LogicAttack: Adversarial Attacks for Evaluating Logical Consistency of Natural Language Inference
Authors: Mutsumi Nakamura
Santosh Mashetty
Mihir Parmar
Neeraj Varshney
Chitta Baral
Venue: EMNLP 2023 Findings (2023)
Keywords: Logical Reasoning
Large Language Models
Natural Language Inference
Adversarial Attacks
TL;DR: We propose a LogicAttack, a method to attack NLI models using diverse logical forms of premise and hypothesis, providing a more robust evaluation of their performance.

Abstract: Recently  Large Language Models (LLMs) such as GPT-3, ChatGPT, and FLAN have led to impressive progress in Natural Language Inference (NLI) tasks. However, these models may rely on simple heuristics or artifacts in the evaluation data to achieve their high performance, which suggests that they still suffer from logical inconsistency. To assess the logical consistency of these models, we propose a LogicAttack, a method to attack NLI models using diverse logical forms of premise and hypothesis, providing a more robust evaluation of their performance. Our approach leverages a range of inference rules from propositional logic, such as Modus Tollens and Bidirectional Dilemma, to generate effective adversarial attacks and identify common vulnerabilities across multiple NLI models. We achieve an average ~53% Attack Success Rate (ASR) across multiple logic-based attacks. Moreover, we demonstrate that incorporating generated attack samples into training enhances the logical reasoning ability of the target model and decreases its vulnerability to logic-based attacks. Data and source code are available at https://github.com/msantoshmadhav/LogicAttack.

LogicAttack: Adversarial Attacks for Evaluating Logical Consistency of Natural Language Inference
Mutsumi Nakamura" Neeraj Varshney
Santosh Mashetty* Mihir Parmar*
Chitta Baral
School of Computing and AI, Arizona State University {mutaumi, smas hett, mparmar3, nvarshn2, ch1 tta (eauc.edu
Abstract
(Brown et al., 2020). However, a crucial question remains: do these models generate logical output on NLI, or do they rely on simple heuristics and learn shortcuts to generate their results? Hence, we believe that logical reasoning is a critical com- ponent of NLI systems and should be subject to evaluation.
Recently Large Language Models (LLMs) such GPT-3, ChatGPT, and FLAN have led to impressive progress in Natural Language Infer- ence (NI.) tasks. However, these models may rely on simple heuristics or artifacts in the eval- uation data to achieve their high performance, which suggests that they still suffer from logical inconsistency. To assess the logical consistency these models, we propose LogicAttack, method to attack NLI models using diverse log- ical forms of premise and hypothesis, providing robust evaluation of their performance. Our approach leverages range of inference rules from propositional logic, such as Modus Tollens and Bidirectional Dilemma, generate effective adversarial attacks and identify com- mon vulnerabilities across multiple NLI mod- els. We achieve an average 53% Attack Suc- cess Rate (ASR) across multiple logic-hased attacks. Moreover, we demonstrate that incor- porating generated attack samples into training enhances the logical reasoning ability of the target model and decreases its vulnerability to logic-based attacks !
Here, aim to address important question: "Are widely used NLI models exhibit logical con- sistency?" Although attempts have been made create adversarial attacks for NLI (Williams et al., 2022; Chien and Kalita, 2020), and also to evaluate the logical consistency of LLMs across a range of tasks (Gaskell et al., 2022), they do not consider logic-based attack generation?. To bridge this gap, propose LogicAttack, method to create logic- based adversarial attacks that utilize a variety of inference rules from propositional logic (PL). Here, we utilize PL since pre-training data (usually data from the web or books) lacks sufficient explicit relations (e.g., implies, and, not, or, etc.) between propositions in different inference rules, making essential to evaluate reasoning ability of models on such logic-based relationships. Specifically, we employ six inference rules to generate attacks from PL. Table 1 depicts example instances from the SNLI (Bowman et al., 2015) on which the LogicAt- tack technique applied to create an adversarial attack. In Table 1, we give examples of some per- turbed (i.e., adversarial) samples created through the application of logical rules. These samples were generated using (premise, hypothesis) pairs with "entailment" labels exclusively.
1 Introduction
Recently, LLMs have demonstrated impressive per- formance on Natural Language Inference (NLI) tasks (Raffel et al., 2020). Prior to the introduc- tion of prompt paradigm, the top-performing NLI systems relied heavily on pre-training, followed by fine-tuning on labeled task-specific data (Nie et al., 2020a). However, with the emergence of prompt-based LLMs, these models have achieved good performance (~ 90%) on NLI tasks with minimal training data (i.e., shw-shot learning) (Liu et al., 2023). These systems have demonstrated robustness to variations on syntax and lexical level, and the ability generalize beyond training data
In this work, evaluate range models, in- cluding both fine-tuned models on NLI such RoBERTa (Liu al., 2019a), and BART (Lewis et al., 2020); and prompt-based models such as GPT-4, GPT-3 (Brown et al., 2020), ChatGPT and FLAN-T5 (Chung et al., 2022), using LogicAt- tack. Experimental results show that the logic-
'Data and source code are available at hctps:// github. wttchu...cm///ne http///aattshmmmaaa//ooooooooooo "Equal Contribution
DDetailed related work is discussed in Appendix A

---

Name
Formal Expressions
Atlack Examples
Original I
[bu -+ Ro)
Hypullanis: A mun gas hsircut.
Premise: An older man wessing salon drape getting a hairear.
Original 2
(pu Ro)
Hyputhosis A day none
Premise: The dog raus towards the hall.
Madus
(pi - lr) (im)))
Premise: an
wearlng silon drape getting haircut, then gets huireur. gols luireni.
Tollons
Hopothesis: older man wearing a salon drape getting haircur.
Promise: Im older man watrrng salon drspe potling haircut, then mon gets huircull And the dog ruts towards the ball. then a dog nuns. But exter an older man wearing a salon drape getting a haireut or the dog runs sowards the ball.
Constructvee Dilemma
((u -s Au) (Pa -> Au) A Seu V (hu viaa
Hypothesis: Either a man get a haircut or a dog runs.
Premise: an older man wearing salen drape getting haircur, then itan pets a haircut. And if the dog runs towards the ball, then a dog runs. But exther no man haircut or no dog runs.
Desinativve Dilemna
((n (o) A do Whll fron V
Hypuilhesis Either no older wearing salon draps getling a hommuu towards ball.
does
Promiies older wearing
drape getting haircut, then morn gets haiecut. ball. a dog runs.
Bidurctional Dilemma
(in + Ai -+ Aa) (pu v v-raa) H (fu v vimp
And dog ruts But un okler man wessing sako drage getting a haireut dog ruts. Hypuibosis: Filher man gets hsircul the dug does not ran lowards holl.
Transpatation
(Gu -13 (- (-
Hypulhosis: If no man gets a huincu, then no older min worring a salun drape is galing a haircut
Premise: IF older man wearing a salon drape getting lnircct, theo stas gets a haircut.
Transpatition
(-hi pi3 (6p. - Ai)
Hyputhesis: If an obder man worning salon dnge geiing luireni thmm
Premise: to man ges briscut, then no coder man wearing stlon drape getting hnircut.
hainest
Mutefal
(x)+AA) - (3
Premise: an older wearing
drape getting huircut, then gets huireur.
Implicaiion!
Rypotbesis:
warring salon drape getling a hiimat man gols
Implicatio?
Muteial
Crpu M.hh by hhd
Hyputhosis: If an older man weoring a salon dnge gaiing a luireut, then a man grts a huirout.
Premise: Either to older mun weating a salos drpp getting haircut or mast gets huireur.
Hypuihesis
Negute
(p + Ad)
Hypulhoiis No mon geis huineat.
Premise: An older man weasing salon drspe getting a haireat.
Table I: Example of all nine adversarial attacks generated by utilizing six inference rules from propositional logic and negation. Here, Original and Original represent two data instances from the evaluation set SNLI.
based attacks significantly reduce model perfor- mance, achieving higher ASR of ~ 50% on SNLI and ~ 55% MNLI, indicating that these models rely simple heuristics rather than using desirable reasoning processes. Additionally, we enhance the robustness of RoBERTa by fine-tuning a limited set of attack samples (~~ 9k) created from SNLI. Results demonstrate that fine-tuning the model on these samples maintains its accuracy on the original evaluation set and significantly decreases the ASR on SNLI. This indicates that LogicAttack is useful for the robust evaluation of NLI models and for en- hancing their logical capabilities. Furthermore, our analysis of results leads to several interesting find- ings. Overall, this study highlights that models still rely on simple heuristics for generating outputs for NLI, emphasizing the need to enhance their logical reasoning capabilities.
perturbing p, and h. We leverage various infer- ence rules from the PL to perturb (p, h) pair hav- ing entailment relation into (p', h²) keeping the en- tailment relationship, but being able to fool many models to infer otherwise. The process of creating (p', h²) from (p, h) using different rules denoted as LogicAttack. By generating a set of diverse perturbations (P where Y(y h1)) E P)), we aim to maximize the likelihood of fooling the model.
2.2 Attack Strategies
In order to generate diverse set of perturbations, we carefully select six inference rules from PL: (1) Modus Tollens, (2) Constructive Dilemma, (3) De- structive Dilemma, (4) Bidirectional Dilemma, (5) Transposition, and (6) Material Implication. Addi- tionally, we investigate the potential for generating adversarial attacks by negating the hypothesis (h) (denoted as "Negate Hypothesis"". A formal repre- sentation of each inference rule and corresponding examples of generated adversarial attacks is pre- sented in Table 1. Morcover, detailed explana- tion of each inference rule and negate hypothesis method presented in Appendix B.
2 LogicAttack
This section provides a detailed description of task formulation, our attack strategies, and algorithm.
2.1 Task Formulation
NLI models train to Iearn f hp + y, where p denoted premise, h denotes hypothesis, and y E (entailment, contradiction, neutral). Here, we probe NLI models using an adversarial attack by
2.3 Attack Algorithm
Here, we present Algorithm 1 that demonstrates the procedural steps to perform LtgicAttack using Modus Tollens on any NLI model (M). The aim is

---

have (p, 1t) pair such that p entails h. then apply Modus Tollens generate perturbed (p', h²) pair. Note that, perturbations using inference rules such as Modus Tollens will not alter its entailment label.
gets haircut. No man gets a haircut,", and h' is "No older man wearing a salon drape is getting a haireut," Algorithm provides a demonstration of LogicAttack using the Modus Tollens. However, a similar algorithm applies to generate attacks for other inference rules illustrated in Table 1.
Algorithm LogicAttack using Modus Tollens 1: Input: NLI Model M f(p, + y. Evalua- tion set T
Experiments and Results
2: Output: A (Attack Success Rate)
3.1 Experimental Setup
3: Function: Negation(s) (returns negation of sentence s)
Dataset To generate attacks (Algorithm 1), we utilize the evaluation set of SNLI (Bowman et al.. 2015) and MNLI (Williams et al., 2018a). In par- ticular, we only generate attacks for the premise and hypothesis pairs with the "Entailment" label. In addition, we use k entailment instances from the SNLI train set to generate attack samples for training purposes.
4: for (p, h. v) GTo do
5: if y = Entailment then
6:
if f h) == Entailment then premise(p, h) = ((p + h)
7:
N Negation(h))
8:
hypothesis(p.. h)) = (Negationpp)
9:
p' - premise(p. (p,
10:
h' <- hypptheesis(p..
Models We evaluate models on three different configurations: (i) single-task, (ii) multi-task, and (iii) prompting. For single-task, we evaluate the RoBERTa- large fine-tuned on the SNLI and MNLI, respectively. For multi-task, we evaluate two mod- els: RoBERTa-large, and BART-large fine-tuned SNLI, MNLI, FEVER-NLI (Thorne al., 2018), and ANLI (Williams et al., 2022). For prompt- based models, we evaluate GPT-4, GPT-3, Chat- GPT, and FLAN-TS using zero-shot and few-shot prompts. Appendix C provides prompts and few- shot results are presented in Appendix D.
M f('
12:
if != Entailment then InCorrect InCorrect
13:
14:
A
InCorvedt (T)
In Algorithm 1, (p. h, y) denotes the original pair of premise, hypothesis, and label; (p', h') denotes perturbations; and I denotes model generated label for (p', Additionally, Algorithm incorporates the function Negation(s). which is responsible for generating the negation of any given sentence (s). In this work, we prompt GPT-3 to generate negations. Note that, generating the negation of logical sentences can be complicated, hence, it is important to provide multiple in-context examples of how negated sentences should be generated for different logical forms. To get a better sense of the correctness of our method, 500 random sentences from SNLI were negated using N Negation(s) and reviewed by an author. The precision for these negations is ~ 98%. The prompt used for generat- ing negation is presented in Appendix C.
Here, we conduct two experiments: (i) evaluation of models using LogicAttack, and (ii) fine- tuningingg with attack instances. In (i), we evalu- ale cach model on the evaluation data of SNLI and MNLI, and identify the samples where the model generates the correct label. Subsequently, we apply Algorithm 1 to these selected samples to create at- tacks, which are then used to evaluate the model's performance. In (ii), we aim to investigate the im- pact of incorporating logic-based attack sentences into the training set. To explore this, we generate 9k attack instances by randomly selecting 11 pairs from the training set of SNLI. We perform fine- tuning the RoBERTa (large) model using both the attack samples and the original SNLI training set. More details about experiments are presented in Appendix E.
Experiments
In Algorithm 1, premise(p, h) and hypothesissp,hh h) play a crucial role in cre- ating logic-based attacks. To illustrate this, let's consider an example where p is "An older man wearing salon drape getting haireut.", h is "A man gets haireut.", and y is "Entailment". thus (p + h). Now, we apply the Modus Tollens (formally expressed as ((p h) A -h) + -p), and get a (p', N/). The resulting p' is "If an older man wearing a salon drape getting a haircut, then a man
Metric As defined (Gaskell et al., 2022), we are evaluating the performance of LogicAttack on each model using Attack Success Rate (ASR) and

---

Single-Tase Task
Multi-Task
Prompting
Dataset
Attack Type
value
RoBERIa
RoBERTa
BART
FLAN-TS
GPT33
ChaiGPT
GPT4
Modus Tollens
99.7
94.1
45.5
99.9
97.8
96,3
50.6
61.0
Constructive Dilemma
34.7
0.1
0.6
34.7
11.3
9.0
60.4
Destructive Dilemma
93.6
24.9
87.3
90.4
46.7
18.8
57.9
Bidirectional Dilemma
73.4
67.0
22.5
15.6
63.5
16.3
11.7
59.1
Transposition
99.7
82.5
99.1
82.0
79.6
25.0
22.7
58.6
SNLI
Transposition
95.4
40.0
94.4
94.2
46.2
44.0
16.2
58.6
Material Implication
98.6
94.8
94.5
54.6
25.5
11.1
59.8
Material Implication 2
85.6
93.5
46.1
33.0
35.4
12.9
29.8
59.8
Negate Hypothesis
1.1
3.2
1.9
0.6
35.0
15.4
9.7
95.2
Avg.
76.1
56.2
48.7
56.4
59.7
32.7
20.0
63.4
Modus Tollens
96.6
81.1
68.1
94.8
94.6
96.1
72.3
62.3
Constructive Dilemma
23.8
2.8
0.7
7.0
26.9
4.6
0.0
62.2
Destuuctvv Dilemma
90.5
58.4
64.0
86.9
96.5
94.8
63.2
60..
Bidirectional Dilemmna
85.6
68.9
52.8
49.4
70.1
58.4
30.6
61.3
Transposition
91.5
78.1
67.1
57.3
47.1
60.5
MNLI
Transposition
90.4
92.3
95.4
33.6
32.7
42.9
60.5
Material Implication
88.9
70.4
72.9
78.6
45.6
53.1
40.7
61.4
Material Implication 2
75.8
79.3
64.9
43.2
18.9
7.6
69.9
61.44
Negate Hypothesis
10.0
5.9
11.6
9.1
5.6
94.2
Avg.
73.5
59.9
58.3
59.9
51.7
46.0
41,4
64.9
Table 2: Evaluation of different models in terms of ASR (%) using SNLI and MNLI. Higher ASR is better.
100
are between 58% and 62% and their difference is relatively small, However, the LogicAttack by "Negated Hypothesis"' was unsuccessstnn on all mod- els, and the average F1 value is ~ 95%. meaning that sentences that have high overlapping rate with the original sentences, yetjust by negating the hypothesis, the models predict correctly on them. However, do not seek minimize FI since low Fl is bad ("adversarial" implies minimal per- turbations), and Fl value 60% preferable for effective attacks (Gaskell et al., 2022).
91.6
91.6
Baseline
Proposed
Performance Measure (%)
60
$6.1
40
Accuracy
ASR
Figure I: Performance of baseline (fine-tune with SNI.)) and proposed (fine-tune with SNLI attack samples) models. Higher accuracy and lower ASR better.
of negations vs. ASR ASR tends to become higher when the ratio of (# of negated sentences / # of original sentences) is larger, i.e., the num- ber of negated sentences in the premise/hypothesis is higher. Constructive, Destructive, and Bidirec- tional Dilemma utilize the same number of logical AND, logical OR, implications (-+), and original sentences, yet they have different ASR because of difference the number of negations and where their negations appear, in the premise or hypothesis. Destructive Dilemma uses the maximum number of negations (four) in one pair of premise and hy- pothesis, among these logic rules, and also has the highest ASR. Modus Tollens also has high ASR, however, Modus Tollens uses only four sentences from the SNLI test set while Destructive Dilemma uses eight sentences. Appendix G.I presents statis- tics negations in each inference rule.
Fl sentence overlap score (F1). To demonstrate the similarity between generated and original instances, also incorporate SimCSE (Gao al., 2021) and BERTScore (Zhang* et al., 2020) (results presented in the Appendix F).
3.2 Results and Analysis
Here, Table 2 represents ASR of each model evalu- ated using LogicAttack, and Figure shows Aceu- racy and ASR of baseline and proposed models.
ASR values tend become higher when Fl val- ues are lower. From Table 2, we can observe that LtgicAttack achieves high ASR for the most PL inference rules. Their Fl value averages

---

Larger model are less prone attacks. From Table 2, it is evident that as the size of the prompt- ing model and the amount of pre-training data in- crease, ASR decreases. Moving from GPT-3 to GPT-4, there a drop in ASR, where GPT-3 shows 59.7%, whereas GPT-4 shows 20.0% for SNLI, and 51.7% and 41.4% for MNLI, respectively. To in- vestigate the improvements in mitigating ASR by GPT-4 compared to GPT-3, randomly selected 20 instances in which GPT-4 succeeded while GPT- 3 failed and applied the chain-of-then of-thought prompt- ing technique to analyze their reasoning steps for predicting the final answer. While evaluating the reasoning chain generated by GPT-4, we observed its ability to establish logical relations between the premise and hypothesis, thus performing logical in- ference generate final answer. In contrast, GPT-3 simply compares premise and hypothesis (without any logical connections in majority of cases) for generating final answer, leading to a lack of logi- cal consistency and, in some cases, contradictory results instead of entailment. Thus, GPT-4 has im- proved performance (low ASR) compared to GPT- 3. However, GPT-4 still exhibits a relatively low ASR for certain inference rules (c.g., <50% for Modus Tollens). Further discussion (i.e., prompt and examples) is presented in Appendix G.2.
ASR. Overall, our findings suggest that LogicAt- tack provides valuable framework for conducting logically consistent evaluations of models.
Limitations
In this work, we explore six inference rules from propositional logic, however, this study can be ex- tended further incorporate more inference rules to create logic-based attacks. Furthermore, we plan to extend our work to evaluate more models and also a range of other NLI datasets. In addi- tion, this work only provides the logical consistent evaluation of NLL, however, this method can be extended to other natural language understanding tasks such as question-answeriigg and other reason- ing tasks. Furthermore, the scope of this work is limited in terms of logical conjunctions and disjunc- tions where we use simple word "and" for conjunc- tions and "or" for disjunctions in our experiments. To this end, different ways to create logical con- junctions and disjunctions can be explored since it can be more complicated in the case of logic.
Acknowledgement
We thank the anonymous reviewers for constructive suggestions, and the Research Computing (RC) at Arizona State University (ASU) for providing com- puting resources for experiments. We acknowledge support by NSF grant 2132724 and a 2023 Spring Amazon Research Award (ARA).
Effect of Fine-tuning with Attack Samples From Figure 1, it becomes evident that the model, when fine-tuned using small set of attack samples (~ 9k), achieves lower ASR (0.7%) compared to the baseline (5).1%). Additionally, the proposed model maintains its performance on the original SNLI evaluation set (91.655 (.)...) This observation highlights that incorporating a small number of at- tack samples during training does not hinder the model's 's capacity to effectively perform the NLI task on the original (premise, hypothesis) pairs.
References
Samuel R Bowman, Gabor Angeli, Christopher Potts, and Christopher D Manning. 2015. A large annotated corpus for learning natural language inference. In Conference on Empirical Methods in Natural Lan- guage Processing, EMNLPP 2015, pages 632-642. Association for Computational Linguisties (ACL).
4 Conclusions
Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Ncelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, al. 2020. Language models are few-shot learners. Advances neural information processing systems, 33: 1877-1901.
We introduce LogicAttack. a novel method for gen- erating logic-based attacks to assess the robustness of NLI models. We evaluate a range of models on NLI, considering single-task, multi-task, and prompting. Experimental results demonstrate that these models are vulnerable to logic-based adver- sarial attacks, as evidenced by their higher ASR. Additionally, we investigate the impact of fine- tuning models with attack samples and observe a significant improvement in their logical reason- ing capabilities, leading to a substantial decrease in
Oana-Maria Camburu, Tim Rocktäschel, Thomas Lukasiewicz, and Phil Blunsom. 2018. e-snli: Natu- language inference with natural language expla- nations. Advances in Neural Information Processing Systems, 31.
Alvin Chan, Yi Tay, Yew-Soon Ong, and Aston Zhang 2020. Poison attacks against text datasets with con- ditional adversarially regularized autoencoder. In

---

Findings of the Association for Computational Lin- guistics: EMNLP 2020, pages 1175-4188 Online. Association for Computational Linguistics.
Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Man- dar Joshi, Danqi Chen, Omer Levy, Mike Lewis. Luke Zettlemoyer, and Veselin Stoyanov. 2019b. Roberta: A robustly optimized BERT pretraining approach. CoRR, abs/ 1997.11999999
Wei-Lin Chiang. Zhuohan Li. Zi Lin, Ying Sheng. Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang. Yonghao Zhuang, Joseph E. Gonzalez, Ion Stoica, and Eric P. Xing. 2023. Vicuna: An open- source chatbot impressing gpt-4 with 90%* chatgpt quality.
Yixin Nie, Adina Williams, Emily Dinan, Mohit Bansal, Jason Weston, and Douwe Kiela. 2020a. Adversarial NLE: A new benchmark for natural language under- standing. In Proceedings of the 58th Annual Meet- ing of the Association for Computational Linguistics, pages 4885-4900 Online. Association for Computa- tional Linguistics.
Tiffany Chien and Jugal Kalita. 2020. Adversarial anal- ysis of natural language inference systems. In 2020 IEEE 14th International Conference on Semantic Computing (ICSC), pages 1-8, IEEE
Yixin Nie, Adina Williams, Emily Dinan, Mohit Bansal, Jason Weston, and Douwe Kiela. 2020b. Adversarial NLI: A new benchmark for natural language under- standing. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics. As- sociation for Computational Linguistics.
Hyung Won Chung, Hou, Shayne Longpre, Bar- ret Zoph, Yi Tay, William Fedus, Eric Li, Xuezhi Wang, Mostafa Dehghani, Siddhartha Brahma, et al. 2022. Scaling cntruction-inetunne language models. arXiv preprint arXiv:2210.11 11416.
Adam Poliak. 2020. A survey on recognizing textual entailment as an NLP evaluation. In Proceedings of the First Workshop on Evaluation and Comparison of NLP Systems, pages 92-109, Online. Association for Computational Linguistics.
Tianyu Gao, Xingeheng Yao. and Danqi Chen. 2021. SimCSE: Simple contrastive learning of sentence em- beddings. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Process- ing, pages 6894-6910, Online and Punta Cana, Do- minican Republic. Association for Computational Linguisties.
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. 2020. Exploring the limits of transfer learning with a unified text-to-text trans- former. The Journal of Machine Learning Research, 21(1):5485- 5551.
Alexander Gaskell, Yishu Miao, Lucia Specia, and Francesca Toni. 2022. Logically consistent adversar- ial attacks for soft theorem provers. In International Joini Conference on Artificial Intelligence.
Ioana Baldini Soares, Chhavi Yadav, Payel Das, and Kush Varshney. 2023. Keeping up with the language models: Robustness-biat interplay in nli data and models. In Anmual Meeting of the Association for Computational Linguisties.
Mike Lewis, Yinhan Liu, Naman Goyal, Marjan Ghazvininejad, Abdelrahman Mohamed, Omer Levy. Veselin Stoyanov, and Luke Zettlemoyer. 2020. BART: Denoising sruuence-to-sqqueeee for natural language generation, translation, and com- prehension. In Proceedings of the 58th Annual Meet- ing of the Association for Computational Linguistics, pages 7871-7880, Online. Association for Computa- tional Linguistics.
pre-training
Aame Talman, Marianna Apidianaki, Stergios Chatzikyriakidis, and Jörg Tiedemann. 2021. NLI data sanity check: Assessing the effect of data corruption on model performance. In Proceedings of the 23rd Nordic Conference on Computational Linguistics (NoDaLiDa), pages 276-287, Reykjavik, Iceland (Online). Linköping University Electronic Press, Sweden.
Alisa Liu, Swabha Swayamdipta, Noah A. Smith, and Yejin Choi. 2022. WANLI: Worker and Al collabora- tion for natural language inference dataset creation. In Findings of the Association for Computational Linguistics: EMNLP 2022, pages 6826-6847, Abu Dhabi, United Arab Emirates. Association for Com- putational Linguistics.
James Thorne, Andreas Vlachos. Christos Christodoulopoulos, and Arpit Mittal. 2018. FEVER: large-scale dataset for fact extraction and VERification. In Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume (Long Papers), pages (199819, New Orleans, Louisiana. Association for Computational Linguisties.
Pengfei Liu, Weizhe Yuan, Jinlan Fu, Zhengbao Jiang, Hiroaki Hayashi, and Graham Neubig, 2023. Pre- train, prompt, and predict: A systematic survey of prompting methods natural language processing. ACM Computing Surveys, 1-35):1-35.
Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, Aurelien Rodriguez, Armand Joulin, Edouard Grave, and Guillaume Lample. 2023. Llama: Open and efficient foundation language models. arXiv preprint 2302
Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Man- dar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. 2019a. Roberta: robustly optimized bert pretraining ap- proach. arXiv preprint arXiv: 1907. 1692..

---

Neeraj Varshney, Pratyay Banerjee, Tejas Gokhale, and Chitta Baral. 2022a. Unsupervised natural language inference using PHI triplet generation. In Findings of the Association for Computational Linguistics: ACL 2022. pages 2003-2016, Dublin, Ireland. As- sociation for Computational Linguistics.
Neeraj Varshney, Swaroop Mishra, and Chitta Baral. 2022b. Investigating selective prediction approaches across several tasks in IID, OOD, and adversarial settings. In Findings of the Association for Compu- tational Linguistics: ACL 2022, pages 1995-2002, Dublin, Ireland. Association for Computational Lin- guistics.
Adina Williams, Nikita Nangia, and Samuel Bowman. 2018a. A broad-coverage challenge corpus for sen- tence understanding through inference. In Proceed- ings of the 2018 Conference of the North American Chapter of the Association for Computational Lin- guistics: Human Language Technologies, Volume 1 (Long Papers), pages 1112-1122. Association for Computational Linguistics.
Adina Williams, Nikita Nangia, and Samuel Bowman. 2018b. A broad-coverage challenge corpus for sen- tence understanding through inference. In Proceed- ings of the 2018 Conference of the North American Chapter of the Association for Computational Lin- guistics: Human Language Technologies, Volume I (Long Papers), pages 1112-1122, New Orleans, Louisiana. Association for Computational Linguis- tics.
Adina Williams, Tristan Thrush, and Douwe Kiela. 2022. ANLIzing the adversarial natural language inference dataset. In Proceedings of the Society for Computation Linguistics 2022, pages 23 54, line. Association for Computational Linguistics.
Linyi Yang, Shuibai Zhang, Libo Qin, Yafu Li, Yi- dong Wang, Hanmeng Liu, Jindong Wang, Xing Xie, and Yue Zhang. 2023. GLUE-X: Evaluating natu- ral language understanding models from an out-of- distribution generalization perspective. In Findings of the Association for Computational Linguistics: ACL 2023, pages 12731-12750, Toronto, Canada. Association for Computational Linguistics.
Tianyi Zhang*, Varsha K Felix Wu*, Kilian Q Weinberger, and Yoav Artzi. 2020. Bertscore: Eval- uating text generation with bert. International Conference on Learning Representations.

---

A Related Work
each attack, we introduce some notations: p - h, where p represents the premise, h represents the hy- pothesis, and -> denotes the "Entailment" relation between and h. Here, to generate attack using modus tollens, transposition, material implication, and negate hypothesis, we use only one (p, h) pair to generate attacks. However, we use two (pi, h1) and (p2, h22 pairs to generate attack for construc- tive, destructive, and bidirectional Dilemma.
Natural Language Inference (NLI) is extensively studied in NLP and many datasets and models have been proposed to effectively perform NLI tasks (Camburu et al., 2018; Soares et al., 2023; Tal- man et al., 2021; Liu et al., 2022; Bowman et al., 2015; Williams et al., 2018b; Poliak, 2020). Varsh- ney et al. (2022a) proposed number of sentence transformations to procedurally create NLI train- ing instances. To evaluate the robustness of these NLI models, one thread of work evaluates these models on out-of-domail datasets (Varshney et al., 2022b; Yang et al., 2023), Another thread aims at creating different adversarial attacks on NLI mod- els (Williams et al., 2022; Chien and Kalita, 2020; Chan et al., 2020; Thome et al., 2018). For in- stance, Adversarial NLJ (Nie et al., 2020b) one of the first attempts that introduces a dataset of carefully crafted adversarial examples to evaluate and assess the robustness and generalization capa- bilities of language models in the context of NLI tasks. Chien and Kalita (2020) highlights creat- ing adversarial datasets to challenge NLI models which revealed failure in generalizing on unseen examples. Moreover, Chan et al. (2020) introduced poison attack technique to find vulnerability in NLI system.
Modus Tollens Modus Tollens is described as: "If then h; not h; therefore not p". Using this rule, we generate new premise, p': p + h A -h, and new hypothesis. h1: -p.
Transposition Transportation is described as: "If then h is equivalent to not then not p". We split this rule to two parts since it involves the equivalency: (i) Transportationl: using this rule, we generate new premise, p': p - h. and new hypothesis. N/: -h -p, and (ii) Transportation2: using this rule, we generate new premise, p': -h -, and new hypothesis, N: p-+ h.
Material Implication Material Implication is de- scribed as: "If then h is equivalent to not p or h". Similar to transposition rule, we split this rule to two parts since it involves the equivalency: (i) Material Implicationl: using this rule, we generate new premise, p': p + h, and new hypothesis, h': -p V h. and (ii) Material Implication2: using this rule, we generate new premise, p': -p h, and new hypothesis, h:: p h.
However, these adversarial attack techniques do not consider logic-based techniques to create attack since logical reasoning is critical component of NLI system and subject evaluation. Previous efforts have been made to assess the logical consistency of LLMs on range of other tasks. Most recent study by Gaskell et al. (2022) introduced framework called LAVA which aims to address a problem of logical inconsistency by combining an adversarial and gen- erative process for Soft -rovvnng (STP). However, Gaskell et al. (2022) do not utilize any logic-based inference rules create adversarial at- tacks. Motivated by this, propose LogicAttack, a framework evaluate logical consistency of NLI models by creating logie-based attacks.
Negate Hypothesis Since we have pairs of two sentences p and h, where "if p then ht", we negated its conclusion so that will be "if p then -h" and see if we can obtain the contradiction label. Here, we generate a new premise to be p': and a new hypothesis to be M: -h.
Constructive Dilemma Constructive Dilemma is described as: "If p1 then h1; and if p2 then hg; but p1 or P2; therefore h1 or h22" Using this rule, we generate new premise, p¹: (p1 - h1) A (p2 >> hz) A (p1 V p2), and new hypothesis, h!: h1 V h2-
B Attack Strategies
Detailed explanation of inference rules employed to generate a Table (main paper) provides examples of generated attack corresponding to each rule. To provide a more in-depth understanding of
Destructive Dilemma Destructive Dilemma is described as: "If p1 then hi; and if p2 then h2g but not h or not hę; therefore not p1 or not p2". Using this rule, we generate new premise, p/: (p) -> h1)A(p2 + (Mh-h--Vh)) and new hypothesis, W: -p V -p2.
'Part of the information in this section is adapted from https: ///////n.. /ww.///wikkkk. wikkieee pedt a org/wikk1 Propositional irapositional_calcllllo calculus

---

Bidirectional Dilemma Bidirectional Dilemma is deseribed as: "If pi then hy; and if p2 then hi; but p1 or not hez therefore h1 or not p2". Using this rule, we generate new premise, p': (p1 7 h1) (p2 -> h2) V-22), and new hypothesis,
ago.
sentence: It was so not good.
negation: was not so not good.
sentence:
She presented not very confidently.
N: h1 -p2
negation: She did not present not very confidently.
Prompts
sentence: It was not great contribution. negation: It was a great contribution. sentence: They need a food that is bitter. negation: They don't need a food that is bitter.
C.1 Negation Prompt
In order to create negated sentences, we have done multiple evaluations with GPT-3, Vicuna (Chiang al., 2023) and Llama (Touvron et al., 2023) based models. According the initial experiments, we found that GPT-3 was giving much better results. We handcrafted some negated sentence examples and included them as part of a prompt in GPT-3 to generate negated sentences. We sampled over 500 generated negated sentences and found their accu- racy to be around around 98%. For negation gener- ation, the parameters used for GPT-3: temperature 0.7, max-tokens 512, top-p 1, frequency- penalty 2, presence-penalty = 2.
sentence:
The children are playing. negation: The children are not playing. Provide negation of the next sentence by following the examples above:
C.2 Prompts for Experiments
Zero-Shot Prompt The following is the format of prompt used for the experiments using GPT-3, ChatGPT, and GPT-4 with zero-shot:
The following is the prompt used to generate negated sentences:
In this task, you are given two sentences (Premise and Hypothesis). Your task is to identify the Label (velation) between the given Premise and Hypothesis. If both sentences agree with each other then return "entailment"; if both sentences indicate opposite view from each other then relurn "contradiction": and there is no relation between two sentences or relation can not be identified then return "neutral".
sentence: A dog loves to play in the
park.
negation: No dog loves to play in the park.
sentence: An apple red.
negation:
No apple is red.
sentence: Some dogs like to sleep on the grass.
negation: No dog likes to sleep on the grass.
Format:
sentence: Everybody is playing.
(Premise is sentence that describes condition which logical argument is based)
Premise:
negation: Somebody is not playing.
sentence: Everyone likes sunny days.
negation: Someone does not like sunny days.
Hypothesis: (Hypothesis is sentence which a plausible conjecture or explanation which can be proved or disproved)
sentence: Every school has a math class.
negation: Some schools do not have a math class.
Label: entaiimentccmtraaicttinnnnnn
sentence: Every apple is sweet.
negation: Some apples are not sweet.
Identify the Label (relation) between the following Premise and Hypothesis Premise: this church choir sings to the masses as they sing joyous songs from the book church
sentence: Jill is having hot soup.
negation: Jill is not having hot soup.
sentence: We don't watch the movie.
negation: We watch the movie.
sentence: He was there not long ago.
Hypothesis: the church filled with song
negation: He was not there not long

---

Label:
6-Shots Prompt The following is the format of prompt used for the experiments using GPT-3, ChatGPT, and GPT-4 with 6-shots:
3-Shots Prompt The following is the format of prompt used for the experiments using GPT-3, ChatGPT, and GPT-4 with 3-shots:
In this task, you are given sentences (Premise and Hypothesis). Your task is to identify the Label (relation) between the given Premise and Hypothesis. If both sentences agree with each other then return "entailment"; if both sentences indicate opposite view from each other then return "contradiction"; and there is relation between two sentences relation can not be identified then return "neutral"
In this task, you are given two sentences (Premise and Hypothesis). Your task identify the Label (relation) between the given Premise and Hypothesis. If both sentences agree with each other then return "entailment"; if both sentences indicate opposite view from each other then return "contradiction", and there is relation between two sentences relation can not be identified then return "neutral"
Format:
Format:
Premise:
(Premise is a sentence that describes a condition on which logical argument is based)
(Premise is a sentence that describes condition on which a logical argument is based)
Premise:
Hypothesis: (Hypothesis is sentence which is a plausible conjecture explanation which can be proved or disproved)
Hypothesis: (Hypothesis is sentence which is plausible conjecture or explanation which can be proved or disproved)
Label: entaimenntoonrracciioonuurrd
Label: entüimenttconrradciiinnnnnntn
Premise: A person on a horse jumps over broken down airplane.
Premise: A person on horse jumps over broken down airplane.
Hypothesis: A person is training his horse for competition.
Hypothesis: A person is training his horse for competition.
Labelzneutral
Label:neutral
Premise: person on a horse jumps over a broken down airplane.
Premise: A person on horse jumps over a broken down airplane.
Hypothesis: person at a diner, ordering an omelette.
Hypothesis: A person is at a diner, ordering an omelette.
Label:comtrudiction
Label:contrudiction
Premise: A person on horse jumps over broken down airplane.
Premise: A person horse jumps broken down airplane.
Hypothesis: person is outdoors, on horse.
Hypothesis: A person is outdoors, on a horse Label:entailment
Label:entailment
Premise: Children smiling and waving
at camera
By understanding the above exam- ples, give the Label (relation) between the following sentences-
Hypothesis:
They are smiling at their
parents
Label:neutral
Premise: this church choir sings to the masses as they sing joyous songs from the book at a church
Premise: Children smiling and waving
camera
Hypothesis: There are children present Labelsentailment
Hypothesis: the church is filled with song
Premise: Children smiling and waving at camera
Label:

---

The kids are frowning Label:contradiction
Hypothesis:
FLAN-T5 using zero-shot and few-shot prompts. To perform adversarial attacks on GPT4, GPT3, and ChatGPT, the following were the parameters used: temperature = 0, max-tokens = 128, top-p = I, crequency-penalty = 0, wesence-penalty = O. These parameters were used for all of GPT4, GPT3 and ChatGPT.
By understanding the above exam- ples, give the Label (relation) between the following sentences-
Premise: this church choir sings to the masses as they sing joyous songs from the book at church
Experiment (ii) During the fine-tuning process of RoBERTa (large) (Liu al., 2019b), the model trained for 10 epochs, with a batch size 16 and an initial lcarning rate of 5e-6. The ex- periments were conducted using NVIDIA GPUs, specifically the A6000 and A 100 models. To estab- lish baseline for comparison, we also fine-tune the RoBERTa (large) model on the original train- ing set with a similar configuration. Both models are then evaluated on the original evaluation of SNLI, as well as the corresponding attack samples.
Hypothesis: the church is filled with song Label:
Few-shot Results
We have also experimented using GPT-3, ChatGPT, and GPT-4 with 3-shots and 6-shots, in addition to using zero-shot. Table 4 provides the results of few-shot experiments.
Here is detailed explanation of the metrics used for evaluation:
Giving examples of NLI as few shots in prompt of GPT-3, ChatGPT, and GPT-4 can en- hance each model's ability understand their tasks better, can improve their logical abilities, and re- sulted in lowering their ASRs (shown in Table 4). One thing note that changing from zero-shot to 3 shots improved each model's performance sig- nificantly, but changing from shots to 6 shots did not. In some cases, it degraded their performance slightly. Another point is that the models seem perform better for inference rules with longer premises and hypothesis (Constructive Dilemma, Destructive Dilemma, Bidirectional Dilemma).
A Attack Success Rate (ASR) This represents the attacker's 's performance: ASR = # success- ful attacks / # total attacks
F1 Sentence Overlap Score (F1) F1 value was for each attack sample, overlap score between the original (premise, hypothesis) pair and their corresponding perturbation gen- erated by LogicAttack.
F SimCSE and BERTScore
We have also evaluated the resemblance between original and attack <premise. hypothesis> pairs using BERTScore and SimCSE From Table 3, observe that BERTScore and SimCSE are 90% and 88% for all attack strategies (the score for each attack is average overall dataset samples). This shows the quality of generated perturbations.
E Experimental Setup
Here, we provide additional details about the ex- periments.
Experiment (i) All models in this experiment are used from Huggingface except GPT-family models. For single-task, the model we used is RoBERTa- large fine-tuned on the SNLI'. For multi-task, the models used are: RoBERTa-large, and BART-large fine-tuned on SNLI, MNLI, FEVER, and ANLIS For prompt-based models, the mod- cls used are: GPT-3 and GPT-46, ChatGPT and
G Qualitative Analysis
G.1 Effect of Negations
Because all propositional logic rules used for logic attacks were generated from the same set of sen- tences in the SNLI test data set, we have checked their sentence structures to see what makes their "attpe///gattoo.om//i/////////e SimCSE
"nttps://hugginggfacc.. cotpaacccccoopppp. popa/ coberta-large-ssi
co/coss/ raansfermmrztmndeel_ddd///laaaae
"https://buggiiggfacee co/yni///
r:bertaa-large-snliimmi. wewenrlllleeeeeeeeeeeeee R2 k3-nli
"https://pLattorr owwnaa..ppcn.cccoommm com/

---

Dataset
in natural language, perform step-by- step reasoning to predict one of three labels: Entailment, Contradiction, or Attack Strategies
SimCSE
BERTScore
Modus Tollens
0.839
0,919
Constructive Dilemma
0,935
0,908
Destructive Dilemma
0.869
0,906
Bidirectional Dilemma
0.909
0.906
Transposition
0,866
0.912
SNLI
Transposition 2
0.848
0,9(4
Material Implication
0,901
0.917
Material Implication
0.880
0.910
Negate Hypothesis
0.868
0.967
Avg.
0.879
0.917
Modus Tollens
0.846
0.926
Constructive Dilemma
0.937
0,914
Destructive Dilemma
0.892
0.914
Bidirectional Dilemma
0.914
0.914
Transposition 1
0.864
0.920
MNLI
Transposition
0.864
0.911
Material Implication
0,905
0.925
Material Implication
0.891
0.918
Negate Hypothesis
0.879
0.963
Avg.
0.888
0.923
Table SimCSE and BERTScore between original and attack <premise, hypothesis> pairs from SNLI and MNLI.
ASR different. Their main differences are the num-
ber and the location (premise or hypothesis) of certain logical words such as "and", "or", and "if then (implication), and also the number of in- cluded sentences from the SNLI test data. The num- ber negated sentences is also an important factor because they are modified from the original sen- tences, and can lower values. The information in the Table 5 was used for the ASR analysis. In terms of their location, i.e., whether they appear in the premise or hypothesis, it also affects their ASRs. Between Transposition 1 and Transposition 2, or Material Implication and Material Implication swapped, 2, only their premise and hypothesis however, their ASRs differ. The main difference caused by swapping them that in Transposition 2 and Material Implication 2, negated sentences appear in their premise instead of hypothesis.
Neutral. Please use the below format:
[natural language text for premise]
Premise:
Hypothesis: [natural language text for hypothesis]
Reasoning steps: Igenerate step-by-st by-step reasoning]
Answer:
Entail-
mendVeetralCCnttradiioon
Premise:
Hypothesis:
Answer:
G.2 Prompt for GPT-4 vs. GPT-3
We conducted an analysis of the drop in ASR per- formance between GPT-4 and GPT-3, investigating the reasoning process employed by each model to provide answers. To achieve this, we utilized the following chain-of-thought prompt for our study;
This is a Natural Language Inference task. Given the premise and hypothesis that contains rules of logical reasoning

---

GPT-3
ChatGPT
GPT-4
Inference Rules
3-shots
6-shots
3-shots
6-shots
3-shots
6-shots
Modus Tollens
69.4
67.2
90.9
92.8
12.3
11.4
Constructive Dilemma
2.4
4.2
3.7
3.6
5.3
5.8
Destructive Dilemma
15.9
15.6
14.7
17.7
13.8
13.6
Bidirectional Dilemma
4.3
6.5
5.4
8.3
8.6
Transposition 1
71.5
68.7
4.7
5.3
13.2
10.0
Transposition 2
11.5
16.1
10.3
11.7
12.8
11.1
Material Implication
5.1
6.5
3.7
4.1
5.6
5.9
Material Implication
4.1
7
3.7
3.7
23.5
15.9
Negate Hypothesis
4.4
5.6
7.9
8.7
5.7
6.4
Avg.
19.5
20.8
16.1
17.1
11.2
9.9
Table 4: Evaluation using GPT-3, ChatGPT, GPT-4 with shots and shots w.r.t. ASR (%)
# of negations
# of logical AND
# of logical OR
of implications
contained
Inference Rules
original
sentences
Modus Tollens
Constructive Dilemma
Destructive Dilemma
2
Bidirectional Dilemma Transposition I Transposition 2
2
2
8
2
4
Material Implication 1
4
Material Implication 2 Negate Hypothesis
0
4
2
Table 5: Statistics of generated sentences in terms of various characteristics w.t.t. inference rules.


Reviews:
[{"review_id": "TtWJo9FTDk", "reviewer": "Reviewer_n17E", "summary": "", "questions": "Question A) Why is there a large improvement in mitigating ASR for ChatGPT/GPT-4 over FLAN-T5/GPT3?\nQuestion B) How did you evaluate the quality of perturbations such that they adhere to the correct logic?\nQuestion C) What sampling parameters or temperature settings did you use for LLM models?", "limitations": "", "rating": 3, "confidence": 5, "soundness": 3, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "The authors propose 9 perturbation strategies from propositional calculus to craft adversarial attack samples to 7 models. The evaluations are provided clearly and the contributions the authors claim are clearly described. The appendix is detailed to provide the necessary context for each strategy. Prompts are clearly enumerated in appendix. Well focused problem statement and approach for a short paper.", "reasons_to_reject": "With the amount of content provided in the appendix and descriptions related to attack strategies - readers may not understand at first glance the purpose of each adversarial attack. Figure 1 is not legible (no reference numbers to differentiate baseline vs proposed for Accuracy). No discussion is placed on the quality of perturbations vs failures via prompting. There is no clear method (except manual inspection) to ensuring LLM generation adheres to negation logic, simple construction of perturb answers could have influenced results in larger models (Authors provide 0/3/6-shot prompts for entailment tasks & negation generation).", "questions_to_authors": "Question A) Why is there a large improvement in mitigating ASR for ChatGPT/GPT-4 over FLAN-T5/GPT3?\nQuestion B) How did you evaluate the quality of perturbations such that they adhere to the correct logic?\nQuestion C) What sampling parameters or temperature settings did you use for LLM models?", "paper_topic_and_main_contributions": "Authors propose a method to create adversarial attacks on LLMs through perturbed samples, reducing model performance on SNLI (subset with label == entailment). The authors outline 6 rules to transform a premise and hypothesis then attempt to find examples where a NLI model fails to predict the correct entailment. Authors evaluate their methodology on RoBERTa, BART, GPT3/3.5/4 and T5. Discussion by the Authors conclude that large models are less prone to attacks, smaller models are susceptible (76% RoBERTa ASR vs 20% GPT4 ASR). Authors then propose a solution to fine tune models on successful attack samples, claiming a lower ASR (0.7%).", "excitement": 3, "reproducibility": 4, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {"Typos_Grammar_Style_and_Presentation_Improvements": "Figure 1 can have either numbers reported or highlight the difference between baseline and proposed bars.\nAppendix C.1 sentences - the formatting for sentence/negation could be clearer by bolding the labels for the reader. \nI found it initially difficult to follow the attack examples and their relationship to the formal expressions - the authors could clarify this through additional whitespace or formatting to make it easier for readers."}}, {"review_id": "M5TAXKdKEw", "reviewer": "Reviewer_jb1M", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": 3, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "The authors make extensive experiments to see if the new format of the original premise and hypothesis still leads to the same predict. \n\nAs I mentioned above, six different backbones are tested under single-task, multi-task, prompting three different scenarios. The experiments are sufficient especially considering this is a short paper. ", "reasons_to_reject": "In attack papers, stealthiness testing is typically essential, as the fundamental hypothesis is that the modified data should closely resemble the original data. This similarity is crucial to prevent people from easily detecting that the training data has been manipulated. However, in this paper, the modified data appears to be significantly different from the original data, which challenges this principle. Moreover, one could argue that deleting every token in the model could also result in a high attack success rate, making it essential to carefully assess and justify the methods used in the paper to maintain a meaningful evaluation of the attack's stealthiness.", "questions_to_authors": "", "paper_topic_and_main_contributions": "This paper explores nine different data augmentation ways that could be used to fool a well-trained NLI model. The main contribution lies in extensively testing how different forms/combinations of the original premise and hypothesis can fool NLI models. The tested models include RoBERTa, BART, FLAN-T5, and GPT series. \n\nIt is more like an NLP engineering experiment paper. \n\nThis paper reveals the fact that existing models are not robust to different forms/combinations of the existing premise and hypothesis, which could consider to use as data augmentation in future to train a robust NLP model. ", "excitement": 3, "reproducibility": 5, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "9Rmej1KlYP", "reviewer": "Reviewer_59xA", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": 2, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "1) The paper points out a major flaw in the existing LLMs and suggests a novel method for systematically assessing logical discrepancies.\n2) A  variety of Proposition Logical constructs are tested for model assessment.\n3) The authors suggest that using a set of generated PL examples for tuning the model can lead to higher logical consistency within the model.", "reasons_to_reject": "The most inherently problematic part of the paper is the negation generation through the use of an LLM (with GPT-3). Although authors suggest that 500 sampled sentences were verified by an author for negation quality, a set of questions still remains.\n\n1) SNLI is a dataset where the premise-hypothesis pair can include several sentences (sentence-pieces). I.E., one of the first premises of SNLI *\"This church choir sings to the masses as they sing joyous songs from the book at a church\".* A negation of a sentence here is not as straightforward as we would require for PL. A valid negation can cover only one aspect of the premise but still be a direct negation.\n\ni.e. \n1) \"This church choir sings to the masses as they sing joyous songs from the book at **somewhere other than church.**\"\n2) *\"This church choir does not sing to the masses as they do not sing joyous songs from the book at a church\".*\n\nBoth of these examples are valid negations of one aspect in the sentence; however, they impact greatly when predicting the label of the premise-hypothesis pair. (i.e. if the hypothesis is \"The church is filled with song.\" )\n\n2) Generating negations is bound to produce random hallucinations within the generation bound, which can, in turn, impact the final prediction, thus hindering the use of strict propositional logic.\n\n3) Dealing with strict logical conjunctions and disjunctions is not as straightforward as adding \"and/or\" or concatenating two sentences. This part has to be analysed/justified in a deeper manner.\n\n4) Why is only SNLI used for such an evaluation? Is it enough for a definitive conclusion ?\n", "questions_to_authors": "", "paper_topic_and_main_contributions": "The paper suggests a novel method for assessing LLMs beyond their performance on a given task. The authors point out that high performance can stem from recognising spurious correlations and heuristics. The approach proposes to use propositional logic (PL) constructs for assessing the consistency of the models over a variety of logical forms. Such logical variations are achieved by generating negations and combining the original premise hypothesis pairs using an LLM. The authors show that the models are unable to answer ~51% of the rewritten but logically consistent examples.", "excitement": 3, "reproducibility": 4, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This adversarial-attack paper describes how perturbations can significantly affect accuracy when well-known models like RoBERTa, BART, FLAN-T5, and GPT do natural-language inference tasks, showing that there is a lack of logical consistency in these models.

Pros:
- The problem statement is well-focused, and the approach and scope is appropriate for a short paper.
- There is sufficient information to reproduce this work; the data and source code will be openly available.
- There are extensive and detailed experiments.

Cons:
- The paper uses an LLM to generate the perturbations, which may cause some to doubt their quality; but the authors assessed the quality of a sample of these generated perturbations and found no hallucinations.
- The review copy of the paper was somewhat hard to follow in places due to its heavy reliance on the appendix, which was itself hard to follow in places due to the formatting. Restructuring and/or reformatting somewhat may improve readability.
Decision: Accept-Findings