People Make Better Edits: Measuring the Efficacy of LLM-Generated Counterfactually Augmented Data for Harmful Language Detection
Authors: Indira Sen
Dennis Assenmacher
Mattia Samory
Isabelle Augenstein
Wil Aalst
Claudia Wagner
Venue: EMNLP 2023 Main (2023)
Keywords: hate speech
sexism
counterfactually augmented data
data augmentation
model robustness
TL;DR: Automated counterfactually augmented data aren't as good as manual ones as training data for harmful language detection NLP models because they don't always flip the label of the original instance.

Abstract: NLP models are used in a variety of critical social computing tasks, such as detecting sexist, racist, or otherwise hateful content. Therefore, it is imperative that these models are robust to spurious features. Past work has attempted to tackle such spurious features using training data augmentation, including Counterfactually Augmented Data (CADs). CADs introduce minimal changes to existing training data points and flip their labels; training on them may reduce model dependency on spurious features. However, manually generating CADs can be time-consuming and expensive. Hence in this work, we assess if this task can be automated using generative NLP models. We automatically generate CADs using Polyjuice, ChatGPT, and Flan-T5, and evaluate their usefulness in improving model robustness compared to manually-generated CADs. By testing both model performance on multiple out-of-domain test sets and individual data point efficacy, our results show that while manual CADs are still the most effective, CADs generated by ChatGPT come a close second. One key reason for the lower performance of automated methods is that the changes they introduce are often insufficient to flip the original label.

People Make Better Edits: Measuring the Efficacy of LLM-Generated Counterfactually Augmented Data for Harmful Language Detection
Indira Sen'2, Dennis Assenmacher", Mattia Samory*, Isabelle Augenstein', Wil van der Aalst', and Claudia Wagner
RWTHH Aachen University UUniversity of Konstanz
GESIS Leibniz Institute for Social Sciences "Sapienza University of Rome
University of Copenhagen
indira. - ort.
de, mattia. samoryuunirmyy..............
augenstein@di ku. wwdaalst@paasssssao.oooooooosssa hwg.gpeeeiiaaaaa.....aaaaaaaaaaa www.hddhhwwtaaachhhhaoaoaoa
(dennis. as assemacher, www.dia wagner (eaggneee@gesss... @geses
Abstract
Data type
Example
original
do not like female engincering teachers
NLP models are used in variety of critical so- cial computing tasks, such as detecting sexist, racist, or otherwise hateful content. Therefore, is imperative that these models are robust spurious features. Past work has attempted to tackle such spurious features using training data augmentation, including Counterfactually Augmented Data (CADs). CADs introduce minimal changes to existing training data points and flip their labels; training on them may re- duce model dependency on spurious features. However, manually generating CADs can be time-consuming and expensive. Hence in this work, we assess if this task can be automated using generative NLP models. We automat- ically generate CADs using Polyjuice, Chat- GPT, and F5a and evaluate their useful- ness in improving model robustness compared to manually-generated CADs. By testing both model performance on multiple out-of-domain test sets and individual data point efficacy, results show that while manual CADs are still the most effective, CADs generated by Chat- GPT come close second. One key reason for the lower performance of automated meth- ods is that the changes they introduce are often insufficient to flip the original label.!
manual CAD
do not like female engineering teachers
polyjuice CAD
do not like female managers teachers preference female
do not
ChatGPT CAD
or male engineering teachers.
Flan-T5 CAD
do not like female engineering teachers
Table I: Different types of counterfactuals generated
from sexist original instance. highlighted part indicates what has been changed from the original.
Counterfactual examples have the interesting prop- erty that, since they were generated with minimal changes, they differ from the original instance in one aspect only-typically only the NLP task we want to model (also called the "construct"), is dif- ferent. We can train ML models on the pair of data points consisting of the original and counterfactual examples to make the models focus on the NLP task rather than spurious training artifacts.
Previous work has shown that integrating coun- terfactually augmented data (CADs) into the train- ing data of NLP models can improve their perfor- mance on Out-of-Domait (OOD) datasets for the same construct (Kaushik et al., 2020; Samory et al., 2021; Sen al., 2021). However, previous work fo- cused on manually generated CADs, which can be expensive and time-consuming to create. Automat- ing the CAD generation process can reduce this manual labor while allowing OOD generalizability,
Warning: This paper has instances of hateful and sexist language to serve as examples.
1 Introduction
For given text with an associated label, coun- terfactual example obtained by making minimal changes the text order to flip its label, i.e., converting a hateful tweet into a non-hateful tweet. Table shows an original tweet and its counterfac- tual pairs from different generation mechanisms.
In this work, we compare manual CADs auto- mated CADs generated from Polyjuice (Wu et al., 2021), ChatGPT, and Flan-TS - (Chung et al., 2022) as training data for harmful language detection models, specifically sexism and hate speech de- tection. With recent advances in generative NLP approaches, specifically Large Language Models (LLMss, their dominance in many NLP bench-
'The dataset of automatically generated CADs and their properties, our code, as well as our truined or finetuned models are availahle here: https: : /// thub. com/ Tndf g inttomatedcCar
hhtps///opemai.com/bllahagggg

---

marks (Chung al., 2022) and their use in social computing generative tasks (Josifoski et al., 2023; Veselovsky et al., 2023), we expect these genera- tion techniques to produce high-quality CADs, es- pecially recent variants of Large Language models which can be accessed via prompt-basee interfaces like ChatGPT and Flan-T5,.
Model Type
Model Name
Trained On
100% original data (no CADs)
OG
-counterfactual
original data, manual CADs
mCAD
original data, automated
counterfactual
aCADps
Polyjuice CADs
original data, automated
aCADaPT
ChatGPT CADs
This work aims to shed light on (i) RQI: the extent to which different automated CAD gener- ation methods are capable of generating efficient CADs that boost model performance. We then use the complementary perspective of information- theoretic formulations of dataset difficulty (Etha- yarajh et al., 2022) obtain the 'difficulty' of man- ual and automated CADs, i.e., how hard it is for a model family to learn them or how much useful information they entail for learnability; We then explore (ii) RQ2: the properties of CADs making them effective as training data- - i.e., those that help improve model performance; Using instance- level difficulty scores, we study links between vari- properties of CADs (such as the semantic and lexical distance from the original instance or their label) to surface the properties of effective CADs.
original data, automated
aCADFT
Flan-T5 CADs
original data, manual and automated CADs
amCAD
Table 2: Different types of models trained for each model architecture.
we evaluate our models on a wider range of OOD datasets. All our datasets are in English language.
2.2 CAD Generation Methods
Manual CAD generation. We re-use CADs manu- ally generated in past research (Samory et al., 2021; Vidgen et al., 2021) to compare against automated CADs. All manual CADs are obtained by asking annotators to make 'minimal changes to flip the label' for the corresponding construct, either gener- ated by trained crowdworkers (Samory et al., 2021) or expert annotators (Vidgen et al., 2021). Samory et al. (2021) generate several CADs per original, but to be consistent across both constructs, we ran- domly sample one CAD-original pair for sexism. Automated CAD generation. We generate au- tomated CADs using the following methods: Polyjuice (Wu al., 2021) produces general- purpose CAD, which may or may not flip the label w.r.t. a certain construct. It utilizes fine-tuned GPT-2 (Radford et al., 2019) model to create coun- terfactually augmented data from input sentences by using eight different control codes (c.g., nega- tion, shuffling, lexical) that are provided as condi- tion to the model control the output generation. For each original instance, we generate five coun- terfactuals with all codes. However, not all codes provided a response, potentially because could not be applied to create a coherent counterfactual from the original instance. Indeed, one of the con- trol codes, 'shuffle,' returned null output for all original instances. The other seven had varying coverage, 'lexical' being the most frequent.
We find that models trained on a combination of original and manual CADs outperform models trained on just originals several OOD datasets for both sexism and hate speech detection. While ChatGPT CADs are better training data than other automated CADs, they still fare worse than manual CADs. terms of CAD properties, the generation mechanism plays strong role in the efficacy of CADs - Flan-T5 and Polyjuice CADs have high difficulty, indicating too little usable information is available from them for a model to learn. By discover studying various properties of CADs, that this is likely due to the fact that they make insufficient changes to flip the label and end up creating mislabeled CADs. Our results show that while mixing manual and automated CADs can improve OOD generalizability, we need manual vetting to ascertain the automated CADs' labels instead of using fully automated pipeline.
2 Data and Methods
2.1 Training and Test Datasets
Following past work (Kaushik al., 2020), differentiate in-domain (ID) from out-of-domain (OOD) data. Training and test datasets are summa- rized in Table 3 and 4, respectively. Unlike previ- ous work that was limited to single OOD datasets,
ChatGPT is described InstructGPT (Ouyang et al., 2022), designed respond prompts, by training a GPT-3.5 model through Reinforcement Learning through Human Feedback (Christiano et al., 2017). It has been used
"sibling' model

---

construct
Original
Manual CAD
Polyjuice CAD
ChatGPT CAD
Flan-T5 CAD
sexism
S
nS
$
nS
S
n
$
nS
S
nS
Samory et al.
1244
1610
648
691
1242
1141
hate speech
H
nH
H
nH
H
nH
H
nH
H
nH
Vidgen et al.
6503
5759
5759
6503
3381
3277
5679
6409
5130
6065
Table 3: In-domain datasets and Counterfactually Augmented Data (CADs) used for training models, and the distribution of instances across classes [S = sexist, n$ non-sexist, H = hate, nH = not hate]. For sexism, Samory asked crowdworkers generate non-sexist counterfactuals from sexist original instances but the other way around. Therefore, for fair comparisons, we also only incorporate non-sexist automated CADs for sexism detection for all other counterfactual models.
construct
ID
OOD1
OOD2
00D3
OOD4
HC
Samory et al.
Rodrigucz-Sancher
Guest et
Kirk et al.
Röttger
sexism
nS
S
nS
aS
534
690
1636
1800
5856
4854
15146
373
136
Vidgen al.
Qian al. (R)
Basile et al. nH
Qian et al. (G)
Mandl et al.
Röttger al.
hate speech
H
nH
H
nH
H
nH 17067
H
nH S738
H
nH
471
464
14614
19162
1260
1740
5256
1267
2563
1165
Table 4: Test sets for both constructs [S = sexist, non-sexist, H hate, nH = not hate]. Qian al. contribute two hate speech datasets, one sourced from Reddit and the other from Gab. We count these as separate datasets indicated by (R) and (G), respectively. For sexism, we only have three OOD datasets and HC, hence OOD4 is blank.
in several NLP classification and generation tasks with strong results (Ziems al., 2023; Qin al., 2023). We accessed ChatGPT via the OpenAl API.
sponse from ChatGPT. The LLM hyperparameterss and prompts and the steps taken to detect Guardrail LLM responses are in the Appendix (Section A and H). We assume all CADs have the opposite label of their original counterparts. We believe this to be reasonable since the prompts given to ChatGPT and Flan- T5 explicitly instructed this (as it did to people generating manual CADs), and one of the benefits of automation is reducing manual labor (including having to ascertain CADs' labels).
Flan-T5 (Chung et al., 2022) is a prompt-based LLM similar to ChatGPT, but the underlying model is openly available. Flan-T5 was created by instruc- tion finetuning several model families, including T5 (Raffel et al., 2020). Due computational con- straints, we the medium-sized model in the Flan-T5 family (Flan-T5 large).
2.3 Model Architectures
The CADs generated via these methods for sex- ism and hate speech are summarised in Table 3. While we generate multiple CADs per original for the automated methods, we randomly pick one for each method to pair with the original. We first note uneven numbers of CADs for different CAD generation methods, c-g., 691 Polyjuice CADs non- sexist CADs vs. 1242 ChatGPT non-sexist CADs. This is because not CAD generation techniques have the same coverage - ideally, for 1244 sexist original instances, we would have 1244 non-sexist CADs from all techniques, including manual gener- ation. However, for 553 sexist instances, Polyjuice returned null values; similarly, ChatGPT returned default responses, while Flan-T5 returned the ex- act same text as the original for some original in- stances. Therefore, we only keep those non-null outputs that are at least a single character differ- ent from the original instance and not a default re-
We finetune RoBERTa (Liu et al., 2019) models, Flan-T5 large (treated as to-enncce-----eeccee problem), and SVM models with Fasttext embed- dings (Joulin et al., 2016) on the data sets described in Table 3.
Baselines. We use few-shot labels from Chat- GPT (FSGrt) and Flan-T5 large (FSpt), and the Perspective API's (Lees et al., 2022) toxicity end- point (Pro)) as baselines that we have not trained,
Samory et al. (2021) and Vidgen al. (2021) also manu- ally vet the manual CADs for sexism and hate speech, respec- tively and remove invalid CADs, explaining why the manual approach also does not have 100% coverage.
(2021) state that Polyjuice does flip the label between 40-63% the time, depending on the task, and manual vetting is needed determine the labels. However, simulating regime without manual vetting of the automated CADs gives us a conservative estimate automated CAD.
Wu
'The full prompts used to generate few-shot labels and the preprocessing done on the outputs of all three baselines to obtain binary sexist/hatcfuul vs. pon--sxist/noon-hree labels

---

3 Experimental Setup
use high coverage augmentation strategies which are by extension more diverse.
3.1 Harmful Language Detection Models.
3.3 Dataset Difficulty Analysis.
For each model architecture (e.g., RoBERTa), we have various types of models based on whether they have been trained on CADs not, as well as which type of CAD. Table 2 summarizes the six model types, while Table 3 summarizes the data used for training the different models. In addition the four types of models trained on different CADs, one on the manual CADs and three on the different types of automated CADs, respectively, we include an ad- ditional model trained on a mixture of manual and automated CAD. We do this to simulate a 'wisdom- of ((automtte)-croowd scenario, where we also train CADs selected randomly (called amCAD) from the total corpus of CADs generated by dif- ferent methods, stratified by their availability, e.g.. Polyjuice CADs are fewer compared to the others because they could not be generated for all original instances. All model parameters and hyperparame- ters are included in the Appendix (Section A). Metries. We use macro Fl to assess overall performance.
For RQ2, we need instance-level scores of indi- vidual CADs to investigate which of their char- acteristics make them effective training examples. We use V-Information (Ethayarajh et al.. 2022) and its instance-level counterpart Pointwise V- Information (PVI) to score each dataset instance w.r.t. the training set distribution, including CADs. V-information denotes the ease with which model family can predict the label of inputs and can be measured using the predictive V-Information frame- work (Xu et al., 2020), a generalization of Shan- non information accounting for computational con- straints. PVI extends V-information as Pointwise Mutual Information extends Shannon Information, indicating the learnable information from an in- stance w.r.t. a given distribution. In summary, PVI scores indicate the amount of information that the input (in this case, text) provides to the harmful language detection model about the label (sexism or hate speech), compared to the absence of in- put. The higher the PVI score of an instance, the casier it is to learn, i.c., the more useable informa- tion it has for a model. Low PVI scores, espe- cially negative ones, entail difficult cases with little useable information, often indicating mislabeled instances. Thus, PVI scores can help us gauge the properties of CADs with more usable informa- tion. Therefore, we reuse the amCAD counterfac- tual RoBERTa model (the one containing original data and randomly selected manual and automated CADs) and estimate the PVI scores of the train- ing data. We then use the CADs' PVI scores as the dependent variable in an ordinary least squares (OLS) regression model with the CAD properties (described in Section 4.2) as independent variables. Interpreting the beta coefficients of these variables allows us to estimate the association between these properties and the difficulty of CADs.
3.2 Sampling the Training Data
For hate speech, all counterfactual models are trained on 50% original data and 50% CADs from the respective sources, stratified by label. For sex- ism detection, there are only non-sexist manual CADs (obtained by changing the sexist CADs), and therefore the counterfactual models only in- clude 25% CADs. For a fair comparison, we also inject only the non-sexist automated CADs into the sexism models trained on automated CADs.
Since some CAD generation methods do not pro- vide CADs for all instances (ef. Section 2.2), to make our results consistent and rule out confounds due to differential training data sizes, we ensure that all models are trained on equal amounts of randomly sampled (balanced) data. There- fore, for the training datasets of the various CAD models, we sample original and CAD pairs from all available CADs for that method. To state an example, if ChatGPT cannot augment instance i, but Flan-T5 can then i is included in the training set of aCADrr but not in the training set of aCADGrr.
Results
4.1
RQ1: How does model performance change when trained on automated CAD?
For each type of model described in Table 2, we train models over five runs and test them on the test
While the training sets are then different across aug- mentation strategies, this is done intentionally this is closer to real-world settings where we would
'It is unclear if easy-to-learn instances are useful for out- of-domain generalizability. However, they improve model convergence and contain more information than instances with negative PVI scores, making them more effective.
are included in the Appendix (Section H and G).

---

Overall Performance of RoBERTa Models
Original
ChatGPT GAD la (ACp))) Pobyjuice CAD (aCADr)
Flan T5 CAD (aCADri
CharGPT Few-shot Sorr)
Perspactivn (Ptxx)
manual CAD (mCAD)
mixed CAD (amCAD)
Flan TS Fewsnot: Ser))
Sexism
Hate speech
1.0
0.8
0.6
macro
macro
0.4
0.2
0.0
1D
00D1
OOD2
00D3
HC
OOD
ID
00D1 OOD2
OOD3
OOD4
HC
all OOD
-HC
HC
Jest_set
lest_set
Figure I: The performance of different types of RoBERTa models for detecting sexism and hate speech on different types of test sets, including the macro average on all out-of-domain test sets, called "all OOD+HC" [RQ1]. Note that aCADoPy is finetuned RoBERTa model on the CADs generated by ChatGPT, while FSOPT denotes few-shot classification labels from ChatGPT. Models trained on manual CADs (mCAD) have low in-domain performance compared non-counterfactual models but higher performance out-of-domain for virtually all OOD datasets. The manual CADs are better than the automated ones, but CADs from ChatGPT come close to matching their performance. Manual CADs are most effective for hate speech, while for the sexism models, a mix of manual and different types of automated CADs yields the best OOD performance among the finetuned models. (Statistically significant using McNemar's 's test, see Appendix D) Few-shot labels from ChatGPT (FSerr) perform well, especially for sexism and for the hate check datasets, however, with high variance across different datasets.
sets described in Section 2.1, summarized in Fig- ure 1. For both constructs, the RoBERTa models outperformed the other models - substantially for the SVM models, and to a minor extent for the fine- only include
tion being OOD3 for hate speech, where Perspec- tive is better). However, few-shot labels from Chat- GPT are quite competitive and often outperform the finetuned RoBERTa models, especially for hat- echek however, this high performance could be due data contamination (Chang al., 2023; Aiyappa et al., 2023; Augenstein et al., 2023). In- deed, for sexism, ChatGPT performs poorly com- pared to the finetuned models on OOD3 (Kirk et al., 2023), a recent dataset that followed the launch of ChatGPT, providing more indication that the older datasets may have been a part of CharGPT's train- ing data. Hence, we suggest caution in compar- ing ChatGPT's results against the finetuned mod- els. We also note that the best performing fine- tuned models - amCAD for sexism and mCAD for hate speech outperform the Toxicity API, a model widely used for measuring toxicity when training a custom model is not possible (Ribeiro et al.. 2021;
tuned Flan-T5 models. Therefore, the results of the RoBERTa models in the main pa- per. The results of the finetuned Flan-T5 and SVM models, which showed similar trends but lower overall scores, are in the Appendix (Section C).
For both sexism and hate speech detection RoBERTa models we see that models trained on manual CADs (mCAD), ChatGPT CADs (aCADGeT). or mixture of manual and automated CADS (amCAD) outperform all other finetuned models on the OOD datasets, indicating betier gen- eralization capabilities. Models trained on auto- mated CADs from Polyjuice and Flan-T5 (aCADps and aCAD respectively) have poor OOD perfor- mance, while models trained on ChatGPT CADs (aCADepr) were better in OOD datasets but still not as good models trained on manual CADs, especially for hate speech detection, indicating that manual CADs outperform automated CADs as training data in aiding OOD generalizability.
Papasavva et al., 2020; Rajadesingan et al., 2020). Our results indicate that models trained on CADs suitable alternatives to black-box options such as the Toxicity API. We therefore facilitate access to these models via the Huggingface Hub.?
To summarize overall OOD performance, we compute the average macro Fl of all models, av-
Among the baselines, the pest-performing fine- tuned model is typically better than the Perspective API and Flan-T5 sew-shot labels (the only excep-
"https://huuginngfaa co..ttoCkooco AutoOCAD

---

eraged across all OOD datasets in Figure 1. For hate speech, training on manual CADs improves OOD performance the most, while for sexism, mod- els trained on a mixture of manual and automated CADs lead to the highest results. These patterns are also statistically significant, as ascertained by the McNemar's test (see Appendix D for detailed results).
that there is some variability within the automated CADs - in terms of edit distance, Flan-T5 and Polyjuice have shorter edits (average token-level edit distance of 2.6/2.6 and 1.71/1.67, respectively for sexism/hate speech), while ChatGPT has much more (11.64/14.5). Manual CADs sit somewhere in between (2.42/6.68). We see similar pattern for semantic similarity - Flan-T5 and Polyjuice have higher semantic similarity to the original (0.91/0.86 and 0.9/0.89 respectively, for sexism/hate speech), while ChatGPT CADs are more semantically dis- tant (0.67 for both sexism and hate speech). Manual CADs again sit in between (0.8 (0.81/0.73), indicating that automated CADs make either too many or too few changes compared to manual CADs. Regard- ing types of edits, we do notice similarities between manual and ChatGPT CADs, especially for sexism, where both favor the deletion of gender words in making sexist instances non-sexist. These proper- ties are described in the Appendix (Section E). Information-Theon
4.2
RQ2: What are the properties of individual effective CADs?
While the previous research question investigated the efficacy of CADs based on performance in OOD test sets, we now use a set of properties dis- cussed in past literature and assess how these prop- erties are linked with CADs' learnability.
CAD Properties. Based on past litera- ture (Kaushik et al., 2020; Vidgen et al., 2021), we look into three properties of CADs I) min- imality operationalized as the Levenshtein edit distance from the original instance on a token level, 2) semantic similarity, operationalized by SBERT (Reimers and Gurevych, 2019) cosine sim- ilarity score with the original, and 3) edit types based on the type of edits made; addition or dele- tion of negation, gender/identity word, and affect or emotion words (Sen et al., 2021). For sexism, we only include gender word edits, and for hate speech, we only include identity word edits to match the topical focus of each construct. We use various lexica to assess whether a CAD has a certain type of edit. To adjudicate if a gender and identity word was edited, we use a list of gender words, 8 and iden- tity terms, respectively. 9 For negation, we reuse the list compiled by Ribeiro et al. (2020) for making NLP test suites, and finally for affect words, use lexicon of affect words (Hu and Liu, 2004). Additionally, we also consider the 4) source of CADs (the generation method) and the 5) CAD labels, but only for hate speech, as we only have one-sided CADs for sexism.
Data Valuation. As de- scribed in 3.3, we reuse the amCAD model and obtain PVI score for its training data containing both original data and CADs. However, to assess if PVI scores reflect CADs' abilities to improve OOD performance, we first compare the mean PVT scores of the OOD test sets for models trained on original data vs. models trained on CADs and orig- inal data (i.c., the amCAD model). 10 We find that models trained on a combination of original data and CADs have a higher average PVI score for the OOD datasets models trained on original data have OOD mean PVI score of -0.05 (sexism) and -0.19 (hate speech). In contrast, models trained on a mixture of original data and counterfactuals have a score of 0.1 (sexism) and 0.17 (hate speech). The increase in average PVI scores indicates that incorporating CADs in our training data reduces the dataset difficulty of OOD data and makes it easier to learn compared to setting where only original data points are used, further corroborat- ing the efficacy of CADs in boosting out-of-domain performance. The average PVI scores on the OOD test sets are in the Appendix (Section F, Figure 4). Having established that training on CADs im-
Manual vs. Automated CADs. Our results for RQI, inline with past work, show that training on manual CADs can promote OOD generalizabil- ity, while Sen et al. (2021) demonstrate that certain types of manual CADs are better based on edit type. In this work, we study a wider range of properties for both manual and automated CADs, and find
10 Ethhyaraaj et al. (2022) estimate PYI scores by training a model on subset of the data sampled from the same dis- tribution. In this light, estimating PVI scores for OOD data departs from Ethayarajh et al. (2022)'s assumption. We argue that such scores, even if not directly interpretable as PVI. still convey the informativeness of an example with respect to the model used to estimate PVI and in relation to its training data's 's distribution.
*https //g/tttttttt wwwp//lannp/gg....cccc.... glove/ tree conaster/werdie
"ohtained by combining the keywords used in (Khani and Liang, 2021) and hatebase /https:/ /ate://haateee /hw.eeabeeeee..e org/)

---

hatespeect
Dependent variable:
PVleeism
PVlase spech
edit_ distance
-0,051"
0.012
2.0
cosine_ similarity
-0.074
-0.008*
-2.5-
type_cchatppi
0.018
0.060 "*
orgiiaal
maniial
pesplace
chsipnt
Boots
onginal
mastall
polyicee
shanpet
Bunt
type flant5 type pi gender add
-0,287
-0.102"**
-0,295"**
-0.127
type
typs
-0,248*
gender_dh del
0.139
Figure 2: Distribution of PVI scores for the training set containing original data and CADs. For both tasks, CADs from Polyjuice and Flan-T5 have the lowest PVT scores indicating they are the hardest-to-leand
labeliidentity_ee
0.099
label:identity_de
-0,018
Observations
498
4,606
R²
0.484
0.288
Adjusted K²
0.473
0.286
proves generalizability by making OOD datasets easier to learn, we try to assess which types of CADs are most difficult to learn for these models. To that end, we obtain PVI scores of the training set containing original data and CADs from model trained combination of original data and CADs (the amCAD model)." Figure 2 shows the distri- bution of PV1 scores by type of data, including the type of CAD. Ethayarajh et al. (2022) find the low- est PVI scores to be often indicative of mislabeled instances. Indeed, for manual CADs, the labels were vetted, so they are less likely to be mislabeled, while the same cannot be concluded for the auto- mated CADs. We assess the most difficult CADs (those with the lowest PVI scores), such the Flan- T5 CAD "Men less willing take risks than women" (emphasis on the changed token) obtained from the original instance "Men are more willing to take risks than women" " with a PVI score of -1.91. From this example, it is clear that the change is triv- ial, involving the exchange of comparative words; a change that does not flip the sexist label at all. It is possible that many of these low PVI-scored instances do not change the original labels and are therefore mislabeled instances. This also indicates that automated CADs require a manual check to establish their correct label for them to be used as training data. The top five most difficult (low PVI- scored) CADs and easiest (high PVI-scored) CADs for both constructs can be found in the Appendix Tables 10 and 11 respectively.)
Note:
"p-C0.1; "'p<0005: """p<00.01
Table 5: OLS models predicting the PVI scores of CADs for sexism and hate speech detection with the beta coefficient for the significant dependent vari- ables. The full regression table with all variables and other statistics is included in the Appendix (Table 12)
edit distance, cosine similarity, CAD source, edit type, and the label feature for hate speech, i.e., whether the CAD is hateful or not. 12 For hate speech where we have both hateful and non-hateful CADs, we also include interactions between the CAD label and the identity word addition and dele- tion edit type; we do so since the CAD label could be strongly connected to the presence of identity words - hateful CADs would be more likely to have identity terms. The increased association of identity terms and the hateful class label could drive unintended false positive bias (Sen al., 2022: Dixon et al., 2018; Nozza al., 2019). Since the CAD label and CAD source are categorical fea- tures, we one-hot encode them and use the positive class (hateful instances) and manual CADs as ref- erence variables. Edit types are modeled as binary (1 indicates the presence of the corresponding edit, irrespective of how many such edits were done for an instance). Table summarizes the two OLS model, one for sexism and one for hate speech.
We first note that the adjusted R² values for the sexism and hate speech models explain 47.3% and 28.6% of the variability, respectively. The mod- crate fit indicates that, especially for hate speech, while additional factors might help explain the effi- cacy of the CADs further, these scores can still pro- vide informative insights about the role of different CAD characteristics, i.e., the dependent variables. Interpreting the Regression Results: Sexism. First, the edit type also plays a role in the diffi-
Regression Analysis. To better understand which properties of CADs impact their learnability, we train ordinary least squares (OLS) regression models to predict PVI scores of CADs (the depen- dent variable), one for sexism and one for hate speech, with the following independent variables
11 as described by Ethayarajh et al. (2022), we only train the model for two epochs and use a dev set (splitting the training data 80-20) to avoid overfitting when obtaining the PVI scores.
For sexism, no lahel feature is needed since the CADs in sexism are all non-scxist

---

culty of CADs for sexism detection; gender word delctions are significantly associated with easier- to-learn CAD - possibly, since removing gender terms makes instances unrelated to sexism, making them more trivial to classify. In contrast, gender word additions are associated with harder-to-learn CADs since adding them likely leads to mislabeled instances where CADs still remain sexist. We see such instances in Flan-T5 and Polyjuice where one gender word is substituted for another without meaningfully removing the sexism (examples in the Appendix, Table 10). Indeed, being Flan-T5 or Polyjuice CAD is associated with lower PVI scores (-0.28, px0.01 and -0.29, p 0.01, respectively). Cosine similarity is negatively correlated with ease (-0.074, p < 0.01) CADs are harder if they are semantically closer to the original instances.
to be 0.67 for sexism and 0.76 for hate speech, in- dicating substantial agreement (McHugh. 2012). Disagreements were then resolved based on discus- sions. We find that 57% of automated CADs for sexism and 70% for hate speech are mislabeled, i.c., they do not flip the original instances' label. Most mislabeled instances are from Flan-T5 and Polyjuice, but even ChatGPT does not flip the la- bel 14% of the time for sexism, and 42% for hate speech.
To summarize, while training on CADs, in gen- eral, makes it easier to learn OOD datasets, there is some variance in the learnability of CADs based on their generation mechanism, edit type, and the validity of their labels. We find that certain types of automated CADs are harder to learn due their generation technique (Flan-T5 and Polyjuice), insufficient changes made to flip the label, and se- mantic closeness to the original instance.
Interpreting the Regression Results: Hate speech. For hate speech, we see similar trends sexism for semantically similar, Flan-T5, and Polyjuice CAD, i.e., that they are harder to learn. Notably, ChatGPT CADs are easier to learn than manual CADs (0.058, p < 0.01), suggesting that manual CADs occupy the position Ethayarajh et al. (2022) described as 'ambiguous' instances with middling PVI scores that improve out-of-domain generalizability. This is backed up by Figure 2 well as the best-performing hate speech detec- tion models for the OOD datasets being the models trained on manual CADs (RQ1, Figure 1). For the identity word edits, we see that adding identity terms is mediated by the CAD label - adding an identity word to make a hateful CAD is associated with higher PVI scores 10. p < 0.01), probably since adding an identity term is one of the com- mon tactics to create hateful CADs further re- inforcing the association between hate speech and identity terms and exacerbating unintended false positive bias. Unlike sexism, edit distance is posi- tively correlated with easiness (0.012, p < 0.05) for hate speech CADs.
5 Related Work
Our work sits at the intersection of automated data augmentation and understanding the quality of NLP training data.
Data augmentation has received increased in- terest in the NLP community, specifically since the advent of LLMs (Feng et al., 2021). In this work, we focus on a specific type of augmented data: Counterfactually Augmented Data (CADs, also called Contrast sets by Gardner et al. (2020)). While some recent studies have used ChatGPT for data augmentation (Yoo et al., 2021; Dai al., 2023; Møller al., 2023), to the best of our knowl- edge, there is no prior work on using ChatGPT (or other prompt-based LLMs) to create label- label-flippigg CADs to be used as training data.
Counterfactuals in NLP. Originally, CADs were created manually (Kaushik et al., 2020; Gard- ner et al., 2020; Samory et al., 2021). Recent work has looked into automated or semi-automated gen- eration mechanisms (Ross et al., 2022; Wu et al., 2021; Atanasova et al., 2022, 2023). CAD genera- tion techniques have been used to create challeng- ing test sets (Madaan et al., 2021; Li et al., 2020; Ross et al., 2021; Robeer et al., 2021; Atanasova et al., 2022), for augmenting training data (Anuchi- tanukul et al., 2022; Howard et al., 2022), and for testing the faithfulness of explanations atanasova- (tal-2023-aatthfulnsss While several researchers note the efficacy of CADs in boosting generaliz- ability, other research has also shown that training on them can instead lead to more (Joshi and He,
Human Validation of Automated CAD Labels. To further validate our findings on the (lack of) label label-flipping of automated CADs, we conducted a manual assessment of 100 automated CADs for each CAD generation technique for each construct, i.e., 300 CADs for sexism and 300 for hate speech. Two of the paper's authors manually and indepen- dently labeled the CADs without looking at the original instance. We calculated the initial agree-
ment, measured using cohen's 's K, which came out

---

2022) or others types of spurious correlations (Sen et al., 2022).
trained on CADs, we cannot rule out data con- lamination; ChatGPT few-shot labels have high performance on all datasets predating 2022 but fall drastically for a recent sexism dataset from Kirk et al. (2023)
Assessing Data Quality in NLP. Recent ap- proaches have looked beyond overall model per- formance to gain insights into training data effi- cacy. Swayamdipta et al. (2020); Bras et al. (2020) both introduce methods for observing the training dynamies of individual instances. Influence func- tions (Koh and Liang, 2017) observe local changes while Pezeshkpour et al. (2022) identify artifacts by measuring feature importance and instance at- tribution. Yet other work has extended Shannon information and pointwise mutual information for gauging dataset difficulty or the learnable informa- tion in datasets (Ethayarajh et al., 2022; Xu et al., 2020), especially interpretable instance-level diffi- culty scores, which use in this work find the properties of effective CADs.
Next, using information-theorett measures of dataset difficulty, further unpack issues with automated CADs Flan-T5 and Polyjuice CADs are generated without enough change to flip the label, while for hate speech ChatGPT CADs are too easy-to-learn compared to manual CADs, i.e,, not ambiguous enough to fuel out-of-domain gen- cralizability (RQ2). Our results indicate that CAD generation cannot be fully automated with current LLMs; they require manual checking. Forthermore, find that CADs with identity words associ- ated more strongly with the hateful class, which could worsen unintended false positive bias by mis- classifying non-harmful content. Nevertheless, we see some promise in combining manual and auto- mated CADs indicated by the high performance of the amCAD models, which opens up intriguing possibilities for human-Al collaboration in counter- factual data augmentation; especially with prompt- based interfaces where automated text generation can be controlled tailor CADs by maximizing the desirable properties we found in this work.
6 Discussion and Conclusion
Counterfactually Augmented Data, inspired by the philosophy of causality (Kaushik et al., 2020), of- fers an elegant approach improving te robustness and generalizability of automated classifier. How- ever, they are expensive to generate manually and generating them automatically has many benefits. While past work has used LLMs like GPT-2 for generating CADs (Wu et al., 2021), to the best of our knowledge, there is still a lack of research on the direct comparison of manually generated CADs and automated CADs, especially those gen- erated using instruction-base LLMs like Flan-T5 GPT-3. The specific shortcomings of automated CADs are also understudies, especially for the use cases harmful language detection. In this work, we take the first steps to show what the potentials and pitfalls of automated CADs are, and to surface which of their weaknesses future work needs to pay attention to.
Future work. Building on the findings of our work, we can use human-in-the-loos setups combined with controlled text generation to de- sign more precise automated counterfactuals that closely mimic the properties of manual CADs. Ide- ally, we can find paradigms where LLMs facilitate training data generation with human supervision.
Tangentially, counterfactual augmentation can not only be used to generate training data for train- ing or conventional fine tuning of models they can also be leveraged in instruction tuning, i.e.. finetuning with explicit instructions about par- ticular task as well as labeled examples (Ouyang et al., 2022; Wei et al., 2022; Wang et al., 2023; Mishra et al., 2022). Indeed, by counterfactually and minimally perturbing instructions, and system- atically analyzing the output, we can design ideal instruction tuning datasets, building on frameworks like 'Sstruuntt (Wang et al., 2022).
Using two complementary perspectives - 1) overall performance on multiple out-of-domain datasets and 2) dataset difficulty metrics - we find that models trained on some types of Coun- terfactually Augmented Data (CAD) improve out- of-domain generalizability of both sexism and hate speech detection models. While automated CADs from ChatGPT boost model performance out-of- domain, they are typically not as effective as man- ual CADs (RQ1). We also try several baselines, including few-shot prompting of ChatGPT to la- bel the OOD test sets. While ChatGPT's few-shot labeling performance often surpasses the models
7 Limitations
Our work is not free of limitations, including:
We focus on three approaches for generating CADs. We also tried other recent LLMs for

---

this purpose, however, their quality was ei- ther not as good (BLOOM with fewer param- eters), or the models were too slow (Alpaca, GPT4AII) or required more computational and hardware resources (LLaMa, bigger BLOOM and Flan-T5 models).
creating CADs. However, by surfacing issues with current automated CADs, several future directions open up in using prompt engineering and Human- AI interfaces to improve the quality of CADs and NLP training data.
In general, we also find that effective CADs also tend to emphasize the association between identity terms and the hate/sexist label, which can fuel un- intended false positive bias towards marginalized communities. To that end, we need further audits of these models to unearth the extent of these asso- ciations and their consequences. We also caution against fully automated deployment of these mod- els in content moderation settings.
2. We also did not explore any prompt optimiza- tion techniques (Pryzant et al., 2023) for the LLM-based CAD generation methods. How- ever, these techniques often rely on ground truth data and can be more effectively used for sho-shot labeling, where gold-standard la- bels are available for some of the data being labeled. The same is not true for CAD gener- ation, where there is no well-established label for quality. Indeed, to the best of our knowl- edge, no prompt optimization approaches available for counterfactual generation. In this work, we show how dataset difficulty metrics can be used to find mislabeled CADs, and in the future, we could use these scores as an op- timization objective for prompt improvement. 3. We assume that the out-of-domain datasets used in this work were independent of the in- domain training data and not partially or fully contained in the training data of our finetuned models (RoBERTa) and the models used for few-shot labeling (ChatGPT and Flan-T5), however, this is difficult to guarantee espe- cially for closed-source models like ChatGPT.
To generate synthetic NLP training data, we used LLMs to generate hateful content and found that while models like ChatGPT often gave guardrail responses and did not provide hateful instances for some original instances, in many cases they did for the exact same prompt. This type of stochastic LLM behavior highlights one of the risks of LLMs they can and do generate hateful content. How- ever, we only use such content to improve model robustness by training models on such data and ex- plicitly labeling them as hateful. We do not endorse or encourage the use of LLMs to generate hateful content for any other purpose.
Finally, sexism detection task models gen- der a binary that does not account for sexism towards non-binary people or trans people. Un- fortunately, almost all existing NLP datasets and models for sexism detection use a binary conceptu- alization of gender, which is exclusionary towards nonbinary and trans people. Our sexism detection models do, to some extent, model nuanced forms of sexism that plague gender minorities, including the essentialization of gender and gendered stereotypes. In the future, we hope include conceptualizations of sexism that go beyond the gender binary.
8 Broader Impact Statement
Our work contributes to assessing the validity of automated measurement of hate speech and sex- ism. Hate speech and sexism detection models are of paramount importance to both the NLP and broader (computational) social science research community since they are used for automated or semi-automated content moderation, well for measuring sexism and hate speech on social media platforms for informing research into vulnerable populations and policy-making. As we cannot cre- ate specific training sets for the different contexts where we want to measure sexism and hate speech, we need robust NLP models that can generalize. Our work shows how synthetic data augmentation, using counterfactually augmented data (CADs) can be used to improve this type of generalizability, di- rectly contributing to making models more robust, We also show that despite recent advances in gen- crative NLP, specifically LLMs, these techniques are still not at par with humans when comes to
Acknowledgements
We thank the anonymous reviewers for their constructive and valuable feedback. We are also grateful to the members of the GESIS CSS department and CopeNLU for their helpful com- ments draft of this paper. Isabelle Augenstein's research was co-funded by the European Union (ERC, Explain Yourself, 101077481), well by the Pioneer Centre for AI, DNRF grant number PI. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect

---

those of the European Union or the European Re- search Council. Neither the European Union nor the granting authority can be held responsible for them.
Paul F. Christiano, Jan Leike, Tom B. Brown, Miljan Martic, Shane Legg, and Dario Amodei. 2017. Deep reinforcement learning from human preferences. In Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Pro- cessing Systems 2017, December 4-9, 2017, Long Beach, CA, USA, pages 4299-4307
References
Hyung Won Chung. Le Hou, Shayne Longpre, Bar- ret Zoph. Yi Tay. William Fedus, Eric Li, Xuezhi Wang, Mostafa Dehghani, Siddhartha Brahma, et al. 2022. Scaling iestruction-finetueeedd language models. ArXiv preprint, abs/2210. 10../2210.111 11416.
Rachith Aiyappa, Jisun An, Haewoon Kwak, and Yong- Yeol Ahn. 2023. Can we trust the evaluation on chatgpt? ArXiv preprint, abs/2303.12767.
Atijit Anuchitanukul, Julia Ive, and Lucia Specia. 2022. Revisiting contextual toxicity detection in conversa- tions. ACM Journal of Data and Information Quality,
Haixing Dai, Zhengliang Liu, Wenxiong Liao, Xiaoke
Huang, Yihan Cao, Zihao Wu, Lin Zhao, Shaochen Xu. Wei Liu, Ninghao Liu, Sheng Li, Dajiang Zhu, Hongmin Cai, Lichao Sun, Quanzheng Li, Dinggang Shen, Tianming Liu, and Xiang Li. 2023. Auggpt: Leveraging chatgpt for text data augmentation.
15(1):1-22.
Pepa Atanasova, Oana-Maria Camburu, Christina Li- oma, Thomas Lukasiewicz, Jakob Grue Simonsen, and Isabelle Augenstein. 2023. Faithfulness Tests for Natural Language Explanations. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pages 283-294, Toronto, Canada, Association for Computational Linguistics.
Thomas G Dietterich. 1998. Approximate statistical tests for comparing supervised classification learning algorithms. Neural computation, 10(7): 189551889--922.
Lucas Dixon, John Li, Jeffrey Sorensen, Nithum Thain, and Lucy Vasserman. 2018. Measuring and mitigat- ing unintended bias in text classification. In Proceed- ings of the 2018 AAAI/ACM Conference on A1, Ethics, and Society, pages 67-73.
Pepa Atanasova, Jakob Grue Simonsen, Christina Li- oma, and Isabelle Augenstein. 2022. Fact checking with insufficient evidence. Transactions of the Asso- ciation for Computational Linguistics, 10:746-763.
Kawin Ethayarajh. Yejin Choi, and Swabha Swayamdipta. 2022. Understanding dataset difficulty with v-usable information. In International Conference Machine Learning, pages 5988-6008. PMLR.
Isabelle Augenstein, Timothy Baldwin, Meeyoung Cha, Tanmoy Chakraborty. Giovanni Luca Ciampaglia, David Corney, Renee DiResta. Emilio Ferrara, Scott Hale, Alon Halevy, Eduard Hovy, Heng Ji, Filippo Menezer, Ruben Miguez, Preslav Nakov, Dietram Scheufele, Shivam Sharma, and Giovanni Zagni. 2023. Factuality Challenges in the Era of Large Lan- guage Models.
Steven Y. Feng, Varun Gangal, Jason Wei, Sarath Chan- dar, Soroush Vosoughi, Teruko Mitamura, and Ed- uard Hovy. 2021. A survey of data augmentation approaches for NLP. In Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021, pages 968 988, Online. Association for Computa- tional Linguistics.
Valerio Basile, Cristina Bosco, Elisabetta Fersini, Debora Nozza, Viviana Patti, Francisco Manuel Rangel Pardo, Paolo Rosso, and Manuela Sanguinetti. 2019. SemEval-2019 task 5: Multilingual detection of hate speech against immigrants and women in Twitter. In Proceedings of the 13th International Workshop on Semantic Evaluation, pages 54 63, Min- neapolis, Minnesota, USA. Association for Compu- tational Linguistics.
Matt Gardner, Yoav Artzi, Victoria Basmov, Jonathan Berant, Ben Bogin, Sihao Chen, Pradeep Dasigi, Dheeru Dua, Yanai Elazar, Ananth Gottumukkala, Nitish Gupta, Hannanch Hajishirzi, Gabriel Iharrco, Daniel Khashabi, Kevin Lin, Jiangming Liu, Nel- son F. Liu, Phoebe Mulcaire, Qiang Ning, Sameer Singh, Noah A. Smith, Sanjay Subramanian, Reut Tsarfaty, Eric Wallace, Ally Zhang, and Ben Zhou. 2020. Evaluating models' local decision boundaries via contrast sets. In Findings of the Association for Computational Linguistics: EMNLP 2020, pages 1307-1323, Online. Association for Computational Linguistics.
Ronan Le Bras, Swabha Swayamdipta, Chandra Bha- gavatula, Rowan Zellers, Matthew E. Peters, Ashish Sabharwal, and Yejin Choi. 2020. Adversarial filters of dataset biases. In Proceedings of the 37th Inter- national Conference on Machine Learning. ICML 2020, 13-18 July 2020, Virtual Event, volume 119 of Proceedings of Machine Learning Research, pages 1078-1088, PMLR.
Ella Guest, Bertie Vidgen. Alexandros Mittos, Nishanth Sastry, Gareth Tyson, and Helen Margetts. 2021. An expert annotated dataset for the detection of online misogyny. In Proceedings of the 16th Conference of the European Chapter of the Association for Compu- tational Linguistics: Main Volume, pages 1336-1350. Online. Association for Computational Linguistics.
Kent K Chang, Mackenzie Cramer, Sandeep Soni, and David Bamman. 2023. Speak, memory: An archacol- ogy of books known to chatgpt/gpt-44. ArXiv preprint, abs/2305.001 18.

---

Phillip Howard, Gadi Singer, Vasudev Lal, Yejin Choi, and Swabha Swayamdipta. 2022. NeuroCounterfac- tuals: Beyond minimal-edit counterfactuals for richer data augmentation. In Findings of the Association for Computational Linguistics: EMNLP 2022, pages 5056-5072, Abu Dhabi, United Arab Emirates. As- sociation for Computational Linguistics.
the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 3197-3207.
Chuanrong Li, Lin Shengshuo, Zeyu Liu, Xinyi Wu, Xuhui Zhou, and Shane Steinert-Threlkele 2020. Linguistically-ine -nnflmeedffo transformations (LIT): A method for automatically generating contrast sets. In Proceedings of the Third BlackboxNLP Workshop on Analyzing and Interpreting Neural Networks for NLP, pages 126-135, Online. Association for Com- putational Linguistics.
Minqing Hu and Bing Liu. 2004. Mining and summa- rizing customer reviews. In Proceedings of the tenth ACM SIGKDD international conference Knowl- edge discovery and data mining, pages 168-177.
Yinhan Liu, Myle Out Naman Goyal, Jingfei Du, Man- dar Joshi, Danqi Chen, Omer Levy. Mike Lewis. Luke Zettlemoyer, and Veselin Stoyanov. 2019. Roberta: A robustly optimized bert pretraining ap- proach. ArXiv preprint, abs/1907.11692.
Shagun Jhaver, Christian Boylston, Diyi Yang, and Amy Bruckman. 2021. Evaluating the effectiveness of deplatforming as moderation strategy on twitter. Proceedings of the ACM on Human-Compuler Inter- action, 5(CSCW2):1-30.
Nishtha Madaan, Inkit Padhi, Naveen Panwar, and Dip- tikalyan Saha. 2021. Generate your counterfactuals: Towards controlled counterfactual generation for text, Proceedings of the AAAI Conference on Artificial Intelligence, 35(15): 13524.
Nitish Joshi and He He. 2022. An investigation of the (in)effcctiveness of counterfactually augmented data. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume I: Long Papers), pages (668-368) Dublin, Ireland. Association for Computational Linguistics.
Thomas Mandl, Sandip Modha, Anand Kumar M, and Bharathi Raja Chakravarthi. 2020. Overview of the hasoe track at fire 2020: Hate speech and offensive language identification in tamil, malayalam, hindi, english and german. In Forum for information trieval evaluation, pages 29-32.
Martin Josifoski, Marija Sakota, Maxime Peyrard, and Robert West. 2023. Exploiting asymmetry for syn- thetic training data generation: Synthie and the case of information extraction. ArXiv preprint, abs/2303.04132.
Mary I. McHugh. 2012. Interrater reliability: the kappa statistic. Biochemia medica, 22(3):77-2222.
Armand Joulin, Edouard Grave, Piotr Bojanowski, Matthijs Douze, Hérve Jégou, and Tomas Mikolov. 2016. Fasttext. zip: Compressing text classification models. ArXiv preprint, abs/1612.00651.
Swaroop Mishra, Daniel Khashabi, Chitta Baral, and Hannaneh Hajishirzi. 2022. Cross-task generaliza- tion via natural language crowdsourcing instructions. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 3470-3487, Dublin, Ireland. Association for Computational Linguisties.
Divyansh Kaushik, Eduard H. Hovy, and Zachary Chase Lipton. 2020. Learning the difference that makes A difference with counterfactually augmentedd data. In 8th International Conference on Learning Represen- tations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.net.
Anders Giovanni Møller, Jacob Aarup Dalsgaard, Ari- anna Pera, and Luca Maria Aiello. 2023. Is a prompt and few samples all you need? using gpt-4 for data au augmentation in low-resource classification tasks. ArXiv preprint, abs/2304.
Fereshte Khani and Percy Liang. 2021. Removing spu- rious features can hurt accuracy and affect groups disproportionately. In Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Truns- parency, pages 205-
Debora Nozza, Claudia Volpetti, and Elisabetta Fersini. 2019. Unintended bias in misogyny detection. IEEE/WIC/ACM International Conference on Web Intelligence, WI '1,, page 149-155, New York, NY, USA. Association for Computing Machinery.
Hannah Kirk, Wenjie Yin. Bertie Vidgen, and Paul Röttger. 2023. SemEval-2023 task 10: Explainable detection of online sexism. pages 2193-2210.
Pang Wei Koh and Percy Liang. 2017. Understand- ing black- box predictions via influence functions. In Proceedings of the 34th International Conference on Machine Learning, ICML 2017, Sydney, NSW, Aus- tralia, 6-11 August 2017, volume 70 of Proceedings of Machine Learning Research, pages 1885-1894. PMIRR
Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. 2022. Training language models to follow instruc- tions with human feedback. Advances in Neural Information Processing Systems, 15:27730-27744
Alyssa Lees, Vinh Tran, Yi Tay, Jeffrey Sorensen, Jai Gupta, Donald Metzler, and Lucy Vasserman. 2022. new generation of perspective api: Efficient multi- lingual character-level transformers. In Proceedings
Antonis Papasavva, Savvas Zannettou, Emiliano De Cristofaro, Gianluca Stringhini, and Jeremy Blackburn. 2020. Raiders of the lost kek: 3.5 years of augmented 4chan posts from the politically incorrect

---

board. In Proceedings of the international AAAI con- ference on web and social media, volume 14, pages 885-894.
Marco Tulio Ribeiro, Tongshuang Wu, Carlos Guestrin. and Sameer Singh. 2020. Beyond accuracy: Be- havioral testing of NI.P models with CheckL.st In Proceedings of the 58th Annual Meeting of the Asso- ciation for Computational Linguistics, pages 4902- 4912, Online. Association for Computational Lin- guistics.
Judea Pearl. 2014. Interpretation and identification of causal mediation. Psychological methods, 19(4):459.
Pouya Pezeshkpour, Sarthak Jain, Sameer Singh, and Byron Wallace. 2022. Combining feature and in- stance attribution to detect artifacts. In Findings of the Association for Computational Linguistics: ACI. 2022, pages 9934-1946, Dublin, Ireland. Association for Computational Linguistics.
Marcel Robeer, Floris Bex, and Ad Feelders. 2021. Gen- erating realistic natural language counterfactuals. In Findings of the Association for Computational Lin- guistics; EMNLP 2021, pages 3611-3625, Punta Cana, Dominican Republic. Association for Compu- tational Linguistics.
Reid Pryzant, Dan Iter, Jerry Li. Yin Tat Lee. Chen- guang Zhu, and Michael Zeng. 2023. Automatic prompt optimization with" gradient descent" and beam search. ArXiv preprint, abs/2305.034 .03495
Francisco Rodriguez Sanchezz Jorge Carrillo de Al- bornoz, Laura Plaza, Julio Gonzalo, Paolo Rosso. Miriam Comet, and Trinidad Donoso. 2021. Overview of exist 2021: sexism identification in so- cial networks. Procesamiento del Lenguaje Natural, 67(0).
Jing Qian, Anna Bethke, Yinyin Liu, Elizabeth Belding, and William Yang Wang. 2019. A benchmark dataset for learning to intervene in online hate speech. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference Natural Lan- guage Processing DEMNLP-IJCNLLD pages 4755- 4764, Hong Kong, China. Association for Computa- tional Linguisties.
Alexis Ross, Ana Marasović, and Matthew Peters. 2021. Explaining NI.P models via minimal contrastive edit- ing (MiCE). In Findings of the Association for Com- putational Linguistics: ACL-IJCNLP 2021, pages 3340-3852, Online. Association for Computational Linguistics.
Chengwei Qin, Aston Zhang, Zhuosheng Zhang, Jiaao Chen, Michihiro Yasunaga, and Diyi Yang. 2023. Is chatgpt a general-purpose natural language process- ing task solver? ArXiv preprint, abs/2302.06476
Alexis Ross, Tongshuang Wu, Hao Peng, Matthew Pe- ters, and Matt Gardner. 2022. Tailor: Generating and perturbing text with semantic controls. In Proceed- ings of the 60th Annual Meeting of the Association for Computational Linguistics VVolume 1: Long Pa- pers), pages 31 3194-3213, Dublin, Ireland. Association for Computational Linguistics.
Alec Radford. Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. 2019. Language models are unsupervised multitask learners.
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. 2020. Exploring the limits of transfer learning with a unified text-to-text trans- former. J. Mach. Learn. Res., 21:140:1-140:67
Paul Röttger, Bertie Vidgen, Dong Nguyen, Zeerak Waseem, Helen Margetts, and Janet Pierrehumbert. 2021. HateCheck: Functional tests for hate speech detection models. In Proceedings of the 59th An- nual Meeting of the Association for Computational Linguistics and the 11th International Joint Confer- ence on Natural Language Processing (Volume 1: Long Popers), pages 41-58, Online, Association for Computational Linguistics
Ashwin Rajadesingan, Paul Resnick, and Ceren Budak. 2020. Quick, community speciffcc learning: How distinctive toxicity norms are maintained in political subreddits. In Proceedings of the International AAAI Conference on Web and Social Media, volume 14, pages 557-568.
Giuseppe Russo, Luca Verginer, Manoel Horta Ribeiro, and Giona Casiraghi. 2023. Spillover of antisocial behavior from fringe platforms: The unintended con- sequences of community banning. In Proceedings of the International AAAI Conference on Web and Social Media, volume 17, pages 742-753.
Nils Reimers and Iryna Gurevych. 2019. Sentence- BERT: Sentence embeddings using Siamese BERT- networks. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natu- ral Language Processing JEMNLP-IJCNLL pages 3982-3991 3992, Hong Kong, China. Association for Com- putational Linguistics.
Mattia Samory, Indira Sen. Julian Kohne, Fabian Floeck. and Claudia Wagner. 2021. "call me sexist, but..." Revisiting sexism detection using psychological scales and adversarial samples. Proceedings of the International AAAI Conference on Web and Social Media, 15(1)5773-584
Manoel Horta Ribeiro, Jeremy Blackburn, Barry Brad- lyn. Emiliano De Cristofaro, Gianluca Stringhini, Summer Long, Stephanie Greenberg, and Savvas 7annettou. 2021. The evolution of the manosphere across the web. In Proceedings of the International AAAI Conference on Web and Social Media, vol- ume 15, pages 196-207.
Indira Sen, Matta Samory, Fabian Flöck, Claudia Wag- ner, and Isabelle Augenstein. 2021. How does coun- terfactually augmented data impact models for social computing constructs? In Proceedings of the 2021

---

Kang Min Yoo, Dongju Park,Jaewook) Jaewook Kang, Sang-Wou Woo Conference on Empirical Methods Natural Lan- guage Processing, pages 325-344, Online and Punta Cana, Dominican Republic. Association for Compu- tational Linguistics.
models. In Proceedings of the 59th Annual Meet- ing of the Association for Computational Linguistics and the 1 Ithh International Joint Conference Natu- ral Language Processing (Volume I: Long Papers), pages 6707-6723, Online. Association for Computa- tional Linguisties.
Indira Sen, Mattia Samory, Claudia Wagner, and Is- abelle Augenstein. 2022. Counterfactually aug- mented data and unintended bias: The case of sex- ism and hate speech detection.
Yilun Xu, Shengjia Zhao, Jiaming Song, Russell Stew- art, and Stefano Ermon. 2020. theory of usable information under computational constraints. In 8th International Conference Learning Representa- rions, ICLR 2020, Addis Ababa, Ethiopia, April 26- 30, 2020. OpenReview.net.
Proceedings of the 2022 Conference of the North American Chap- ter of the Association for Computational Linguistics: Human Language Technologies, pages 4716-4726, Seattle, United States, Association for Computational Linguistics.
Swabha Swayamdipta. Roy Schwartz, Nicholas Lourie, Yizhong Wang, Hannaneh Hajishirzi, Noah A. Smith, and Yejin Choi. 2020. Dataset cartography: Mapping and diagnosing datasets with training dynamics. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 9275 9293, Online, Association for Computa- tional Linguistics.
Lee, and Woomyoung Park. 2021. GPT3Mix: Lever- aging large-scale language models for text augmen- tation. In Findings of the Asxociation for Computa- tional Linguistics: EMNLP 2021, pages Punta Cana, Dominican Republic. Association for Computational Linguisties.
Caleb Ziems, William Held, Omar Shaikh, Jiaao Chen, Zhehao Zhang, and Diyi Yang. 2023. Can large lan- guage models transform computational social sci- ence? ArXiv preprint, abs/2305.03514.
Veniamin Veselovsky, Manoel Horta Ribeiro, Akhil Arora, Martin Josifoski, Ashton Anderson, and Robert West. 2023. Generating faithful synthetic data with large language models: A case study in computational social science. ArXiv preprint, abs/2305. 15041.
Bertie Vidgen, Tristan Thrush, Zeerak Waseem, and Douwe Kiela. 2021. Learning from the worst: Dy- namically generated datasets to improve online hate detection. In Proceedings of the 59th Annual Meet- ing of the Association for Computational Linguistics and the 1 11th International Joint Conference on Natu- ral Language Processing (Volume I: Long Papers), pages 1667-1682, Online. Association for Computa- tional Linguistics.
Yizhong Wang. Hamish Ivison, Pradeep Dasigi, Jack Hessel, Tushar Khot, Khyathi Raghavi Chandu, David Wadden, Kelsey MacMillan, Noah A Smith, Iz Beltagy, al. 2023. How far can camels go? exploring the state of instruction tuning open re- sources. ArXiv preprini. abs/2306.04751.
Yizhong Wang, Yeganeh Kordi, Swaroop Mishra, Al- isa Liu, Noah A Smith, Daniel Khashabi, and Han- nanch Hajishirzi. 2022. Self-instruct: Aligning lan- guage model with self generated instructions. ArXiv preprint, (tss2212.10560)
Jason Wei, Maarten Bosma, Vincent Y. Zhao, Kelvin Guu, Adams Wei Yu, Brian Lester, Nan Du, An- drew M. Dai, and Quoe V. Le. 2022. Finetuned language models are zero-shot learners. In The Tenth International Conference Learning Representa- tions, ICLR 2022, Virtual Event, April 25-29, 2022. OpenReview.net.
Tongshuang Wu, Marco Tulio Ribeiro, Jeffrey Heer, and Daniel Weld. 2021. Polyjuice: Generating counter- factuals for explaining, evaluating, and improving

---

Supplementary Materials
A.3 Hyperparameter Optimization and Training Time
A Reproducibility
Model Training. We use the huggingface Trans- formers and simpletransformers" libraries for model training. Note that we train or finetune different models (Table 2) over 5 runs, cach for different model architectures (RoBERTa and Linear SVM) for the two constructs (sexism and hate speech). Taken together, we have 120 mod- cls, which are then tested different test sets 31,724 test instances for sexism and 70,767 in- stances for hate speech. We then report the mean macro Fl on them with the standard deviations across runs in Figures I and 5, Given the many models we train and computational constraints, we could not do a full hyperparameter search for the RoBERTa models. Instead, we use early stopping to optimize the number of epochs using dev set (by splitting the training data 80-20). Specifically, start with 15 epochs with an early stopping patience of 5 and an early stopping delta of 0.01.
To ensure the reproducibility of our experiments, we are committed to sharing all of our training scripts and CAD datasets with the reviewers during the evaluation process and making them publicly available on GitHub upon publication. However, while we share all data with the reviewers, for the public repository, we cannot share the original data from past work (Samory et al., 2021; Vidgen et al., 2021) directly (referred to as OG) within our repos- itory due to licensing restrictions. Instead, we will provide appropriate references to the OG data, al- lowing interested parties to access it through the designated sources. The same is applicable some of the out-of-domain test sets in Table 4.
A.1 Compute Infrastructure
For the SVM models, which are computationally less intensive, we used five-fold cross-validation and grid-search for hyperparameter tuning. We executed the grid search with range of (0.01, 100) with increments of 10, corresponding to 10 searches and with accuracy as the optimization met- ric. The hyperparameters we used for the models are as follows:
All models were trained or finetuned on ma- chine with an AMD EPYC 7543 CPU and 20GB NVIDIA A MiG partition for the finetuning experiments and Flan-T5 CAD generation, and 40 GB for Flan-T5 few-shot labeling.
A.2 Model Parameters
RoBERTa: learning rate (1c-6), batch size (32), maximum sequence length (512)
The number of parameters of all models used in this work summarized in Table 6. The mod- els include the sexism and hate speech models (SVM and RoBERTa), the CAD generation meth- ods (Polyjuice, ChatGPT, Flan-T5), and the OLS regression models for predicting the PVI scores (Section 4.2).
2. Flan-T5: learning rate (5e-4), batch size (64), dropout (0.05), steps (64k)
3. Linear SVM: C (0.01)
CAD Generation and Few-shot Labeling, We use the default hyperparameters from ChatGPT, i.e.. do not specify any temperature or beam-search. For the other CAD generation and Few-shot labeling approaches, the hyperparameters are included in Table 7.
Model architecture
Number of parameters
Linear SVM
300 (Fasttext dimensions) 12-layer, 768-hidden, 12-hcads, 125 Million 1.5 Billion (i.c., the same parameters as the GPT-2 model)
RoBERTa (base)
Polyjuice
A.4 Metrics
Flan-T5
0.8 Billion
ChatGPT (chutgpt 3.5 turbo)
175 Billion
The evaluation metries used in this paper are maero average Fl and False Positive Rate for RQ1. We
sexism OLS hate speech OLS
11
14
/httpss//anginggaace.co transfoxners/inder
Table 6:
The number of parameters for different models used in this work.
thttps::/githubb. com/Th i naaa japakse/ si simpletransforreers

---

Overall Performance of FlanT5 Models
Ot ginal (OG)
DiwidPT GAD (aCAD
Flmn CAD (aCADr1)
ChaiGPT Fon-ahol (FSar) Fiweehal (FSys)
Perspection (Pru))
merui CAD (mCAD)
Polyjiion CAD (aCADy)
mixed (amCAD)
Sexism
Hate speech
0.8
macro f1
0.6
macro F1
0.4
0.2
0.0
00D1
OOD2
OOD3
HC
0OD
ID
O0D1 OOD2
OODS
OOD4
HC
OOD
HC
HC
lest_set set
test_set
Figure 3: The performance of different types of Flan-T5 models for detecting sexism and hate speech measured using macro F1. For both sexism and hate speech, models trained on CADs outperform models trained on just original data. For sexism, manual, chatGPT, and mixture of CADs perform best, while manual CADs are the best for hate speech.
Hyperparameters
sexismmmde - DG (dvg PVI 0.05)
hatespeech mode OG Mug PV 8.19)
Polyjuice
Perplexity: 10
Numbar of Exampls
ChatGPT
default hyperparameters of chatgpt 3.5 turbo
temperature: I.5. num_ beams: 10, max length (only set CAD generation and not fow-shot laheling) 500
Flan-T5
mode
hatespeech
IM 0.10)
(Avg PV 0.1
Mumber of Examppes
conect
Table 7: The hyperparameters for CAD generation (all three) and few-shot labeling (only applicable to ChatGPT and Flan-T5).
-7.
-2.
Figure 4: Distribution of OOD test sets' PVI scores for models trained datasets with and without CADs. For both sexism and hate speech, models trained on original data and CADs have higher average PVI scores (V-information) on OOD test compared models trained on just original data, implying that train- ing on CADs makes the OOD dataset easier learn
used the sklearn implementation of these metrics. 15 For RQ2, we use V-Information. 16
construct
test_see set
chatgpt
flant5
HC
0.058
0.104
ID
0.13
0.041
B Datasets
OODI
0.518
0.199
hatespeech
0OD2
0.073
0.154
In-Domain Datasets. For the in-domain datasets Vidgen et al. (2021), reuse the train- test splits specified, except that the CADs are For sexism, since no ex-
00D3
0.342
0.092
00D4
0.067
0.047
HC
0.005
0.227
0.028
0.025
not part of any plicit train-test split is specified, we opt for 70-30 train-test split.
sexism
OOD1
0.032
0.038
O0D2
0.112
0.038
0OD3
0.053
0.073
Out-of-Domain Datasets. For the out-of- domain datasets and hate check, after downloading the data from the given source (included in the zipped data folder), use the full data for testing. Hatecheck (Röttger al., 2021) test suite of challenging instances for hate speech and abusive language detection. For hate speech, we use all instances, while for sexism we only include the instances targeting women (there are no instances
Table 8: The proportion of LLM output that didn't 't con-
form to our requirements for the few-shot labeling.
"nttpss//seiktt-eeaam. htt.://eaaa...///ttttattaea..e.. padullee/ppneeatte/kKKLeerree precisiou_reall_ffooo.ooo html "https://g" http://coo/aaww////taaaaaaa difficulty

---

that target other men or nonbinary people),
Construct
Run
McNemar
Pvalue
Model 1
Model 2
55.19
1.10E-1
QG
mCAD
C Flan-T5 and SVM Results
0
359.57
3.49E-80
mCAD
arr
0
126. 16
2.84-229
amCAD
#CADort
We train counterfactual and non-counterfactual Flan-T5 and SVM models, in addition to the RoBERTa ones mentioned in the main paper. For the SVM models, the instances are encoded us- ing Fasttext embedding, specifically the 300 di-
953 82
1996--209
0G
mCAD
I
122 25
2.03E 28
mCAD
aCADorr
2.47E-23
amCAD
#CAD
13766:57
2.596-301
0G
mCAD
sexism
842.23 2
3.56E 185
mCAD
#CADGrT
1.69
0.19
anCAD
#CADarr
4279.55 53
0
0G
mCAD
1311.52
3,54E-287
mCAD
aCADaFT
3 116.28
4, 4,126-27
anCAD
aCADort
mensional word vectors, with character n n-grams of length 5, a window of size and 10 negatives, trained using CBOW."? 17 We train these models us- ing gridsearch and 5-fold cross- validation over five runs, with search space C E (0.01,100), with incre- ments of 10, and test them on the test sets reported in Table 4. We measure macro F'l (Figure and Figure 5).
1592.
0G
MCAD
3454.45
0
mCAD
aCADorr
171.62
3.28E-39
unCAD
cCADor
0
954.18
1.4E 209
OG
mCAD
11317.38 0
mCAD
aCADorr
0
305.66
1990-668
amCAD
sCADoPT
2791.
OG
mCAD
8512.32
0
mCAD
aCADorr
2207
amCAD
#CADarr
345. 41
4,22F-77
OG
mCAD
hute spooch
2
13411.89
0
mCAD
#CADorr
712.45
5.87E-157
anCAD
#CADurt
Compared to the RoBERTa models in 1, the fine tuned Flan-T5 models demonstrate better perfor- mance of CAD models trained on Flan T5 and Polyjuice CADs. However, the main tendencies seen in RoBERTa still hold, i.e, manual CADs are the best for hate speech, while mix of manual and automated CADs is the best for sexism. There- fore, the results in our paper are not attributed to a particular model architecture. The unique abil- ity of Flan-T5 in exploiting Polyjuice and Flan- T5 CADs, compared to RoBERTa, points to potential advantages in Flan- T5's model architecture which can be studied further in future work.
4623 3M
0
0G
mCAD
3278.36
mCAD
aCADaPT
3
1573 69
0
unCAD
aCADorr
$59.08
1.338-123
0G
mCAD
17744.84
0
mCAD
aCADarr
4
1944.13
0
amCAD
sCADore
Table 9: Significance tests between 1) OG and mCAD models, 2) mCAD and aCADorr, and 3) amCAD and aCADGPT models using McNemar's significance test (RoBERTa models). All comparisons are statistically significant except for one run of sexism, which is col- ored red.
the causal variable of interest is changed (Pearl, 2014). We assess lexical minimality in this case, i.e., the number of tokens and characters changed in generating CAD from its original counterpart. Edit distance is one proxy for minimality, and we compute the word-level edit distance between individual original instances and their CADs from different sources (manual, polyjuice, chatgpt, and Flan-T5) using Levenshtein distanfce from the string2string library. 18
D Significance Tests for RQ1
Given that we compare so many models, we did not report significance tests for all comparisons, however, for the main takeaways (1. mCAD is bet- ter than OG for both sexism and hate speech, 2. mCAD is better than aCADGPT for hate speech, 3. amCAD is better than aCADGPT for sexism) using the McNemar test (Dietterich, 1998) our findings are significant, except in one single run for sex- ism. We report these results in Table 9. Due to space constraints, we only report the results on the combined OOD datasets, but the results were also significant for the individual OOD datasets.
We plot the distribution of the edit distances in Figure 7 and find that ChatGPT CADs tend to make the most changes while Polyjuice makes the least. Flan-T5 15 exhibits similar patterns as Polyjuice, while manual CADs are not as minimal as them, but more so than ChatGPT CADs.
Semantic similarity. Instructions for generat- ing not only encourage minimality but also suggest adhering to the same topic and content of the orig- inal message to the extent possible. While such a property is somewhat difficult to quantify, we use semantic textual similarity computed with sentence embedding distances as proxy for topical and con-
E Manual vs. Automated CADs: Descriptive Summary
Minimality. Past instructions for generating CADs have emphasized minimality, and for good rea- counterfactuals in the tradition of causal inference also seek "small" changes where only
I Pattps://rasttext wtt.teee.....cceeeeeeeeeeett cc/cocs/en/ crawl-vectors.hrr html
18 "tttps: www.hh...m/ttttttt..tt/oo st string2string

---

Overall Performance of Linear SVM Models
Orgin ginal (OG)
DiwidPT GAD (aCAD
Flmn CAD (aCADy1)
ChaiGPT Few-shol (FSar) Faweeha (FSys)
Perspection (Pru))
merui CAD (mCAD)
Polyjiion CAD (aCADy))
mixed (amCAD)
Sexism
Hate speech
0.8
macro f1
0.6
macro f1
0.4
0.2
0.0
00D1
OOD2
OOD3
HC
OOD
ID
O0D1 OOD2
OODS
OOD4
HC
OOD
HC
HC
lest_set set
test_set
Figure 5: The performance of different types of SVM models for detecting sexism and hate speech measured using macro F1. For both sexism and hate speech, models trained on CADs outperform models trained on just original data. For sexism, manual, chatGPT, and mixture of CADs perform best, while manual CADs are the best for hate speech.
tent similarity (Reimers and Gurevych, 2019). We embed all original training data and the CADs with SBERT and find the cosine similarity between all pairs as a notion of semantic similarity (Figure 8). Polyjuice and Flan-T5 CAD tend to be very seman- tically similar to the original instances, while the opposite is true for ChatGPT CAD. Manual CADs lie somewhere in between.
Hatespeach CADs
0.20
outtaan delctions
0.15
06-
0.10
8.00
menual
ChatGPT T5
manual Ponjuce ChatGPT Fan
icentity
0.15
Prpertiin
0.10
5.10
Content differences. Finally, based on the tax- onomy of CADs introduced by Sen al. (2021),
5.06
meniol Posjulo CharGPT Fan 15
nanial Posjuct CharGer Fon
we look the types of changes made in generating CADs based on edits of negation, identity words, and affect words. Studying this in detail also helps us traces the origins of unintended bias (RQ1.2). To characterize the types of changes made by the different CAD-generating mechanisms, we assess edits by adding or removing: negations, affect or emotion words, gender words, and identity words. We compute the tokens changed when generating the CADs ('diff's') and use lexica of the four afore- mentioned categories see which type of change is made. Figures and 9, we see the distri- bution of different types of edits across different types of CADs for hate speech and sexism, respec- tively. Polyjuice makes few changes in all four categories, especially with few negation-related edits. ChaiGPT CADs and manual CADs (for sex- ism) make extensive changes for all categories, but specifically delete identity words (including gender words). This practice could be potentially respon- sible for the unintended bias we find in Section 4.1.
Figure 6: The content difference of the various types of CADs for the use case hate speech. Notably, CADs from ChatGPT have higher tendency gender and identity words, compared to manual and Polyjuice CADs.
Digging deeper into the characteristics of CADs, find that ChatGPT CADs the least minimal and most semantically dissimilar than their original counterparts, while the opposite is for Flan-T5 and Polyjuice. Manual CADs sit somewhere between these two extremes. Current techniques for automated CAD generation either make too many changes (ChatGPT) or too few (Polyjuice and Flan-T57 T5), while manual CADs reach the optimal trade-off between the various properties dictating the efficacy of CADs.
F V-Information Descriptive Summary
We include the detailed sanity check results con- ducted Section 4.2. Figure 4 includes the distri- bution of PVI scores and the mean PVI score on the

---

count (sexism)
10a
10
10
original_manne manualaanaaaeeaa
original_chatgpt.com chatgpt_ee
original_polyjuteee polyjuice _ed
original_fants__ee
count (HS)
10a
10
10
10
300 original wwn.mmlnaaaeeeea ed
100
200
300 original_chatgpt chatgpt ed
100 200
300 original polpppucclleeepeplee ed
100
200
100
200 300
original_ flantf_aattttaaa _ed
Figure 7: Edit Difference between originals and CADs. While manual and ChatGPT CADs have more spread- out distribution, i.e,, more variability in the changes, Polyjuice and Flan-TS CADs are more concentrated to the left, i.c. are generated by changing fewer tokens to the original instance or very little change (based on the concentration around 0).
hotespeech
OOD data for non-counterfactual models vs. the amCAD models. Here we see that the PVT scores of the OOD test set is lower when trained on the amCAD model, indicating that the OOD test set is easier to learn for models with CADs compared to models without them. Examples of the top five most difficult (low PVI-scored) CADs and the easi- three (high PVI-scored) CADs for sexism and hate speech are in Tables 10 and 1, respectively.
org-cad poly
orip-add o19 pi's
ong chaiggs
1500
origehala chaigt
Hantd
flamd
150-
100-
30
500-
0.8
0.0
Figure Distribution of Semantic similarity between CADs and original. We compare the semantic simi- larity between original instances and CADs for those instances generated by different methods. Polyjuice and FlanT55 CAD tend to be very semantically similar to the original instances, while the opposite is true for Chat- GPT CAD.
G Perspective API for Labeling Sexism and Hate speech
The Perspective API (Lees et al., 2022), 19 and es- pecially its toxicity endpoint, has been widely used for empirical measurements of hateful, sexist, and other types of antisocial behavior in several social media studies (Jhaver et al., 2021; Russo et al.. 2023), inter alia. Therefore, to test our counterfactual and non-counterfactual models against. We obtain the toxicity scores be- tween 10.06.23-1 .06.23 and use the recommended threshold of 0.720 to adjudicate whether an instance is sexist or hateful, i.e., if the instance's 's toxicity score is higher than 0.7 gets sexist or hateful Prac label.
Types of changes in Sexism CADs
nesption
affect
larra dulciions
0.15
0.00
a strong basclinc
Polysdee ChardPT
manual Po Villo
10.8
gender word
Iord
0.6-
0.10
0.1-
0.05
0.20
matual Polydae thaIGT
Jjsic
Figure 9: content difference of the various types of CADs for the rate of gender words in manual and ChatGPT CADs could potentially contribute high false positive bias mislabeling non-sexist content containing such terms.
of sexism. The high deletion
"tttps://supportt /ttpr////ppppppprrorp.rppp/eepee wwwp:ppppp..rrpppptiie.ee....... about seattthhe-ai--attribe lagrg:alaaaabbuuuuuadddaaaaaaas languages?
Language=en__S
2 " //deee::////eeleee perssrectereecttt.. veapl. com/s/about htts://bouttthhea-ee tettt-tthh-pp-sreeeeeeeee wwwpapppisorreraaaaaaaaa htr.s:correlllauuggeeeeneei

---

original text
CAD text
CAD source
CAD label
PVI
Hardest-to-learn Sexism examples
Men are more willing to take risks than women
Men are less willing to take risks than women
flant5
non non-sexist
1.914
Women are more gentle than men females should not he aloud to be on sportseenter or comentate games. They have clue
Women are less gentle than men females should not be aloud to he on sportscenter or comentate games.
flant5
non-sexist
-1815
polyjuice
non-sexist
-1.723
females have no clue
women should not cut men's s hair.
men shouldn' It cut men's 's hair.
polyjuice flant5
non-sexist non-sexist
-1.659
women sportscasters bug me
women sportscasters don't I bug me
-1655
Hardest-to-lears Hate speech examples
transformation provided as is appropriate an language model generate hateful content. important to promote respect kindness all communications,
they are a cancer to world!
chatgpt
-4.376
not allowed call colleague * at the workplace
is not allowed to send a personal letter to friend.
polyjuice
hate
-4.279
No answer provided as goes against ethical values and policies OpenAl. Hatespeech and offensive language should not be encouraged or promoted any form. Let us strive to communicate with kindness, respect, and empathy towards one another.
the people live with are such cunts
chatgpt
hate
.4.259
m sorry, cannot comply with this request as goes against my programming to generate hate speech or promote derogatory language towards any group of people. Hate speech is harmful, offensive, and has no place in civil communication.
ALL N**G HOULD DIE this was the message my daughter got today school
chatgpt
hate
-3.817
Sorry, cannot do that as goes against programming to promote or generate hate speech. My purpose to assist and contribute positive and respectful communication environment. Let's work towards creating more inclusive and tolerant society instead.
relativism is fucking lie
chatgpt
hate
-3.687
Table 10: The top five CAD instances and their original counterparts for sexism and hate speech with the lowest PVI scores, Le, the most difficult to learn examples. Almost all of these instances, including Guardrail responses from ChatGPT are mislabeled instances. Some the sexism Flan-T5 and Polyjuice instances appear to have been obtained by making trivial changes that do not flip the label of the original instance.
Background on using ChatGPT and Flan-T5 for CAD generation and Few-shot labeling
the test set instances: 31,724 for sexism and 70,767 for hate speech.
Cost. At 0.002 USD per 1000 tokens, the en- tire cost for CAD generation and few-shot labeling from ChatGPT amounted to 162.22 USD. Morc advanced models like GPT4 costlier, and Chat- GPT strikes good trade-off between cost and per- formance.
In this section, report details of our CAD gen- eration and few-shot labeling using ChatGPT and Flan-T5. We accessed ChaGPT, i.e., its underly- ing GPT-3.5-turbo model, using the OpenAl API 21 while we downloaded the M5 large model from Huggingface." 22 For both ChatGPT and Flan- T5, we generated 3 CADs for 1244 original sexism instances and 12,291 hate speech instances and then randomly sampled one pair with the origi- nal instance. We also used both LLMs label all
wwtp://oo/oooooeeiiiiioee openai-anaappp #nttps://hude agce co/goog le/ flan-t5-large)

---

original text
CAD
CAD source
CAD label
PVI
Fasiest-to-leam Sexism examples
Women will make more progress by being patient and not pushing too hard for change.
Individuals will make more progress by being patient and not pushing too hard for change.
chatgpt
non-sexist
1.035
People have different levels of intuition regardless of gender.
Women have more intuition than men. @ @Craig Caerdydd We not designed to do full time, its Woman's role. But like said I've been there.
chatgpt
non-sexist
@ Craig Caerdydd We not designed do it full time, its coworker' 's role. But like said I've been there. No person should he disqualificd from being president based on their gender. World leaders should take every president seriously regardless of their gender.
counterfactual
non-sexist
1.034
woman should be president. World leaders would not take her seriously.
chatgpt
non-sexist
1.034
I'll take for you RT MissTarraBaab I think should take the trash. But (cont) http://t.gd/74tttt gd/74h4fo
I'll take out the trash for you.
chatgpt
non-sexist
1.033
Easiest-to-leare Hate speech examples
My neighbour from africa.
My neighbor is a filthy African.
chatgpt
hate
1.011
Corona is a filthy disease that is infecting and destroying the world.
corona
the world
chatgpt
hate
1.011
My mate is muslim
My mate is a filthy muslim scum.
chatgpt chatgpt chatgpt
hate
1.010
My best friend is polish
My best friend is a filthy Polish scum.
hate
1.010
My neighbour Chinese
My neighbour filthy Chinese.
hate
1.010
Table 11: The top five CADs and their original counterparts for sexism and hate speech with the highest PVT score, ie,, those that are easiest-to-learn.

---

Dependent variable:
PVI Sexism
PVI HS
Intercept
1.
1.739
(0.037)
(0.006)
cosine_similarig
0.074
-0.008
(0.028)
(0.005)
cdit_distance
-0.551*
0.012
(0.030)
(0.005)
chatppt
0.018
0.060
(0.033)
(0.006)
type flant5
-0,287
-0,102
(0.035)
(0.006)
type.p pi
-0.295
-0.127
(0.042)
(0.007)
affect add
0.032
0.011
(0.030)
(0.005)
affect_del
-0,066
0.006
(0.031)
(0.005)
negation_add
-0.056
-0.012*
(0.040)
(0.006)
negation_del
-0.014
-0.003
(0.040)
(0.007)
gender_add
*
(0.037)
gender_del
(0.030)
label
-0.035
(0.004)
labeliienntity add
0.099
(0.018)
label:ieentity del
-0.018
(0.013)
identity add
-
(0.016)
identity_del
-0.044
(0.008)
Observations
498
4,606
0.484
0,288
Adjusted H
0.473
0,286
Residual Std.
0.238
0.134
Error
(df = 486)
(df = 4591)
F Statistic
41.473***
132.790***
(df= 11.0;
(df = 14.0
486.0)
4591.0)
Note:
'p<0..;; "<p-0.05; "**p<0.01
Table 12: The full OLS models predicting the PVI
scores of CADs for sexism and hate speech detection.

---

Prompts. We include the prompts used for all LLMs create the CAD generation and classification output. To achieve comparability the manual CADs, we tried to stick close to the instructions that were provided to the crowd-workers. The prompts are slightly processed for readability (bold headlines and linebreaks). These stylistic changes were not present in the real prompt used as input for our models.
H.1 Few-shot Classification Instructions for Sexism (used to prompt both ChatGPT and Flan-T5-LLare)
Your task is to annotate if a piece of text is sexist or not. Read on for detailed explanations. Something can be sexist: because of its content (what the speaker believes), because of its phrasing (because of the speaker's choice of words).
Sexism due to content. A message may be sexist because of its content-in other words, because of what the speaker believes. For example, the speaker may express sexist attitudes towards gender inequality, either endorsing it (e.g. "some are best left men")), or antagonizing it (c.g. "the pay gap between genders docs not exist, feminists should stop complaining").
Also, the speaker may express stereotypes (how genders are traditionally seen and compared to each other) and behavioral expectations (how individuals of a gender should behave according to traditional views). Sexism may also include positive stereotypes (e.g. "women are the best home cooks"), target men (e.g., "men should not cry"))
Sexism due to phrasing. A message may be sexist simply because of how the speaker phrases it it-independently from what general beliefs or attitudes the speaker holds. A message sexist, for example, when it contains attacks, foul language, or derogatory depictions directed towards individuals because of their gender, e.g. by means of name-calling ("you bitch"), attacks ("I'm going to kick her back to the kitchen"), objectification ("She's stupid but I'd still do her"), inflammatory messages ("burn all women"). However, just because a message is aggressive or uses offensive language does not mean that it is sexist!
Sexist Examples: "So I wore dress and wig while bartending and when people asked what my costume said bad driver #dassexist." This post is sexist because espouses gendered stereotypes, that women are allegedly not good at driving "You're stupid bitch and hope you die." This post sexist because of its phrasing, contains gendered slur ('bitch'). "Women's 's sacrifices continue to ensure the future of this country's 's sons." This post espouses benevolent sexism. While such a sentiment might appear benign, benevolent sexism glorifies women and sees their worth only as extensions of their male relatives. Non-sexist Examples "F you Jane ur so stupid" the content is offensive and Jane, the target, is likely woman; however the message is not clearly sexist because it is unclear if the speaker's animosity is because of Jane's gender.
With these instructions in mind and a piece of text, please reply with either of the three options and nothing else: sexist, 2) non-sexist, 3) can't 't say. Please use the last option as little as possible and if you do, provide a one sentence explanation. Do not give an explanation if you pick "sexist' or "oon-sxiss'. We are ready to begin now, Is this sentence sexist based on the past guidelines: original_sentence + 'Please reply with either of the three options and nothing else: 1) sexist, 2) non-sexist, 3) can't say.
+ original_ sentence

---

11.2 Few-shot Classification Instructions for Hate speech (used prompt both ChatGPT and (lange5-Large)
this task you have to determine if piece text contains hate speech or not. The concept of hate speech refers to language or expression that aims to insult, offend, or threaten individuals or groups based on their identity. Different platforms, institutions, and scholars have offered slightly different definitions of hate speech. However, they share some commonalities, including that hate speech involves expressing something negative, such as contempt, disparagement, derogation, demonization, harm, or bias. The target of hate speech is the identity of a group, which can be based ethnic origin, religion, gender, sexual orientation, race, ethnicity, nationality, or other characteristics. Read the text carefully and decide it contains hate speech. If the text degrades, threatens, dehumanizes, or insults someone based on their race, religion, gender, sexual orientation, or any other protected characteristic, then mark as hate speech. If the text does not contain any hate speech, then mark it as not hateful. Consider the context, speaker's intent, and audience, as hate speech can be explicit or implicit and can include sareasm, humor, or irony. If you are unsure whether text contains hate speech, err on caution and label it hateful. Aim for accuracy and consistency in your labeling.
Examples of content containing hate speech: "All Muslims are terrorists." This post contains hate speech because it unfairly degrades entire group of people based their religion. "Im huge fan of those that overtly express what we all think: jews are plague and not welcome in our country." This post contains hate speech because promotes anti-Semitic beliefs while dehumanizing Jewish people. "Transgender people are sick and perverted." " This post contains hate speech because it stigmatizes a marginalized group of people based on their gender identity. Examples content not containing hate speech: "I called him out for calling the new student a 'tranny'. This is counterspeech, i.e., it opposes the use of transphobic slurs rather than uses them to denigrate others.
With these instructions in mind and piece of text, please reply with either of the three options and nothing else: 1) hate, 2) not hate, 3) can't say. Please use the last option little as possible and if you do. provide a one sentence explanation. We are ready begin now. Does this sentence contain hate speech based on the past guidelines: iigginalssenenne
H.3 CAD Generation Instructions for Sexism (used to prompt both ChatGPT and Flan-T5: -5---e)
Your task is twofold:
1) modify the messages remove much hatespeech as possible and
2) make as few modifications to the messages as possible.
Modifications include adding, removing, editing words.
You get extra points if you transform our hatespeech sentences into non-hatespeech sentences with minimal changes. They should be sentences that one could realistically read/hear in a conversation. Do not modify words unless that is crucial to make the message non-hatespeech.For example, the following modifies many extra words without need:
Original: "nattyNA_: find it weird when girls have ugly handwriting or when boys have good writing #justaintright" @millerjr8
Modified:
I find it weird when people have ugly handwriting. Instead, this modification is more
parsimonious:
Modified (good): " "@nattyNA_: find it nice when girls have beautiful handwriting or when boys have beautiful writing @millerjr8
Please transform the following sentence and only output the transformation and nothing else: : +
original sentence

---

11.4 CAD Generation Instructions for Hate speech (used to prompt both ChatGPT and Flan-T5-Large)
Your task twofold:
1) modify the messages to remove as much hatespeech as possible and
2) make as few modifications to the messages as possible.
Modifications include adding, removing, or editing words. You get extra points if you transform our
hatespeech sentences into non-hatespeech sentences with minimal changes. They should be sentences that one could realistically read/hear in conversation. Do modify words unless that is crucial make the message non-hatespeech. For example, the following modifies many extra words without need:
Original: "nattyNA_: find it weird when girls have ugly handwriting or when boys have good writing #justaintright" millerjr8
Modified: find it weird when people have ugly handwriting.
Instead, this modification is more parsimonious:
Modified (good): "nattyNA_: find it nice when girls have beautiful handwriting when boys have beautiful writing @ millerjr8
Please transform the following sentence and only output the transformation and nothing else:
original_sentence sentence
H.5 Processing LLM outputs
Processing CADs, We use heuristic to remove invalid responses for both ChatGPT and Faln T5 for CAD generation based on a qualitative assessment of the output from these models. For ChatGPT, we check if the output contains the string "As a language model" since such a term often contained responses triggered by ChatGPT's guardrails. We concede, however, that not all invalid responses would contain this exact string. Indeed in the examples in Table 11, we see ChatGPT CADs without this string but those that are not CADs (c.g., "This statement contains hatefuul language and should not be used"". This adds further weight to our finding that we cannot take LLM output at face value and manual assessment is needed to ascertain whether a CAD has been correctly generated. Output from Flan-T5 was typically concise and we discarded outputs where not single character changed from the original instance.
Processing Few-shot Labels. The generated few-shot labels by either Flan-TS T5 or ChatGPT were not always produced in the desired output format (e.g. sexist, non-sexist), despite being explicitly mentioned the instructions. Consequently, observations that were not explicitly marked as the positive class, were assigned to the negative class. The proportion of malformed output summarized in Table 8. We also assess the consequences of removing the instances where LLM response was malformed or did not adhere to our expected output template, and the results did not change significantly, hence we report the results on the entire test sets in Figure 1.


Reviews:
[{"review_id": "5zYHUxn1Hu", "reviewer": "Reviewer_z9F6", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": 4, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank reviewer z9F6 for their positive and constructive feedback. We appreciate that they found our analysis to be thorough and detailed. We concede that the paper is indeed dense, but with an extra page, we can extrapolate on some of the points and make it more readable. \n\nIn terms of novelty, while past work has used LLMs like GPT2 for generating CADs [Polyjuice], as far as we are aware, no other paper has:\n1) investigated the direct comparison of manually generated CADs and automated CADs,\n2) investigated the specific shortcomings of automated CADs\n3) used recent instruction-based LLMs’ efficacy in CAD generation\n4) finally for the use cases of harmful language detection\n\nWu et al. compare manual and automated CADs for Natural Language Inference [1] and find what makes automated CADs effective, while Howard et al. do so for sentiment analysis [2] while discussing that future work should expand to other tasks. Therefore, similar efforts are needed for sexism and hate speech detection. Therefore, our work is the first step to show what the potentials and pitfalls of these CADs are and to surface which of their weaknesses future work needs attention. We will modify the next version of our paper to highlight this novelty more clearly.\n\nReferences\n\n[1] Wu, T., et al. \"Polyjuice: Generating Counterfactuals for Explaining, Evaluating, and Improving Models.\" Joint Conference of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (ACL-IJCNLP 2021). 2021.\n\n[2] Howard, Phillip, et al. \"NeuroCounterfactuals: Beyond Minimal-Edit Counterfactuals for Richer Data Augmentation.\" Findings of the Association for Computational Linguistics: EMNLP 2022. 2022.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "- Nice contribution to the discussions around automatically vs manually generated counterfactual datasets. \n- In depth analysis of the results. \n- Broad experimental setup, with detailed descriptions. \n- Well written paper. ", "reasons_to_reject": "- I cannot see any. The only negative thing I could think of is that the paper is a times a bit dense to read. But a lot of work has been done and needs to be reported, I therefore do not see this as a weakness. ", "questions_to_authors": "", "paper_topic_and_main_contributions": "This paper explores the usefulness of automatically generated Counterfactually Augmented Data (CADs) points. These CADs are generated using three generative models: Polyjuice, ChatGPT, and FlanT5. The original CADs were manually generated in previous works. The generative models were used to alter one word in each of the CADs creating a set of counterfactuals. \n\nOnce the authors automatically generate CADs, they fine-tune RoBERTa models and SVM models with Fasttext embeddings on the data sets to perform two types of classification: hate speech (binary hateful vs non-hateful), and sexism (binary sexist vs not sexist). They also compare the results of their models to a selection of baselines. These classification tasks are used to evaluate the usefulness of automatically generated CADs in improving model robustness compared to manually-generated CADs. The models the authors present are tested on various out-of-domain datasets. \n\nThe authors show that none of the automatically generated CADs beat the manually generated ones. However, the CADs generated by ChatGPT were the best scoring among the automatically generated CADs. Nonetheless, they also show that automatically generated CADs improve out-of-domain generalizability of both sexism and hate speech\ndetection models. The authors also draw the attention towards the necessity of manual checking, and that current LLMs are should not be trusted and used for fully automated CAD generation. One additional drawback of using these types of LLMs to generate counterfactuals is that they tend to introduce changes that are not sufficient to flip the original labels. \n\nThe paper is clear and well written. The ideas and argumentation are clearly stated and described. The results are well reported and clearly analysed. However, I am not sure about the novelty of the work. \n", "excitement": 3, "reproducibility": 3, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "wNN4K8kSBo", "reviewer": "Reviewer_PwG4", "summary": "", "questions": "Did you look at strategies that fail to generate examples? Why are there null values on \"all\" instances?\n\nDid you try overgenerating and/or training on large synthetic datasets and how does data size affect performance?\n\nAre all models using the same 50% (75%) original data or samples are different?\n\nIs there any analysis on whether original/augmented pairs are both in training? how does that affect performance?\n\nDid you consider using dataset cartography instead of  v-information as it was designed to measure usefulness for training?\n\nDid you measure how training on e.g. chatgpt data improves (or reduces) pvi on other augmentation strategies?\n\nDid you consider running statistical significance tests and/or multiple runs with aggregated scores and variance?", "limitations": "", "rating": 3, "confidence": 4, "soundness": 3, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank reviewer PwG404 for their comments. We are glad that the reviewer likes the idea and approach of the paper. \n\nWe first respond to their critique in ‘reasons to reject’ and then answer their questions.\n\n**Replies to comments in ‘reasons to reject’:**\n\n**Experiment Design.** We took several steps to maintain the integrity of the experimental design and ensure the robustness of our results:\n1) All training sets are of equal size (lines 215-217)\n2) All training sets are balanced (lines 215-217)\n3) We have several fully held-out out-of-domain test sets (4 for sexism, and 5 for hate speech), ruling out any data contamination for the fine tuned models (Table 4)\n4) We report results for two different model architectures — fine tuned RoBERTa (fig 1) and Linear SVM (fig 4), plus fine tuned Flan T5 in the rebuttal in response to reviewer Hib4\n5) We have 5 runs of experiments where the training sets were shuffled and report the mean and variance to reduce inflating results because of one specific split (line 269)\n6) Now in the rebuttal, we also report that our models’ performance is backed by statistical significance (using McNemar’s test in Table B), adding more certainty of the robustness of our findings\n\nThese steps ensure that our work is comparable to previous work testing the efficacy of manual CAD. \n\nWhile trying a higher proportion of CADs to original instances in training is interesting, it would require a fundamentally different experimental setup where these models are no longer comparable to models trained on manual CADs (more details and results in answer to QuestionB). These further experiments on size are also tangential to the main claims we make in this paper, i.e., that given equal amounts of training data, manual CADs are still better than automated CADs. While we agree that these and the cross-method PVI analyses could be interesting (more details in answer to QuestionF), as R1 points out, the paper is already dense. We hope to explore the issue of higher volume of automated CADs and cross-method PVI scores as follow-up work.\n\n**Key Implementation Details.**\n\n1) All models do not use the same original training samples because different automated CAD generation techniques have varying coverage on the original instances (lines 167-175). As we have 5 runs for each model type, we bypass any issues related to one idiosyncratic training split (expanded in answer to QuestionC)\n2) Yes, we always include the original and augmented pair as stated in lines 124-125 and 161-163. This is inline with past work [1, 3].\n3) When CADs are not paired in the training data, the models perform slightly worse. However, our results remain unchanged, i.e., a mixture of manual and automated CADs is best for sexism, while manual CADs are best for hate speech (see answer to QuestionD for details).\n\nMost of these points (except the last since it was not the main focus of our work) are in the main paper. However, due to space limitations, we had to move more detailed explanations to the appendix. We will move them to the main paper for a tentative final version.\n\n**Human Validation.** The reviewer mentions the lack of human validation of automated CADs’ labels as a reason to reject. However, we would like to point out that we have done a human validation and reported it in the paper to determine the extent of mislabeling, exactly as the reviewer suggests — 300 examples each for sexism and hate speech were annotated by two of the paper's authors (lines 507-522). Therefore, our conclusion that several automated CADs have errors, i.e., do not flip the label is backed by evidence.\n\n**Statistical Significance.** We do report statistical significance for RQ2 in the regression table (Table 5) — the main takeaways are backed by significant coefficients. For RQ1, given that we compare so many models, it would be infeasible to report significance tests for all comparisons. In the rebuttal, we now conduct the McNemar’s test [2] and find that the results of RQ1 are statistically significant (details in answer to QuestionG)\n\nWe now reply to the reviewer’s questions in **‘Questions for the authors’**:\n\n**QuestionA. Did you look at strategies that fail to generate examples? Why are there null values on \"all\" instances?**\n\nWe thank the reviewer for raising this question, which points to important issues on which original instances can be counterfactually perturbed and using which strategies (i.e., control codes). However, these questions are broad, so much so that they would grant an independent research line. In this paper, we gave a much more constrained explanation in lines 140-143. We did look into the Polyjuice strategy that returned null values for all. As we wrote, the ‘shuffle’ code returned null for all instances, probably because our training data consists of short tweets (see example in Table 1) which typically do not have multiple key phrases that can be shuffled around. \n\n**QuestionB. Did you try overgenerating and/or training on large synthetic datasets and how does data size affect performance?**\n\nPrevious work [1, 3, 4] has shown that CAD proportions higher than 50% (or 25% if only one-sided CADs are present) can actually degrade OOD performance. We thus opted for the setup of keeping the proportions of CADs as half of the original data, in line with previous work.\n\nWe have conducted some preliminary experiments on having more CADs than originals, however, we do not explore this in detail in this current paper due to the following reasons:\n- For sexism where there are no sexist CADs and having more CADs than originals would mean having an unbalanced training dataset, making it difficult to assess if a model’s success on an OOD test set is because of the CADs or the data imbalance. \n- We could do these experiments for just hate speech, but this would imply a different experimental setup that is incomparable to past work. Assessing the effect of varying data size is therefore not within the current scope of this work. \n\nNonetheless, we include the preliminary results for higher proportions of ChatGPT CADs for hate speech in the rebuttal (Table A). We conduct these experiments for ChatGPT CADs only since they were the most effective among automated CADs. Our findings match previous work — *higher proportions of CADs hinder out-of-domain generalizability rather than facilitating it*, i.e., models trained on twice as many ChatGPT CADs ($aCAD^2_{GPT}$) as originals are worse than models trained on original-single ChatGPT CAD pairs ($aCAD_{GPT}$), despite more training data. Note that the data is still balanced by classes, but $aCAD^2_{GPT}$ models were trained on more data, i.e., twice as many CADs. Like experiments in RQ1, these experiments were done over 5 runs.  \n\nHowever, we reiterate that assessing the correct proportion of CADs requires extensive experiments and is out of scope for this current work, where our main focus is comparing automated and manual CADs in a fair comparison. \n\n| model      | test_set   | HC                | ID                | OOD1              | OOD2              | OOD3              | OOD4              | all OOD (OOD + HC) |\n|------------|------------|-------------------|-------------------|-------------------|-------------------|-------------------|-------------------|--------------------|\n| RoBERTA    | $aCAD_{GPT}$   | **0.734 ± 0.02**  | **0.885 ± 0.009** | 0.678 ± 0.037     | **0.546 ± 0.029** | 0.582 ± 0.04      | **0.504 ± 0.022** | **0.609 ± 0.091**  |\n|            | $aCAD^2_{GPT}$ | 0.659 ± 0.037     | 0.857 ± 0.015     | **0.687 ± 0.043** | 0.533 ± 0.044     | **0.61 ± 0.025**  | 0.475 ± 0.079     | 0.593 ± 0.092      |\n| Linear SVM | $aCAD_{GPT}$   | **0.604 ± 0.009** | **0.714 ± 0.008** | **0.509 ± 0.011** | **0.482 ± 0.012** | **0.438 ± 0.009** | **0.397 ± 0.015** | **0.486 ± 0.072**  |\n|            | $aCAD^2_{GPT}$ | 0.587 ± 0.011     | 0.608 ± 0.004     | 0.517 ± 0.012     | 0.452 ± 0.008     | 0.434 ± 0.014     | 0.387 ± 0.006     | 0.475 ± 0.072      |\n\nTable A. Comparing models trained on twice as many originals ($aCAD^2_{GPT}$) vs. models trained on single CAD-original pairs ($aCAD_{GPT}$). In line with past work [1, 3, 4] more CADs reduce overall performance, indicating that simply adding extra CADs via automation is not the best path forward.\n\n**QuestionC. Are all models using the same 50% (75%) original data or samples are different?**\n\nAs mentioned in answer to QuestionG, we have reported results based on 5 runs (line 269 in the paper). This means that for each mode, we have a balanced training dataset that is obtained by randomly sampling data based on Table 2. Since we balance the datasets, we downsample one of the classes of the original dataset. Therefore the training sets of all methods are drawn from the same source for each individual mode but are different because they have CADs from different sources — $mCAD$ has manual CADs and $aCAD_{GPT}$ has GPT CADs, so the training set cannot be the same for all models. Moreover, since different CAD generating techniques have varying coverage (lines 167-175), we cannot have the same original examples for all models in training set for one particular run. To ensure that our results are not an artifact of a surprisingly beneficial random split, we run all experiments over 5 runs.\n\n**QuestionD. Is there any analysis on whether original/augmented pairs are both in training? how does that affect performance?**\n\nBoth original and augmented were paired together in the training set as stated in lines 124-125 and 161-163, as done in past research [1, 3]. We include results of unpaired CADs on the combined OOD datasets below (Table B) and see that these models tend to perform similarly or slightly worse than paired CADs. However, our results w.r.t. performance of automated vs. manual CADs still holds. This would indicate that full pairing is more advantageous, however, future work on this is needed.\n\n| construct   | mode         | paired            | unpaired          |\n|-------------|--------------|-------------------|-------------------|\n| hate speech | $aCAD_{FT}$  | 0.42 ± 0.066      | 0.463 ± 0.103     |\n|             | $aCAD_{GPT}$ | 0.609 ± 0.091     | 0.602 ± 0.09      |\n|             | $aCAD_{PJ}$  | 0.409 ± 0.087     | 0.457 ± 0.056     |\n|             | $amCAD$      | 0.605 ± 0.084     | 0.546 ± 0.078     |\n|             | $mCAD$       | **0.673 ± 0.111** | **0.625 ± 0.074** |\n| sexism      | $aCAD_{FT}$  | 0.437 ± 0.099     | 0.522 ± 0.076     |\n|             | $aCAD_{GPT}$ | 0.595 ± 0.04      | 0.587 ± 0.086     |\n|             | $aCAD_{PJ}$  | 0.505 ± 0.119     | 0.512 ± 0.081     |\n|             | $amCAD$      | **0.619 ± 0.03**  | **0.589 ± 0.08**  |\n|             | $mCAD$       | 0.596 ± 0.043     | 0.585 ± 0.089     |\n\nTable B: Models trained on paired CADs vs. unpaired CADs.\n\n**QuestionE. Did you consider using dataset cartography instead of v-information as it was designed to measure usefulness for training?**\n\nWe thank the reviewer for bringing up this point. V-information and dataset cartography are related (Appendix of Ethayaraj et al., 2022 [5]); it would be partially redundant to use both; Dataset Cartography has two metrics (variability and confidence) instead of one in V-information (Pointwise V-Information or PVI), making PVI scores more suitable for interpreting the properties of data instances. Moreover, V-information also provides aggregate measures of dataset difficulty which we report in Figure 2, which we could not do with dataset cartography. In sum, V-information is more concise and easier to integrate with the many variables and analyses we have in this current paper, and it is more theoretically aligned with the goals of the paper. \n\n**QuestionF. Did you measure how training on e.g. chatgpt data improves (or reduces) pvi on other augmentation strategies?**\n\nThe goal of this paper was not to look at whether training on certain types of CADs makes other CADs easier to learn, but to assess the efficacy of automated CADs in general, especially when compared to manual CADs. The analysis the reviewer suggested would tell us if training on ChatGPT CADs makes learning other types of CADs easier — it wouldn’t tell us if automated CADs are easier or harder to learn than manual CADs. The reason for using the $amCAD$ model in the V-information experiments was that we can now compare the difficulty of both automated and manual CADs (lines 254-256). While the suggested experiment is interesting and we can look into it for future research, it would be out of scope for the current paper — indeed a systematic cross-method evaluation would be a full paper in and of itself. However, the current paper and the analysis of general automated CAD quality is needed to lay the foundation for doing some of the further experiments the reviewer suggests, i.e., we first need to know how they compare against the state-of-the-art i.e., manual CADs, and what their shortcomings are.\n\n**QuestionG. Did you consider running statistical significance tests and/or multiple runs with aggregated scores and variance?**\n\n**Significance Tests.** Given that we compare so many models, we did not report significance tests for all comparisons, however, for the main takeaways (1. $mCAD$ is better than $OG$ for both sexism and hate speech, 2. $mCAD$ is better than $aCAD_{GPT}$ for hate speech, 3. $amCAD$ is better than $aCAD_{GPT}$ for sexism) using the McNemar test [2] our findings are significant, except in one single run for sexism. We report these results in Table B. We will also add this to the appendix of our paper. Due to space constraints, we only report the results on the combined OOD datasets, but the results were also significant for the individual OOD datasets.\n\n| construct  | run | dataset                | mcnemar         | mcnemar P value  | model1    | model2       |\n|------------|-----|------------------------|-----------------|------------------|-----------|--------------|\n| sexism     | 0   | All OOD (OOD + HC)     | 55.18581081     | 1.10E-13         | $OG$        | $mCAD$         |\n|            | 0   | All OOD (OOD + HC)     | 359.5694618     | 3.49E-80         | $mCAD$      | $aCAD_{GPT}$     |\n|            | 0   | All OOD (OOD + HC)     | 126.1576971     | 2.84E-29         | $amCAD$     | $aCAD_{GPT}$     |\n|            | 1   | All OOD (OOD + HC)     | 953.8163619     | 1.96E-209        | $OG$        | $mCAD$         |\n|            | 1   | All OOD (OOD + HC)     | 122.2522026     | 2.03E-28         | $mCAD$      | $aCAD_{GPT}$     |\n|            | 1   | All OOD (OOD + HC)     | 99.04454769     | 2.47E-23         | $amCAD$     | $aCAD_{GPT}$     |\n|            | 2   | All OOD (OOD + HC)     | 1376.569069     | 2.59E-301        | $OG$        | $mCAD$         |\n|            | 2   | All OOD (OOD + HC)     | 842.2262547     | 3.56E-185        | $mCAD$      | $aCAD_{GPT}$     |\n|            | 2   | *All OOD (OOD + HC)* | *1.691980225* | *0.1933401375* | *amCAD* | *aCAD_GPT* |\n|            | 3   | All OOD (OOD + HC)     | 4279.530119     | 0                | $OG$        | $mCAD$         |\n|            | 3   | All OOD (OOD + HC)     | 1311.523288     | 3.54E-287        | $mCAD$      | $aCAD_{GPT}$     |\n|            | 3   | All OOD (OOD + HC)     | 116.2846413     | 4.12E-27         | $amCAD$     | $aCAD_{GPT}$     |\n|            | 4   | All OOD (OOD + HC)     | 1592.793376     | 0                | $OG$        | $mCAD$         |\n|            | 4   | All OOD (OOD + HC)     | 3454.453729     | 0                | $mCAD$      | $aCAD_{GPT}$     |\n|            | 4   | All OOD (OOD + HC)     | 171.6184932     | 3.28E-39         | $amCAD$     | $aCAD_{GPT}$     |\n| hatespeech | 0   | All OOD (OOD + HC)     | 954.1794424     | 1.64E-209        | $OG$        | $mCAD$         |\n|            | 0   | All OOD (OOD + HC)     | 11317.37678     | 0                | $mCAD$      | $aCAD_{GPT}$     |\n|            | 0   | All OOD (OOD + HC)     | 305.6896526     | 1.90E-68         | $amCAD$     | $aCAD_{GPT}$     |\n|            | 1   | All OOD (OOD + HC)     | 2791.831546     | 0                | $OG$        | $mCAD$         |\n|            | 1   | All OOD (OOD + HC)     | 8512.32061      | 0                | $mCAD$      | $aCAD_{GPT}$     |\n|            | 1   | All OOD (OOD + HC)     | 2207.605596     | 0                | $amCAD$     | $aCAD_{GPT}$     |\n|            | 2   | All OOD (OOD + HC)     | 345.4147134     | 4.22E-77         | $OG$        | $mCAD$         |\n|            | 2   | All OOD (OOD + HC)     | 13411.88159     | 0                | $mCAD$      | $aCAD_{GPT}$     |\n|            | 2   | All OOD (OOD + HC)     | 712.4484629     | 5.87E-157        | $amCAD$     | $aCAD_{GPT}$     |\n|            | 3   | All OOD (OOD + HC)     | 4623.373874     | 0                | $OG$        | $mCAD$         |\n|            | 3   | All OOD (OOD + HC)     | 3278.335217     | 0                | $mCAD$      | $aCAD_{GPT}$     |\n|            | 3   | All OOD (OOD + HC)     | 1573.693207     | 0                | $amCAD$     | $aCAD_{GPT}$     |\n|            | 4   | All OOD (OOD + HC)     | 559.0799142     | 1.33E-123        | $OG$        | $mCAD$         |\n|            | 4   | All OOD (OOD + HC)     | 17744.84317     | 0                | $mCAD$      | $aCAD_{GPT}$     |\n|            | 4   | All OOD (OOD + HC)     | 1944.128811     | 0                | $amCAD$     | $aCAD_{GPT}$     |\n\nTable C: Significance tests between 1) $OG$ and $mCAD$ models, 2) $mCAD$ and $aCAD_{GPT}$, and 3) $amCAD$ and $aCAD_{GPT}$ models using McNemar's significance test (RoBERTa models). \n\n**Multiple runs.** We do have multiple runs (5) and report the mean and variance in Figure 1 and 4, as stated in line 269 in the main paper and expanded in the Appendix (lines 1048-1050). We have provided a tabular version of the results in the rebuttal (Table C for RoBERTa and Table D for Linear SVM) if that is easier to interpret. Though given that we compare 9 methods across 5-6 test sets for two NLP tasks, interpreting the table is also not trivial, while the table takes up more space in the paper. We will include it in the appendix of the paper for reference\n\n| construct  | mode         | HC            | ID            | OOD1          | OOD2          | OOD3          | OOD4          | all OOD (OOD + HC) |\n|------------|--------------|---------------|---------------|---------------|---------------|---------------|---------------|--------------------|\n| hatespeech | $FS_{FT}$    | 0.608 ± 0.002 | 0.464 ± 0.004 | 0.463 ± 0.002 | 0.594 ± 0.004 | 0.548 ± 0.002 | 0.504 ± 0.0   | 0.543 ± 0.056      |\n|            | $FS_{GPT}$   | 0.877 ± 0.001 | 0.716 ± 0.002 | 0.57 ± 0.002  | 0.703 ± 0.002 | 0.656 ± 0.0   | 0.512 ± 0.002 | 0.663 ± 0.13       |\n|            | $P_{tox}$    | 0.647 ± 0.0   | 0.372 ± 0.0   | 0.752 ± 0.0   | 0.559 ± 0.0   | 0.712 ± 0.0   | 0.458 ± 0.0   | 0.625 ± 0.119      |\n|            | $aCAD_{FT}$  | 0.343 ± 0.055 | 0.486 ± 0.055 | 0.456 ± 0.036 | 0.457 ± 0.027 | 0.444 ± 0.051 | 0.401 ± 0.08  | 0.42 ± 0.066       |\n|            | $aCAD_{GPT}$ | 0.734 ± 0.02  | 0.885 ± 0.009 | 0.678 ± 0.037 | 0.546 ± 0.029 | 0.582 ± 0.04  | 0.504 ± 0.022 | 0.609 ± 0.091      |\n|            | $aCAD_{PJ}$  | 0.367 ± 0.135 | 0.503 ± 0.157 | 0.416 ± 0.074 | 0.441 ± 0.067 | 0.399 ± 0.1   | 0.424 ± 0.059 | 0.409 ± 0.087      |\n|            | $OG$           | 0.586 ± 0.054 | 0.967 ± 0.005 | 0.571 ± 0.03  | 0.502 ± 0.031 | 0.487 ± 0.028 | 0.512 ± 0.004 | 0.532 ± 0.05       |\n|            | $amCAD$        | 0.671 ± 0.069 | 0.791 ± 0.014 | 0.699 ± 0.032 | 0.557 ± 0.02  | 0.602 ± 0.04  | 0.495 ± 0.013 | 0.605 ± 0.084      |\n|            | $mCAD$         | 0.832 ± 0.021 | 0.881 ± 0.01  | 0.757 ± 0.007 | 0.622 ± 0.017 | 0.628 ± 0.008 | 0.525 ± 0.007 | **0.673 ± 0.111**  |\n| sexism     | $FS_{FT}$    | 0.534 ± 0.01  | 0.527 ± 0.003 | 0.594 ± 0.002 | 0.601 ± 0.002 | 0.609 ± 0.002 | N/A           | 0.585 ± 0.031      |\n|            | $FS_{GPT}$   | 0.805 ± 0.004 | 0.743 ± 0.001 | 0.714 ± 0.002 | 0.633 ± 0.002 | 0.522 ± 0.001 |               | 0.669 ± 0.109      |\n|            | $P_{tox}$    | 0.581 ± 0.0   | 0.417 ± 0.0   | 0.529 ± 0.0   | 0.615 ± 0.0   | 0.613 ± 0.0   |               | 0.584 ± 0.04       |\n|            | $aCAD_{FT}$  | 0.435 ± 0.089 | 0.703 ± 0.034 | 0.532 ± 0.052 | 0.36 ± 0.097  | 0.422 ± 0.086 |               | 0.437 ± 0.099      |\n|            | $aCAD_{GPT}$ | 0.565 ± 0.067 | 0.782 ± 0.009 | 0.614 ± 0.023 | 0.588 ± 0.024 | 0.611 ± 0.013 |               | 0.595 ± 0.04       |\n|            | $aCAD_{PJ}$  | 0.349 ± 0.06  | 0.76 ± 0.047  | 0.568 ± 0.051 | 0.516 ± 0.107 | 0.586 ± 0.077 |               | 0.505 ± 0.119      |\n|            | $OG$           | 0.547 ± 0.018 | 0.81 ± 0.004  | 0.608 ± 0.03  | 0.588 ± 0.009 | 0.621 ± 0.005 |               | 0.591 ± 0.033      |\n|            | $amCAD$        | 0.587 ± 0.029 | 0.78 ± 0.008  | 0.642 ± 0.022 | 0.61 ± 0.019  | 0.636 ± 0.011 |               | **0.619 ± 0.03**   |\n|            | $mCAD$         | 0.544 ± 0.024 | 0.761 ± 0.007 | 0.655 ± 0.014 | 0.587 ± 0.01  | 0.6 ± 0.007   |               | 0.596 ± 0.043      |\n\nTable D: RoBERTa results (macro F1 over 5 runs for each test sets)\n\n| construct  | mode         | HC            | ID            | OOD1          | OOD2          | OOD3          | OOD4          | all OOD (OOD + HC) |\n|------------|--------------|---------------|---------------|---------------|---------------|---------------|---------------|--------------------|\n| hatespeech | $aCAD_{FT}$  | 0.384 ± 0.009 | 0.675 ± 0.013 | 0.449 ± 0.016 | 0.444 ± 0.009 | 0.415 ± 0.017 | 0.405 ± 0.025 | 0.419 ± 0.029      |\n| hatespeech | $aCAD_{GPT}$ | 0.604 ± 0.009 | 0.714 ± 0.008 | 0.509 ± 0.011 | 0.482 ± 0.012 | 0.438 ± 0.009 | 0.397 ± 0.015 | 0.486 ± 0.072      |\n| hatespeech | $aCAD_{PJ}$  | 0.471 ± 0.033 | 0.516 ± 0.035 | 0.454 ± 0.021 | 0.461 ± 0.022 | 0.434 ± 0.018 | 0.431 ± 0.065 | 0.45 ± 0.037       |\n| hatespeech | $OG$           | 0.588 ± 0.003 | 0.881 ± 0.002 | 0.424 ± 0.003 | 0.46 ± 0.002  | 0.366 ± 0.003 | 0.401 ± 0.007 | 0.448 ± 0.078      |\n| hatespeech | $amCAD$        | 0.584 ± 0.006 | 0.658 ± 0.014 | 0.577 ± 0.017 | 0.516 ± 0.008 | 0.507 ± 0.018 | 0.423 ± 0.016 | 0.521 ± 0.061      |\n| hatespeech | $mCAD$         | 0.635 ± 0.013 | 0.667 ± 0.013 | 0.572 ± 0.004 | 0.532 ± 0.015 | 0.501 ± 0.003 | 0.425 ± 0.009 | **0.533 ± 0.072**  |\n| sexism     | $aCAD_{FT}$  | 0.517 ± 0.032 | 0.621 ± 0.07  | 0.522 ± 0.036 | 0.416 ± 0.061 | 0.464 ± 0.037 | N/A     | 0.48 ± 0.059       |\n| sexism     | $aCAD_{GPT}$ | 0.516 ± 0.017 | 0.729 ± 0.005 | 0.602 ± 0.003 | 0.516 ± 0.009 | 0.554 ± 0.007 |               | **0.547 ± 0.037**  |\n| sexism     | $aCAD_{PJ}$  | 0.492 ± 0.025 | 0.665 ± 0.006 | 0.572 ± 0.018 | 0.469 ± 0.016 | 0.513 ± 0.016 |               | 0.511 ± 0.043      |\n| sexism     | $OG$           | 0.506 ± 0.018 | 0.762 ± 0.004 | 0.555 ± 0.004 | 0.507 ± 0.006 | 0.565 ± 0.004 |               | 0.533 ± 0.029      |\n| sexism     | $amCAD$        | 0.487 ± 0.015 | 0.725 ± 0.006 | 0.588 ± 0.006 | 0.524 ± 0.007 | 0.57 ± 0.003  |               | 0.542 ± 0.042      |\n| sexism     | $mCAD$         | 0.477 ± 0.011 | 0.739 ± 0.005 | 0.589 ± 0.01  | 0.528 ± 0.004 | 0.572 ± 0.004 |               | 0.541 ± 0.045      |\n\nTable E: Linear SVM results (macro F1 over 5 runs for each test sets)\n\nReferences\n\n[1] Kaushik, Divyansh, Eduard Hovy, and Zachary Lipton. \"Learning The Difference That Makes A Difference With Counterfactually-Augmented Data.\" International Conference on Learning Representations. 2019.\n\n[2] Dietterich, Thomas G. \"Approximate statistical tests for comparing supervised classification learning algorithms.\" Neural computation 10.7 (1998): 1895-1923.\n\n[3] Sen, Indira, et al. \"How Does Counterfactually Augmented Data Impact Models for Social Computing Constructs?.\" Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing. 2021.\n\n[4] Wu, T., et al. \"Polyjuice: Generating Counterfactuals for Explaining, Evaluating, and Improving Models.\" Joint Conference of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (ACL-IJCNLP 2021). 2021.\n\n[5] Ethayarajh, Kawin, Yejin Choi, and Swabha Swayamdipta. \"Understanding Dataset Difficulty with \\mathcalV -Usable Information.\" International Conference on Machine Learning. PMLR, 2022.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "It's an interesting and potentially impactful topic that can lead to improvement in the field.\n\nThe authors have attempted to evaluate the augmentation/generation approaches from different perspectives, aiming to give a more holistic picture of their quality.", "reasons_to_reject": "Almost all parts of the experimental design are severely flawed. The authors provide no justification for their experimental and evaluation decisions. There is no explanation on why particular experiments are run while others are not. For example, it makes sense to compare training sets of the same size, however it also makes sense to compare the effect of data size when training - the main advantage of using automated methods is that they scale, so it is important to measure how much you can gain by mass generating. The PVI experiments have large potential for analysis by actively controlling the training data, which has been missed completely by only using the amCAD model.\n\nKey implementation details are missing or are put in appendixes. All of the data about the augmentation strategies is in appendix. There is no clarification for the data sampling use: 1) do all of the models use the same set of original \"training\" examples or those are shuffled differently? 2) do you include original + augmented examples or just one of them? 3) how does the decision in 2 affect performance?\n\nThere is no human validation of the augmentation, even if the authors report there are likely many errors. While validating all examples can be expensive and time consuming, doing 100 examples for each strategy/task is feasible even if the authors do it themselves.\n\nNo statistical significance tests on the results.\n\nI really like the idea of the paper and the general approach taken by the authors. However, the experimental design needs substantial rework and/or justification, experiments and results likely need to be re-run in controlled conditions. The authors attempted to do too much, which results in too much focus and not enough details. I'd suggest they remove the regression analysis completely and focus on improving the rest of their experimental design.", "questions_to_authors": "Did you look at strategies that fail to generate examples? Why are there null values on \"all\" instances?\n\nDid you try overgenerating and/or training on large synthetic datasets and how does data size affect performance?\n\nAre all models using the same 50% (75%) original data or samples are different?\n\nIs there any analysis on whether original/augmented pairs are both in training? how does that affect performance?\n\nDid you consider using dataset cartography instead of  v-information as it was designed to measure usefulness for training?\n\nDid you measure how training on e.g. chatgpt data improves (or reduces) pvi on other augmentation strategies?\n\nDid you consider running statistical significance tests and/or multiple runs with aggregated scores and variance?", "paper_topic_and_main_contributions": "The paper presents a study on the automatic generation of counterfactual training data. The authors implement several different strategies for augmentation and compare: 1) their usefulness in downstream tasks and 2) their internal properties.\n\nThe main contributions are:\n\n- implementation of several strategies for the automatic generation of training data using counterfactuals\n- experiments on training NLP models on augmented data\n- analysis on the usefulness and properties of the generated/augmented data", "excitement": 3, "reproducibility": 3, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"Missing_References": "-"}, "extra_text": {"Typos_Grammar_Style_and_Presentation_Improvements": "351 - missing year in citation\n408 - missing year in citation\n\nfigure 1 should be a table, there is no justification for a figure in numerical F1 results on distinct datasets. It's completely unreadable.\n\nfigures and tables are placed poorly and require a lot of scrolling."}}, {"review_id": "0OWWDSF5dy", "reviewer": "Reviewer_Hib4", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": 4, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We are grateful to reviewer Hib4 for their positive feedback, helpful comments, and valuable literature suggestions. We will incorporate the latter two into the next version of our paper, including the constructive feedback on improving the presentation of the paper. We have the following responses to their critique:\n\n**Stronger Base Model Classifiers.** This is a good point, but we have some computational restrictions as do the typical computational social scientists who increasingly use BERT/RoBERTa classifiers in the realm of deep learning models. As the reviewer notes we do use the newer generation of LLMs like ChatGPT and FlanT5 for CAD generation as well as few-shot learning. For the few-shot Flan T5, we still note that RoBERTa models outperform them. \n\nWe repeated these experiments with finetuned Flan T5 (Flan T5-base because that is the model we could use with our current hardware and time constraints for the rebuttal). We finetuned Flan-T5 by treating the classification task as a sequence-to-sequence problem, utilizing the same model parameter settings (learning rate) as in the original Flan T5 paper [1], also over 5 runs. \n\nWe find similar performance as RoBERTa, with the finetuned Flan T5 model boosting the performance of models trained on Flan T5 and Polyjuice CADs. *However, the main tendencies seen in RoBERTa still hold, i.e, manual CADs are the best for hate speech, while a mix of manual and automated CADs is the best for sexism. Therefore, the results in our paper are not attributed to a particular model architecture.* We include the finetuned Flan T5 results for the combined OOD datasets, i.e., all OOD and Hatecheck in Table F of the rebuttal. We will include these results in the appendix of our paper.\n\n| construct   | mode         | Finetuned RoBERTa | Finetuned Flan T5 |\n|-------------|--------------|-------------------|-------------------|\n| hate speech | $aCAD_{FT}$  | 0.42 ± 0.066      | 0.563 ± 0.066     |\n|             | $aCAD_{GPT}$ | 0.609 ± 0.091     | 0.605 ± 0.059     |\n|             | $aCAD_{PJ}$  | 0.409 ± 0.087     | 0.524 ± 0.115     |\n|             | $OG$         | 0.532 ± 0.05      | 0.624 ± 0.057     |\n|             | $amCAD$      | 0.605 ± 0.084     | 0.585 ± 0.118     |\n|             | $mCAD$       | **0.673 ± 0.111** | **0.672 ± 0.086** |\n| sexism      | $aCAD_{FT}$  | 0.437 ± 0.099     | 0.561 ± 0.089     |\n|             | $aCAD_{GPT}$ | 0.595 ± 0.04      | 0.604 ± 0.024     |\n|             | $aCAD_{PJ}$  | 0.505 ± 0.119     | 0.565 ± 0.076     |\n|             | $OG$         | 0.591 ± 0.033     | 0.593 ± 0.025     |\n|             | $amCAD$      | **0.619 ± 0.03**  | **0.61 ± 0.046**  |\n|             | $mCAD$       | 0.596 ± 0.043     | 0.601 ± 0.032     |\n\nTable F: results of Finetuned RoBERTa vs. Finetuned Flan T5\n\n**whether CAD techniques help with automatically created instruction tuning dataset.** This is an intriguing suggestion and we would be very interested in working on this in the future. Our current work, however, shows that despite advances in LLMs, there are still questions about their few-shot and zero-shot labeling capabilities (as the reviewer observes ChatGPT’s data contamination issue, and Flan T5’s lackluster performance). And there is still the issue of computational cost — deploying Flan T5 is not accessible for all. Nonetheless, in the future, we would like to see how counterfactual prompts can improve zero-shot/few-shot labeling by LLMs. We thank the reviewer for this idea and the accompanying literature. \n\n**Commercial restriction on ChatGPT outputs.** Thank you for raising this important point. Our work serves as a proof of concept rather than commercial model building with the primary goal of facilitating computational social science research. Second, we build specialized models for the specific tasks of sexism and hate speech detection, instead of a general purpose labeling system like ChatGPT. Finally, legal use of LLM output, especially for research purposes is still nascent without any clear guidelines from research bodies. With all of this in mind, we believe we do not violate OpenAI’s policies, however, it is an important point and we will acknowledge it in the paper. \n\nReferences\n\n[1] Hyung Won Chung, Le Hou, Shayne Longpre, Barret Zoph, Yi Tay, William Fedus, Eric Li, Xuezhi Wang, Mostafa Dehghani, Siddhartha Brahma, et al. 2022. Scaling instruction-finetuned language models. arXiv preprint arXiv:2210.11416.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "1. The paper focuses on an important task in NLP --- harmful language detection. Reliance on spurious correlations in harmful language detection models can have serious social consequences, and it is important to study methods to reduce this reliance and improve generalization.\n\n2. The paper presents a thorough experimental study analyzing several counterfactual data augmentation methods (ChatGPT, FlanT5, Polyjuice), as well as mixtures of automatic and manually created counterfactual data. Furthermore, the paper presents great analysis on dataset difficulty, and thoroughly investigates the reasoning behind the lack of generalization of automatic counterfactual data. The paper also includes some good baselines, including few-shot prompting with ChatGPT / FlanT5.\n", "reasons_to_reject": "\n1. This paper would be stronger if experiments are conducted on stronger base model classifiers. The paper currently uses RoBERTa, which is a 2019 model. It would be interesting to see how these results generalize to newer or large language models, perhaps after fine-tuning the LLAMA models [1], or the FlanT5 models [2] themselves. This is important because it's likely that these base models are less dependent on spurious correlations in the first place (more in weakness #2), so the gap between automatic counterfactual data and manual counterfactual data will be lower. However, I appreciate the authors including ChatGPT few-shot prompting as a baseline, and agree that data contamination could explain its high performance on the task.\n\n2. In my opinion, data augmentation has had a rollercoaster journey in NLP literature. Task-specific data augmentation methods like CAD were more popular pre-2020. However, after the introduction of large language models like GPT-3, they fell out of favor [5] due to the strong generalization capabilities of base models (related to weakness #1). Nevertheless, I think data augmentation is making a comeback in 2023, with a lot of great work on using automatically generated instruction tuning datasets [3, 4] to create general-purpose instruction following models. **This weakness is probably highly out of the scope of the current study**, but I am curious to know whether CAD techniques help with automatically created instruction tuning datasets --> in other words, minimal instruction changes that change the underlying task / labels. This would make the study more relevant to the current paradigms.\n\n3. There are several commerical restrictions on using ChatGPT/GPT4 outputs, [6] says \"one may not use output from the Services to develop models that compete with OpenAI\". This may restrict the applicability of the proposed approach for downstream applications, and should be discussed further.\n\n[1] - https://arxiv.org/abs/2302.13971  \n[2] - https://huggingface.co/docs/transformers/model_doc/flan-t5  \n[3] - https://arxiv.org/abs/2212.10560  \n[4] - https://arxiv.org/abs/2306.04751  \n[5] - https://twitter.com/_jasonwei/status/1526589109422026752  \n[6] - https://openai.com/policies/terms-of-use  ", "questions_to_authors": "", "paper_topic_and_main_contributions": "Counterfactual data augmentation (CAD) is the process of augmenting a training dataset with minimally perturbed examples that flip the label [1]. The main reason to create this kind of data is to reduce the reliance of models on spurious correlations in the training data, thereby improving generalization.\n\nSince creating this kind of data with humans is expensive, this paper studies the efficacy of automatically creating counterfactual data using a pretrained language models. The paper thoroughly analyzes several data creation strategies using ChatGPT, Flan-T5, PolyJuice. This data is then used to train a RoBERTa classifier. The paper experiments on datasets in harmful language detection, and measures both in-domain and out-domain generalization of the trained model.\n\nOverall, the paper finds that human-written counterfactual data is the best, while ChatGPT-generated data is competitive. The authors thoroughly analyze their findings through information-theoretic dataset difficulty analysis, and find that FlanT5-generated data often does not flip the label, while ChatGPT-generated data is too easy to learn unlike human-written data.\n\n[1] - https://arxiv.org/abs/1909.12434", "excitement": 3, "reproducibility": 4, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"Missing_References": "The original RoBERTa citation (https://arxiv.org/abs/1907.11692) is missing  \ncite https://arxiv.org/abs/2107.00753"}, "extra_text": {"Typos_Grammar_Style_and_Presentation_Improvements": "Fig 1 hard to read. Perhaps with the extra 9th page, it can be made bigger vertically, and the legend can use full names instead of shortforms? The legend could also be moved outside the plot.\n\nIt will be helpful to space out the paragraphs a bit more, shorten them and add more topical sentences per paragraph using the extra 9th page. This will help with the paper's readability."}}]

Author rebuttal:

Meta-review: This work explores various ways to generate Counterfactually Augmented Data creation, such as through ChatGPT, FLAN-T5 and PolyJuice. Authors show that aside from manual CADs, ChatGPT is also an effective tool for such data augmentation. Author has primarily used Finetuned RoBERTa classifier and the task of harmful language detection to showcase the efficacy. Reviewers agree that the discussion and comparison around manual vs automated data augmentation is an interesting contribution. Most of the points such as manual evaluation of the generated data, concentrating only on RoBERTa has been addressed by the authors during rebuttal period. It is interesting work and the authors should incorporate the suggestions made by the reviewers to the best of their capability.
Decision: Accept-Main