Hyung Won Chung, Le Hou, Shayne Longpre, Barret Zoph, Yi Tay, William Fedus, Yunxuan Li, Xuezhi Wang, Mostafa Dehghani, Siddhartha Brahma, Albert Webson, Shixiang Shane Gu, Zhuyu Dai, Mirac Suzgun, Xinyuan Chen, Akakansha Chowdhary, Alex Castro-Ros, Mario Peltalt, Kevin Robinson, Dasha Valter, Sharan Narang, Gaurav Mishra, Adams Yu, Vincent Zhao, Yanping Huang, Andrew Dai, Hongkun Yu, Slav Petrov, Ed H. Chi, Jeff Dean, Jacob Devlin, Adam Roberts, Denny Zhou, Quoc V. Le, and Jason Wei. 2022. Scaling instruction-finetuned language models.
* Clark et al. (2019) Christopher Clark, Kenton Lee, Ming-Wei Chang, Tom Kwiatkowski, Michael Collins, and Kristina Toutanova. 2019. BoolQ: Exploring the surprising difficulty of natural yes/no questions. In _Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers)_, pages 2924-2936, Minneapolis, Minnesota. Association for Computational Linguistics.
* Dasigi et al. (2019) Pradeep Dasigi, Nelson F. Liu, Ana Marasovic, Noah A. Smith, and Matt Gardner. 2019. Quoref: A reading comprehension dataset with questions requiring coreferential reasoning. In _Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing, EMNLP-IJCNLP 2019, Hong Kong, China, November 3-7, 2019_, pages 5924-5931. Association for Computational Linguistics.
* Devlin et al. (2019) Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-training of deep bidirectional transformers for language understanding. In _Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers)_, pages 4171-4186, Minneapolis, Minnesota. Association for Computational Linguistics.
* Dolan and Brockett (2005) William B. Dolan and Chris Brockett. 2005. Automatically constructing a corpus of sentential paraphrases. In _Proceedings of the Third International Workshop on Paraphrasing (IWP2005)_.
* Dua et al. (2019) Dheeru Dua, Yizhong Wang, Pradeep Dasigi, Gabriel Stanovsky, Sameer Singh, and Matt Gardner. 2019. DROP: A reading comprehension benchmark requiring discrete reasoning over paragraphs. In _Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers)_, pages 2368-2378, Minneapolis, Minnesota. Association for Computational Linguistics.
* Dunn et al. (2017) Matthew Dunn, Levent Sagun, Mike Higgins, V. Ugur Guney, Volkan Cirik, and Kyunghyun Cho. 2017. Searchqa: A new q&a dataset augmented with context from a search engine. _CoRR_, abs/1704.05179.
* Gan and Ng (2019) Wee Chung Gan and Huwee Tou Ng. 2019. Improving the robustness of question answering systems to question paraphrasing. In _Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics_, pages 6065-6075, Florence, Italy. Association for Computational Linguistics.
* Gao et al. (2018) Ji Gao, Jack Lanchantin, Mary Lou Soffa, and Yanjun Qi. 2018. Black-box generation of adversarial text sequences to evade deep learning classifiers. In _2018 IEEE Security and Privacy Workshops, SP Workshops 2018, San Francisco, CA, USA, May 24, 2018_, pages 50-56. IEEE Computer Society.
* Gao et al. (2021) Leo Gao, Jonathan Tow, Stella Biderman, Sid Black, Anthony DiPofi, Charles Foster, Laurence Golding, Jeffrey Hsu, Kyle McDonell, Niklas Muennighoff, Jason Phang, Laria Reynolds, Eric Tang, Anish Thite, Ben Wang, Kevin Wang, and Andy Zou. 2021. A framework for few-shot language model evaluation.
* Gardner et al. (2020) Matt Gardner, Yoav Artzi, Victoria Basmov, Jonathan Berant, Ben Bogin, Sihao Chen, Pradeep Dasigi, Dheerua Dua, Yanai Elazar, Ananth Gottumukkala, Nitish Gupta, Hannaneh Hajishirzi, Gabriel Ilharco, Daniel Khashabi, Kevin Lin, Jiangming Liu, Nelson F. Liu, Phoebe Mulcaire, Qiang Ning, Sameer Singh, Noah A. Smith, Sanjay Subramanian, Rout Tsafrafty, Eric Wallace, Ally Zhang, and Ben Zhou. 2020. Evaluating models' local decision boundaries via contrast sets. In _Findings of the Association for Computational Linguistics: EMNLP 2020_, pages 1307-1323, Online. Association for Computational Linguistics.
* Garg and Ramakrishnan (2020) Siddhant Garg and Southam Ramakrishnan. 2020. BAE: BERT-based adversarial examples for text classification. In _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)_, pages 6174-6181, Online. Association for Computational Linguistics.
* Glockner et al. (2018) Max Glockner, Vered Shwartz, and Yoav Goldberg. 2018. Breaking NLI systems with sentences that require simple lexical inferences. In _Proceedings of the 56th Annual Meeting of the Association for 

Computational Linguistics (Volume 2: Short Papers)_, pages 650-655, Melbourne, Australia. Association for Computational Linguistics.
* Goel et al. [2021] Karan Goel, Nazneen Fatema Rajani, Jesse Vig, Zachary Taschdjian, Mohit Bansal, and Christopher Re. 2021. Robustness gym: Unifying the NLP evaluation landscape. In _Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies: Demonstrations_, pages 42-55, Online. Association for Computational Linguistics.
* Goodfellow et al. [2015] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and harnessing adversarial examples. In _3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings_.
* Gururangan et al. [2018] Suchin Gururangan, Swabha Swayamdipta, Omer Levy, Roy Schwartz, Samuel Bowman, and Noah A. Smith. 2018. Annotation artifacts in natural language inference data. In _Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 2 (Short Papers)_, pages 107-112, New Orleans, Louisiana. Association for Computational Linguistics.
* He et al. [2021] Pengcheng He, Xiaodong Liu, Jianfeng Gao, and Weizhu Chen. 2021. Deberta: decoding-enhanced bert with disentangled attention. In _9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021_. OpenReview.net.
* 15, 2016_, pages 507-517. ACM.
* Hendrycks et al. [2021] Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2021. Measuring massive multitask language understanding. In _9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021_. OpenReview.net.
* Hupkes et al. [2023] Dieuwke Hupkes, Mario Giulianielli, Verna Dankers, Mikel Artetxe, Yanai Elazar, Tiago Pimentel, Christos Christolooloupoulos, Karim Lasri, Naomi Saphra, Arabella Sinclair, Dennis Ulmer, Florian Schotmann, Khuyagbaatar Batsturen, Kaiser Sun, Koustuv Sinha, Leila Khalatbari, Maria Ryskina, Rita Frieske, Ryan Cotterell, and Zhijing Jin. 2023. A taxonomy and review of generalization research in nlp. _Nature Machine Intelligence_, 5(10):1161-1174.
* Ivison et al. [2023] Hamish Ivison, Yizhong Wang, Valentina Pyatkin, Nathan Lambert, Matthew Peters, Pradeep Dasigi, Joel Jang, David Wadden, Noah A. Smith, Iz Beltagy, and Hannaneh Hajishirizi. 2023. Camels in a changing climate: Enhancing lm adaptation with tuba 2.
* Jia and Liang [2017] Robin Jia and Percy Liang. 2017. Adversarial examples for evaluating reading comprehension systems. In _Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing_, pages 2021-2031, Copenhagen, Denmark. Association for Computational Linguistics.
* Jiang et al. [2023] Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lemple, Lucile Saulinier, Leibo Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothee Lacroix, and William El Sayed. 2023. Mistar 7b.
* Jin et al. [2020] Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2020. Is BERT really robust? A strong baseline for natural language attack on text classification and entailment. In _The Thirty-Fourth AAAI Conference on Artificial Intelligence, AAAI 2020, The Thirty-Second Innovative Applications of Artificial Intelligence Conference, IAAI 2020, The Tenth AAAI Symposium on Educational Advances in Artificial Intelligence, EAAI 2020, New York, NY, USA, February 7-12, 2020_, pages 8018-8025. AAAI Press.
* Joshi et al. [2017] Mandar Joshi, Eunsol Choi, Daniel Weld, and Luke Zettlemoyer. 2017. TriviaQA: A large scale distantly supervised challenge dataset for reading comprehension. In _Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)_, pages 1601-1611, Vancouver, Canada. Association for Computational Linguistics.
* Kaushik et al. [2020] Divyannk Kaushik, Eduard H. Hovy, and Zachary Chase Lipton. 2020. Learning the difference that makes A difference with counterfactually-augmented data. In _8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020_. OpenReview.net.
* Kembhavi et al. [2017] Anirudha Kembhavi, Min Joon Seo, Dustin Schwenk, Jonghyun Choi, Ali Farhadi, and Hannaneh Hajishrizi. 2017. Are you smarter than a sixth grader? textbook question answering for multimodal machine comprehension. In _2017 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2017, Honolulu, HI, USA, July 21-26, 2017_, pages 5376-5384. IEEE Computer Society.
* Khashabi et al. [2018] Daniel Khashabi, Snigdha Chaturvedi, Michael Roth, Shyam Upadhyay, and Dan Roth. 2018. Looking beyond the surface: A challenge set for reading comprehension over multiple sentences. In _Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long Papers)_, pages 252-262, New Orleans, Louisiana. Association for Computational Linguistics.
* Khashabi et al. [2020] Daniel Khashabi, Tushar Khot, and Ashish Sabharwal. 2020. More bang for your buck: Natural perturbation for robust question answering. In _Proceedings of 

the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)_, pages 163-170, Online. Association for Computational Linguistics.
* Kwiatkowski et al. [2017] Tom Kwiatkowski, Jennimaria Palomaki, Olivia Redfield, Michael Collins, Ankur Parikh, Chris Alberti, Danielle Epstein, Illia Polosukhin, Jacob Devlin, Kenton Lee, Kristina Toutanova, Llion Jones, Matthew Kelcey, Ming-Wei Chang, Andrew M Dai, Jakob Uszkoreit, Quoc Le, and Slav Petrov. 2019. Natural questions: A benchmark for question answering research. _Transactions of the Association for Computational Linguistics_, 7:452-466.
* Lai et al. [2017] Guokun Lai, Qizhe Xie, Hanxiao Liu, Yiming Yang, and Eduard Hovy. 2017. RACE: Large-scale ReAding comprehension dataset from examinations. In _Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing_, pages 785-794, Copenhagen, Denmark. Association for Computational Linguistics.
* Lan et al. [2017] Wuwei Lan, Siyu Qiu, Hua He, and Wei Xu. 2017. A continuously growing dataset of sentential paraphrases. In _Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing_, pages 1224-1234, Copenhagen, Denmark. Association for Computational Linguistics.
* Levy et al. [2017] Omer Levy, Minjoon Seo, Eunsol Choi, and Luke Zettlemoyer. 2017. Zero-shot relation extraction via reading comprehension. In _Proceedings of the 21st Conference on Computational Natural Language Learning (CoNLL 2017)_, pages 333-342, Vancouver, Canada. Association for Computational Linguistics.
* Lewis et al. [2020] Patrick Lewis, Barlas Oguz, Ruty Rinott, Sebastian Riedel, and Holger Schwenk. 2020. MLQA: Evaluating cross-lingual extractive question answering. In _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_, pages 7315-7330, Online. Association for Computational Linguistics.
* Li et al. [2019] Jinfeng Li, Shouling Ji, Tianyu Du, Bo Li, and Ting Wang. 2019. Textwugger: Generating adversarial text against real-world applications. In _26th Annual Network and Distributed System Security Symposium, NDSS 2019, San Diego, California, USA, February 24-27, 2019_. The Internet Society.
* Liang et al. [2020a] Percy Liang, Rishi Bommasani, Tony Lee, Dimitris Tsipras, Dilara Soylu, Michihiro Yasunaga, Yuan Zhang, Deepak Narayanan, Yuhuai Wu, Ananya Kumar, Benjamin Newman, Binhang Yuan, Bobby Yan, Ce Zhang, Christian Cosgrove, Christopher D. Manning, Christopher Re, Diana Acosta-Navas, Drew A. Hudson, Eric Zelikman, Esin Durmus, Faisal Ladhak, Frieda Rong, Hongyu Ren, Huaxiu Yao, Yue Wang, Keshav Santhanam, Laurel Orr, Lucia Zheng, Mert Yukeskgoundi, Mirac Suzgun, Nathan Kim, Neel Guha, Niladri Chatterji, Ozmar Khattab, Peter Henderson, Qian Huang, Ryan Chi, Sang Michael Xie, Shibani Santurkar, Surya Ganguli, Tatsunori Hashimoto, Thomas Icard, Tianyi Zhang, Vishrav Chaudhary, William Wang, Xuechen Li, Yifan Mai, Yuhui Zhang, and Yuta Koreeda. 2022. Holistic evaluation of language models.
* Liu et al. [2022] Alisa Liu, Swabha Swayamdipta, Noah A. Smith, and Yejin Choi. 2022. WANLI: Worker and AI collaboration for natural language inference dataset creation. In _Findings of the Association for Computational Linguistics: EMNLP 2022_, pages 6826-6847, Abu Dhabi, United Arab Emirates. Association for Computational Linguistics.
* Maas et al. [2011] Andrew L. Maas, Raymond E. Daly, Peter T. Pham, Dan Huang, Andrew Y. Ng, and Christopher Potts. 2011. Learning word vectors for sentiment analysis. In _Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics: Human Language Technologies_, pages 142-150, Portland, Oregon, USA. Association for Computational Linguistics.
* McCoy et al. [2019] Tom McCoy, Ellie Pavlick, and Tal Linzen. 2019. Right for the wrong reasons: Diagnosing syntactic heuristics in natural language inference. In _Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics_, pages 3428-3448, Florence, Italy. Association for Computational Linguistics.
* Min et al. [2020b] Sewon Min, Julian Michael, Hannaneh Hajishirzi, and Luke Zettlemoyer. 2020b. AmbigQA: Answering ambiguous open-domain questions. In _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)_, pages 5783-5797, Online. Association for Computational Linguistics.
* Mishra et al. [2022] Swaroop Mishra, Daniel Khashabi, Chitta Baral, and Hannaneh Hajishirzi. 2022. Cross-task generalization via natural language crowdsourcing instructions. In _Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)_, pages 3470-3487, Dublin, Ireland. Association for Computational Linguistics.
* Morris et al. [2020a] John Morris, Eli Lifland, Jack Lamchantin, Yangfeng Ji, and Yanjun Qi. 2020a. Reevaluating adversarial examples in natural language. In _Findings of the Association for Computational Linguistics: EMNLP 2020_, pages 3829-3839, Online. Association for Computational Linguistics.
* Morris et al. [2020b] John Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, Di Jin, and Yanjun Qi. 2020b. TextAttack: A framework for adversarial attacks, data augmentation, and adversarial training in NLP. In _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations_, pages 119-126, Online. Association for Computational Linguistics.
* Naik et al. [2018] Akanksha Naik, Abhilasha Ravichander, Norman Sadeh, Carolyn Rose, and Graham Neubig. 2018. Stress test evaluation for natural language inference. In _Proceedings of the 27th International Conference on Computational Linguistics_, pages 2340-2353, 

Santa Fe, New Mexico, USA. Association for Computational Linguistics.
* February 1, 2019_, pages 6859-6866. AAAI Press.
* Nie et al. (2020) Yixin Nie, Adina Williams, Emily Dinan, Mohit Bansal, Jason Weston, and Douve Kiela. 2020. Adversarial NLI: A new benchmark for natural language understanding. In _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_, pages 4885-4901, Online. Association for Computational Linguistics.
* OpenAI (2023) OpenAI. 2023. Gpt-4 technical report.
* Pang and Lee (2005) Bo Pang and Lillian Lee. 2005. Seeing stars: Exploiting class relationships for sentiment categorization with respect to rating scales. In _Proceedings of the 43rd Annual Meeting of the Association for Computational Linguistics (ACL'05)_, pages 115-124, Ann Arbor, Michigan. Association for Computational Linguistics.
* Paszke et al. (2019) Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. 2019. Pytorch: An imperative style, high-performance deep learning library. _Advances in neural information processing systems_, 32.
* Radford et al. (2019) Alec Radford, Jeff Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. 2019. Language models are unsupervised multitask learners.
* Raffel et al. (2020) Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. 2020. Exploring the limits of transfer learning with a unified text-to-text transformer. _Journal of Machine Learning Research_, 21(140):1-67.
* Raina and Gales (2022) Vyas Raina and Mark Gales. 2022. Residue-based natural language adversarial attack detection. In _Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies_, pages 3836-3848, Seattle, United States. Association for Computational Linguistics.
* Rajbhandari et al. (2020) Samyam Rajbhandari, Jeff Rasley, Olatunji Ruwase, and Yuxiong He. 2020. Zero: Memory optimizations toward training trillion parameter models. In _SC20: International Conference for High Performance Computing, Networking, Storage and Analysis_, pages 1-16. IEEE.
* Rajpurkar et al. (2016) Pranav Rajpurkar, Jian Zhang, Konstantin Lopyrev, Percy Liang. 2016. SQuAD: 100,000+ questions for machine comprehension of text. In _Proceedings of the 2016 Conference on Empirical Methods in Natural Language Processing_, pages 2383-2392, Austin, Texas. Association for Computational Linguistics.
* Ravichander et al. (2022) Abhilasa Ravichander, Matt Gardner, and Ana Marasovic. 2022. CONDAQA: A contrastive reading comprehension dataset for reasoning about negation. In _Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing_, pages 8729-8755, Abu Dhabi, United Arab Emirates. Association for Computational Linguistics.
* Ren et al. (2019) Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. 2019. Generating natural language adversarial examples through probability weighted word saliency. In _Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics_, pages 1085-1097, Florence, Italy. Association for Computational Linguistics.
* Ribeiro et al. (2019) Marco Tulio Ribeiro, Carlos Guestrin, and Sameer Singh. 2019. Are red roses red? evaluating consistency of question-answering models. In _Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics_, pages 6174-6184, Florence, Italy. Association for Computational Linguistics.
* Ribeiro et al. (2020) Marco Tulio Ribeiro, Tongshuang Wu, Carlos Guestrin, and Sameer Singh. 2020. Beyond accuracy: Behavioral testing of NLP models with CheckList. In _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_, pages 4902-4912, Online. Association for Computational Linguistics.
* Rosenthal et al. (2017) Sara Rosenthal, Nourra Farra, and Preslav Nakov. 2017. SemEval-2017 task 4: Sentiment analysis in Twitter. In _Proceedings of the 11th International Workshop on Semantic Evaluation (SemEval-2017)_, pages 502-518, Vancouver, Canada. Association for Computational Linguistics.
* Ross et al. (2022a) Alexis Ross, Matthew Peters, and Ana Marasovic. 2022a. Does self-rationalization improve robustness to spurious correlations? In _Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing_, pages 7403-7416, Abu Dhabi, United Arab Emirates. Association for Computational Linguistics.
* Ross et al. (2022b) Alexis Ross, Tongshuang Wu, Hao Peng, Matthew Peters, and Matt Gardner. 2022b. Tailor: Generating and perturbing text with semantic controls. In _Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)_, pages 3194-3213, Dublin, Ireland. Association for Computational Linguistics.
* Saha et al. (2018) Amrita Saha, Rahul Aralikatte, Mitesh M. Khapra, and Karthik Sankaranarayanan. 2018. DuoRC: Towards complex language understanding with paraphrased 

reading comprehension. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), Melbourne, Australia, pp. 1683-1693. External Links: Link Cited by: SS2.
* V. Sanh, A. Webson, C. Raffel, S. H. Bach, L. Sutawika, Z. Alyafaei, A. Chaffin, A. Stiegler, A. Raja, M. Dey, M. Saiful Bari, C. Xu, U. Thakker, S. Sharma Sharma, E. Szczechla, T. Kim, G. Chhablani, N. V. Jayak, D. Datta, J. Chang, M. Tian-Jian Jiang, H. Wang, M. Manica, S. Shen, Z. X. Yong, H. Pandey, R. Bawden, T. Wang, Y. Neeraj, J. Rozen, A. Sharma, A. Santulli, T. Fery, J. Alan Fries, R. Teehan, T. Le Scao, Stella Biderman, L. Gao, T. Wolf, and A. M. Rush (2022)Multitask prompted training enables zero-shot task generalization. In The Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29, 2022, External Links: Link Cited by: SS4.2.
* T. Schuster, D. Shah, Y. J. Serene Yeo, D. Roberto Filizzola Ortiz, Enrico Santus, and Regina Barzilay (2019)Towards debiasing fact verification models. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), Hong Kong, China, pp. 3419-3425. External Links: Link Cited by: SS2.
* P. Sen and A. Saffari (2020)What do models learn from question answering datasets?. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), Online, pp. 2429-2438. External Links: Link Cited by: SS2.
* R. Socher, A. Perelygin, J. Wu, J. Chuang, C. D. Manning, A. Ng, and C. Potts (2013)Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing, Seattle, Washington, USA, pp. 1631-1642. External Links: ISBN 978-1-4503-3213-1, Document, Link Cited by: SS2.
* S. Sugawara, K. Inui, S. Sekine, and A. Aizawa (2018)What makes reading comprehension questions easier?. In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, Brussels, Belgium, pp. 4208-4219. External Links: Link Cited by: SS2.
* M. Suzgun, N. Scales, N. Scharli, S. Gehrmann, Y. Tay, H. W. Chung, A. Chowdhrey, Q. Le, Ed Chi, D. Zhou, and J. Wei (2023)Challenging glo-bench tasks and whether chain-of-thought can solve them. In Findings of the Association for Computational Linguistics: ACL 2023, Toronto, Canada, pp. 13003-13051. External Links: Link Cited by: SS2.
* S. Swagamdipta, R. Schwartz, N. Lourie, Y. Wang, H. Hajishirzi, N. A. Smith, and Y. Choi (2020)Dataset cartography: Mapping and diagnosing datasets with training dynamics. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), Online, pp. 9275-9293. External Links: Link Cited by: SS2.
* R. Taori, A. Dave, V. Shankar, N. Carlini, B. Recht, and L. Schmidt (2020)Measuring robustness to natural distribution shifts in image classification. In Advances in Neural Information Processing Systems, Vol. 33, pp. 18583-18599. External Links: Link Cited by: SS2.
* H. Touvron, T. Lavril, G. Izacard, X. Martinet, M. Lacknaux, T. Lacroix, B. Roziere, N. Goyal, E. Hambro, F. Azhar, A. Rodriguez, A. Joulin, E. Grave, and G. Lample (2023)Llama: open and efficient foundation language models. External Links: 2303.03066 Cited by: SS2.
* A. Trischler, T. Wang, X. Yuan, J. Harris, A. Sordoni, P. Bachman, and K. Suleman (2017)NewsQA: a machine comprehension dataset. In Proceedings of the 2nd Workshop on Representation Learning for NLP, Vancouver, Canada, pp. 191-200. External Links: Link Cited by: SS2.
* George Tsatsaronis, Georgios Balikas, Prodromos Malakaisotik, Ioannis Partalas, Matthias Zschunke, Michael R. Alvers, D. Weissenborn, A. Krithara, S. Petridis, D. Polychronopoulos, Y. Almirantis, J. Pavloopulos, N. Baskiotis, P. Gallinari, M. Artieres, A. Negonga Ngomo, N. Heino, E. Gaussier, L. Barrio-Alvers, M. Schroeder, I. Androutsopoulos, and G. Paliouras (2015)An overview of the BIOASQ large-scale biomedical semantic indexing and question answering competition. BMC Bioinform.16, pp. 138:1-138:28. External Links: Link Cited by: SS2.
* A. Wang, A. Singh, J. Michael, F. Hill, O. Levy, and S. Bowman (2018)GLUE: a multi-task benchmark and analysis platform for natural language understanding. In Proceedings of the 2018 EMNLP Workshop BlackboxNLP: Analyzing and Interpreting Neural Networks for NLP, Brussels, Belgium, pp. 353-355. External Links: Link Cited by: SS2.
* X. Wang, H. Wang, and D. Yang (2022)Measure and improve robustness in NLP models: a survey. In Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Seattle, United States, pp. 4569-4586. External Links: Link Cited by: SS2.
* X. Wang, J. Wei, D. Schuurmans, Quoc V. Le, E. H. Chi, S. Narang, A. Chowdhrey, and Denny Zhou (2023)Self-consistency improves chain of thought reasoning in language 

models. In _The Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023_. OpenReview.net.
* Wang et al. (2022) Yizhong Wang, Swaroop Mishra, Pegah Alipoormolabashi, Yeganeh Kordi, Amirreza Mirzaei, Atharva Naik, Arjun Ashok, Artul Selvan Dhanasekaran, Anjana Arunluxm, David Step, Eshaan Pathak, Giannis Karamanolakis, Haizi Lai, Ishan Purohit, Ishani Mondal, Jacob Anderson, Kirby Kuznia, Krima Doshi, Kuntal Kumar Pal, Maitreya Patel, Mehrad Moradshahi, Mihir Parmar, Mirali Purohit, Neeraj Varshney, Phani Rohitha Kaza, Pulkit Verma, Ravesheaj Singh Puri, Rushang Karia, Savan Doshi, Shailaja Keyur Sampat, Siddhartha Mishra, Sujan Reddy A, Sumanta Patro, Tanay Dixit, and Xudong Shen. 2022b. Super-NaturalInstructions: Generalization via declarative instructions on 1600+ NLP tasks. In _Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing_, pages 5085-5109, Abu Dhabi, United Arab Emirates. Association for Computational Linguistics.
* Wei et al. (2022) Jason Wei, Xuezi Wang, Dale Schuurmans, Maarten Bosma, Brian Ichter, Fei Xia, Ed H. Chi, Quoc V. Le, and Denny Zhou. 2022. Chain-of-thought prompting elicits reasoning in large language models. In _NeurIPS_.
* Welleck et al. (2019) Sean Welleck, Jason Weston, Arthur Szlam, and Kyunghyun Cho. 2019. Dialogue natural language inference. In _Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics_, pages 3731-3741, Florence, Italy. Association for Computational Linguistics.
* Williams et al. (2018) Adina Williams, Nikita Nangia, and Samuel Bowman. 2018. A broad-coverage challenge corpus for sentence understanding through inference. In _Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long Papers)_, pages 1112-1122, New Orleans, Louisiana. Association for Computational Linguistics.
* Wolf et al. (2020) Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delague, Anthony Moi, Pierric Cistac, Tim Rault, Remii Louf, Morgan Funtowicz, Joe Davison, Sam Shelifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gueger, Mariama Drame, Quentin Lhoest, and Alexander Rush. 2020. Transformers: State-of-the-art natural language processing. In _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations_, pages 38-45, Online. Association for Computational Linguistics.
* Wu et al. (2022) Yuxiang Wu, Matt Gardner, Pontus Stenetorp, and Pradeep Dasigi. 2022. Generating data to mitigate spurious correlations in natural language inference datasets. In _Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)_, pages 2660-2676, Dublin, Ireland. Association for Computational Linguistics.
* Yang et al. (2023) Linyi Yang, Shuibai Zhang, Libo Qin, Yafu Li, Yidong Wang, Hanmeng Liu, Jindong Wang, Xing Xie, and Yue Zhang. 2023. GLUE-X: Evaluating natural language understanding models from an out-of-distribution generalization perspective. In _Findings of the Association for Computational Linguistics: ACL 2023_, pages 12731-12750, Toronto, Canada. Association for Computational Linguistics.
* Yang et al. (2018) Zhilin Yang, Peng Qi, Saizheng Zhang, Yoshua Bengio, William Cohen, Ruslan Salakhutdinov, and Christopher D. Manning. 2018. HotpotQA: A dataset for diverse, explainable multi-hop question answering. In _Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing_, pages 2369-2380, Brussels, Belgium. Association for Computational Linguistics.
* Ye et al. (2021) Qinyuan Ye, Bill Yuchen Lin, and Xiang Ren. 2021. CrossFit: A few-shot learning challenge for cross-task generalization in NLP. In _Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing_, pages 7163-7189, Online and Punta Cana, Dominican Republic. Association for Computational Linguistics.
* Yuan et al. (2023) Lifan Yuan, Yangyi Chen, Ganqu Cui, Hongcheng Gao, Fangyuan Zou, Xingyi Cheng, Heng Ji, Zhiyuan Liu, and Maosong Sun. 2023. Revisiting out-of-distribution robustness in nlp: Benchmark, analysis, and llms evaluations. _arXiv preprint arXiv:2306.04618_.
* Zhang et al. (2022) Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christopher Dewan, Mona T. Diab, Xian Li, Xi Victoria Lin, Todor Mihalyov, Myle Ott, Sam Shleifer, Kurt Shuster, Daniel Simig, Punit Singh Koura, Anjalid Sridhar, Tianlu Wang, and Luke Zettlemoyer. 2022. OPT: open pre-trained transformer language models. _CoRR_, abs/2205.01068.
* Zhang et al. (2015) Xiang Zhang, Junbo Jake Zhao, and Yann LeCun. 2015. Character-level convolutional networks for text classification. In _Advances in Neural Information Processing Systems 28: Annual Conference on Neural Information Processing Systems 2015, December 7-12, 2015, Montreal, Quebec, Canada_, pages 649-657.
* Zhang et al. (2019) Yuan Zhang, Jason Baldridge, and Luheng He. 2019. PAWS: Paraphrase adversaries from word scrambling. In _Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers)_, pages 1298-1308, Minneapolis, Minnesota. Association for Computational Linguistics.
* Zhuang et al. (2021) Liu Zhuang, Lin Wayne, Shi Ya, and Zhao Jun. 2021. A robustly optimized BERT pre-training approach with post-training. In _Proceedings of the 20th Chinese National Conference on Computational Linguistics_, pages 1218-1227, Huhhot, China. Chinese Information Processing Society of China 

Additional Experimental Details

We finetune models across five model families with all the available sizes among them, giving us a total of 19 models per task. For models that are too big to train on a single GPU, we utilize DeepSpeed to perform multi-GPU training Rajbhandari et al. (2020). For all the models except those that require DeepSpeed, we train three models with different random seeds (seeds 1, 2, and 3). In total, we have 51 models for each task, not counting models we use for in-context learning analyses.

### Training Details

Learning Rate Search.During preliminary experiments, we observed significant variance in task performance across different random seeds when using the default learning rates. We perform a learning rate search across six learning rates to select the best learning rate: {1e-4, 5e-4, 1e-5, 5e-5, 1e-6, 5e-6}. To reduce the time required for learning rate search, we train each model to 1000 training steps and select the learning rate with the lowest training loss. We found this strategy works well and stabilizes training across all models we used.

Other Hyperparameters.All classification models are trained with a batch size of 32 and the QA models are trained with a batch size of 8 and are determined based on the availability of the GPU resources. Wherever necessary, we employ gradient accumulation with multiple GPUs to emulate these batch sizes. All QA models are trained with the sequence length of 512 and a document stride of 128. The maximum sequence lengths for classification tasks are dependent on each task as they vary in terms of the size of input text. All NLI and paraphrase identification models are trained with a sequence length of 256, while sentiment classification claim verification models, and topic classification (on AGNews) models are all trained with a sequence length of 512. During our preliminary experiments, we find that training for three epochs was sufficient and therefore we train all models for three epochs.

Toolkits.We train all our models using the Transformers library from Huggingface Wolf et al. (2020) with the PyTorch backend Paszke et al. (2019). For evaluating adversarial attacks, we use the TextAttack Morris et al. (2020) library. At the time of evaluation, the library did not support attacking text-to-text models like the T5 model for the classification tasks and is therefore implemented by ourselves. For few-shot in-context evaluations, we compared the popular lm-evaluation-harness Gao et al. (2021) with llm-foundry and found lm-evaluation-harness to generally work better in reproducing the reported results.

QA Models: Span Classification vs. Generative.For question answering, we use the auto-regressive language models (i.e., OPT/GPT) in their generative form instead of span classification Awadalla et al. (2022).

### Pre-processing Evaluation Sets

For some evaluation sets, we did not find any publicly available data splits and therefore construct our own. For out-of-domain evaluation with the QNLI dataset (the task of determining if a sentence answers a question or not), Swayamdipta et al. (2020) use the adversarial SQuAD data from Jia and Liang (2017). Since we did not find a publicly available version of this, we pre-process the data released by Jia and Liang (2017) where we extract the last sentence from each passage along with the question to construct the evaluation instances. The adversarial instances are marked with the label not-entailment.

Similarly, the Amazon Reviews dataset has been used in a number of out-of-domain evaluation settings for sentiment classification models. Different papers use different domains for training and evaluation. Therefore, we sample 10000 examples randomly from six genres (appliances, beauty, fashion, gift cards, magazines, and software).

Additionally, we found that the Twitter paraphrase corpus was not available online and thus we contact authors to get that data.11 The dataset provides paraphrase ratings on a scale of 1 to 6. We discard the examples with ratings 3 (recommended by authors) and classify those from 1-2 as not-paraphrase and from 4-6 as paraphrase.

Footnote 11: [https://languagenet.github.io/](https://languagenet.github.io/)

The original QuAC dataset Choi et al. (2018) contains question-answers in a multi-turn dialogue format and is therefore not directly applicable for reading comprehension. We use the converter script provided by Sen and Saffari (2020) to convert to the SQuAD format.12

Footnote 12: [https://github.com/amazon-science/qa-dataset-converter](https://github.com/amazon-science/qa-dataset-converter)

Finally, the MultiRC dataset Khashabi et al. (2018) which is used for 

with BoolQ, we extract only the yes/no questions from the train set as we find the validation set does not have enough of those yes/no questions.

### Llama-2-7B vs Mistral-7B

For the in-context learning experiments, we consider two high-performing open-models, Llama-2-7B (Touvron et al., 2023) and Mistral-7B (Jiang et al., 2023). To decide which to use we first compare the performance of the models on a subset of our evaluation sets including MNLI-mismatched, SST, QQP, and SQuAD. We find that Mistral-7B outperforms Llama-2 across all tasks in both zero-shot and 8-shot settings. Additionally, Mistral-7B shows a consistent improvement going from zero-shot to 8-shot settings while Llama-2 shows a drop in accuracy on MNLI-mismatched and a drop in f1-score for QQP. These results lead us to choose Mistral for our experiments.

## Appendix B Robustness to Adversarial Attacks

We provide additional results that supplement the main body of the paper.

* Figure 16-17 show the ASR drop for attacks not included in Figure 5.
* Figures 6 and 7 show the \(\mathrm{LAR}\) and \(\mathrm{DSR}\) values in the MNLI and AGNews experimental setup.
* Table 3 shows the label mismatch between a human (one of the authors in this case) and those assigned by GPT-4. Please refer to B.2 for discussion and anlaysis.
* Tables 26-35 provide examples produced by the five attack methods.

 



## Appendix C Contrast Set Evaluation

We provide additional contrast set evaluation results:

* Figure 8 shows the task performance and consistency of TuLU-2-13B model on the contrast sets.
* Figure 9 shows the task performance and consistency of Llama2-13B-chat model on the contrast sets.

### Tulu-2-13B vs Llama-2-13B

In most tasks, Tulu-2 outperforms Llama2 both in task performance and consistency. This is expected since Tulu-2 is a finetuned version of Llama2.

### Tulu-2-13B vs FLAN-T5-11b

FLAN-T5 does better than Tulu-2 on all tasks except perspectrum on which Tulu-2 achieves both a higher task performance and consistency. Tulu-2 is less consistent than FLAN-T5 even on tasks such as Boolq and ropes where the gap between the task performance is small. Just as was the case with FLAN-T5, chain-of-thoughts and self-consistency decoding improve neither task performance nor consistency for Tulu-2. Despite better pretraining, there is still a huge gap between task performance and consistency across tasks. This suggests that issues of robustness persist.

Figure 7: Label altering rate (\({\rm LAR}\); 4) and defense success rate (\({\rm DSR}\); 5) obtained in the **AGNews** setting. Higher values of these measurements contribute to worse effectiveness of attacks, i.e., lower attack success rate.



Figure 8: Tulu-2-13B performance with standard measures (accuracy, F1, token-F1) vs. contrast set consistency. Prompts include an instruction, 8 examples, and optionally explanations for chain-of-thought prompting and self-consistency decoding.

Figure 9: Llama-2-13B-chat performance with standard measures (accuracy, F1, token-F1) vs. contrast set consistency. Prompts include an instruction, 8 examples, and optionally explanations for chain-of-thought prompting and self-consistency decoding.

 



\begin{table}
\begin{tabular}{l l l c c c}

- Twitter Sentiment Analysis \\  & AmazonReviews He and McAuley (2016) & Accuracy & domain & ✓ & Six Genes: appliances, beauty, fashion, gift_cards, magazines, software (10k examples each) \\  & RotterTommaces Pang and Lee (2005) & Accuracy & domain & ✓ & \\  & IMDb Maas et al. (2011) & Accuracy & in-domain & ✓ & \\ \multirow{6}{*}{**Front/out**} & PawS-Waii Zhang et al. (2019) & Accuracy, AUC & domain & ✓ & \\  & MRPC Dolan and Brockett (2005) & Accuracy, F1 & in-domain & ✓ & \\ \cline{1-1}  & FEVER-Symmetric v1 Schuster et al. (2019) & Accuracy & challenge, domain & ✓ & \\ \cline{1-1}  & FEVER-Symmetric v2 Schuster et al. (2019) & Accuracy & challenge, domain & ✓ & \\ \cline{1-1}  & FEVER Nie et al. (2019) & Accuracy & in-domain & ✓ & Used as NLJ \\ \cline{1-1} \cline{2-5}  & Adversarial Squad Jia and Liang (2017) & Accuracy & domain & ✓ & Used in Dataset Cartography for the first time. Not Available. Created from the source \\ \cline{1-1}  & QNLI Wang et al. (2018) & Accuracy & in-domain & ✓ & \\ \end{tabular}
\end{table}
Table 4: Evaluation setups for NLI, Sentiment Classification, Paraphrase Identification, and Claim Verification tasks. The name of each dataset contains a link to its source.




\begin{table}
\begin{tabular}{l l l l c c} \hline
**Train** & **Eval** & **Metrics** & **Evaluation Types** & **Included?** & **Remarks** \\ \hline  & TriviaQA Joshi et al. (2017) & Exact Match, F1 & domain & ✓ & \\  & NaturalQuestions Kwiadowski et al. (2019) & Exact Match, F1 & domain, challenge & ✓ & \\  & NewsQA Trischler et al. (2017) & Exact Match, F1 & domain, challenge & ✓ & \\  & HelpQuara Ying et al. (2018) & Exact Match, F1 & domain & ✓ & \\  & SearchQA Dunn et al. (2017) & Exact Match, F1 & domain & ✓ & \\  & BioxSQ Tustavantiis et al. (2015) & Exact Match, F1 & domain & ✓ & \\  & TextbookQA Kembhavi et al. (2017) & Exact Match, F1 & domain & ✓ & \\  & XQaAD Artetxe et al. (2020) & Exact Match, F1 & domain & ✗ & English subset already included in SQaAD validation \\  & Non-Adversarial Paraphraseed Gan and Ng (2019) & Exact Match, F1 & challenge & ✓ & \\  & Adversarial Paraphraseed Gan and Ng (2019) & Exact Match, F1 & challenge & ✓ & \\  & SQuADhard Sugawana et al. (2018) & Exact Match, F1 & challenge & ✓ & \\  & SQuAD+applications Ribeiro et al. (2019) & Exact Match, F1 & challenge & ✗ & Generating set of implications requires each model’s predictions. \\  & AddOneSent Jia and Liang (2017) & Exact Match, F1 & challenge & ✓ & HF link gives loading error. This paper uses it wrongly. The examples come from 1000 dev exposes the original file contains these 1000 extra clean or examples that need to be removed. So our count of these are 2560 and 787 instead of 3560 and 1787 as reported in the paper. \\  & AdAllSent Jia and Liang (2017) & Exact Match, F1 & challenge & ✓ & Same as AddOneSent \\ Quererd Dasigi et al. (2019) & Exact Match, F1 & challenge & ✓ & \\ QA Contrast Ross et al. (2022b) & Exact Match, F1 & challenge & ✗ & Authors here say they “use the Qa implication challenge set Rajpurkar et al. (2016) as the human contrast set”; but it’s unclear what they are referring to. \\  & QuickC Choi et al. (2018) & Exact Match, F1 & domain & ✓ & Original dataset has multi-turn dialogues which we convert to SQaAD format using this tool \\ DROP Dua et al. (2019) & Exact Match, F1 & domain & ✓ & \\  & Dwork C Shah et al. (2018) & Exact Match, F1 & domain & ✓ & \\  & RACE Lai et al. (2017) & Exact Match, F1 & domain & ✓ & \\  & RelationExtraction Levy et al. (2017) & Exact Match, F1 & domain & ✓ & \\  & MDA Lewis et al. (2020) & Exact Match, F1 & domain & ✓ & Using only on subset \\  & SQuAD Brugurkar et al. (2016) & Exact Match, F1 & in-domain & ✓ & \\  & SQuAD Brugurkar et al. (2016) & Exact Match, F1 & domain & ✓ & \\  & NaturalQuestions Kwiadowski et al. (2019) & Exact Match, F1 & domain & ✓ & \\  & TriviaQA Joshi et al. (2017) & Exact Match, F1 & domain & ✓ & \\  & QuAC Choi et al. (2018) & Exact Match, F1 & domain & ✓ & Original dataset has multi-turn dialogues which we convert to SQaAD format using this tool \\  & BioxSQ Tustavantiis et al. (2015) & Exact Match, F1 & domain & ✓ & \\  & DROP Dua et al. (2019) & Exact Match, F1 & domain & ✓ & \\  & DueRC Saha et al. (2018) & Exact Match, F1 & domain & ✓ & \\  & RacLE Lai et al. (2017) & Exact Match, F1 & domain & ✓ & \\  & RelationExtraction Ley et al. (2017) & Exact Match, F1 & domain & ✓ & \\  & TextbookQA Kembhavi et al. (2017) & Exact Match, F1 & domain & ✓ & \\  & NewQA Trischler et al. (2017) & Exact Match, F1 & in-domain & ✓ & \\  & TruixiQA Joshi et al. (2017) & Exact Match, F1 & domain & ✓ & \\  & SQuAD Brugurkar et al. (2016) & Exact Match, F1 & domain & ✓ & \\  & NewQA Trischler et al. (2017) & Exact Match, F1 & domain & ✓ & \\  & BioxSQ Tustavantiis et al. (2015) & Exact Match, F1 & domain & ✓ & \\  & DROP Dua et al. (2019) & Exact Match, F1 & domain & ✓ & \\  & DROP Chao Chao et al. (2018) & Exact Match, F1 & domain & ✓ & \\  & DROP Schau et al. (2018) & Exact Match, F1 & domain & ✓ & \\  & RACLE Lai et al. (2017) & Exact Match, F1 & domain & ✓ & \\  & RelationExtraction Ley et al. (2017) & Exact Match, F1 & domain & ✓ & \\  & TextbookQA Kembhavi et al. (2017) & Exact Match, F1 & domain & ✓ & \\  & QuAC Choi et al. (2018) & Exact Match, F1 & domain & ✓ & \\  & TRECI Liu et al. (2018) & Exact Match, F1 & domain & ✗ & Only applicable for open-domain QA \\  & AmbigQA Min et al. (2020) & Exact Match, F1 & domain & ✗ & Only applicable for open-domain QA \\  & NaturalQuestions Kwiadowski et al. (2019) & Exact Match, F1 & in-domain & ✓ & \\  & Book Operator Sent Gardner et al. (2020) & Exact Match or Accuracy & challenge & ✓ & other name book\_contrast\_gather \\  & RootQA Chaudh et al. (2020) & Exact Match or Accuracy & challenge & ✓ & \\  & MultiRC Khashabi et al. (2018) & Exact Match or Accuracy & domain & ✓ & Used only train set questions with yes/no answers \\  & BoolQ Clark et al. (2019) & Exact Match or Accuracy & in-domain & ✓ & \\ \hline \end{tabular}
\end{table}
Table 5: Evaluation setups for Reading Comprehension and QA tasks. The name of each dataset contains a link to its source.





\begin{table}
\begin{tabular}{l l c c c c} \hline \hline  & & \multicolumn{4}{c}{Results of a model with the max OOD-ID} \\ \cline{3-6}
**Train** & **Test** & **Model** & **ID** & **OOD** & **OOD-ID** \\ \hline MNLI & HANS Lexical Overlap & DeBERTa-v3-Base & 89.66 & 98.48 & 8.82 \\ SNLI & HANS Lexical Overlap & T5-11B & 92.13 & 98.95 & 6.82 \\ IMDB & AmazonReviews & RoBERTa-Large & 92.43 & 94.89 & 2.46 \\ IMDB & YELP & OPT-125M & 89.14 & 91.04 & 1.90 \\ SNLI & NLI Diagnostics genitives/partitives & T5-Base & 90.11 & 91.67 & 1.56 \\ SST2 & YELP & T5-11B & 95.99 & 97.45 & 1.46 \\ FEVER & FEVER-symmetric v2 & OPT-13B & 78.75 & 79.63 & 0.88 \\ SNLI & NLI Diagnostics double negation & T5-3B & 92.16 & 92.86 & 0.70 \\ SST2 & AmazonReviews & T5-11B & 95.99 & 95.73 & -0.26 \\ IMDB & SST2 & DeBERTa-v3-Base & 91.41 & 91.09 & -0.32 \\ SST2 & RottenTomatoes & GPT-2 & 90.79 & 90.15 & -0.64 \\ SST2 & IMDB & T5-11B & 95.99 & 95.30 & -0.69 \\ MNLI & SNLI & T5-11B & 91.46 & 90.16 & -1.30 \\ IMDB & RottenTomatoes & DeBERTa-v3-Base & 91.41 & 89.56 & -1.85 \\ SNLI & NLI Diagnostics nominalization & T5-11B & 92.13 & 89.29 & -2.84 \\ \hline MNLI & MNLI-Hard & T5-11B & 91.46 & 88.43 & -3.03 \\ SNLI & Stress Test & T5-11B & 92.13 & 89.05 & -3.08 \\ QQP & Twitter PPDB & OPT-125M & 88.80 & 85.56 & -3.24 \\ SNLI & MNLI-Mismatched & T5-3B & 92.16 & 88.87 & -3.29 \\ SNLI & MNLI-Matched & T5-3B & 92.16 & 88.86 & -3.30 \\ SNLI & NLI Diagnostics universal & GPT-2-Medium & 88.69 & 85.19 & -3.50 \\ YELP & IMDB & T5-3B & 98.62 & 94.80 & -3.82 \\ YELP & SST2 & OPT-13B & 97.01 & 93.00 & -4.01 \\ FEVER & FEVER-symmetric v1 & OPT-13B & 78.75 & 74.48 & -4.27 \\ SNLI & NLI Diagnostics morphological negation & RoBERTa-Large & 91.57 & 87.18 & -4.39 \\ SNLI & NLI Diagnostics redundancy & DeBERa-v3-Large & 92.24 & 87.18 & -5.06 \\ SNLI & NLI Diagnostics prepositional phrases & T5-Small & 88.40 & 83.33 & -5.07 \\ SNLI & NLI Diagnosticsatives & RoBERTa-Base & 90.37 & 85.00 & -5.37 \\ IMDB & Twitter Emotion & OPT-125M & 89.14 & 81.33 & -7.81 \\ SNLI & NLI diagnostics conjunction & T5-11B & 92.13 & 82.50 & -9.63 \\ SNLI & NLI Diagnostics upward monotone & GPT-2-large & 89.21 & 78.43 & -10.78 \\ SNLI & NLI Diagnostics ellipsis/implicits & T5-3B & 92.16 & 81.37 & -10.79 \\ QNLI & Adversarial Squad & T5-Large & 94.41 & 79.73 & -14.68 \\ MNLI & DNLI & GPT-2 & 81.66 & 66.89 & -14.77 \\ SNLI & NLI Diagnostics anaphora/coreference & T5-3B & 92.16 & 74.71 & -17.45 \\ SNLI & NLI Diagnostics lexical entailment & DeBERTa-v3-Large & 92.24 & 74.52 & -17.72 \\ SNLI & NLI Diagnostics news & DeBERTa-v3-Large & 92.24 & 74.51 & -17.73 \\ SNLI & NLI Diagnostics negation & T5-11B & 92.13 & 74.39 & -17.74 \\ MNLI & HANS Subsequence & OPT-125M & 74.39 & 56.09 & -18.30 \\ MNLI & HANS constituent & OPT-350M & 81.76 & 62.87 & -18.89 \\ MRPC & PAWS Wiki & OPT-350M & 68.22 & 48.78 & -19.44 \\ SNLI & NLI Diagnostics conditionals & T5-3B & 92.16 & 71.88 & -20.28 \\ SNLI & NLI Diagnostics core args & DeBERTa-v3-Large & 92.24 & 71.79 & -20.45 \\ SNLI & NLI Diagnostics coordination scope & T5-3B & 92.16 & 71.67 & -20.49 \\ SNLI & NLI Diagnostics artificial & T5-11B & 92.13 & 71.33 & -20.80 \\ SNLI & HANS Constituent & DeBERTa-v3-Large & 92.24 & 71.17 & -21.07 \\ SNLI & NLI Diagnostics restrictivity & OPT-6.7B & 90.41 & 69.23 & -21.18 \\ SNLI & HANS Subsequence & T5-3B & 92.16 & 70.26 & -21.90 \\ SNLI & NLI Diagnostics quantifiers & OPT-13B & 91.38 & 69.23 & -22.15 \\ SNLI & NLI Diagnostics symmetry/collectivity & GPT-2-large & 89.21 & 66.67 & -22.54 \\ SNLI & NLI Diagnostics relative clauses & T5-3B & 92.16 & 68.75 & -23.41 \\ \hline \hline \end{tabular}
\end{table}
Table 6: The OOD evaluation of classification **finetuned** models (continued in Table 7). All results are accuracy scores. For each train-test split, we report the model with the best OOD generalization (among 19 models), defined as the highest OOD accuracy minus ID accuracy. All except a few models in the upper part of the table achieve an in-domain accuracy over 90% while also maintaining similar OOD and ID accuracies. These splits might no longer be fitting for OOD robustness research



\begin{table}
\begin{tabular}{l l c r r r}  & \multicolumn{5}{c}{Results of a model with the max OOD-ID} \\
**Train** & **Test** & **Model** & **ID** & **OOD** & **OOD-ID** \\ \hline SNLI & NLI Diagnostics named entities & OPT-13B & 91.38 & 66.67 & -24.71 \\ SNLI & NLI Diagnostics wikipedia & DeBERTa-v3-Large & 92.24 & 67.33 & -24.91 \\ SNLI & NLI Diagnostics common sense & DeBERTa-v3-Large & 92.24 & 67.33 & -24.91 \\ SNLI & NLI Diagnostics world knowledge & OPT-13B & 91.38 & 66.42 & -24.96 \\ SNLI & NLI Diagnostics acl & DeBERTa-v3-Large & 92.24 & 66.67 & -25.57 \\ SNLI & NLI Diagnostics non-monotone & OPT-6.7B & 90.41 & 63.33 & -27.08 \\ SNLI & NLI Diagnostics existential & T5-3B & 92.16 & 65.00 & -27.16 \\ SNLI & NLI Diagnostics active/passive & OPT-125M & 86.22 & 58.82 & -27.40 \\ SNLI & NLI Diagnostics factivity & DeBERTa-v3-Large & 92.24 & 64.71 & -27.53 \\ SNLI & NLI Diagnostics temporal & DeBERTa-v3-Large & 92.24 & 64.58 & -27.66 \\ SNLI & NLI Diagnostics reddit & T5-3B & 92.16 & 64.33 & -27.83 \\ SNLI & NLI Diagnostics interselectivity & RoBERTa-Base & 90.37 & 60.87 & -29.50 \\ SNLI & DNLI & T5-Large & 91.20 & 60.35 & -30.85 \\ SNLI & NLI diagnostics intervals/numbers & T5-11B & 92.13 & 60.53 & -31.60 \\ QQP & PAWS QQP & T5-11B & 92.11 & 50.81 & -41.30 \\ SNLI & NLI Diagnostics disjunction & OPT-13B & 91.38 & 47.37 & -44.01 \\ SNLI & NLI Diagnostics downward monotone & T5-11B & 92.13 & 23.33 & -68.80 \\ \end{tabular}
\end{table}
Table 7: The OOD evaluation of classification **finetuned** models (continuation of Table 6).





\begin{table}
\begin{tabular}{l l l c r r r} \hline \hline  & & \multicolumn{5}{c}{Results of a model with the max OOD-ID} \\ \cline{3-6}
**Train** & **Test** & **Model** & **ID** & **OOD** & **OOD-ID** \\ \hline NewsQA & SQuAD & T5-Large & 21.78 & 87.92 & 66.14 \\ NewsQA & RelationExtraction & T5-Large & 21.78 & 79.62 & 57.84 \\ NewsQA & NaturalQuestions & T5-11B & 23.06 & 64.40 & 41.34 \\ NewsQA & BioASQ & T5-11B & 23.06 & 58.24 & 35.18 \\ NewsQA & RACE & T5-11B & 23.06 & 52.73 & 29.67 \\ NewsQA & TriviaQA & OPT-6.7B & 60.33 & 79.74 & 19.41 \\ NaturalQuestions & SQuAD & T5-11B & 71.64 & 88.83 & 17.19 \\ NaturalQuestions & RelationExtraction & T5-11B & 71.64 & 87.12 & 15.48 \\ NewsQA & DROP & T5-11B & 23.06 & 35.02 & 11.96 \\ NewsQA & DuoRC & GPT-2XL & 59.74 & 63.11 & 3.37 \\ NaturalQuestions & TriviaQA & OPT-6.7B & 80.38 & 82.98 & 2.60 \\ SQuAD & RelationExtraction & GPT-2 & 76.13 & 74.86 & -1.27 \\ NewsQA & TextbookQA & OPT-6.7B & 60.33 & 57.56 & -2.77 \\ \hline NaturalQuestions & DROP & T5-11B & 71.64 & 67.47 & -4.17 \\ BoolQ & MultiRC & OPT-350M & 68.60 & 63.91 & -4.69 \\ SQuAD & NoiseQA & RoBERTa-Large & 92.46 & 86.21 & -6.25 \\ SQuAD & MLQA & OPT-350M & 82.33 & 75.24 & -7.09 \\ SQuAD & TriviaQA & OPT-13B & 91.33 & 83.56 & -7.77 \\ NaturalQuestions & BioASQ & T5-11B & 71.64 & 62.89 & -8.75 \\ BoolQ & BoolQ Contrast Set & OPT-125M & 66.54 & 57.70 & -8.84 \\ BoolQ & BoolQ CAD & T5-3B & 89.23 & 78.09 & -11.14 \\ NaturalQuestions & DuoRC & OPT-6.7B & 80.38 & 68.78 & -11.60 \\ NewsQA & QuAC & T5-11B & 23.06 & 10.99 & -12.07 \\ NaturalQuestions & TextbookQA & OPT-6.7B & 80.38 & 67.29 & -13.09 \\ NaturalQuestions & RACE & T5-11B & 71.64 & 56.64 & -15.00 \\ NaturalQuestions & NewsQA & DeBERTa-v3-Large & 56.83 & 40.60 & -16.23 \\ SQuAD & HotPotQA & OPT-6.7B & 91.79 & 73.62 & -18.17 \\ SQuAD & DuoRC & OPT-13B & 91.33 & 71.32 & -20.01 \\ SQuAD & BioASQ & OPT-6.7B & 91.79 & 68.65 & -23.14 \\ SQuAD & NewsQA & OPT-13B & 91.33 & 66.50 & -24.83 \\ SQuAD & NaturalQuestions & OPT-6.7B & 91.79 & 65.63 & -26.16 \\ SQuAD & DROP & T5-11B & 93.80 & 65.36 & -28.44 \\ SQuAD & TextbookQA & OPT-2.7B & 91.56 & 62.57 & -28.99 \\ SQuAD & SearchQA & OPT-2.7B & 91.56 & 59.94 & -31.62 \\ SQuAD & RACE & T5-11B & 93.80 & 57.05 & -36.75 \\ NaturalQuestions & QuAC & DeBERTa-v3-Large & 56.83 & 11.86 & -44.97 \\ SQuAD & QuAC & GPT-2 & 76.13 & 16.44 & -59.69 \\ \hline \hline \end{tabular}
\end{table}
Table 8: The OOD evaluation of reading comprehension **finetuned** models. All results are F1 scores, except for models trained with BoolQ for which we report exact match (EM) following the standard practice. For each train-test split, we report the model with the best OOD generalization (among 19 models), defined as the highest OOD F1/EM minus ID F1/EM. In contrast to sentiment classification and NLI, no reading comprehension model achieves an F1/exact match score over 90% while also maintaining similar OOD and ID accuracies; see the upper part of the table. Thus, all reading comprehension splits remain suitable.





\begin{table}
\begin{tabular}{l l c c c} \hline
**Train** & **Test** & **ID** & **OOD** & **OOD-ID** \\ \hline SNLI & NLI Diagnostics redundancy & 45.88 & 96.15 & 50.27 \\ SNLI & NLI Diagnostics genitives/partitives & 45.88 & 85.00 & 39.12 \\ FEVER & FEVER-symmetric v1 & 36.08 & 55.79 & 19.71 \\ SNLI & NLI Diagnostics restriction & 45.88 & 65.38 & 19.50 \\ SNLI & NLI Diagnostics morphological negation & 45.88 & 65.38 & 19.50 \\ SNLI & NLI Diagnostics nominalization & 45.88 & 64.29 & 18.41 \\ SNLI & NLI Diagnostics double negation & 45.88 & 64.29 & 18.41 \\ FEVER & FEVER-symmetric v2 & 36.08 & 53.37 & 17.29 \\ QNLI & Adversarial Squad & 55.81 & 71.29 & 15.48 \\ SNLI & NLI Diagnostics symmetry/collectivity & 45.88 & 60.71 & 14.83 \\ SST2 & YELP & 65.94 & 80.11 & 14.17 \\ SST2 & AmazonReviews & 65.94 & 75.86 & 9.92 \\ SNLI & NLI diagnostics core args & 45.88 & 55.77 & 9.89 \\ SNLI & NLI Diagnostics named entities & 45.88 & 55.56 & 9.68 \\ SNLI & Stress Test & 67.83 & 75.34 & 7.51 \\ YELP & IMDB & 81.54 & 88.98 & 7.44 \\ SNLI & NLI Diagnostics ellipsis/implicits & 45.88 & 52.94 & 7.06 \\ SNLI & NLI Diagnostics world knowledge & 45.88 & 52.24 & 6.36 \\ SNLI & NLI Diagnostics acl & 45.88 & 50.50 & 4.62 \\ SNLI & NLI Diagnostics wikipedia & 45.88 & 50.50 & 4.62 \\ SNLI & NLI Diagnostics news & 45.88 & 50.49 & 4.61 \\ SNLI & HANS Constituent & 45.88 & 50.04 & 4.16 \\ SNLI & HANS Subsequence & 45.88 & 50.02 & 4.14 \\ SNLI & HANS Lexical Overlap & 45.88 & 50.01 & 4.13 \\ SNLI & NLI Diagnostics conditionals & 45.88 & 50.00 & 4.12 \\ SNLI & NLI Diagnostics universal & 45.88 & 50.00 & 4.12 \\ MNLI & HANS Constituent & 46.68 & 50.04 & 3.36 \\ MNLI & HANS Subsequence & 46.68 & 50.02 & 3.34 \\ MNLI & HANS Lexical Overlap & 46.68 & 50.01 & 3.33 \\ SNLI & NLI Diagnostics nan & 45.88 & 48.65 & 2.77 \\ SNLI & NLI Diagnostics prepositional phrases & 45.88 & 48.53 & 2.65 \\ IMDB & YELP & 95.10 & 97.48 & 2.38 \\ QQP & Twitter PPDB & 78.36 & 80.15 & 1.79 \\ SST2 & RottenTomatoes & 65.94 & 67.73 & 1.79 \\ MNLI & MNLI-Hard & 46.68 & 48.08 & 1.40 \\ SNLI & MNLI-Mismatched & 45.88 & 47.21 & 1.33 \\ IMDB & AmazonReviews & 95.10 & 95.94 & 0.84 \\ SNLI & MNLI-Matched & 45.88 & 46.14 & 0.26 \\ SNLI & NLI Diagnostics common sense & 45.88 & 46.00 & 0.12 \\ SST2 & IMDB & 93.23 & 93.22 & -0.01 \\ SNLI & NLI Diagnostics lexical entailment & 45.88 & 45.71 & -0.17 \\ MNLI & SNLI & 59.86 & 59.52 & -0.34 \\ SNLI & NLI Diagnostics existential & 45.88 & 45.00 & -0.88 \\ SNLI & NLI Diagnosticsatives & 45.88 & 45.00 & -0.88 \\ SNLI & NLI Diagnostics conjunction & 45.88 & 45.00 & -0.88 \\ IMDB & SST2 & 95.10 & 93.69 & -1.41 \\ SNLI & NLI Diagnostics active/passive & 45.88 & 44.12 & -1.76 \\ SNLI & NLI Diagnostics relative clauses & 45.88 & 43.75 & -2.13 \\ IMDB & RottenTomatoes & 95.10 & 92.40 & -2.70 \\ \hline \end{tabular}
\end{table}
Table 9: The OOD evaluation of **few-shot in-context learning** Mistral-7B for classification tasks (continued in Table 10). All results are accuracy scores. For only a few splits Mistral-7B achieves an in-domain accuracy over 90% while also maintaining similar OOD and ID accuracies. These splits might no longer be fitting for OOD robustness research.





\begin{table}
\begin{tabular}{l l c c c} \hline \hline
**Train** & **Test** & **ID** & **OOD** & **OOD-ID** \\ \hline MRPC & PAWS-Wiki & 61.76 & 58.64 & -3.12 \\ YELP & SST2 & 98.10 & 94.95 & -3.15 \\ SNLI & NLI Diagnostics negation & 67.83 & 64.63 & -3.20 \\ SNLI & NLI Diagnostics reddit & 45.88 & 42.50 & -3.38 \\ SNLI & NLI Diagnostics upward monotone & 45.88 & 41.18 & -4.70 \\ MNLI & DNLI & 59.86 & 54.66 & -5.20 \\ SNLI & NLI Diagnostics disjunction & 45.88 & 39.47 & -6.41 \\ SNLI & NLI Diagnostics anaphora/coreference & 45.88 & 37.93 & -7.95 \\ SNLI & NLI Diagnostics artificial & 45.88 & 37.33 & -8.55 \\ SNLI & NLI Diagnostics interseectivity & 45.88 & 36.96 & -8.92 \\ SNLI & NLI Diagnostics quantifiers & 45.88 & 36.54 & -9.34 \\ SNLI & DNLI & 45.88 & 36.43 & -9.45 \\ QQP & PAWS-QQP & 40.67 & 30.28 & -10.39 \\ SNLI & NLI Diagnostics downward monotone & 45.88 & 33.33 & -12.55 \\ SNLI & NLI Diagnostics temporal & 45.88 & 31.25 & -14.63 \\ SNLI & NLI Diagnostics coordination scope & 45.88 & 30.00 & -15.88 \\ SNLI & NLI Diagnostics intervals/numbers & 45.88 & 28.95 & -16.93 \\ SNLI & NLI diagnostics facility & 45.88 & 26.47 & -19.41 \\ SNLI & NLI Diagnostics non-monotone & 45.88 & 23.33 & -22.55 \\ IMDB & Twitter Emotion & 95.10 & 70.59 & -24.51 \\ \hline \end{tabular}
\end{table}
Table 10: The OOD evaluation of **few-shot in-context learning** Mistral-7B for classification tasks (continuation of Table 6).





\begin{table}
\begin{tabular}{l l c c c} \hline \hline
**Train** & **Test** & **ID** & **OOD** & **OOD- ID** \\ \hline NaturalQuestions & TextbookQA & 31.94 & 66.65 & 34.71 \\ NaturalQuestions & TriviaQA & 31.94 & 65.79 & 33.85 \\ NewsQA & RelationExtraction & 60.77 & 90.52 & 29.75 \\ NewsQA & SQuAD & 60.77 & 89.51 & 28.74 \\ NewsQA & TriviaQA & 60.77 & 85.69 & 24.92 \\ NaturalQuestions & SQuAD & 31.94 & 54.28 & 22.34 \\ NewsQA & TextbookQA & 60.77 & 81.76 & 20.99 \\ NewsQA & BioASQ & 60.77 & 80.24 & 19.47 \\ NaturalQuestions & BioASQ & 31.94 & 48.40 & 16.46 \\ NaturalQuestions & RelationExtraction & 66.86 & 82.53 & 15.67 \\ NewsQA & NaturalQuestions & 60.77 & 74.82 & 14.05 \\ SQuAD & TextbookQA & 54.28 & 66.65 & 12.37 \\ SQuAD & TriviaQA & 54.28 & 65.79 & 11.51 \\ NaturalQuestions & DROP & 31.94 & 42.16 & 10.22 \\ NaturalQuestions & NewsQA & 31.94 & 42.08 & 10.14 \\ NaturalQuestions & DuoRC & 31.94 & 41.85 & 9.91 \\ SQuAD & HotPotQA & 54.28 & 63.11 & 8.83 \\ NewsQA & DuoRC & 60.77 & 69.29 & 8.52 \\ SQuAD & SearchQA & 54.28 & 60.36 & 6.08 \\ NewsQA & DROP & 60.77 & 65.40 & 4.63 \\ NewsQA & RACE & 60.77 & 63.78 & 3.01 \\ NaturalQuestions & RACE & 31.94 & 34.08 & 2.14 \\ BoolQ & BoolQ & 83.52 & 83.52 & 0.00 \\ SQuAD & RelationExtraction & 84.01 & 82.53 & -1.48 \\ SQuAD & NoiseQA & 54.28 & 50.44 & -3.84 \\ SQuAD & BioASQ & 54.28 & 48.40 & -5.88 \\ BoolQ & MultiRC & 83.52 & 76.38 & -7.14 \\ SQuAD & MLQA & 54.28 & 46.12 & -8.16 \\ SQuAD & DROP & 54.28 & 42.16 & -12.12 \\ SQuAD & NewsQA & 54.28 & 42.08 & -12.20 \\ SQuAD & DuoRC & 54.28 & 41.85 & -12.43 \\ BoolQ & BoolQ CAD & 83.52 & 69.38 & -14.14 \\ SQuAD & NaturalQuestions & 84.01 & 66.86 & -17.15 \\ NaturalQuestions & QuAC & 31.94 & 12.72 & -19.22 \\ SQuAD & RACE & 54.28 & 34.08 & -20.20 \\ BoolQ & BoolQ Contrast Set & 83.52 & 52.48 & -31.04 \\ SQuAD & QuAC & 54.28 & 12.72 & -41.56 \\ \hline \hline \end{tabular}
\end{table}
Table 11: The OOD evaluation of **few-shot in-context learning** Mistral-7B for reading comprehension tasks. All results are F1 scores, except for models trained with BoolQ for which we report exact match (EM) following the standard practice.





\begin{table}
\begin{tabular}{l l r} \hline
**Test (Category)** & **Accuracy** & **Diff** \\ \hline ANLI (r1) & 70.1 & 8.2 \\ ANLI (f2) & 58.9 & 19.4 \\ ANLI (f3) & 52.7 & 25.6 \\ Breaking NLI & 78.3 & 0.0 \\ HANS (all) & 92.0 & -13.7 \\ HANS (constituent) & 79.1 & -0.8 \\ HANS (lexical overlap) & 99.0 & -20.7 \\ HANS (subsequence) & 97.8 & -19.5 \\ MNLI-hard (val matched) & 79.3 & -1.0 \\ MNLI-hard (val mismatched) & 78.8 & -0.5 \\ NLI Diagnostics (min-max) & 40.0-100.0 & 38.3/ -21.7 \\ Stress Test (min-max) & 43.2-82.5 & 35.1/ -4.2 \\ SNLI CAD & 76.2 & 2.1 \\ SNLI-hard & 74.1 & 4.2 \\ \hline \end{tabular}
\end{table}
Table 13: The challenge set accuracy for the T5-11B model trained on WANLI Liu et al. (2022).

Figure 10: Breaking NLI and ANLI (r3) accuracy of all models with the in-domain accuracy accuracy of 85% or more. Breaking NLI shows that models of different types and sizes can get high challenge set accuracy, while ANLI shows that none of them can.





\begin{table}
\begin{tabular}{l l c r}
**Test** & **Category** & **Sub-Category** & **Accuracy** \\ \hline NLI Diagnostics & & & 95.0 \\ \hline NLI Diagnostics & acI & Domain & 67.7 \\ NLI Diagnostics & artificial & Domain & 73.3 \\ NLI Diagnostics & news & Domain & 75.0 \\ NLI Diagnostics & reddit & Domain & 65.2 \\ NLI Diagnostics & wikipedia & Domain & 70.5 \\ NLI Diagnostics & common sense & Knowledge & 70.0 \\ NLI Diagnostics & world knowledge & Knowledge & 66.4 \\ NLI Diagnostics & factivity & Lexical Semantics & 68.6 \\ NLI Diagnostics & lexical entailment & Lexical Semantics & 76.4 \\ NLI Diagnostics & morphological negation & Lexical Semantics & 91.0 \\ NLI Diagnostics & named entities & Lexical Semantics & 70.4 \\ NLI Diagnostics & quantifiers & Lexical Semantics & 82.7 \\ NLI Diagnostics & redundancy & Lexical Semantics & 88.5 \\ NLI Diagnostics & symmetry/collectivity & Lexical Semantics & 73.8 \\ NLI Diagnostics & conditionals & Logic & 75.0 \\ NLI diagnostics & conjunction & Logic & 87.5 \\ NLI Diagnostics & disjunction & Logic & 47.4 \\ NLI Diagnostics & double negation & Logic & 94.1 \\ NLI Diagnostics & downward monotone & Logic & 30.0 \\ NLI Diagnostics & existential & Logic & 73.3 \\ NLI Diagnostics & intervals/numbers & Logic & 63.2 \\ NLI Diagnostics & negation & Logic & 76.8 \\ NLI Diagnostics & non-monotone & Logic & 63.3 \\ NLI Diagnostics & temporal & Logic & 71.9 \\ NLI Diagnostics & universal & Logic & 94.4 \\ NLI Diagnostics & upward monotone & Logic & 79.4 \\ NLI Diagnostics & active/passive & Predicate-Argument Structure & 62.8 \\ NLI Diagnostics & anaphora/coreference & Predicate-Argument Structure & 74.7 \\ NLI Diagnostics & coordination scope & Predicate-Argument Structure & 72.5 \\ NLI Diagnostics & core args & Predicate-Argument Structure & 76.3 \\ NLI Diagnostics & datives & Predicate-Argument Structure & 85.0 \\ NLI Diagnostics & ellipsist/implicits & Predicate-Argument Structure & 81.4 \\ NLI Diagnostics & genitives/partitives & Predicate-Argument Structure & 95.0 \\ NLI Diagnostics & intersectivity & Predicate-Argument Structure & 63.0 \\ NLI Diagnostics & nominalization & Predicate-Argument Structure & 92.9 \\ NLI Diagnostics & prepositional phrases & Predicate-Argument Structure & 86.8 \\ NLI Diagnostics & relative clauses & Predicate-Argument Structure & 68.8 \\ NLI Diagnostics & restricitivity & Predicate-Argument Structure & 69.2 \\ \hline Stress Test & validation matched & & 90.6 \\ Stress Test & validation matched & Antonym & 89.1 \\ Stress Test & validation matched & Length_Mismatch & 89.5 \\ Stress Test & validation matched & Negation & 76.8 \\ Stress Test & validation matched & Spelling Error (contentword\_swap\_perturbed) & 89.7 \\ Stress Test & validation matched & Spelling Error (keyboard) & 90.6 \\ Stress Test & validation matched & Spelling Error (swap) & 90.2 \\ Stress Test & validation matched & Word_Overlap & 83.1 \\ Stress Test & validation mismatched & & 90.5 \\ Stress Test & validation mismatched & Antonym & 88.4 \\ Stress Test & validation mismatched & Length Mismatch & 90.2 \\ \hline Stress Test & validation mismatched & Negation & 77.4 \\ Stress Test & validation mismatched & Spelling Error (contentword\_swap\_perturbed) & 89.6 \\ Stress Test & validation mismatched & Spelling Error (functionword\_swap\_perturbed) & 90.5 \\ Stress Test & validation mismatched & Spelling Error ( keyboard) & 89.5 \\ Stress Test & validation mismatched & Spelling Error (swap) & 90.5 \\ Stress Test & validation mismatched & Word Overlap & 82.9 \\ \end{tabular}
\end{table}
Table 14: The breakdown of individual tests in NLI Diagnostics and Stress Test.





**Test Id: Capability; Test Type; _Test Description_: Q1: question) Q2: {question} ([label])
* MFT Add an adjective (modifier): Q1: Is Adam Ward a historian? Q2: Is Adam Ward an aspiring historian? (not duplicates)
* MFT Different adjectives: Q1: Is Jason Price an immigrant? Q2: Is Jason Price Indian? (not duplicates)
* MFT Different animals: Q1: Can I feed my dog cereal? Q2: Can I feed my snake cereal? (not duplicates)
* MFT Add irrelevant modifiers (examples with animals): Q1: Is that monkey up on the table? Q2: Is that monkey truly up on the table? (duplicates)
* MFT Add irrelevant modifiers (examples with people): Q1: Is Melissa responding to Christina? Q2: Is Melissa really responding to Christina? (duplicates)
* MFT Different irrelevant preamble: Q1: My pet cat ears soy. Is it normal for animals to eat soy? Q2: My pet monkey eats soy. Is it normal for animals to eat soy? (duplicates)
* MFT Preamble is relevant (different injuries): Q1: I hurt my hip last time I played football. Is this a common injury? Q2: I hurt my thigh last time I played football. Is this a common injury? (not duplicates)
* MFT How can I become more [synonym/?] Q1: How can I become more religious? Q2: How can I become more spiritual? (duplicates)
* INV (question, f(question)) where f(question) replaces synonyms? Q1: I am a 32 year old single man, doing a govt job in India, not happy with my job and life, nothing much in my bank account, what should I do? Q2: I am a 32 year old single man, doing a govt job in India, not jyofild with my job and life, nothing much in my bank account, what should I do? (duplicates)
* INV Replace symptoms in pairs of duplicates from the dev set: Q1: What is the secret of happy life? Q2: What's the bloodly secret of a happy life? (duplicates) lQ1: What is the secret of joyful life? Q2: What's the bloodly secret of a happy life? (duplicates)
* MFT How can I become more X \(\neq\) How can I become less x: Q1: How can I become less secular? Q2: How can I become more secular? (not duplicates)
* MFT How can I become more X = How can I become mostorm(X): Q1: How can I become less hopeful? Q2: How can I become more hopeless? (not duplicates)
* INV Add one type: Q1: What are the best tisp for early-stage startups? Q2: What are your best tips for very early stage startups? (duplicates) lQ1: What are the best tips for early-stage startups? Q2: What are your best tips for very early stage startups? (duplicates) lR1: Why Contractions: Q1: What are the qualifications for being an FBI or CIA agent? Q2: What does it take to become an FBI agent? (not duplicates) lL...
* DIR (q, parabrae(q)): Q1: Do you think you can use another operator's SIM in Jio SIM slot after using Jio SIM? Q2: Can you use another operator's SIM in Jio SIM slot after using Rio SIM? (duplicates)
* INV Product of par abrages(q1) ! parabrares(q2): Q1: If you want to publish poetry on Quora, what should you don? Q2: Do you think you can post your poetry on Quora? (not duplicates)lQ1: In order to publish poetry on Quora, what should you do? Q2: Can you post my poetry on Quora? (not duplicates) lL...
* MFT Same adjectives different people: Q1: Is Samuel Rogers Australian? Q2: Is Joshua James Australian? (not duplicates)
* MFT Some adjectives different people v2: Q1: Is Eric Wilson Jewish? Q2: Is Victoria Wilson Jewish? (not duplicates)
* MFT Same adjectives different people v3: Q1: Is Olivia Edwards Muslim? Q2: Is Olivia Reyes Maslim? (not duplicates)
* INV Change same name in both questions: Q1: Did Jesus keep the sabbath? Q2: When Jesus died on the cross did he do away with keeping the seventh year asubbath? (not duplicates) lQ1: Did Kyle keep the sabbath? Q2: When Kyle died on the cross did he do away with saying weeping the seventh year subbath? (not duplicates)
* INV Change same location in both questions: Q1: Why does the caste system persist in India? Q2: Do you support the caste system in India? ... (not duplicates)
* INV Change same number in both questions: Q1: How can I invest $100 into myself? Q2: What is the best way to invest S100 in today market? (not duplicates) lQ1: How can I invest $103 into myself? Q2: What is the best way to invest S103 in otolays market? ... (not duplicates)
* DIR Change first name in one of the questions: Q1: What does Hillary Clinton think of high-skill immigration? Q2: What is Hilitary Clinton's stance on high skilled immigration? (duplicates) lQ1: What does Hillary Clinton think of high-skill immigration Q2: What is Diana Clinton's stance on high skilled immigration? (not duplicates) lL...
* DIR Change first and last name in one of the questions: Q1: Would Hillary get women's vote just because she's a female? Q2: Are there a lot of women who will vote for Hillary Clinton just because she is a woman? (duplicates) lQ1: Would Brooke get women's vote just because she's a female? Q2: Are there a lot of women who will vote for Hillary Clinton just because she is a woman? (not duplicates) lL...
* DIS Change location in one of the questions: Q1: Why did India signed Indus water Treaty? Q2: Why did India signed Indus water treaty? (duplicates) lQ1: Why did Nauru sign the Indus Water Treaty? Q2: Why did India signed Indus water treaty? (not duplicates) lL...
* DIR Change numbers in one of the questions: Q1: What do you think of abolishing 500 and 1000 Rupee Currency notes by the Indian Government? Q2: Was the decision by the Indian Government to demonetize 500 and 1000 notes right or is it a big scam? (duplicates) lQ1: What do you think of abolishing 500 and 931 Rupee Currency notes by the Indian Government? Q2: Was the decision by the Indian Government to demonetize 500 and 1000 notes right or is it a big sccam? (not duplicates) lQ1: —
* DIR Keep entities, fill in with gibberish: Q1: What would have happened if Hitler hadn’t declared war on the United States after Pearl Harbor? Q2: What would have happened if the United States split in two after the revolutionary war? (not duplicates) lQ1: What would have happened if the United States split in two after the revolutionary war? Q2: What divided the United States in two after the revolutionary war? (not duplicates) lL..

\begin{table}
\begin{tabular}{p{48.4pt} p{76.8pt} p{76.8pt}} \hline \multicolumn{2}{c}{**Test Id: Capability; Test Type; _Test Description_: Q1: {question} Q2: {question} ([label])} \\ \hline
1 & MFT Add an adjective (modifier): Q1: Is Adam Ward a historian? Q2: Is Adam Ward an aspiring historian? (not duplicates) \\
2 & MFT Different adjectives: Q1: Is Jason Price an immigrant? Q2: Is Jason Price Indian? (not duplicates) \\
3 & MFT Different animals: Q1: Can I feed my dog cereal? Q2: Can I feed my snake cereal? (not duplicates) \\
4 & MFT Add irrelevant modifiers (examples with animals): Q1: Is that monkey up on the table? Q2: Is that monkey truly up on the table? (duplicates) \\
5 & MFT Add irrelevant modifiers (examples with people): Q1: Is Melissa responding to Christina? Q2: Is Melissa really responding to Christina? (duplicates) \\
6 & MFT Different irrelevant preamble: Q1: My pet cat ears soy. Is it normal for animals to eat soy? Q2: My pet monkey eats soy. Is it normal for animals to eat soy? (duplicates) \\
7 & MFT Premble is relevant (different injuries): Q1: I hurt my hip last time I played football. Is this a common injury? Q2: I hurt my thigh last time I played football. Is this a common injury? (not duplicates) \\
8 & MFT How can I become more [synonym/?]: Q1: How can I become more religious? Q2: How can I become more spiritual? (duplicates) \\
9 & INV (question, f(question)) where f(question) replaces synonyms? Q1: I am a 32 year old single man, doing a govt job in India, not happy with my job and life, nothing much in my bank account, what should I do? Q2: I am a 32 year old single man, doing a govt job in India, not jyofild with my job and life, nothing much in my bank account, what should I do? Q2: What’s the bloodly secret of a happy life? (duplicates) lQ1: What is the secret of joxth life? Q2: What’s the bloodly secret of a happy life? (duplicates) lQ1: What is the secret of joxth life? Q2: What’s the bloodly secret of a happy life? (duplicates) \\
11 & MFT How can I become more X + How can I become less x: Q1: How can I become more sexual? (not duplicates) \\
12 & MFT How can I become more [knowers X = How can I become less astorym(X)]: Q1: How can I become less novelty! Q2: How can I become more hopeless? (not duplicates) \\ \hline
13 & INV Add one type: Q1: What are the best tisp for early-stage startups? Q2: What are your best tips for very early stage startups? (duplicates) lQ1: What are the best tips for early-stage startups? Q2: What are your best tips for very early stage startups? (duplicates) lR1: Why Contractions: Q1: What are the qualifications for being an FBI or CIA agent? Q2: What does it take to become an FBI agent? (not duplicates) lL...
15 & DIR (q, parabrae(q)): Q1: Do you think you can use another operator’s SIM in Jio SIM slot after using Jio SIM? Q2: Can you use another operator’s SIM in Jio SIM slot after using Jio SIM? (duplicates) \\
16 & INV Producer of parabrasse(q1) ! parabrares(q2): Q1: If you want to publish poetry on Quora, what should you don? Q2: Do you think you can post your poetry on Quora? (not duplicates)lQ1: In order to publish poetry on Quora, what should you do? Q2: Can you post my poetry on Quora? (not duplicates) lL...
17 & MFT Same adjectives, different people: Q1: Is Samuel Rogers Australia? Q2: Is Joshua James Australian? (not duplicates) \\
18 & MFT Name adjectives, different people v2: Q1: Is Eric Wilson Jewish? Q2: Is Victoria Wilson Jewish? (not duplicates) \\
19 & MFT Name adjectives, different people v3: Q1: Is Oliva Edwards Muslim? Q2: Is Oliva Reyes Maslim? (not duplicates) \\
20 & INV Change same name in both questions: Q1: Did Jesus keep the sabbath? Q2: When Jesus died on the cross did he do away with keeping the seventh year subbath? (not duplicates) lQ1: Did Kyle keep the sabbath? Q2: When Kyle died on the cross did he do away with kriging the seventh year subbath? (not duplicates) \\
21 & INV Change same location in both questions: Q1: Why does the caste system persist in India? Q2: Do you support the caste system in India? ... (not duplicates) \\
22 & INV Change same number in both questions: Q1: How can I invest $100 into myself? Q2: What is the best way to invest S100 in today market? (not duplicates) lQ1: How can I invest $103 into myself? Q2: What is the best way to invest S103 in today's market? ... (not duplicates)



**Test 1d: Capability; Test Type; Test Description: Q1: (question) Q2: {question} ([label])**

\begin{table}
\begin{tabular}{l l p{340.0pt}} \hline \multicolumn{5}{c}{**Test Id: Capability; Test Type; Test Description: Q1: {question} Q2: {question} ([label])**} \\ \hline
28 & MFT & _Is person X + Did person use to be X_: Q1: Is James Russell an actress? Q2: Did James Russell use to be an actress? (not duplicates) \\
29 & MFT & _Is person X + Is person becoming X_: Q1: Is Taylor Long an investigator? Q2: Is Taylor Long becoming an investigator? (not duplicates) \\
30 & MFT & _What was person’s life before becoming X + [...] after becoming X_: Q1: What was Kyle Ross’s life before becoming an academic? Q2: What was Kyle Ross’s life after becoming an academic? (not duplicates) \\
31 & MFT & _Do you have to X your dog before Y ii [...] after Y it_: Q1: Do you have to weigh your dog before naming it? Q2: Do you have to weight your dog after naming it? (not duplicates) \\
32 & MFT & _Is it ok, ...] to [smoke, ...] after \(\neq\) before_: Q1: Is it reasonable to text before 7pm? Q2: Is it reasonable to text after 7pm? (not duplicates) \\ \hline
33 & MFT & _How can I become A person \# [...] a person who is not X_: Q1: How can I become an invisible person? Q2: How can I become a person who is not insribler? (not duplicates) \\
34 & MFT & _Is it ok, ...] to [smoke, ...] in country [...] not to [...]_ Q1: Is it socially acceptable to preach in Tanzania? Q2: Is it socially acceptable not to preach in Tanzania? (not duplicates) \\
35 & MFT & _What are things a (non!) should worry about + [...] not worry about_: Q1: What are things an escort should worry about? Q2: What are things an escort should not worry about? (not duplicates) \\
36 & MFT & _How can I become a X person = [...] a person who is not antonym(X)_: Q1: How can I become a smart person? Q2: How can I become a person who is not stupid? (duplicates) \\ \hline
37 & MFT & _Simple conf(the and she)_: Q1: If Olivia and Donald were alone, do you think he would reject him? Q2: If Olivia and Donald were alone, do you think she would reject him? (not duplicates) \\
38 & MFT & _Simple conf(his and her)_: Q1: If George and Jasmine were married, would his family be happy? Q2: If George and Jasmine were married, would hayamine’s family be happy? (not duplicates) \\  & Q2: If George and Jasmine were married, would George’s family be happy? (not duplicates) \\ \hline
39 & MFT & _Who do X think = Who is the [...] according to X_ Q1:Who do critics think is the brightest boxer in the world? Q2: Who is the brightest boxer in the world according to critics? (duplicates) \\
40 & MFT & _Order does not matter for comparison_: Q1: Are dwarves warmer than men? Q2: Are men warmer than dwarves? (not duplicates) \\
41 & MFT & _Under does not matter for symmetric relations_: Q1: Is Hannah engaged to Isabella? Q2: Is Isabella engaged to Hannah? (duplicates) \\
42 & MFT & _Order does matter for asymmetric relations_: Q1: Is Elizabeth beating Adam? Q2: Is Adam beating Elizabeth? (not duplicates) \\
43 & MFT & _Traditional SRL: active / passive swap_: Q1: Did Samuel miss the estate? Q2: Was the estate missed by Samuel? (duplicates) \\
44 & MFT & _Traditional SRL: wrong active / passive swap_ Q1: Did Michelle like the car? Q2: Was Michelle liked by the car? (not duplicates) \\
45 & MFT & _Traditional SRL: active / passive swap with people_: Q1: Does Mary remember Adam? Q2: Is Adam remembered by Mary? (duplicates) \\
46 & MFT & _Traditional SRL: wrong active / passive swap with people_: Q1: Does Michelle trust Angela? Q2: Is Michelle trusted by Angela? (not duplicates) \\ \hline
47 & MFT & _A or B is not the same as C And D_: Q1: Is Emily Fisher an actress or an investor? Q2: Is Emily Fisher simultaneously an auditor and an organizer? (not duplicates) \\
48 & MFT & _A or B is not the same as A and B_: Q1: Is Taylor King an educator or an accountant? Q2: Is Taylor King simultaneously an educator and an accountant? (not duplicates) \\
49 & MFT & _A and / or B is the same as B and / or A_: Q1: Is Jennifer Flores an engineer and an editor? Q2: Is Jennifer Flores an editor and an engineer? (duplicates) \\
50 & MFT & \(a\) (nationality) (profession) = \(a\) (profession) _and_ (nationality): Q1: Is Christina Nguyen a French nurse? Q2: Is Christina Nguyen a nurse and French? (duplicates) \\
51 & MFT & _Reflexivity: (q,q) should be duplicate_: Q1: What does the following symbol mean Q2: What does the following symbol mean ? (duplicates) \\
52 & INV & _Symmetry: f_ (a,b) = f(b,a): Q1: Which colleges come under the GMAT? Q2: Which all colleges come under GMAT in india? (not duplicates) | Q1: Which all colleges come under GMAT in india? Q2: Which colleges come under the GMAT? (not duplicates) \\
53 & DIR & _Testing implications:_ Q1: Why was Albert Einstein considered an atheist? Q2: Do atheists look down on Albert Einstein because he was religious? (not duplicates) | Q1: Why was Albert Einstein considered an atheist? Q2: Was Albert Einstein an atheist? (not duplicates) | ... \\ \hline \end{tabular}
\end{table}
Table 16: Checklists tests 28–53 for QQP.





\begin{table}
\begin{tabular}{l c c c c c}  & RoBERTa-L & DeBERta-L & OPT-6.7B & GPT-2XL & T5-11B \\ \hline
**\% Total Tests with 95+\% accuracy** & 45.3 & 45.3 & 34.0 & 26.4 & 45.3 \\   \(\downarrow\)**\& No 3+\% drops from scaling** & 45.3 & 45.3 & 24.5 & 26.4 & 32.1 \\   \(\downarrow\)**\& Equally robust across model sizes** & 32.1 & 34.0 & 13.2 & 22.6 & 26.4 \\
**\% 10+\% gains from scaling, no 3+\% drops** & 28.3 & 20.8 & 9.4 & 7.5 & 15.1 \\ \hline
**\% Total Tests with <60\% accuracy** & 28.3 & 22.6 & 32.1 & 35.8 & 15.1 \\
**\% Major scaling complications (10+\% drops)** & 1.9 & 1.9 & 37.7 & 18.9 & 22.6 \\ \hline \end{tabular}
\end{table}
Table 17: Analysis of CheckList results for identifying duplicate questions (QQP) with best models from each type.

Figure 11: RoBERTa

Figure 12: DeBERTa



Figure 13: OPT



Figure 14: GPT-2



Figure 15: T5





**Task**: **CoT Prompt****Passage:**

The end of the long-held animosity between Moscow and Beijing was marked by the visit to China by Soviet General Secretary Mikhail Gorbachev in 1989. After the 1991 demise of the Soviet Union, China's relations with Russia and the former states of the Soviet Union became more amicable as the conflicting ideologies of the two vast nations no longer stood in the way. A new round of bilateral agreements was signed during reciprocal head of state visits. As in the early 1950s with the Soviet Union, Russia has again become an important source of military technology for China, as well as for raw materials and trade. Friendly relations with Russia have been an important advantage for China, complementing its strong ties with the U.S.

**Question:** Can China rely on both the US and Russia as supportive allies?

**Give the rationale before answering.** If a country has either friendly relations or strong ties with another country, one can expect the other country is their ally. So the answer is _YES_.

***...

***Passage:** Trans have operated continuously in Melbourne since 1885 (the horse tram line in Fairfield opened in 1884, but was at best an irregular service). Since then they have become a distinctive part of Melbourne's character and feature in tourism and travel advertising. Melbourne's cable tram system opened in 1885, and expanded to one of the largest in the world, with of double track. The first electric tram line opened in 1889, but closed only a few years later in 1896. In 1906 electric tram systems were opened in St Kilda and Essendon, marking the start of continuous operation of Melbourne's electric terms.

**Question:** If I wanted to take a horse tram in 1884, could I look up the next tram on a schedule?

**Give the rationale before answering.**

**Passage:** Love Island Australia is an Australian dating reality show based on the British series Love Island. The series is presented by Sophie Monk and narrated by Eoghan McDermott. The series began airing on 9Go! and 9Now on 27 May 2018. The final aired on 5 July 2018, with Grant Crapp and Tayla Damir winning and sharing the $50,000 prize money. Eden Dally and Erin Barnett finished as runners up.

**Question:** is there a prize for love island australia

**Give the rationale before answering.** There is a $50000 prize money. So the answer is _True._

***...

***Passage:** Conscription in the United States, commonly known as the draft, has been employed by the federal government of the United States in five conflicts: the American Revolution, the American Civil War, World War I, World War II, and the Cold War (including both the Korean War and the Vietnam War). The third incarnation of the draft came into being in 1940 through the Selective Training and Service Act. It was the country's first peacetime drift. From 1940 until 1973, during both peacetime and periods of conflict, men were drafted to fill vacancies in the United States Armed Forces that could not be filled through voluntary means. The draft came to an end when the United States Armed Forces moved to an all-volunteer military force. However, the Selective Service System remains in place as a contingency plan; all male civilians between the ages of 18 and 25 are required to register so that a draft can be readily resumed if needed. United States Federal Law also provides for the compulsory conscription of men between the ages of 17 and 45 and certain women for militia service pursuant to Article I, Section 8 of the United States Constitution and 10 U.S. Code SS 246.

**Question:** was there a draft in the revolutionary war

**Give the rationale before answering.**

*Perspective:** Interfering with a species for cosmetic reasons is poor practice
*Claim:** The breeding of white tigers in captivity should be banned. Does the perspective support or undermine the claim? Answer with: supports, undermines or not a valid perspective.
*Give the rationale before answering. Breeding tigers in captivity is interfering with the species. So the answer is _supports._
*ffffff
*ffffff
*Perspective:** I would just be so upset that that guy cheated and stole that moment away from me.
*Claim:** should cheaters be given a second chance. Does the perspective support or undermine the claim? Answer with: supports, undermines or not a valid perspective.
*Give the rationale before answering.





**Task** & **CoT Prompt****Passage:** Hemophilia is the name of a group of hereditary diseases that affect the body's ability to control blood clotting. Hemophilia is caused by a lack of clotting factors in the blood. Clotting factors are normally released by platelets. Since people with hemophilia cannot produce clots, any cut can put a person at risk of bleeding to death. The risk of internal bleeding is also increased in hemophilia, especially into muscles and joints. This disease affected the royal families of Europe. Greg and Bobby are coworkers who are currently eating lunch together on their break. They haven't known each other very long and are having a casual conversation when Bobby mentions that he is a hemophiliac. Greg, unsure of what exactly that means, looks confused and taken aback. Bobby, noticing the bewilderment on Greg's face, takes a moment to explain the details of his condition to Greg.**Question:** Does Greg or Bobby have a lower platelet count?

**Give the rationale before answering.** Bobby is hemophiliac which would mean that he lacks clotting factors normally released by platelets. So the answer is _Bobby_.

***
* **Passage:** The theory of evolution by natural selection was proposed at about the same time by both Charles Darwin and Alfred Russel Wallace, shown in Figure below , and was set out in detail in Darwin's 1859 book On the Origin of Species . Natural selection is a process that causes heritable traits that are helpful for survival and reproduction to become more common, and harmful traits, or traits that are not helpful or advantageous for survival to become more rare in a population of organisms. This occurs because organisms with advantageous traits are more "fit" to survive in a particular environment and have "adapted" to the conditions of that environment. These individuals will have greater reproductive success than organisms less fit for survival in the environment. This will lead to an increase in the number of organisms with the advantageous trait(s) over time. Over many generations, adaptations occur through a combination of successive, small, random changes in traits, and natural selection of those variants best-suited for their environment. Natural selection is one of the cornerstones of modern biology.

**Question:** The tree frogs range covers 2 different habitats, One has a lot of trees and the other a lot of tall green grass with few if any trees. Tree frogs can either be green or brown. Which color tree frog has an advantage living in trees?

**Give the rationale before answering.****Passage:** Svitrigaila was losing his influence in the Slavic principalities and could no longer resist Poland and Sigismund. On 4 September 1437 he attempted to reconcile with Poland: he would rule the lands that still backed him , and after his death these territories would pass to the King of Poland. However, under strong protest from Stigismund, the Polish Senate declined to ratify the treaty . In 1438 Svitrigaila withdrew to Moldavia. The reign of Sigismund Kestuatiis was brief -- he was assassinated in 1440. Svitrigaila returned from exile in 1442 and ruled Lutsk until his death a decade later. Jogaila's son Casimir IV Jagiellon, born in 1426, received approval as a hereditary hospodar from Lithuania's ruling families in 1440. This event is seen by the historians Jerzy Lukowski and Hubert Zawadzki as marking the end of the succession dispute.

**Question:** Who was ruler first, Sigismund of Casimir IV Jagiellon?

**Give the rationale before answering.** Casimir IV Jagiellon became the ruler only after the assination of Sigismund Kesutatiitis. So the answer is _Sigismund Kesutatatis_.

*** ***

* **Passage:** The origins of al-Qaeda can be traced back to the Soviet war in Afghanistan . The United States, the United Kingdom, Saudi Arabia, Pakistan, and the People's Republic of China supported the Islamist Afghan mujahadeen guerillas against the military forces of the Soviet Union and the Democratic Republic of Afghanistan. A small number of "Afghan Arab" volunteers joined the fight against the Soytics, including Osama bin Laden, but there is no evidence they received any external assistance. In May 1996 the group World Islamic Front for jhaid Against Jews and Crusaders , sponsored by bin Laden , started forming a large base of operations in Afghanistan, where the Islamist extremist regime of the Taliban had seized power earlier in the year. In February 1998, Osama bin Laden signed a fatwa, as head of al-Qaeda, declaring war on the West and Israel. Earlier in August 1996, Bin Laden declared jihad against the United States. Later in May 1998 Al-Qaeda released a video declaring war on the U.S. and the West. On 7 August 1998, al-Qaeda struck the U.S. emphasises in Kenya and Tanzania, killing 224 people, including 12 Americans. In retaliation, U.S. President Bill Clinton launched Operation Infinite Reach, a bombing campaign in Sudan and Afghanistan against targets the U.S. asserted were associated with WIFJAJC, although others have questioned whether a pharmaceutical plant in Sudan was used as a chemical warfare facility. The plant produced much of the region's antimalarial drugs and around 50% of Sudan's pharmaceutical needs. The strikes failed to kill any leaders of WIFIJAJC or the Taliban. Next came the 2000 imhelium attack plots, which included an attempted bombing of Los Angeles International Airport. On 12 October 2000, the USS Cole bombing occurred near the port of Yemen, and 17 U.S. Navy sailors were killed.

**Question:** How many years was it between when Bin Laden declared a war against the United States and when he became leader of al-Qaeda?

**Give the rationale before answering.****



**Task**: **CoT Prompt**

**Review:**"Garde a Vue has to be seen a number of times in order to understand the sub-plots it contains. If you're not used to french wordy films, based upon conversation and battle of wits rather than on action, don't even try to watch it. You'll only obtain boredom to death, and reassured opinion that french movies are not for you_cbr /><br />Garde a Vue is a wordy film, essentially based upon dialogs (written by Audiard by the wayband it cruelly cuts the veil of appearances_cbr />chr />Why does Maitre Martineau (Serrault) prefer to be unduly accused of being a child murder rather than telling the truth ? Because at the time of the murder he was with a 18 years old girl with which he has a 8-years sexual relation. His wife knows it, she's jealous of it and he prefers to be executed (in 1980 in France, there was still death penaltyrather than unveiling the sole ""pure and innocent"" aspect of his pitiful life." **What is the sentiment of this review:** Positive or Negative?
**Give the rationale before answering.** The reviewer describes the movie to be complex, one where the audience needs to pay close attention to the dialogues and not just visuals to understand the nuanced story. So the answer is _Positive_.
**###*******

**Review:** May 2004, Wonderland is fairly new in the UK. Brilliant film of a brutal true story. If you know LA from the early 80's, you will appreciate how well it is captured. The use of the elements which make up its grittty cinematic style is original, amplifying the experience and bringing the viewer very close to actually being there. The use of a disjointed 'Pulp Fiction' style time line allows exploration of the uncertainty concerning what really happened, while the direction and performances of the cast command attention, especially Val Kilmer as John Holmes; an Oscar for sure if I were handing them out.
**What is the sentiment of this review:** Positive or Negative?
**Give the rationale before answering.**

**Passage:** Dr. Barnett Sleplan was *killed* in his kitchen by a sniper's bullet last fall . Investigators said Friday they *found* a rifle buried near his home in the Buffalo suburb of Amherst.
**Question:** When did the event *killed* happen in relation to the event *found*: before, after, simultaneously, or is it vague?
**Give the rationale before answering.** The investigation into the killing, during which the finding took place, was started only after the killing. So the answer is _before_.
**....**
**MATRES**: **.....**
**Passage:** A book of memoirs and photographs from the climb by Mr Lowe , which he worked on with Dr Lewis-Jones , is due to be published in May . He *said* : " Lowe was a brilliant , kind fellow who never sought the limelight ... and 60 years on from Evererest his achievements deserve wider recognition . " He was *involved* in two of the most important explorations of the 20th Century ... yet remained a humble , happy man right to the end ... an inspirational lesson to us all . "
**Question:** When did the event *said* happen in relation to the event *involved*: before, after, simultaneously, or is it vague?
**Give the rationale before answering.**



**Task**: **CoT Prompt**

\begin{table}
\begin{tabular}{p{142.3pt} p{280.5pt}}
**Task** & **CoT Prompt** \\  & **Passage: He succeeds James A. Taylor, who stepped down as chairman, president and chief executive in March for health reasons. How often are chief executives typically replaced? Is this the answer: every 10 weeks? Give the rationale before answering. Most chief executives keep their positions for years. So the answer is _no._ ### \\ MCTACO & ... \\  & **Passage:** Roberta Adams skipped the thick how-to guide on child-custody forms and sat down at a computer at the Lamoreaux Justice Center in Orange on Wednesday. When did Roberta arrive at the Lamoreaux Justice Center? Is this the answer: 10:45 PM? Give the rationale before answering. \\  & **Passage: In the year 1978, Gracie Bowen, a 15-year-old tomboy who lives in South Orange, New Jersey, is crazy about soccer, as are her three brothers and their former soccer star father. Although Gracie wants to join her brothers and neighbor Kyle in the nightly practices her father runs, she is discouraged by everyone except her older brother, Johnny. Johnny, Gracie and Kyle attend Columbia High School, where Johnny is the captain and star player for the varsity soccer team. After missing a shot at the end of a game, the desopondent Johnny drives off with a friend’s car and dies in a traffic accident. Strugging with grief, Gracie decides that she wants to replace her brother on the team. Her father does not believe that girls should play soccer, telling her she is neither tough nor talented enough. Her mother is a nurse who lacks the competitive drive of the rest of her family and fears for Gracie’s safety. Her mother later tells Gracie that she would have liked to become a surgeon, but that option had not been available to her as a woman. Rejected and depressed, Gracie begins to rebel; she stops doing her schoolwork, is caught cheating on an exam, and experiments with wild and self-destructive behavior. She is finally caught by her father almost having sex with a guy she met near the docks after telling her friend, “I want to do something that I’ve never done before.” This serves as a wake-up call for her parents, particularly her father. He quits his job to work with her on her soccer training. Question: What happens to the sibling that supports Gracie’s interest in soccer? Give the rationale before answering. Garcia’s older brother Johnny who was supportive of her interest in soccer died in a car accident. So the answer is _dies in a traffic accident._ ### Quoref .... ### ### #### Passage: Bath once had an important manufacturing sector, particularly in crane manufacture, furniture manufacture, printing, brass foundries, quarries, dye works and Plasticine manufacture, as well as many mills. Significant Bath companies included Stothert & Pitt, Bath Cabinet Makers and Bath & Portland Stone. Nowadays, manufacturing is in decline, but the city boasts strong software, publishing and service-oriented industries, being home to companies such as Future plc and London & Country mortgage brokers. The city’s attraction to tourists has also led to a significant number of jobs in tourism-related industries. Important economic sectors in Bath include education and health (30,000 jobs), retail, tourism and leisure (14,000 jobs) and business and professional services (10,000 jobs). Major employers are the National Health Service, the city’s two universities, and the Bath and North East Somerset Council, as well as the Ministry of Defence although a number of MOD offices formerly in Bath have recently moved to Bristol. Growing employment sectors include information and communication technologies and creative and cultural industries where Bath is one of the recognised national centres for publishing, with the magazine and digital publisher Future plc employing around 650 people. Others include Buro Happold (400) and IPL Information Processing Limited (250). The city boasts over 400 retail shops, half of which are run by independent specialist retailers, and around 100 restaurants and cafes primarily supported by tourism. Question: half of what are run by independent specialists? Give the rationale before answering. \\ \end{tabular}
\end{table}
Table 21: The exact prompts **with CoT** used for each contrast set (continuation of Table 20).





**Task**: **Prompt**

\begin{tabular}{p{14.2pt} p{369.8pt}}  & **Passage:** \\  & The end of the long-held animosity between Moscow and Beijing was marked by the visit to China by Soviet General Secretary Mikhail Gorbachev in 1989. After the 1991 demise of the Soviet Union, China's relations with Russia and the former states of the Soviet Union became more amicable as the conflicting ideologies of the two vast nations no longer stood in the way. A new round of bilateral agreements was signed during reciprocal head of state visits. As in the early 1950s with the Soviet Union, Russia has again become an important source of military technology for China, as well as for raw materials and trade. Friendly relations with Russia have been an important advantage for China, complementing its strong ties with the U.S. \\ CondaQA & Can China relay on both the US and Russia as supportive allies? \\  & **The answer is YES.** \\ CondaQA & *** \\  & *** \\  & **Passage:** Trams have operated continuously in Melbourne since 1885 (the horse tram line in Fairfield opened in 1884, but was at best an irregular service). Since then they have become a distinctive part of Melbourne's character and feature in tourism and travel advertising. Melbourne's cable tram system opened in 1885, and expanded to one of the largest in the world, with of double track. The first electric tram line opened in 1889, but closed only a few years later in 1896. In 1906 electric tram systems were opened in St Kilda and Essendon, marking the start of continuous operation of Melbourne's electric trams. \\  & **Question:** If I wanted to take a horse tram in 1884, could I look up the next tram on a schedule? \\  & **Passage:** Love Island Australia is an Australian dating reality show based on the British series Love Island. The series is presented by Sophie Monk and narrated by Egghan McDermott. The series began airing on 9Goi! and 9Now on 27 May 2018. The final aired on 5 July 2018, with Grant Crapp and Tayla Damir winning and sharing the $50,000 prize money. Eden Dally and Erin Barnett finished as runners up. \\  & **Question:** is there a prize for love island australia \\  & **The answer is True.** \\  & *** \\  & **### \\ BoolQ & Passage:** Conscription in the United States, commonly known as the draft, has been employed by the federal government of the United States in five conflicts: the American Revolution, the American Civil War, World War L World War II, and the Cold War (including both the Korean War and the Vietnam War). The third incarnation of the draft came into being in 1940 through the Selective Training and Service Act. It was the country's first peacetime draft. From 1940 until 1973, during both peacetime and periods of conflict, men were drafted to fill vacancies in the United States Armed Forces that could not be filled through voluntary means. The draft came to an end when the United States Armed Forces moved to an all-volunteer military force. However, the Selective Service System remains in place as a contingency plan; all male civilians between the ages of 18 and 25 are required to register so that a draft can be readily resumed if needed. United States Federal Law also provides for the compulsory conscription of men between the ages of 17 and 45 and certain women for militia service pursuant to Article I, Section 8 of the United States Constitution and 10 U.S. Code SS 246. \\  & **Question:** was there a draft in the revolutionary war \\  & Interfering with a species for cosmetic reasons is poor practice \\  & The breeding of white tigers in captivity should be banned. \\  & Does the perspective support or undermine the claim? \\  & Answer with: supports, undermines or not a valid perspective. \\  & **The answer is supports.** \\ PERSPECTRUM & *** \\  & *** \\  & I would just be so upset that that guy cheated and stole that moment away from me. \\  & should cheaters be given a second chance. \\  & Does the perspective support or undermine the claim? \\  & Answer with: supports, undermines or not a valid perspective. \\ \hline \end{tabular} Table 22: The exact prompts **without CoT** used for each contrast set (continued in Tables 23-25).





**Task** & **Prompt****Passage:** Hemophilia is the name of a group of hereditary diseases that affect the body's ability to control blood clotting. Hemophilia is caused by a lack of clotting factors in the blood. Clotting factors are normally released by platelets. Since people with hemophilia cannot produce clots, any cut can put a person at risk of bleeding to death. The risk of internal bleeding is also increased in hemophilia, especially into muscles and joints. This disease affected the royal families of Europe. Greg and Bobby are coworkers who are currently eating lunch together on their break. They haven't known each other very long and are having a casual conversation when Bobby mentions that he is a hemophiliac. Greg, unsure of what exactly that means, looks confused and taken aback. Bobby, noticing the bewilderment on Greg's face, takes a moment to explain the details of his condition to Greg.

**Question:** Does Greg or Bobby have a lower platelet count?

**The answer is**_Bobby.__###_

...

**ROPES****Passage:** The theory of evolution by natural selection was proposed at about the same time by both Charles Darwin and Alfred Russel Wallace, shown in Figure below , and was set out in detail in Darwin's 1859 book On the Origin of Species . Natural selection is a process that causes heritable traits that are helpful for survival and reproduction to become more common, and harmful traits, or traits that are not helpful or advantageous for survival to become more rare in a population of organisms. This occurs because organisms with advantageous traits are more "fit" to survive in a particular environment and have "adapted" to the conditions of that environment. These individuals will have greater reproductive success than organisms less fit for survival in the environment. This will lead to an increase in the number of organisms with the advantageous trait(s) over time. Over many generations, adaptations occur through a combination of successive, small, random changes in traits, and natural selection of those variants best-suited for their enviroment. Natural selection is one of the cornerstones of modern biology.

**Question:** The tree frogs range covers 2 different habitats, One has a lot of trees and the other a lot of tall green grass with few if any trees. Tree frogs can either be green or brown. Which color tree frog has an advantage living in trees?

**Passage:** Svitrigaila was losing his influence in the Slavic principalities and could no longer resist Poland and Sigismund. On 4 September 1437 he attempted to reconcile with Poland: he would rule the lands that still backed him , and after his death these territories would pass to the King of Poland. However, under strong protest from Sigismund, the Polish Senate declined to ratify the treaty . In 1438 Svitrigaila withdrew to Moldavia. The reign of Sigismund Kestutatis was brief -- he was assassinated in 1440. Svitrigaila returned from exile in 1442 and ruled Lutsk until his death a decade later. Jogaila's son Casimirr IV Jagillon, born in 1426, received approval as a hereditary hospodar from Lithuania's ruling families in 1440. This event is seen by the historians Jerzy Lukowski and Hubert Zawadzki as marking the end of the succession dispute.

**Question:** Who was ruler first, Sigismund of Casimir IV Jagiellon?

**The answer is**_Sigismund Kestuatitis.__##_

....

***Passage:** The origins of al-Qaeda can be traced back to the Soviet war in Afghanistan . The United States, the United Kingdom, Saudi Arabia, Pakistan, and the People's Republic of China supported the Islamist Afghan mujahadeen guerillas against the military forces of the Soviet Union and the Democratic Republic of Afghanistan. A small number of "Afghan Arab" volunteers joined the fight against the Sovists, including Osama bin Laden, but there is no evidence they received any external assistance. In May 1996 the group World Islamic Front for Jihad Against Jews and Crusaders , sponsored by bin Laden , started forming a large base of operations in Afghanistan, where the Islamist extremist regime of the Taliban had seized power earlier in the year. In February 1998, Osama bin Laden signed a farofa, as head of al-Qaeda, declaring war on the West and Israel. Earlier in August 1996, Bin Laden declared jihad against the United States. Later in May 1998 al-Qaeda released a video declaring war on the U.S. and the West. On 7 August 1998, al-Qaeda struck the U.S. embassies in Kenya and Tanzania, killing 224 people, including 12 Americans. In retaliation, U.S. President Bill Clinton launched Operation Infinite Reach, a bombing campaign in Sudan and Afghanistan against targets the U.S. asserted were associated with WIFJAJC, although others have questioned whether a pharmaceutical plant in Sudan was used as a chemical warfare facility. The plant produced much of the region's antimalarial drugs and around 50% of Sudan's pharmaceutical needs. The strikes failed to kill any leaders of WIFIJAJC or the Taliban. Next came the 2000 millennium attack plots, which included an attempted bombing of Los Angeles International Airport. On 12 October 2000, the USS Cole bombing occurred near the port of Yemen, and 17 U.S. Navy sailors were killed.

**Question:** How many years was it between when Bin Laden declared a war against the United States and when he became leader of al-Qaeda?



**Task**: **Prompt**

* **Review:**"Garde a Vue has to be seen a number of times in order to understand the sub-plots it contains. If you're not used to french wordy films, based upon conversation and battle of wits rather than on action, don't even try to watch it. You'll only obtain boredom to death, and reassured opinion that french movies are not for you_cbr/><br />Garde a Vue is a wordy film, essentially based upon dialogs (written by Audiard by the way)and it crucially cuts the veil of appearances_<br/><br/>Why does Maitre Martineau (Serrault) prefer to be unduly accused of being a child murderer rather than telling the truth ? Because at the time of the murder he was with a 18 years old girl with which he has a 8-years sexual relation. His wife knows it, she's jealous of it and he prefers to be executed (in 1980 in France, there was still death penalty)rather than unveiling the sole ""pure and innocent"" aspect of his pitful life." **What is the sentiment of this review:** Positive or Negative?
* **The answer is** _Positive_.
* *** **Review:** May 2004, Wonderland is fairly new in the UK. Brilliant film of a brutal true story. If you know LA from the early 80's, you will appreciate how well it is captured. The use of the elements which make up its grity cinematic style is original, amplifying the experience and bringing the viewer very close to actually being there. The use of a disjointed 'Pulp Fiction' style time line allows exploration of the uncertainty concerning what really happened, while the direction and performances of the cast command attention, especially Val Kilmer as John Holmes; an Oscar for sure if I were handing them out.
* **What is the sentiment of this review:** Positive or Negative?

* **Passage:** Dr. Barnett Sleplan was *killed* in his kitchen by a sniper's bullet last fall . Investigators said Friday they *found* a rifle buried near his home in the Buffalo suburb of Amherst.
* **Question:** When did the event *killed* happen in relation to the event *found*: before, after, simultaneously, or is it vague?
* **The answer is** _before_.
* ...
* ###
* **Passage:** A book of memoirs and photographs from the climb by Mr Lowe , which he worked on with Dr Lewis- Jones , is due to be published in May . He *said* : " Lowe was a brilliant , kind fellow who never sought the limelight ... and 60 years on from Everest his achievements deserve wider recognition . " He was *involved* in two of the most important explorations of the 20th Century ... yet remained a humble , happy man right to the end ... an inspirational lesson to us all . "
* **Question:** When did the event *said* happen in relation to the event *involved*: before, after, simultaneously, or is it vague?

\begin{table}
\begin{tabular}{l l} \hline \hline
**Task** & **Prompt** \\ \hline  & **Review:** “Garde à Vue has to be seen a number of times in order to understand the sub-plots it contains. If you’re not used to french words firmly films, based upon conversation and battle of wits rather than on action, don’t even try to watch it. You’ll only obtain boredom to death, and reassured opinion that french movies are not for you_cbr/><br />Garde à Vue is a wordy film, essentially based upon dialogs (written by Audiard by the way)and it cruely cuts the veil of appearances_<br/><br/>Why does Maître Martineau (Serrault) prefer to be unduly accused of being a child murderer rather than telling the truth ? Because at the time of the murder he was with a 18 years old girl with which he has a 8-years sexual relation. His wife knows it, she’s jealous of it and he prefers to be executed (in 1980 in France, there was still death penalty)rather than unveiling the sole ””pure and innocent"" aspect of his pitful life.” **What is the sentiment of this review:** Positive or Negative?
* **The answer is** _Positive_.
* **Watt is the sentiment of this review:** Positive or Negative?

* **Passage:** Dr. Barnett Sleplan was *killed* in his kitchen by a sniper’s bullet last fall . Investigators said Friday they *found* a rifle buried near his home in the Buffalo suburb of Amherst.
* **Question:** When did the event *killed* happen in relation to the event *found*: before, after, simultaneously, or is it vague?
* **The answer is** _before_.
* **Watt is the sentiment of this review:** Positive or Negative?

* **Passage:** Dr. Barnett Sleplan was *killed* in his kitchen by a sniper’s bullet last fall . Investigators said Friday they *found* a rifle buried near his home in the Buffalo suburb of Amherst.
* **Question:** When did the event *killed* happen in relation to the event *found*: before, after, simultaneously, or is it vague?
* **The answer is** _before_.
* **Watt**
* **Watt**
* **Passage:** A book of memoirs and photographs from the climb by Mr Lowe , which he worked on with Dr Lewis- Jones , is due to be published in May . He *said* : " Lowe was a brilliant , kind fellow who never sought the limelight ... and 60 years on from Everest his achievements deserve wider recognition . " He was *involved* in two of the most important explorations of the 20th Century .... yet remained a humble , happy man right to the end ... an inspirational lesson to us all . "
* **Question:** When did the event *said* happen in relation to the event *involved*: before, after, simultaneously, or is it vague?



\begin{table}
\begin{tabular}{p{142.3pt} p{280.5pt}}
**Task** & **Prompt** \\  & **Passage:** He succeeds James A. Taylor, who stepped down as chairman, president and chief executive in March for health reasons. How often are chief executives typically replaced? Is this the answer: every 10 weeks? \\ MCTACO & *** \\  & *** \\  & *** \\  & **Passage:** Roberta Adams skipped the thick how-to guide on child-custody forms and sat down at a computer at the Lamoreaux Justice Center in Orange on Wednesday. When did Roberta arrive at the Lamoreaux Justice Center? Is this the answer: 10:45 PM? \\  & **Passage:** In the year 1978, Gracie Bowen, a 15-year-old tomboy who lives in South Orange, New Jersey, is crazy about soccer, as are her three brothers and their former soccer star father. Although Gracie wants to join her brothers and neighbor Kyle in the nightly practices her father runs, she is discouraged by everyone except her older brother, Johnny. Johnny, Gracie and Kyle attend Columbia High School, where Johnny is the captain and star player for the varsity soccer team. After missing a shot at the end of a game, the respondent Johnny drives off with a friend’s car and dies in a traffic accident. Struggling with grief, Gracie decides that she wants to replace her brother on the team. Her father does not believe that girls should play soccer, telling her she is neither tough nor talented enough. Her mother is a nurse who lacks the competitive drive of the rest of her family and fears for Graicé’s safety. Her mother later tells Gracie that she would have liked to become a surgeon, but that option had not been available to her as a woman. Rejected and depressed, Gracie begins to rebel; she stops doing her schoolwork, is caught cheating on an exam, and experiments with wild and self-destructive behavior. She is mainly caught by her father almost having sex with a guy she met near the docks after telling her friend, “I want to do something that Ive never done before.” This serves as a wake-up call for her parents, particularly her father. He quits his job to work with her on her soccer training. \\ Question: What happens to the sibling that supports Gracie’s interest in soccer? The answer is Garcie’s older brother Johnny who was supportive of her interest in soccer died in a car accident. So the answer is _dies in a traffic accident._ \\ Quoref & *** \\  & *** \\  & **Passage:** Bath once had an important manufacturing sector, particularly in crane manufacture, furniture manufacture, printing, brass foundries, quarries, dye works and Plasticine manufacture, as well as many mills. Significant Bath companies included Stothert \& Pitt, Bath Cabinet Makers and Bath \& Portland Stone. Nowadays, manufacturing is in decline, but the city boasts strong software, publishing and service-oriented industries, being home to companies such as Future plc and London \& Country mortgage brokers. The city's attraction to tourists has also led to a significant number of jobs in tourism-related industries. Important economic sectors in Bath include education and health (30,000 jobs), retail, tourism and leisure (14,000 jobs) and business and professional services (10,000 jobs). Major employers are the National Health Service, the city’s two universities, and the Bath and North East Somerset Council, as well as the Ministry of Defence although a number of MOD offices formerly in Bath have recently moved to Bristol. Growing employment sectors include information and communication technologies and creative and cultural industries where Bath is one of the recognised national centres for publishing, with the magazine and digital publisher Future plc employing around 650 people. Others include Buro Happold (400) and IPL Information Processing Limited (250). The city boasts over 400 retail shops, half of which are run by independent specialist retailers, and around 100 restaurants and cafes primarily supported by tourism. \\  & **Question:** half of what are run by independent specialists? \\ \end{tabular}
\end{table}
Table 25: The exact prompts **without CoT** used for each contrast set (continuation of Table 24).



Figure 16: The change in the attack success rate (ASR) as measured in prior work (1) vs. our robust modification (2) in the **MNLI** experimental setup. The attack type is unknown because TextFooler is used to train the defense.

 

Figure 17: The change in the attack success rate (ASR) as measured in prior work (1) vs. our robust modification (2) in the **AGNews** experimental setup. The attack type is unknown because TextFooler is used to train the defense.

 


\begin{table}
\begin{tabular}{p{142.3pt} p{56.9pt} p{78.0pt} p{78.0pt} p{78.0pt} p{78.0pt}} \hline \hline
**Original** & **Method** & **Prediction** & **GPT-4** & **Label** \\ \hline Oil exports flow as strike woes case A massive strike in Nigeria, which has raised fears over oil supply from the world #39:s seventh-largest exporter, will likely end its first phase on Thursday quot;all going well quad; union leaders said. & Optimal Snows Low Easy War Against mass Crime Reuters’ Renters' With an AK-47 assault rifle slug overthis shoulder, Sompong Prajobjan roamed one of Thailand’s lusthonal parks for more than a decade. & Unilateral Shows No Easy War Against mass Crime Reuters’ Renters’ With an AK-47 assault rifle slug overthis shoulder, Sompong Prajobjan roamed one of Thailand’s lusthonal parks for more than a decade. & Unilateral Shows No Easy War Against mass Crime Reuters’ Renters’ With an AK-47 assault rifle slug overthis shoulder, Sompong Prajobjan roamed one of Thailand’s lusthonal parks for more than a decade. & Unilateral Shows No Easy War Against mass Crime Reuters’ Renters’ With an AK-47 assault rifle slug overthis shoulder, Sompong Prajobjan roamed one of Thailand’s lusthonal parks for more than a decade. & Unilateral Shows No Easy War Against mass Crime Reuters’ Renters’ With an AK-47 assault rifle slug overthis shoulder, Sompong Prajobjan roamed one of Thailand’s lusthonal parks for more than a decade. & Unilateral Shows No Easy War Against mass Crime Reuters’ Renters’ With an AK-47 assault rifle slug overthis shoulder, Sompong Prajobjan roamed one of Thailand’s lusthonal parks for more than a decade. & Unilateral Shows No Easy War Against mass Crime Reuters’ Renters’ With an AK-47 assault rifle slug overthis shoulder, Sompong Prajobjan roamed one of Thailand’s lusthonal parks for more than a decade. & Unilateral Shows No Easy War Against mass Crime Reuters’ Renters’ With an AK-47 assault rifle slug overthis shoulder, Sompong Prajobjan roamed one of Thailand’s lusthonal parks for more than a decade. & Unilateral Shows No Easy War Against mass Crime Reuters’ Renters’ With An AK-47 assault rifle slug overthis shoulder, Sompong Prajobjan roamed one of Thailand’s lusthonal parks for more than a decade. & Unilateral Shows No Easy War Against mass Crime Reuters’ Renters’ With an AK-47 assault rifle slug overthis shoulder, Sompong Prajobjan roamed one of Thailand’s lusthonal parks for more than a decade. & Unilateral Shows No Easy War Against mass Crime Reuters’ Renters’ With an AK-47 assault rifle slug overthis shoulder, Sompong Prajobjan roamed one of Thailand’s lusthonal parks for more than a decade. & Unilateral Shows No Easy War Against mass Crime Reuters’ Renters’ With an AK-47 assault rifle slug overthis shoulder, Sompong Prajobjan roamed one of Thailand’s lusthonal parks for more than a decade. & Unilateral Shows No Easy War Against mass Crime Reuters’ Renters’ With an AK-47 assault rifle slug overthis shoulder, Sompong Prajobjan roamed one of Thailand’s lusthonal parks for more than a decade. & Unilateral Shows No Easy War Against mass Crime Reuters’ Renters’ With an AK-47 assault rifle slug overthis shoulder, Sompong Prajobjan roamed one of Thailand’s lusthonal parks for more than a decade. & Unilateral Shows No Easy War Against mass Crime Reuters’ Renters’ With an AK-47 assault rifle slug overthis shoulder, Sompong Prajobjan roamed one of Thailand’s lusthonal parks for more than a decade. & Unilateral Shows No Easy War Against mass Crime Reuters’ Renters’ With an AK-47 assault rifle slug overthis shoulder, Sompong Prajobjan roamed one of Thailand’s lusthonal parks for more than a decade. & Unilateral Shows No Easy War Against mass Crime Reuters’ Renters’ With an AK-47 assault rifle slug overthis shoulder, Sompong Prajobjan roamed one of Thailand’s lusthonal parks for more than a decade. & Unilateral Shows No Easy War Against mass Crime Reuters’ Renters’ With an AK-47 assault rifle slug overthis shoulder, Sompong Prajobjan roamed one of Thailand’s lusthonal parks for more than a decade. & Unilateral Shows No Easy War Against mass Crime Reuters’ Renters’ With an AK-47 assault rifle slug overthis shoulder, Sompong Prajobjan roamed one of Thailand’s lusthonal parks for more than a decade. & Unilateral Shows No Easy War Against mass Crime Reuters’ Renters’ With an AK-47 assault rifle slug overthis shoulder, Sompong Prajobjan roamed one of Thailand’s lusthonal parks for more than a decade. & Unilateral Shows No Easy War Against mass Crime Reuters’ Renters’ With an AK-47 assault rifle slug overthis shoulder, Sompong Prajobjan roamed one of Thailand’s lusthonal parks for more than a decade. & Unilateral Shows No Easy War Against mass Crime Reuters’ With an AK-47 assault rifle slug overthis shoulder, Sompong Prajobjan roamed one of Thailand’s lusthonal parks for more than a decade.

 



\begin{table}
\begin{tabular}{l l} \hline \hline
**Original** & \\ \hline Jordan princip loses succession Jordan \#39.s Prince Hamzah says he is conceeding to the wish of King Abdullah II to strip him of his crown as heir to the throne. quot:bye the command of my elder brother out of my loyalty, love & \\ \hline Trust Digital Gets CEO, Cash Influx Trust Digitral Inc., a McLean software company, is getting a new chief executive and V83.1 million in newer investments at tries to expand its business making security software for wireless devices. kit:PONT face-"wendra/MAS Sans Serifari,alhevtica “size”. 2” color=“t066666*dkt.bl.B@gq::The Washington PostkIt/Br/ggtt;dk/rFONT&gt. \\ \hline PeopleSoft sweetness employee compensation Business software maker PeoplesSort Friday said it was boosting composition packages for all employees except its chief executive in a move that would raise the & Pentiy Says Russia Working on New Nuclear Systems (Reuters) Reuters – Russia is working on new nuclear missilesystems that other powers do not have in order to protect legal future security challenges, President Vladimir[Print with Wedensday]. & Pertin Say Russia Working on New Nuclear Systems (Reuters) Reuters – Russia is working on new nuclear missileystems that other powers do not have in order to protect legal future security challenges, President Vladimir[Print with Wedensday]. & GPT-12SM \\ \hline Challenger dispositions with widroethorn The Kerry Packerback Challenger Financial Services Group has reported his first net loss since incorporating, impacted by a massive windowed outgrowth of goodwill. & Pullin Say Russia Working on New Nuclear Systems (Reuters) Reuters – Russia is working on new nuclear misilvestments that other powers do not have in order to protect legal future security challenges, President UniversitatriumPittsson and Wedensday. & GPT-2-Medium \\ \hline Children disapproptions with widroethorn The Kerry Packerback Challenger Financial Services Group has reported his first net loss since incorpotating, impacted by a massive windowed outgrowth of goodwill. & GFT-2-Medium \\ \hline Hewlett-Packard boys Syntax Pialo Alto-based Hewlett-Packard Co. has bought IT services company Synstar plo, of Bracknell, England for about §5293.3 million. System has some 1,500 customers across Europe, selling IT support for various computer platforms. & RueBERTn-Base \\ \hline Alaska \#39.s summer tourism pegged at 1.4 million visitors The number of summer visitors to Alaska rose from the year before, prompting the president of the Alaska Travel Industry Association to say tourism appeared to be back on track since leveling off after the 2001 terrorist attacks. & T5-Large \\ \hline Two top Nokia executives reusing HELSNIK: No kids said the resepeed head of its networks unit had resigned and another top networks official left in the second major departure of tap management in two weeks at the world largest mobile phone market. & T5-Large \\ \hline ATA: Customers Won \#39.g Be Affected By Bankruptcy INDIANAPOLIS — ATA says it will honor all tickets and maintain its full schedule, after filling for Chapter 11 bankruptcy Tuesday. & T5-Base \\ \hline \hline \end{tabular}
\end{table}
Table 27: Examples of AGNews attacked by DeepWordBig.




\begin{table}
\begin{tabular}{l p{142.3pt}} \hline \hline
* The State Department said Monday it is taking seriously allegations that Lactian military forces may have mastered children of the country’s Hmong ethnic minority. & U.Entropy. Aks Laos to learn slaughter study (AP) AP
- The commonwealth Department said Monday it is consider serious alkylengations that Lactian military force-out many haserassed vyk of the country’s Hmong grain minority. & OPT-6.7B & Sci/Tech & World & World \\ \hline EU Move on Cyprus Eases Way for Turkey Deal BRUSELS (Reuters)
- The European Union and Turkey included toward a historic agreement on starting membership talks on Friday as EU leaders softened their demands on the crucial sticking point of Cyprus. & GUT-2-Large & Business & World & World \\ \hline Smithkehcr Air Windes West Indies have been forced to make a second change to their Champions Trophy squad because of injury. Dwayne Smith is suffering from a shoulder problem and has been replaced by Ryan Hinds. & Unauthoraker flow for Windes Occident mite have been thrust to guide z And commute to their fighter prize team because of trauma. Dworne metharkocker is brook from a border peb and has been replaced by Ryan hinds. & OPT-12SM & Sci/Tech & Sports & Sports \\ \hline Hewlett-Packard bays System Palo Alto-based Hewlette-Packard Co. No length IT services company Systar plc, of Bracknell, England far about §293.3 million. Synstar has some 1,500 customers across Europe, selling IT support for various computer platforms. & GPT-2-Medium & Sci/Tech & Business & Business \\ \hline Liu brings China did exploit in weightfitting at Athens Games ATHENS, Aug. 19 (Xinluanet) – Chinese Hercules Liu Chunhong Thursday lifted 3 domain records on her way to winning the womaned #39; s 69kg dual metal at the Athens Olympics, the fourth of the power spot competition for China. & GifpT-1.3B & Business & Sports & Sports \\ \hline Gibbs doubles Skines were tipping plays If the Cleveland Rrows knew what playe the Washington Reddiswas were going so long no bar before the ball was smaped Sunday, a review of the game tape 24 hours later revealed scant evidence of it. & PogT-1.3B & Business & Sports & Sports \\ \hline England's Lawpers Try to Get Photos Thrown Out Van Luyvers for Pfc. Lynndie R. England sought Wednesday to throw out evidence at the heart of the Abu Ghrabi prison sessional – the now-infamous photos showing her milling and pointing at naked Iraq trainees. & T5-Large & Sci/Tech & World & World \\ \hline MLB: NY Timesse J, Minnesota 6 (12 inn.) Hioki Matsui drove In Derek kdertw with a 12th-inning sacrifice fly Wednesday night, giving the New York Yankees a dramatic, 7-6 win over Minnesota. & T5-Base & World & Sports & Sports \\ \hline \end{tabular}
\end{table}
Table 28: Examples of AGNews attacked by PWWS.
 


* [15] P. A. K. Bost et al., "The role of the social influence in social media: a review of social psychology and social science," _Social Psychology_**2008**(4), pp. 379-466.
* [16] R. M. G. H. Sethammer, "A social influence on social interactions," _Social Psychology_**2008**(4), pp. 115-126.

[MISSING_PAGE_POST]

 



\begin{table}
\begin{tabular}{l l} \hline \hline
* President George W. Bush has rewritten US foreign policy during four years at the White House, with the war on terror now taking priority and doubt cast on some traditional alliances: \\ Dependent species risk extinction The global extinction crisis is worse than thought, because thousands of quot;affiliated quot; species also at risk do not figure in calculations. \\ Heineken Proft Disp But Repeats Outlook AINTERBOAT (Returners)
- Dutch hewwer Heinieken posted a 4.5 percent fall in core profit for the first half on Wedensday, at the low end or expectations as a weak dollar and stingball markets that business. \\ MLB, VA Officials Meer Chicago White Sox owner Jerry Reinsdorf led a team of negotiators from Major League Baseball in a three-hour meeting Wedensday with the leaders of the Virginia Baseball Stadium Authority. \\ Check Boise aggps, Authorists US Check Boeing sops, Authorists US check Boeing sops, Authorists eikrbbg. gktr/bbsgt; European arcraft maker Airbus on Tunyday criticised a US move to take a right about subsidies to the World Trade Organisation (WTO), saying it showed its rivals unwillingness to address its own subsidiers. \\ \hline Stocks Open Lower; Inflation Data Weighs NEW YORK (Reuters)
- U.S. stocks opened lower on Unsteady after a government report showing a much larger-than-expected rise in U.S. product prices in October raised inflation concerns. \\ \hline Stocks Open Lower; Inflation Data Weighs NEW YORK (Reuters)
- U.S. stocks opened lower on Unsteady after a government report showing a much larger-than-expected rise in U.S. producer prices in October raised inflation concerns. \\ \hline Dreams of perfect market are fine, as long as they don’t come true in these times of financial wrongdiong and subsequent systemic changes, it’s only natural to wonder what a perfect investment world would look like. \\ \hline Liu brings China 4th gold in weightfitting at Athens Games ATHENS, Aug. 19 (Xinhunhent) – Chinese Hercules Luis Lin Chunburg Thirdly fitted there would records on her way to winning the women xips*65fg gold medal at the Athens Olympics, the fourth of the power spot competition for China. \\ \hline Packers lose Flanagan for the season Green Bay Packers Pora Bowlcenter Mike Plaangian will undergo surgery on his left knee and miss the rest of the season. Couch Mike Sherman made the announcement after practice Friday, meaning for the second & Sleepwise Megrain for the season Environmental-Stail Gold Pickers Prof Guclities Gerado Cometer hope suffer surgeons on his leave tips and falls the rest of the seasons. Business Michael Sherman realised the publicity after reality Hoy, signify for the second \\ \hline \end{tabular}
\end{table}
Table 30: Examples of AGNews attacked by TextFooler.



\begin{table}
\begin{tabular}{p{142.3pt} p{170.9pt} p{185.4pt} p{162.5pt} p{162.5pt} p{162.5pt}} \hline \hline
**Original** & **Perturbed** & **Model** & **Prediction** & **GPT-4** & **Label** \\ _Promise:_ Lifetime Extension of SCR De-NOx Catalysts Using SCR-Tech’s High Efficiency Ultrasonic Regression Process & _Prosuice:_ ongoing Extension of SCR De-NOx Catalyst Using SCR-Tech’s High Efficiency Ultrasonic Regression Process & & & & \\ _Hypothesis:_ There is a 10 year extension of SCR De-NOx catalysts. & _Hypothesis:_ There is a 10 year extension of SCR De-NOx catalysts. & & GFT-2 & Neutral & Neutral & Contradiction \\ _Prentice:_ Verma looked it and smid. & _Proputive:_ Versus lobed it and studtered. _Hypothesis:_ Vreama were a pleased expression when she saw it. & & DeBERTn-v3-Base & Contradiction & Contradiction & Entailment \\ _Prouse:_ There is a good restaurant in the village, in addition to a well-stocked mini-market for self-catering visitors. & & Prosuice: There is a good restaurant in the village, in addition to a well-stocked mini-market for self-catering visitors. & T5-Small & Neutral & Contradiction & Contradiction \\ _Hypothesis:_ Another village has nowhere to dine. & & & & & \\ _Properties:_ Several of the organizations had professional and administrative staffs that provided analytical capabilities facilitates and facilitated their members’ participation in the organization’s activities. & & & & \\ _Hypothesis:_ Organizations didn’t care about members’ participation. & & & & & \\ _Properties:_ The aggregated for the State month of the personal features of the prices, but found it harder to overall the power of land-owners who had extensive contacts with the more conservative elements in his Congress Party. & & & & \\ _Hypothesis:_ We also able to take much of the principal individual frames for the State, but it was once difficult to wrest power from land owners in contrast with the conservative elements of the Congress Party. & & T5-Small & Neutral & Entailment & Enailment \\ _Precince:_ But when he was persuaded by divers means to help us, be gave up after one week, declaring its powers. & & & & \\ _Hypothesis:_ He decided it was too difficult because he was was distributed by other topics. & & & & \\ _Promise:_ Most of the chances are suggestive of ancient courtship trials, with the man being forceful and amgant, the woman shyty fixations. & & & & \\ _Hypothesis:_ Majority of the chances are influenced by hip hop. & & & & \\ _Properties:_ exactly and when ’in sitting here on the sofa cross-stitching all of a sudden assembly can'saw got heart than on any door knok it’s like like tho and no such i° to them do not? It took time that they need these only use only to prevent that or would be just just to pass a city ordinance to prevent that or (hypothesis:) don’t ever sit on my soft and do cross-stitch. & & & \\ _Properties:_ Do not talk. & & & & & \\ _Hypothesis:_ Don’t speak until they all leave. & & & & \\ _Previous:_ The University of Nevada-Las Vegas boasts a student population over 23,000 (though, like most of the people in Las Vegas, they are commutators). & & & & \\ _Hypothesis:_ Most of the students of The University of Nevada are commutators. & & & & \\ \end{tabular}
\end{table}
Table 31: Examples of MNLI attacked by BAE.

 




\begin{table}
\begin{tabular}{p{142.3pt} p{56.9pt} p{87.0pt} c c c c} \hline \multicolumn{1}{c}{**Original**} & \multirow{-2}{*}{**Model**} & \multirow{-2}{*}{**Prediction**} & \multirow{-2}{*}{**GPT-4**} & \multirow{-2}{*}{**Label**} \\ \cline{1-1} _Promise:_ This is an excerpt from the voice-over credo read in the opening cards for the new UNW series Sur & & & & & \\ \hline PPIful Hepless Giant , staring former Secretary of State George Shultz. & & VPN series Star Print Helpless Giant , stating former secretary of State George Shultz. & OPT-13B & Neutral & Neutral & Contradiction \\ _Hypothesis:_ Star Pinfields Heipsi Giant is a show on WGN & & & & & \\ \hline _Prentice:_ The game of billlists is also hot. & & & & & \\ _Hypothesis:_ People hate playing blindness. & & & & & \\ \hline _Prentice:_ Several of the organizations had professional and administrative staffs that provided analytical qualities and facilitate their members’ participation in the organization's activities. & & & & & \\ _hypothesis:_ Organizations didn’t care about members participation. & & & & & \\ \hline _Prentice:_ Tax purists would argue that the value of the homemakers’ hard work-and the informally benefits they presumedly receive in return for i-should, in fact, be treated as income and taxed, just like the ways paid to outside service providers such as baby stress and housekeepers. & & & & \\ \hline _Hypothesis:_ To tax parists, the value of the homembakers’ hard work should not be taxed. & & & & & \\ \hline _Prentice:_ Well, we’ve just got to get down to it, that’s all. & & & & & \\ _Hypothesis:_ We should take a break from this. & & & & & \\ \hline _Prentice:_ exactly and when ‘run sitting here on the sofa cross-titching all of a sandstone somehow a marx’s got father than or under short know it’s like his talk into he and so I don’t do you like that last and j guess them only way to prevent it would be just to pass a city ordinance to prevent Mr Hypothesis: Idon ’ta always sit on any sota and do cross-stitch. & & & & \\ \hline _Prentice:_ Slend muchicked roof sketches are the parents and French angellish, along with wiently sampled oral, crawfish, or turtles hiding in crevices, can be yours for the viewing in these clear waters where visibility of 30 m (100 f) is common. & & & & \\ \hline _Hypothesis:_ Since the red has been bleached and rendered lifestyles by global warming, it’s no longer possible to see sea life in the cloud? & & & & & \\ \hline _Prentice:_ Homes or businesses not located on one of those roads must place a mail receptacle along the route traveled. & & & & & \\ \hline _Hypothesis:_ The other roads are far too rural to provide small service to. & & & & & \\ \hline _Prentice:_ and that you’re very much right but the jury may or may nor say not set that was soy you get a little anticipate you know anxious there and go well you know & & & & \\ \hline _Hypothesis:_ Even if you re correct, It think the jury would pick up that. & & & & & \\ \hline _Prentice:_ The technical how-to fores these three strategies will be summarized later in this paper. & & & & & \\ \hline _Hypothesis:_ There are seven strategies discussed in the paper. & & & & & \\ \hline \end{tabular}
\end{table}
Table 33: Examples of MNLI attacked by PWWS.

 



\begin{table}
\begin{tabular}{l l c c c c}




\begin{table}
\begin{tabular}{l l c c c c c} \hline \hline
**Original** & **Perturbed** & **Model** & **Prediction** & **GPT-4** & **Label** \\ \hline _Promise:_ That is exactly what our head coupon issuer Alan Greenspan did in 1987–and what I believe he would do again. & _Provoise:_ That is exactly what our head coupon issuer Alan Greenspan did in 1987–and what I believe he would do again. & _Provoise:_ This is what Greenspan didn in 1987 and what I think he will do again, much to the detriment of the economy. & GPT-2 & Contradiction & Contradiction & Neutral \\ \hline _Promise:_ GAO recommends that the Secretary of Defense _revive policy_ and guidance & & & review policy and guidance & & & & \\ _Hypoise:_ GAO recommends that the Secretary of Defense _fweep policy_ and guidance & & & & & & \\ _Hypoise:_ But when he was persuaded by divers means to help us, he gave up after one week, declaring it beyond his powers. & & & & & \\ _Hypoise:_ The decided it was too difficult because he was disturbed by other topics. & & & & & \\ _Proteine:_ Today the trait is busy with commercial shipping, ferries, and fishing boats, and its wooded stores are lined with pretty fishing villages, old Ottoman mannions, and the village of Islands’ wealthier citizens. & & & & & \\ _Hypoise:_ Sudays, the straist is empty after a huge sand storm killed everyone there. & & & & & \\ _Proteine:_ Stop something from from the Guest Who or _Hypoise:_ Get something from the Guest Who, & & & & & \\ _Proteine:_ However, co-requesters cannot approve additional re-routers or restrict the timing of the release of the product after it issued. & & & & & \\ _Hypoise:_ They cannot resstrict timing of the release of the product. & & & & & \\ _Proteine:_ Tax purists would argue that the value of the homembaschers’ hard work—and the interfallly benefits they presumably receive in return for i=should, in fact, be treated as income and taxued, just like the buyers paid to outside service providers such baby sisters and houskee



\begin{table}
\begin{tabular}{l l c r} \hline \hline  & **Model** & **Size** & **PT** \\ \hline \multirow{4}{*}{Datasets} & RoBERTa-Base Zhuang et al. (2021) & 124M & MLM \\  & RoBERTa-Large Zhuang et al. (2021) & 355M & \\ \cline{1-1}  & DeBERTa-v3-Base He et al. (2021) & 184M & MLM \\  & DeBERTa-v3-Large He et al. (2021) & 435M & \\ \hline \multirow{6}{*}{Datasets} & OPT-125M Zhang et al. (2022) & 125M & \\  & OPT-350M Zhang et al. (2022) & 331M & \\  & OPT-1.3B Zhang et al. (2022) & 1.3B & LM \\  & OPT-2.7B Zhang et al. (2022) & 2.7B & \\  & OPT-6.7B Zhang et al. (2022) & 6.7B & \\  & OPT-13B Zhang et al. (2022) & 12.8B & \\ \cline{1-1}  & GPT-2 Radford et al. (2019) & 124M & \\  & GPT-2-Medium Radford et al. (2019) & 354M & LM \\  & GPT-2-Large Radford et al. (2019) & 774M & \\  & GPT-2-XL Radford et al. (2019) & 1.6B & \\ \hline \multirow{6}{*}{Datasets} & T5-Small Raffel et al. (2020) & 60M & \\  & T5-Base Raffel et al. (2020) & 222M & \\ \cline{1-1}  & T5-Large Raffel et al. (2020) & 737M & \\ \cline{1-1}  & T5-XL (3B) Raffel et al. (2020) & 2.8B & \\ \cline{1-1}  & T5-XXL (11B) Raffel et al. (2020) & 11.3B & \\ \hline \hline \end{tabular}
\end{table}
Table 36: Citation and source information for the 19 models used for finetuning. The name of each model contains a link to the implementation used.