Model-tuning Via Prompts Makes NLP Models Adversarially Robust
Authors: Mrigank Raman
Pratyush Maini
J Zico Kolter
Zachary Chase Lipton
Danish Pruthi
Venue: EMNLP 2023 Main (2023)
Keywords: Natural Language Processing
Language Models
BERT
RoBERTa
Prompting
Adversarial Robustness
TL;DR: We make the surprising observation that tuning NLP models via prompting provides robustness against adversarial attacks.

Abstract: In recent years,
NLP practitioners have converged
on the following practice:
(i) import an off-the-shelf pretrained (masked) language model;
(ii) append a multilayer perceptron atop the CLS token's hidden representation
(with randomly initialized weights);
and (iii) fine-tune the entire model on a downstream task (MLP-FT).
This 
procedure 
has 
produced massive gains 
on standard NLP benchmarks,
but these models remain brittle, even to 
mild adversarial perturbations.
In this work, we demonstrate surprising gains 
in adversarial robustness enjoyed by 
Model-tuning Via Prompts (MVP),
an alternative method of adapting to downstream tasks.
Rather than appending an MLP head to make output prediction, MVP appends a prompt template to the input, and makes prediction via text infilling/completion.
Across 5 NLP datasets, 4 adversarial attacks, and 3 different models, 
MVP improves performance against adversarial 
substitutions  by an average of 8% 
over standard methods and even outperforms 
adversarial training-based state-of-art defenses by 3.5%.
By combining MVP with adversarial training, 
we achieve further improvements in adversarial robustness
while maintaining performance on unperturbed examples. 
Finally, we conduct ablations to investigate 
the mechanism underlying these gains.
Notably, we find that the main causes of vulnerability of MLP-FT 
can be attributed to the misalignment between pre-training and fine-tuning tasks, 
and the randomly initialized MLP parameters.

Model-tuning Via Prompts
Makes NLP Models Adversarially Robust
Mrigank Raman"
Pratyush Maini"
Zico Kolter
Carnegie Mellon University
Camnegie Mellon University
Carnegie Mellon University
mrigankr @cmu, edu
pratmusstminn cmu,eed eddu
zkolterêcs emu.edu edu
Zachary C. Lipton
Danish Pruthi
Carnegie Mellon University
Indian Institute of Science (IISc)
zlipton&cme edu
danishp@ iis.:ie.ii.....
Abstract
work on large language models has demonstrated comparable performance without fine-tuning, by just prompting the model with prefix containing several examples of inputs and corresponding target values (Brown et al., 2020). More broadly, prompt- ing approaches recast classification problems sequence completion (or mask infilling) tasks by embedding the example of interest into prompt template. The model's 's output is then mapped a of candidate answers to make the final predic- tion. Prompting has emerged as an effective strat- egy for large-scale language models (Lester et al., 2021), and its utility has also been demonstrated for masked language models (Gao et al., 2021).
In years, NLP practitioners have con- verged on the following practice: (i) import an fff-the-shelf pretrained (masked) language model; (ii) append multilayer perceptron atop the CLS token's 's hidden representation (with randomly initialized weights); and (iii) fine- tune the entire model on downstream task (MLF-FT). This procedure has produced mas- sive gains on standard NLP benchmarks, but these models remain brittle, even to mild adver- sarial perturbations. strate surprising gains in adversarial robustness enjoyed by Model-tuning Via Prompts (MVP), an alternative method of adapting down- stream tasks. Rather than appending MLP head to make output prediction, MVP appends prompt template the input, and makes predic- tion via text infiling/cooppltionn. Across 5 NLP datasets, adversarial attacks, and 3 different models, MVP improves performance against adversarial substitutions by an average of 8% over standard methods and even outperforms adversarial training- based state-of-art defenses by 3.5%. By combining MVP with adversarial training, we achieve further improvements in adversarial robustness while maintaining per- formance on unperturbed examples. Finally, we conduct ablations investigate the mech- anism underlying these gains. Notably, we find that the main causes vulnerability of MLP-FT can be attributed to the misalignment between pre-training and fine-tuning tasks, and the randomly initialized MLP parameters.'
this work, we demon-
While fine-tuned models perform well on in- distribution data, a growing body of work demon- strates that they remain brittle to adversarial pertur- bations (Jin et al., 2020; Li al., 2020; Morris al., 2020a). Even small changes in the input text, such as replacement with synonyms (Ebrahimi al., 2018b), and adversarial misspellings (Ebrahimi et al., 2018a; Pruthi et al., 2019) drastically de- grade the accuracy of text classification models. While prompting has become a popular approach for adapting pretrained models to downstream data, little work has considered interactions between adaptation strategies and adversarial robustness.
In this work, first, demonstrate surprising ben- efits of Model-tuning Via Prompts (MVP) terms of robustness to adversarial substitutions, as compared to the standard approach of fine-tuning models with an MLP head (MLP-FT)) Notably, MVP, which does not utilize any sort of adversarial training or prompt opiimization/engineernng already yields higher adversarial robustness compared to the state- of the-art methods utilizing adversarial training by an average of 3.5% across five datasets (classifica- tion, boolean question answering, and paraphrase detection), models (BERT, RoBERTa, and GPT-2) and four attacks (word and character-leve substi- tutions) ($5). Moreover, we find that combining
1 Introduction
Pre-trained NLP models (Devlin et al., 2019; Liu al., 2019) are typically adapted to downstream tasks by (i) appending randomly initialized multi- layer perceptron to their topmost representation layer; and then (ii) fne-tuning the resulting model on downstream data (MLP-FL FT). More recently,
Equal contribution.
'Code is available at http://giiinnh.commammmmaaaaaa

---

Input "he wcting pattottc
Derise 10300769
Output (700 X
Badi 86%
acting
Goodt 5%
Staindard Fine-tuning
Aardwark
Clenet 02%
Input Prompt "the pathelk, the modie (MA.KK]
Pretesined
Adv: 42%
Goost 5%
IMASI
(b) Modall-uning via Prompta
Zyzzyen
Figure I: An illustration of (a) Standard Finetuning, and (b) Model-tuning via Prompts. The adjoining accuracy metrics correspond to RoBERTa model trained on the BoolQ dataset.
MVP with single-step adversarial training can fur- ther boost adversarial robustness, resulting in com- bined robustness gains of more than 10% over the baselines. This happens without any loss in accuracy on unperturbed inputs, indicating how the objective of adversarial training couples well with MVP.
Through experiments designed to test these hypothe- ses, we find that (i) in the absence of pretraining, MVP and MLP-FI have similar robustness perfor- mance, supporting the hypothesis of pretraining task alignment; (ii) adding extra uninitialized parameters to MVP leads a sharp drop in robustness, whereas removing the dense (768,768) randomly initialized weight matrix from MLP-FT improves the robust- ness of the model significantly; (iii) even random candidate answers such as 'jack', and 'jill' result in similar robustness gains, suggesting that when fine- tuning through prompts, the choice of candidate answers is inconsequential (in contrast, this choice is known to be crucial for few-shot classification). Fourth, we perform a user study ($7) to assess the validity of adveraaaiall examples. We find that human annotators were 23% more likely to find adversarial examples to have been perturbed as opposed to clean examples. Moreover, humans achieved 11 1% lower accuracy on adversarial examples as compared to clean examples with average confidence on the label of perturbed examples being 15% lower. This high- lights that a large fraction of adversarial examples are already detected by humans, and often change the true label of the input, signifying that MVP is more robust than crude statistics discussed in $5. Fu- ture work will benefit from developing better eval- uation strategies for the robustness of NLP models. Fifth. going beyond adversarial robustness. investigate the robustness gains of MVP over MLP-FTT on out-of-distribution (OOD) tasks. We find that MVP improves robustness by 2% across 5 different OOD sentiment analysis tasks ($ 5.2).
So far, prior works have not explored the idea of fine-tuning all the parameters of a model via prompts (we call this setup full-model full-data fine- tuming). We only see instances of (i) fine-tuning the full model via prompts in a few-shot setting (Gao et al., 2021), or (ii) fine-tuning additional tunable parameters using prompts on top of frozen model by utilizing the complete training set (Li and Liang, 2021). We believe the idea of full-model full-data fine-tuning via prompts has not been used until now because clean accuracy improvements for MVP over MLP-FT are negligible, and the robustness advan- tages of MVP were previously undiscovered.
Second, we show that MVP a method for clas- sification more (i) sample efficient, and (ii) has higher effective robustness than MLP-FT 1$..1). That is, MVP requires fewer training samples to achieve the same clean accuracy; and for any given clean accuracy, the robust accuracy of MVP is higher than MLP-FT. Through ablation studies ($5.3), we find that (i) adding multiple prompt tem- plates makes it harder to fool the model; and (ii) having multiple candidate answers has small but positive impact on the robustness.
Third, to explain our observations, we test a set of hypotheses ($6). including (i) random parameter vulnerability- is adding a randomly initialized lin- ear head the source of adversarial vulnerability for MLP-BP FT?? (ii) pretraining task alignment- can the gains in robustness be attributed to the alignment be- tween the fine-tuning and pretaining tasks in MVP?; and (iii) semantically similar candidates are pre- dictions by MVP more robust because the candidate answer is semantically similar to the class label?
In summary, we demonstrate that models tuned via prompts (MVP) are considerably more robust than the models adapted through the conventional approach of fine-tuning with an MLP head. Our findings suggest that practitioners adopt MVP as a means of fine- mine-tuning regardless of the training data size (few-shot or full data) and model capacity.

---

2 Related Work
and Schüizze, 2021 In the full data setting, pre- vious works have explored prompting via prompt tuning (Liu et al., 2022; Li and Liang, 2021; Qin and Eisner, 2021; ; Lester et al., 2021) where the model is injected with additional tunable parameters. None of these works discuss the robustness advantages of prompting (especially in the adversarial context) when compared to standard fine-tuning approaches.
Adversarial Attacks and Defenses Inspired by the brittleness of vision models to adversarial exam- ples (Szegedy et al., 2013; Goodfellow et al., 2014), researchers have found similar vulnerabilities to also exist in language models (Alzantot et al., 2018; Belinkov and Bisk, 2018). Unlike vision, the goal in NLP is to develop (i) semantically viable sub- stitutions or delctions (Ebrahimi et al., 2018b); (ii) character-level misspellings (Zhang et al., 2015b;
Robust Fine-tuning and Adaptation In the vi- sion literature, prior works have also tried to use prompting to improve out-of-distribution robust- ness in the zero-shot and few-shot settings (Zhou et al., 2022a.b). Kumar et al. (2022) observed that fine-tuning worsens the out-of-distribbttio (OOD) performance of models due to the bias introduced via a -onooomml-initialiieedd head on top of the CLIP model, and instead suggest procedure (LPFT) that first fits the linear head and then finetunes the model. Later works have shown that this ID/OOD perfor- mance trade-off could be mitigated by averaging model weights between the original zero-shot and fine-tuned model (Wortsman et al., 2022) and/or by finetuning using an objective similar to that used for pretraining (Goyal et al., 2022). However, this work has been applied only to vision-language models, and secondly only deals with "natural" robustness evaluations rather than the adversarial manipula- tions we consider here.
Ebrahimi et al., 2018 Sa; Pruthi et al., 2019); or (iii) imperceptible homoglyphs (Boucher et al., 2022). The discovery of such adversarial examples span several tasks such as classification (Zhang et al., 2015b; Alzantot et al., 2018). NMT (Belinkov and Bisk, 2018), and question- question-answwritng answering (Jia and Liang, 2017), but they are restricted to small models such as LSTMs and RNNs. Among others, Jin et al. (2020); et (2020) show that despite producing massive gains on standard NLP benchmarks, BERT style pre- trained models are susceptible to adversarial attacks when finetuned on downstream tasks. Subsequently, multiple works have attempted at developing fast and semantically meaningful attacks (Li ct al., 2018) and scalable defenses (Wang and Bansal, 2018; Jia et al., 2019; Wang et al., 1b; Si et al., b02 Zhu et al., 2020) for masked language mod- els. Yang et al. (2022) leverage prompts generate adversarial examples that they train their model on using MLP-FT. Despite these efforts, NLP models suffer a significant drop in robust accuracy, when compared to clean accuracy on the same task.
3 Method
We consider the task of supervised text classifica- tion, where we have dataset S = (z)(0) .y ()) with z0() E X' and y( E (1....,k} for a k-class classifi- cation problem. We train classifier f to predict based on input We follow the terminology by Schick and Schütze (2021a). The input (1)) can be decomposed as a sequence of words (x1 (z.,,.......?.. and the output (y) is a positive integer, with each value corresponding to a particular class. The prompt template (t) is the input string we append at the beginning or end of the input. For example, we may append the following template at the end of a movie review- "Thi movie is [MASK]" ". The can- didate answers (AA) is a set of words corresponding to each class. For example, the positive sentiment class can have the following candidate answers- { (great, good, amazing).
Prompting NLP Models Prompting gained trac- tion from GPT-3 (Brown et al., 2020) where it was primarily used in the zero-shot and few-shot settings and required manual trials to increase performance. In the zero-shot setting, no labeled examples are pro- vided the model and the language model is kept frozen. The model needs to output its prediction us- ing the prompt that is provided. Whereas, in the few- shot setting, a few task-specific labeled examples are also provided for the frozen model in addition to the prompt (also known as in-context learning) (Rubin et al., 2022; Levine et al., 2022). A lot of work has gone into improving the prompts that are used in the zero-shot and few-shot settings, including mining- based methods to automatically augment prompts (Jiang et al., 2020), gradient- based search (Shin et al., 2020), using generative language models (Gao et al., 2021) and others (Hu et al., 2022; Schick
Adversarial Attacks We are concerned with per- turbations to the input x that change the model pre- diction. In the case of adversarial attacks confined

---

synonym substitutions, we confine the model to searching for di in the synonym set of every word 2y in the input. Whereas, the case of character level substitution, we consider substitutions of char- acters that compose each 2; in the input.
(14-class topic classification), and MRPC (Dolan and Brockett, 2005) (paraphrase detection). Re- sults on DBPedial4 4 and MRPC are presented in Appendix C.I. All models are trained with the RoBERTa-Bass Base (Zhuang et al., 2021) backbone. Experiments on GPT-2 and BERT-Bass (Devlin et al., 2019) are included in Appendix C. Detailed information about training and attack hyperparam- eters is provided in Appendix E.
3.1 Model-tuning Via Prompts (MVP)
We present the overall pipeline of MVP in Fig- ure (()), and describe individual components below.
Input Modification Consider prompt template f1.,g,... [MASK] ....mm For any input z, the prompt input (x²) can be constructed by appending the template at the beginning or end of the input. The final output is based on the most likely substitu- tion for the [MASK] token, as given by the language model. Typically, we use set of prompt templates denoted by T.
A Attack Strategies We perturb the inputs using the TextAttack library (Morris et al., 2020b). In particular, we use 1 character-level attack and 3 word-level attacks. Word-level attacks include the TextFooler (Jin et al., 2020), TextBugger (Li et al., 2018) that replace words with neighboring words based on counterfitted GloVe embeddings and BertAttack (Li et al., 2020) that uses BERT to replace keywords with synonyms. 2 For character- level attack, we use adversarial misspellings (Pruthi et al., 2019). More details are in Appendix B.2.
Inference For every class label, we have a set of candidate answers associated with it. During inference, we do the following: (i) for every class label, select the candidate corresponding to the largest logit value among its candidate set; (ii) take the mean of the logits corresponding to the selected candidates over all the templates to compute the final logit of the given class label; (iii) predict the class having the highest final logit.
Baseline Methods We now describe the ter- minologies used to denote training schemes corresponding to various fine-tuning strategies. MLP-FT is the "base" model for classification via standard non-adversarial training, and is utilized by all the baselines. Given pre-trained model, we perform downstream fine-tuning by adding an MLP layer the output corresponding to [CLS] token as illustrated in Figure (a). This hidden represen- tation is of size 768 x 1. In the case of the BERT model, there a single dense layer of dimension 768 x 2, whereas in the case of RoBERTa model, we have a two-layer MLP that is used to make the fi- nal prediction. MLP-FT + Adv is is identical to the method used for adversarial training in Section 3.2, wherein perform adversarial perturbations in the embedding space of the MLP-FT model, rather than MVP. To compare with state-of-art adversarial training-based defenses we consider Freel.+++ (Li et al., 2021) (free large batch adversarial training us- ing projected gradient descent), InfoBERT (Wang et al., 2021 (information bottleneck regularizer to suppress noisy information), and AMDA (Si et al., 202 (adversarial and mixup data augmentation for creating new training examples via interpola- tion). We provide complete details pertaining each baseline method in Appendix B.
3.2 MVP Single-step Adv
Based on the Fast Gradient Sign Method (FGSM) by Goodfellow et al. (2014), we perform single- step adversarial training. Note that the input tokens are discrete vectors, and hence it is not possible to perturb the inputs directly. Instead, we pass the in- puts through the embedding layer of the model and then perform adversarial perturbations in the em- bedding space. We do not perturb the embeddings corresponding the prompt tokens. We find that performing single-step perturbations with the & constraint leads to more stable training than in the foo norm ball, and use the same for all our experi- ments. Similar (but not equivalent) approaches have also been studied in literature (Si et al., 2021a).
4 Experimental Setup
Datasets and Models We perform our experi- ments on five different datasets-AG News (Zhang al.. 2015b) (4-class topic classification), SST- 2 (Socher et al., 2013) (binary sentiment classifi- cation), BoolQ (Clark et al., 2019) (boolean ques- tion answering), DBPedia 14 (Zhang et al., 2015a)
PI line with previous henchmark (Li et al., 2021) we only use the word-substitution transformation in TextBugger.

---

SST2
MLF-FT
MLP-FT Adv
Free LB++
MADA
InfoBert
MVP
MVP Adv
Clean Ace
93.6 10.4
93.6 40.6
94.0 +0.1
93.8 004
94.0 40.4
93.9 +0.7
93.8 #0.1
TextFooler
40.2 40.9
41.
43.4 +1.0
41.8 00.
40.5
46.9 +0.5
53.8 0.77
TextBugger
65.4 40.3
68.5
67.2 +0.6
66.1 =02
66.6 1.8
69.8 +0.5
71.7 #.088
BertAttack
70.3 +0.9
74.3 10.8
76.2 #0.6
74.2 =0.
76.1 40.6
78.1 +0.9
81.7 00.77
Misspellings
45.2 +1.1
49.3 40.3
50.4 +1.1
45.4 -0.4
47.1 40.4
50.5 +0.7
54.9 +1.3
AG News
MLP-FT
MLP-FT Adv
Free LB++
MADA
InfoBert
MVP
MVP Adv
Clean Acc
94.5
94.4 10.6
10.7
94.1 =0.6
94.5 40.9
94.3 10.2
94.4 20.8
TextFooler
42,9 107
47.7 20.5
11.
44.3 =1.4
48.0
51.5 #2.1
62.7 22,4
TextBugger
61.8 100
60.6
61.5
62.9 =0.5
68.7 65.6
75.3 1.6
BertAttack
79.1 #1.
81.1 +100
81.4 10.9
80.4 =02
82.4
85.3 +1.
88.2 2.99
Misspellings
21.
78.6
#1.
77.1 =0.4
8..4
$2.7
86.6 2.06
BoolQ
MLP-FT
MLP-FT Adv
Free LB++
MADA
InfoBert
MVP
MVP Adv
Clean Ace
80.6
11.
80.6 +0.4
79.2
81.5 40.7
80.6
81.1 #0.6
TextFooler
28.2
49.0
+1.4
32.0 003
38.0 +1.3
42.9 +0.5
52.2 :16
TextBugger
48.3
41.4
41.2
41.1
42.4
46.8 +0.9
56.7 #1.2
BertAttuck
48.1 1:07
47.6
57.3
55.2 =044
57.4
61.5 +1.2
69.4 1:155
Misspellings
42.9:110
41.4
46.6
45.2 =0.3
47.3
51.6 +0.8
59.7
Table Adversarial Robustness: Performance of RoBERTa-base model on 3 different datasets averaged over seeds fixed test set of size 1000. The highest accuracies are bolded, and the second-bess is underlined. We observe that models tuned via prompts (MVP) are the most robust while preserving (or improving) the clean accuracy.
5
Results
MVP achieves the kate-of-the-ar adversarial per- formance improving bascline adversarial training methods by 3.5%. Moreover, it can be coupled with single-step adversarial training, resulting in an overall 7% improvement over state-of-an methods. Lastly, the robustness benefits come only at a 2x computation cost of standard training, opposed to past works which need 5-10x computation cost of standard training due additional adversarial training. Results BERT-Base are in Table 7.
We first evaluate the impact of using MVP on the ad- versarial robustness of NLP models. For the task of Boolean question answering (BoolQ), we find that fine-tuning RoBERTa model with an MLP head (MLP-FT) achieves an accuracy of 28.2% on adver- sarial examples obtained through the TextFooler at- tack strategy (Table I). Whereas, the corresponding accuracy for tuning the model via prompts (MVE) is 12.9% which is considerable improvement over MLP-FT. Additionally, MVP leads to more robust models compared to adversarial training baselines like MLP FT Ady and InfoBERT that attain ac- curacies of 39.0% and 38.1% 28.1% respectively. Further, MVP can be combined with adversarial training (MVP + adv), and doing so lcads to an accuracy of 52.2% which about a 10% improvement over MVP, without any loss in clean performance.
5.1 Sample Efficiency & Effective Robustness
We investigate the sample efficiency and effective robustness of MVP through experiments the BoolQ and AG-News datasets using the RoBERTa- base model. We train models on randomly sampled fractions of the dataset, ranging from 5- 10-4 0.1.
Sample Efficiency We compare the performance of MVP and MLF-FT in low-data regimes. We find that MVP results in models are consistently more robust compared to models trained through MLP-FT in the low data setups (see Figure 2a). In fact, we observe that in extremely low resource case (only 60 examples). MLP-FT, but model trained through MVP performs exceedingly well. We note that the relative bene-
Similar to boolean question answering, the ro- business advantages of MVP hold across the three tasks we examine. The individual performance statistics are detailed in Table 1. Overall, across four attack strategies, and three datasets, we report that MVP improves over MLP-a FT by 8%. Remark- ably, even in the absence of any adversarial training
hard learn using

---

BoolQ
AGNews
Experiment
Templates
Candidate
Clean
Trooler
TBugger
Clean
T'ooller
TBugger
MLP-FT
N/A
N/A
1.5
28.2 1.7
38.3 =
94.5 0.4
42.9
61.8 11.8:...
Class Label
81.9 0.8
35.9 0.2
44.6
48.6 0.4
67.3 +
Template
2
Class Label
82.3 +
37.4 0.3
0..5
94.5 0.6
50.8 + 1.6
67.8 0.5
Expansion
Class Label
82.1 0.3
40.8 1.5
1.11
94.2 =02
48.4 4
66.2 + 1.1
4 Class Label
82.0
42.9 0.5
49.8 1.6
94.3 0.2
+..4
68.7 0.7
Candidate Exp.
4
Multiple
81.6
46.1 1.6
5.70
93
5..0
69.8 0.3
We study the impact of the number of candidate answers and prompt templates adversarial performance of XVP (see $5.3). 'TFooler' and "TBugger' represent model robustness under TextFooler and TextBugger attacks respectively. 'Clean' represents model accuracy on original test data. Additionally, we also assess the effect of including semantically similar answer candidates (see $6). All values are averaged over seeds.
Table 2: Ablation Studies:
5.2
Out of Distribution Robustness
80
MEP
Aveunayy (16
Clese
Going beyond adversarial robustness, we now per- form experiments assess the out-o--distribution robustness of MVP, MLF-FT, and LPFT. We sentiment classification datasets, namely SST2, Amazon Polarity (Zhang et al., 2016), IMDb (Maas et al., 2011). I). Movie Rationales (Zaidan al., 2008), and Rotten Tomatoes (Pang and Lee, 2005). We fine-tune Roberta model on 1000 examples of each of these datasets and evaluate all the datasets. Since all of these datasets analysis datasets, use the same template and can- didate words across all the models (for both training and evaluation). Based on our investigation, we see that across 5 different models (and 20 evaluations) the average accuracy for MVP (89.65% is 2% more than MLP FT and 1.3% more than that of LPFT.
60
MV2
MLP
30
40-
20
20
Train set size
Accuasy (in %)
(a) Sample Efficiency: Clean and Robust Accuracy of RoBERTa- base model when trained using different data sizes of the AG News dataset. (b) Effective Robustness: Robust vs Clean Accuracy of RoBERTa Ta- base model on the BoolQ dataset We find that (a) MVP more sample efficient compared to MLF-FT and (b) MVP yields more robustness compared to MLP-FT for the same clean accuracy (see $5.1 for details).
Figure 2:
binary sentiment
fit of MVP over MLP-FTT peaks around 5-10% of the data. Interestingly, the model trained through MVP requires only 5% of samples to achieve similar robustness levels as models trained with MLP-FT on the full dataset. In addition to robust- ness benefits, we find that MVP achieves consider- ably higher clean accuracy in low-data regimes (i.e., with 200 examples). Results on BoolQ are C.3.
These results in Table 3 show that MVP is supe- rior to MLP-FT and LPFT for both adversarial and OOD robustness. In summary, LPFT helps reduce the impact of random parameter vulnerability, but MVP additionally allows pre-training task align- ment (the second hypothesis) hence resulting superior performance and no fundamental trade-off be it OOD or ad adversarial robustness.
Effective Robustness et al., 2021) measures the robust accuracy of mod- els that have the same clean accuracy. This can help determine which training time design deci- sions will be valuable when scaled up. We mea- sure the effective robustness for models trained through MVP and MLP-FT by training them on different data sizes. We find that even when both MLP-FT and MVP achieve the same clean accuracy, models trained through MV2 are more robust (Fig- ure 2b). Results on AG News are presented in C.3.
Effective robustness (Taori
5.3 Ablation Studies
Number of Candidate Answers A larger can- didate answer set is shown to improve clean perfor- mance in the few-shot setting ct 2022). Here, investigate the impact of the size of the candidate answer set on the adversarial performance of models tuned via prompts. The adversarial accuracy of the model with single candidate answer is 42.9%, and increases to 46.2% upon using an answer set com-

---

Train v/s Eval
SST2
Amazon Polarity
IMDb
Movie Rationales
Rotten Tamatoes
MVP
MLP-FT
LPFT
MVP
MLP-FT
LPFT
MVP
MLP-FT
LPFT
MVP
MLP-FT FT
LPFT
MVP
MLP.FT
LPFT
SST2
91.2
91.9
92.8
90.1
87.6
86.0
86.2
86.1
83.2
Amazzn Polurity
90.9
88.5
89.0
92.9
92.9
93.4
92.0
91.2
91.1
85.9
83.9
84.2
86.1
83.3
84.5
IMDb
84.4
81.4
K3.5
91.9
88.8
88.7
92.2
91.9
92.4
92.0
89.9
90.2
81.9
78.1
80.1
Rationales
85.9
85.4
92.5
89.1
90.7
90.6
94.4
94.3
83.0
Rotten Tomatoes
92.4
92.1
92.9
92.6
89.5
90.4
90.9
88.6
90.2
86.4
83.9
84.7
87.2
87.1
87.2
Average
89.8
87.8
88.5
92.5
89.9
90.7
91.3
90.0
90.6
89.0
87.4
87,9
85.7
83.0
83,9
Table 3: OOD Robustness: The results report the standard accuracy (in %) of model trained on the dataset in the left- most column, and evaluated different OOD datasets. We see that across 5 different models (and 20 evaluations), the average accuracy for MVP (89.65%) on OOD tasks is 2% more than MLP-FT and 1.3% more than LPET.
prising 4 candidates." 3 These results correspond to the RoBERTa-base model on BoolQ dataset against adversarial perturbations from the TextFooler at- tack. Overall, we observe an improvement of 1.0- 3.5% in adversarial accuracy when we use larger candidate set across different settings (Table 2). A more detailed analysis of the same with single prompt template is provided in Appendix D.4.
Random Parameter Vulnerability One plau- sible explanation for the observed adversarial vul- nerability of MLP- FT is the randomly-initen linear head used for downstream classification. The intuition behind this effect is that fine-tuning set of randomly- -iitmiiiiiittt parameters may lead to fea- ture distortion of the pretrained model as is demon- strated in Kumar al. (2022). This phenomenon has also been observed in CLIP models (Radford et al., 2021), where the authors found that fine- tuning the model using randomly initialized linear prediction head reduces the out-of-distributie robustness of the model. The phenomenon is un- explored in the context of adversarial robustness. We study this effect through three experiments.
Number of Prompt Templates Another design choice that we consider is the number of prompt templates used for prediction. We conjecture that the adversary may find it difficult to flip the model prediction when we average logits across multiple templates. To evaluate this, we train MVP with dif- ferent number of prompt templates (ranging from to 4), and compare the adversarial robustness. We notice steady improvement in the adversarial accu- racy as we increase the number of templates which supports our initial conjecture (sce Table 2). While increasing the number of templates improves the robustness of the downstream model, MVP achieves large robustness gains even with single template (compared to MLP-FTT Hence, using multiple prompt templates is not the fundamental reason for the improved robustness of MVP. Further, in order assess the impact of the 'choice' of prompt tem- plates used, we perform a more details analysis on the impact of prompt tuning for adversarial robust- ness of MVP in Appendix D.2. We find that even empty or random templates perform nearly similar to well-crafted prompts, and retain the robustness advantages of MVP over MLP-FT.
1. ProjectCLS: First, we reduce the num- ber of random parameters by removing the dense layer of weights (768 x 768 parameters) from the standard MLP architecture. We call this Pro Pro jeejeetCss and only use projection layer of dimensions 768 x C' parameters, with C' being the number of classes (see Figure 3())). We find that Project CLS on average 8% more robust than MLP-FT which suggests that reducing the number of randomly initialized parameters helps to increase model robustness (see Table 4).
2. CLSPrompt: Second, we train another model, CLSP rompt, where instead of using the probabilities corresponding to the [MASK] token as in MVP, we use the probabilities of the candi- date answers corresponding to the [CLS] token (see Figure 3(b)). The key difference between CLSPrompt and MLP-FT is that there are no ran- domly initialized MIP parameters in CLSP rompt, and we the probabilities corresponding to the candidate answers. instead of projecting the repre- sentations with new parameters. From Table 4, we observe that CLSP rompt is once again on average ~ 8% more robust than MLP-FT which provides strong evidence in favor of our hypothesis of ran-
6 Why Does MVP Improve Robustness?
We test three hypotheses to explain the robustness gains achieved by MVP compared to MLP-FTT in the context of adversarial attacks.
Details about candidates and templates are in Appendix A

---

ProjectCLS
CLSPrompt
(c) DenseLPFT Linear prabe only the final layer. Then fine-tune model
Oulpul (788
Remove Dense Layer: Project (CLS)
Pass [CLS] output via pre-trained LM head [MASK]
Remove Dense Layer. Linear probe, then full
represantation
(788X768)
Protrained
Output
Output (788 X
LM head (199 x Wooth Stort
(78ex788)
joust octing
Ingut pathelic
Figure Various model tuning strategics for RoBERTa model trained on the BoolQ dataset. The corresponding clean and robust accuracies (under TextFooler attack) also shown above each model paradigm. The left-most diagram shows the standard fine-tuning paradigm of MLP- FT and each subsequent column modifies the architecture, helping us confirm the hypothesis that randomly initialized parameters are cause of vulnerability.
BoolQ
AGNews
Hypothesis
Setting
Clean
TFoleer
TBugger
Clean
TFooler
TBugger
MLF-FT
80.6 + 1.5
28.2 + 1.6
38.3 1.0
94.5 = 04
42.8 0.7
61.8 = 0.3
ProjectCLS
$1.3.00
37.4 1.2
45.6
93.7 04
46.7 = 1.3
65.2 = 3,3
Random Parameter
CLSP rompt
36.5 8..4
1.
94.7 042
47.2 1.9
66.7 2.0
DenseLPFT
81.3
33.9 144
42
94.5 1
=..2
64.5 = 1.1
LPFT
81,6
1.1 L.1
1.
94.5
46.5
67.2
Task Alignment
Untrained MVP
67.5
11.74427
14.9 2:27
90.1 0.88
12.2 2.9
20.6 2.2
Untrained MLPP-TT
67.0 4
14.8 4:4.3
17.5 1.1
89.5 = 04
13.4 = 1.2
19.4 0.8
Candidate Semantics
Random (MVP)
80.9 0.3.
42.1 0.4.
48.1 2.2
93.4 -
50.3 = 1.2 68.3 =: 0.3
Table 4: Adversarial performance of RoBERTa for experiments correspouding to the random parameter vulnerability and task alignment hypotheses averaged over 3 seeds ($6). 'TFooler' and 'TBugger' represent model robustness under TextFooler and TextBugger attacks respectively. 'Clean' represents model accuracy original test data.
dom parameter vulnerability.
MLP-FT (by over 10%) but it demonstrates lower robustness as compared to LPFT (by over 2%). This provides further evidence that randomly ini- tialized parameters add to the vulnerability.
3. LPFT (linear probe, then fine-tune): For our third experiment, we train two new models namely LPFT and DenseLPFT (see Figure 3(c.d)). In both these models, do the following: (i) fit lo- gistic regression the hidden states corresponding to the [CLS] token (linear probing); (ii) initialize the final layer the classification head with the learned 768 x C' (where C' is the number of classes) matrix of the fitted logistic regression model; and (iii) fine-tune the whole model as in MLP-FT. The only difference between LFFT and DenseLPFT is that DenseLPFT has additional randomly ini- tialized dense layer of dimensions 768 768 unlike LPFT. In contrast to Kumar et (2022), we test LPFT against adversarial manipulations. We note from Table that DenseLB FT is more robust than
Pretraining Task Alignment The task of mask infilling aligns more naturally with the pretrain- ing objective of the language model and we posit that finetuning via mask infilling as in MVP results in robustness gains. To test this hypothesis, we use an untrained RoBERTa model, and measure the clean accuracy and robustness of MVP and MLP-FF models. We observe that in the absence of pre-training, MVP trained with single template does not achieve any additional robustness over the baseline, and in fact, MLP-FTT performs better than MVP (Table 4) whereas the presence of pre- training, MVP outperforms MLP-FT (Table 2)

---

all the settings. Note that this does not contradict the hypothesis about vulnerability due randomly- initialized parameters, as that hypothesis only ap- plies for pretrained models. This suggests that the alignment of MVP with the pre-training task is cru- cial for adversarial robustness on downstream task.
model with a RoBERTa backbone. As control for the study, we provide the original sentence rather than the adversarially perturbed one 33% times. The underlying model achieves a clean accuracy of 81.7% and a robust accuracy of 54.0%.
We find that human annotators identify 29% of adversarial examples to be perturbed as opposed to only 6% of clean examples. Moreover, we also discover that humans achieved 11% lower accuracy on adversarial examples as compared to clean ex- amples (85% - 74%) with average confidence on the label of perturbed examples being 15% lower (90% > 75%). This study highlights that a fraction of adversarial attacks either manipulate the input so significantly that it is easily detectable, or change the label, signifying that MVP is more robust than what crude statistics suggest in $5, Details related to the human study are available in Appendix F.1.
Semantically Similar Candidates We question whether the improvement in robustness can also be attributed to the semantic relatedness between candidate answers and the class labels. To answer this question, we change the candidate answers to random proper nouns ('jack', 'john', 'ann', 'ruby') for the 4-class classification problem of AG-News and ('jack', 'john') for the 2-class classification task of BoolQ. All of these words are unrelated to the class labels. We find that irrespective of whether we use semantically related candidates or not, the robust accuracy of the model within 1% of each other, thereby implying that using semantically sim- ilar candidates is not a factor behind the robustness gains of MVP (Table 4). While the choice of candi- date answers is crucial in the pre-train, prompt, and predict paradigm (Hu et al., 2022), it is irrelevant in the pre-train, prompt, and finetune paradigm. With sufficient fine-tuning over the downstream corpus, a model can learn to associate any candidate word with any class, irrespective of its semanticity. However, one may wonder why using 'random' candidate words doesn't 't hurt the model robustness, since this also leads to modifying a 'parameter' in the model's 's embedding space, which was initially uncorrelated to the class label. We analyze this ques- tion in detail in Appendix D.3 and conclude that the main reason for the preserved robustness is the 'pre- training task hypothesis" and the fact that the mod- ified word embeddings have a much smaller dimen- sion of size 768x x C (where C is the number of candi- date words), as opposed to modifying dense layer.
Conclusion
In this work, we benchmark the robustness of lan- guage models when adapted to downstream classifi- cation tasks through prompting. Remarkably, model tuning via wompts-whieh does not utilize any sort of adversarial training or prompt engineering- already outperforms the state-of-the-art methods in adversarially robust text classification by over 3.5% on average. Moreover, we find that MVP is sample efficient and also exhibits high effective ro- bustness as compared to the conventional approach of fine-tuning with an MLP head (MLP-FT). We find that the lack of robustness in baseline methods can largely be attributed to the lack of alignment between pre-training and finetuning task, and the in- troduction of new
parameters.
Limitations
This work considers models that are under 1B pa- rameters in size. While larger models are becoming popular in the NLP community, developing prac- tical attacks that scale to such large models is an ex- tremely challenging task. For instance, for the eval- uation considered in this paper, each attack takes approximately a day on single A6000 GPU to run (across multiple seeds of the model). Furthermore, the scope of our work is limited to tasks where fine- tuning with an MLP head is commonplace. This in- cludes boolean question answering, sentence classi- fication, and paraphrase detection tasks. Finally, us- ing multiple templates for MVP comes with a trade- off with latency which is discussed in Appendix D.I.
7 Human Study
We conduct a human study to assess the viability of the adversarial attacks. More specifically, we pro- vide machine learning graduate students 250 input examples and ask the following questions: (a) What is the perceived label of the sentence; (b) What is their confidence about this label; and (c) Was this sentence adversarially manipulated? We use the BoolQ dataset and strictly instruct our annotators to not use any external knowledge but the context of the given passage only. We use samples that were successfully attacked by TextFooler for MVP + Ady

---

Broader Impact Our work does not pose any immediate negative impacts to society, except for the carbon emissions owing to the training and eval- uation of big models. We emphasize that the adver- sarial robustness conferred via MVP is a desirable property for deployed systems, and our work con- tributes towards making NLP models more reliable and safe when deployed in real-world settings.
Toutanova, 2019. BoolQ: Exploring the surprising difficulty of natural yes/uo questions. In Proceedings of the 2019 Conference of the North American Chap- ter of the Association for Computational Linguistics: Human Language Technologies, Volume I (Long and Short Papers), pages 2924-2936, Minneapolis, Min- nesota. Association for Computational Linguisties.
Jacob Devlin, Ming- Wei Chang. Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-training of deep bidirectional transformers for language under- standing. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Tech- nologies, Volume (Long and Short Pupers), pages 4171-4186, Minneapolis, Minnesota. Association for Computational I. Linguistics.
A Acknowledgements
We thank the Pittsburgh weather that kept us from doing anything but work on this draft. PM is sup- ported by funding from the DARPA GARD pro- gram. ZL acknowledges the NSF (FAI 2040929 and IIS2211955) Amazon AI, UPMC, Highmark Health, Abridge, Ford, Mozilla, the PwC Center, the Block Center, the Center for Machine Learning and Health, and the CMU Software Engineering Institute (SEI) via Department of Defense contract FA8702-15- D-0002, for their generous support of ACMI Lab's research. DP is grateful for the support of Adobe Inc., Google and Kotak ISSc AI-ML Centre (KIAC).
William B. Dolan and Chris Brockett. 2005. Automat- ically constructing a corpus sentential paraphrases. In Proceedings gs of the T Third International Workshop Paraphrasing (IWP2005).
Javid Ebrahimi, Daniel Lowd, and Dejing Dou. 201 Sa. On adversarial examples for character-leve neural machine translation. In Proceedings of the 27th Inter- national Conference on Computational Linguistics, pages 653-663, Santa Fe, New Mexico, USA. Asso- ciation for Computational Linguistics.
References
Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018b. HotFlip: White-box adversarial exam- ples for text classification. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pages 31-36, Melbourne, Australia. Association for Computational Linguistics.
Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho. Mani Srivastava. and Kai- Wei Chang. 2018. Generating natural language adversarial ex- amples. In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pages 2890-2896, Brussels, Belgium. Association for Computational Linguistics.
Tianyu Gao, Adam Fisch, and Danqi Chen. 2021. Mak- ing pre-trained language models better few-shot learn- ers. In Proceedings of the 59th Annual Meeting the Association for Computational Linguistics and the 11th International Joint Conference on Natural Lan- guage Processing (Volume 1: Long Papers), pages 3816 1-33000, Online. Association for Computational Linguistics.
Yonatan Belinkov and Yonatan Bisk. 2018 Synthetic and natural noise both break neural machine trans- lation. In International Conference Learning Representations.
Nicholas Boucher, Ilia Shumailov, Ross Anderson, and Nicolas Papernot. 2022. Bad characters: Impercepti- ble nlp attacks. In 2022 IEEE Symposium on Security IEEE.
and Privacy (SP). pages
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and hamessing adversar- ial examples. CoRR, abs/ 14126552.
Tom Brown Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert-Voss, Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel Ziegler, Jeffrey Wu, Clemens Winter, Chris Hesse, Mark Chen, Eric Sigler, Ma- teusz Litwin, Scott Gray, Benjamin Chess, Jack Clark, Christopher Berner, Sam McCandlish, Alec Radford, Ilya Sutskever, and Dario Amodei. 2020. Language models are few-shot learners. In Advances in Neural Information Processing Systems, volume 33, pages 1877-1901. Curran Associates, Inc.
Sachin Goyal, Ananya Kumar, Sankalp Garg, Zico Kolter, and Aditi Raghunathan. 2022. Finetune like you pretrain: Improved finetuning of zero-shot vision models.
Shengding Hu, Ning Ding, Huadong Wang. Zhiyuan Liu, Jingang Wang, Juanzi Li, Wei Wu, and Maosong Sun. 2022. Knowledgeable prompt-tuning: Incorporating knowledge into prompt verbalizer for text classifi- cation. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Pupers), pages -225-2240, Dublin, Ireland, Association for Computational Linguistics.
Christopher Clark, Kenton Lee, Ming- Wei Chang, Tom Kwiatkowski, Michael Collins, and Kristina

---

Robin Jia and Percy Liang. 2017. Adversarial exam- ples for evaluating reading comprehension systems. In Proceedings of the 2017 Conference on Empiri- cal Methods in Natural Language Processing, pages 2021-2031, Copenhagen, Denmark. Association for Computational Linguistics.
Zongyi Li. Jiamhan Xu, Jichang Zeng, Linyang Li, Xiao- qing Zheng. Qi Zhang, Kai- Wei Chang, and Cho-Jui Hsieh. 2021. Searching for effective defender: Benchmarking defense against adversarial word sub- stitution. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language P Processing. pages 3137-3 147, Online and Punta Cana, Dominican Republic. Association for Computational L Linguistics.
Robin Jia, Aditi Raghunathan, Kerem Göksel, and Perey Liang. 2019, Certified robustness to adversarial word substitutions. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Process- ing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP). pages 4149-4142, Hong Kong, China, Association for Computational Linguistics.
Xiao Liu, Kaixuan Ji, Yicheng Fu, Weng Tam, Zhengx- iao Du Zhilin Yang, and Jie Tang. 2022. P-tuning: Prompt tuning can be comparable fine-tuning across scales and tasks. Proceedings of the 60th Annual Meeting of the Association for Computational Linguis- rics (Volume 2: Short Papers), ). pages 61-68, Dublin, Ireland. Association for Computational Linguistics.
Zhenghao Jiang, Frank F Xu, Jun Araki, and Graham Neubig. 2020. How can know what language models know? Transactions of the Association for Computational Linguistics, 8:423-438.
Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Man- dar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. 2019. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arviv: 1 1669..
Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2020. Is bert really robust? strong baseline for natural language attack on text classification and en- tailment. Proceedings of the AAAI Conference on Artificial Intelligence, 34(05):8018 8025.
Andrew L. Maas, Raymond E. Daly, Peter T. Pham, Dan Huang. Andrew Y. Ng. and Christopher Potts. 2011. Learning word vectors for sentiment analysis. In Pro- ceedings of the 49th Annual Meeting of the Associa- tionfor for Computational Linguisties: Human Language Technologies, pages 142-150, Portland, Oregon, USA. Association for Computational Linguistics.
Ananya Kumar, Aditi Raghunathan, Robbie Matthew Jones, Tengyu Ma, and Percy Liang. 2022. Fine- tuning can distort pretrained features and underper- form ditt----iitiiuuinnn. In International Conference on Learning Representations.
John Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, Di Jin, and Yanjun Qi. 2020a. TextAttack: frame- work for adversarial attacks, data augmentation, and ad odversarial training in NLP. In Proceedings of the 2020 Conference on Empirical Methods in Natural Longuage Processing: System Demonstrations, pages 119-126, Online. Association for Computational Linguistics.
Brian Lester, Rami Al-Rfou, and Noah Constant. 2021. The power of scale for parameter-efficient prompt tun- ing. In Proceedings of the 2021 Conference on Empir- ical Methods in Natural Language Processing, pages 3045-3059 Online and Punta Cana, Dominican Re- public. Association for Computational Linguistics.
John Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby. Di Jin, and Yanjun Qi. 2020b. Textattack: frame- work for adversarial attacks, data augmentation, and adversarial training in nlp. In Proceedings of the 2020 Conference on Empirical Methods in Natural Longuage Processing: System Demonstrations, pages 119 119-
Yoav Levine, Noam Wies, Daniel Jannai, Dan Navon, Yedid Hoshen, and Amnon Shashua. 2022. The in- ductive bias of in-context learning: Rethinking pre- training example design. In International Conference on Learning Representations.
Jinfeng Li. Shouling Ji, Tianyu Du, Bo Li, and Ting Wang. 2018. Textbugger: Generating adversarial text against real-world applications. arXiv preprint arXiv:1812.00271..
Bo Pang and Lillian Lee. 2005. Seeing stars: Exploiting class relationships for sentiment categorization with respect to rating scales. In Proceedings of the ACL.
Linyang Li. Ruotian Ma. Qipeng Guo, Xiangyang Xue, and Xipeng Qiu. 2020. BERT-ATTACK: Adversarial attack against BERT using BERT. Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 6193-6202, Online. Association for Computational Linguistics.
Danish Pruthi, Bhuwan Dhingra, and Zachary C. Lip- ton. 2019. Combating adversarial misspellings with robust word recognition. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pages 5582-5582555 5591, Florence, Italy. Asso- ciation for Computational I Linguistics.
Xiang Lisa Li and Percy Liang. 2021. Prefix-tuning: Op- timizing continuous prompts for generation. In Pro- ceedings of the 59th Annual Meeting of the Associa- tion for Computational I Linguistics and the 1 11th Inter- national Joint Conference on Natural Language Pro- cessing (Volume I: Long Papers), pages 4582 4597, Online. Association for Computational Linguistics.
Guanghui Qin and Jason Eisner. 2021. Learning how to ask: Querying LMs with mixtures of soft prompts. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computa- tional Linguistics: Human Language Technologies, pages 5203-5212, Online, Association for Compu- tational Linguistics.

---

Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. 2021. Learn- ing transferable visual models from natural language supervision. In ICML.
Christian Szegedy, Wojciech Zaremba, llya Sutskever, Joan Bruna, D. Erhan, lan J. Goodfellow, and Rob Fer- gus. 2013. Intriguing properties of neural networks. CoRR, abs/1 312.6199..
Rohan Taori, Achal Dave, Vaishaal Shankar, Nicholas Carlini, Benjamin Recht, and Ludwig Schmidt. 2021. Measuring robustness to natural distribution shifts image classification. In NeurlPS 202/ Workshop on ImageNet: Post, Present, and Future.
Alec Radford, Jeff Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. 2019. Language models are unsupervised multitask learners.
Ohad Rubin, Jonathan Herzig, and Jonathan Berant. 2022. Learning to retrieve prompts for in-context learning. In Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguisties: Human Language Tech- nologies, pages 2655-200 2671, Seattle, United States. Association for Computational Linguistics.
Boxin Wang, Shuohang Wang. Yu Cheng. Zhe Gan, Ruoxi Jia, Bo Li, and Jingjing Liu. 202 Iner[ Improving robustness of language models from information theoretic perspective. In International Conference on Learning Representations.
Xiaosen Wang, Jin Hao, Yichen Yang, and Kun He. 2021b. Natural language adversarial defense through synonym encoding. In Unceriainty in Artificial In- telligence, pages 823-833. PMLR.
Timo Schick and Hinrich Schütze. 202 Exploiting cloze-questions for few-shot text classification and natural language inference. In Proceedings of the 16th Conference of the European Chapter of the Asso- ciation for Computational Linguistics: Main Volume, pages 255-269, Online. Association for Computa- tional Linguisties.
Yicheng Wang and Mohit Bansal. 2018. Robust ma- chine comprehension models via adversarial training. In Proceedings of the 2018 Conference of the North American Chapter of the Association for Computa- rional Linguistics: Human Language Technologies, Volume (Short Papers), pages 575-581, New Or- leans, Louisiana. Association for Computational Linguistics.
Timo Schick and Hinrich Schütze. 20. It's not just size that matters: Small language models are also few- shot learners. Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Tech- nologies. pages 2339 2352, Online. Association for Computational Linguistics.
Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Anthony Moi. Pierric Cistac, Tim Rault, Remi Louf, Morgan Funtowiez, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Scao, Sylvain Gugger, Mariama Drame, Quentin Lhoest, and Alexander Rush. 2020. Transformers: ofate-of-the-are art natural language processing. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pages 38-45, Online. Association for Computational Linguistics.
Authony
Taylor Shin, Yasaman Razeghi, Robert L.. Logan IV, Eric Wallace, and Sameer Singh. 2020. AutoPrompt: Eliciting Knowledge from Language Models with Au- tomatically Generated Prompts. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 4222-4233
Online. Association for Computational I Linguistics.
Chenglei Si, Ziqing Yang, Yiming Cui, Wentao Ma, Ting Liu, and Shijin Wang. 2021a. Benchmarking robust- ness of machine reading comprehension models. In Findings of the Association for Computational Lin- guistics: ACL-IJCNLP 2021, pages 634-644, Online. Association for Computational Linguistics.
Mitchell Wortsman, Gabriel Ilharco, Jong Wook Kim, Mike Li. Simon Kornblith, Rebecca Roelofs, Raphael Gontijo Lopes, Hannanch Hajishirzi, Ali Farhadi, Hongseok Namkoong, et al. 2022. Robust fine-tuning of zero-shot models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7959-7971.
Chenglei Si, Zhengyan Zhang, Fanchao Qi, Zhiyuan Liu, Yasheng Wang, Qun Liu, and Maosong Sun. 202 Better robustness by more coverage: Adversarial and mixup data augmentation for robust finetuning. In Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021, pages 1569-1576. Online. Association for Computational Linguistics.
Yuting Yang, Pei Huang. Juan Cao. Jintao Li, Yun Lin, Jin Song Dong, Feifei Ma, and Jian Zhang. 2022. A prompting based approach for adversarial exam- ple generation and robustness enhancement. arXiv preprint ar 220v 10714.
Omar F. Zaidan, Jason Eisner, and Christine Piatko. 2008. Machine learning with annotator rationales to reduce annotation cost. In Proceedings of the NIPS Workshop on Cost Sensitive Learning.
Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang. Christopher D. Mamning, Andrew Ng, and Christo- pher Potts. 3013, Recursive deep models for seman- tie compositionality over a sentiment treebank. In Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing, pages 1631-1642, Seattle, Washington, USA. Association for Computational Linguistics.
Xiang Zhang, Junbo Zhao, and Yann LeCun. 201 Character-level convolutional networks for text clas- sification. In Advances in Neural Information Pro- cessing Systems, volume 28, Curran Associates, Inc.

---

Xiang Zhang, Junbo Zhao, and Yann LeCun. 2016. Character-level convolutional networks for text clas- sification.
Xiang Zhang, Junbo Jake Zhao, and Yann LeCun. 2015b. Character-level convolutional networks for text clas- sification. NIPS.
Kaiyang Zhou, Jingkang Yang. Chen Change Loy, and Ziwei Liu. 2022a. Conditional prompt learning for vision-language models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pat- tern Recognition, pages 16816-16825.
Kaiyang Zhou, Jingkang Yang, Chen Change Loy, and Ziwei Liu. 2022b. Learning to prompt vision- language models. International Journal of Computer Vision, 130(9))2337-235 23488.
Chen Zhu, Yu Cheng, Zhe Gan. Siqi Sun, Tom Goldstein, and Jingjing Liu. 2020. Freelb: Enhanced adversarial training for natural language understanding. In In- ternational Conference Learning Representations.
Liu Zhuang, Lin Wayne, Shi Ya, and Zhao Jun. 2021. robustly optimized BERT pre-training approach with post-training. In Proceedings of the 20th Chinese National Conference on Computational Linguistics, pages 1218-1227, Huhhou, China. Chinese Informa- tion Processing Society of China.

---

Supplementary Material
BoolQ The prompt templates used for MLMs are:
Model-tuning Via
Prompts Makes NLP Models More Robust
Answer to the question is [MASK]
A Candidate
[SEP] [MASK]
Answers & Prompt Templates
3. I think [MASK]
We enumerate all the prompt templates and can- didate answers used for our experiments on MVP. Templates beginning with the [SEP] token are appended at the end of the input otherwise they precede the input. Note that remove the [SEP] token and then append the template the input. The [SEP] token just used as an indicator for appending the template to the input. Note that since Causal Language models are not bidirectional, for GPT-2 experiments, all the prompt templates will be appended at the end of the input.
4. [SEP] The answer is [MASK]
The prompt templates used for GPT-2 are the same as above except every template is appended to the end the input. As AG News, the candidate an- swers used are the same as the class labels, namely false and true, except when performing the larger candidate set experiment, in which case use the following candidate answer set:
(false, wrong, incorrect, invalid)
AG News
The prompt templates used for MLMs:
(true, correct, valid, accurate]
1. A [MASK] news
SST-2 The prompt templates used for MLMs are:
2. [SEP] This topic is about [MASK]
1. Sentiment of the statement is [MASK]
3. Category: [MASK]
[SEP] [MASK]
4. [SEP] The category of this news is [MASK]
This is a [MASK] statement
The prompt templates used for GPT-2 are:
4. [SEP] The statement is [MASK]
1. [SEP] This topic about [MASK]
Similar to AG News and BoolQ, use the class labels (i.e., negative and positive) as the candidate answers.
2. [SEP] The category of this text is [MASK)
3.
[SEP] Category: [MASK]
DBPedia14 The prompt templates used for MLMs are:
4. [SEP] This is news from [MASK]
The candidate answers used are the same as the class labels, namely-politics, business, sports, and tcchnology- for all the experiments except the larger candidate set ablation study. For that ablation, we use the following candidate answer
Content on [MASK]
[SEP] This topic is about [MASK)
3. Category: [MASK]
1. (politics, world, government, governance)
4. [SEP] The content is about [MASK]
2. competiiom,,iionn,, games, tournament)
The candidate answers used are:
{0: 'company', 1: 'education', 2: 'artist', 3: 'ath- lete", 'office', 'transportation' 6: 'building'. 7: 'nature', 8: 'village', 9: 'animal', 10: 'plant', 11: 'albumm, 12: 'fil',, 13: 'writing')
3. (business, corporation, enterprise, commerce)
4. (technology, science, electronics, computer)

---

MRPC The prompt templates used for MLMs:
AMIA (Si et al., 2021b): Adversarial and Mixup Data Augmentation (AMDA) improves robustmess to adversriia attacks by increasing the number of ad- versarial samples seen during training. This method interpolates training examples in their embedding space to create new training examples. The label as- signed to the new example is the linear interpolation of the one hot encodings of the original labels.
1. The two sentences are [MASK]
2. [SEP] First sentence is [MASK] to second sentence
3. Two [MASK] sentences
4. [SEP] The two sentences have [MASK] meanings
B.2 Attack Details
In the main paper, we evaluated our method on three popular word substitution attacks and one character-level attack. These included the TextFooler, TextBugger and BertAttack attack strategies. TextFooler and TextBugger are word substitution attacks that replace words with "sim- ilar" neighboring words (where similarity is based counterfitted Glo embeddings). TextFooler greedily searches a large set of neighbors (in the embedding space) for each word, so long as they satisfy some constraints on embedding similarity and sentence quality. An additional constraint re- quires the substituted word to match the POS of the original word. TextBugger, on the other hand, restricts the search space to small subset of neigh- boring words and only uses sentence quality as constraint. To control the amount of change made by an attack, we limit the adversary to perturbing maximum of 30% words in the AG News dataset and 10% in all other datasets. We do not modify any other constraints (such as the query budget) and run the attacks on 1000 examples from the test set. We also evaluate on one character-level, and another word substitution attack. For character-level attack, use the adversarial misspellings attack intro- duced by Pruthi et al. (2019), and we additionally evaluate the popular BertAttack (Li et al., 2020).
The candidate answers used are: (0: 'ifffrrent', 1: 'equivalent')
B Baseline Methods and Attacks
B.1 Baselines
We describe training schemes corresponding to various fine-tuning strategies below.
MLP-FT: This is the "base" model for classifi- cation via standard non-adversarial training and is utilized by all the baselines discussed in this section. Given pre-trained model, we perform downstream fine-tuning by adding MLP layer to the output corresponding to [CLS] token illustrated in Figure (a)) This hidden representation is of size 768 In the case of the BERT model, there is a single dense layer dimension 768 x 2, whereas in the case RoBERTa model, we have a two-layer MLP that is used to make the final prediction. MLP + Adv: This is identical to the method used for adversarial training in Section 3.2, wherein we perform adversarial perturbations in the embed- ding space of the MLP-FT model, rather than MVP. FreeLB++ (Li et al., 2021): Free Large-Batch Batch (Freel.B) adversarial training (Zhu et al., 2020) per- forms multiple Projected Gradient Descent (PGD) steps to create adversarial examples, and simulta- neously accumulates parameter gradients which are then used to update the model parameters (all once). FreeLB++ improves upon FreeLB by in- creasing the number of adversarial training steps 10 and the max adversarial norm to InfoBERT (Wang et al., 2021a): InfoBERT uses an Information Bottleneck regularizer to suppress noisy information that may occur in adversarial attacks. Alongside, an 'anchored feature regular- izer' tries align local stable features the global sentence vector. Together, this leads improved generalization and robustness. InfoBERT can addi- tionally be combined with adversarial training (we use Free LB++ for this purpose).
C Extended Experiments
on Adversarial Robustness
C.1 Results on Additional Datasets and Models
Results on BERT-Base Results on BERT-Base model are presented in Table 7. Similar to the re- sults corresponding to RoBERTa- Base model in the main paper, we find that proposed method MVP improves over the state-of-art defenses across different datasets and 4 different attacks by 2% even without any adversarial training. Using adver- sarial training further improves the average robust accuracy by 4%.

---

GPT2
BoolQ
News
Clean Acc
TextFooler
TextBugger
Clean Acc
TextFooler
TextBugger
MLP-FT
61.0 2.1
20.2 + 0.6
24.9 + 1.4
93.7 =
1.2
58.2 0.9
MLP-F STP-FTTAE +Adv
60.5 0.4
22.0 + 1.1
31.8 1.8
92.4 0.3
39.6 0.5
61.3 0.7
MVD
72.5 + 1.0
28.7 + 1.6
38.3 1.6
93.8 0.3
31.4
61.0
MVP +Adv
71.8 0.8
30.1 + 0.6
41.2
+: 0.8
+3.3
44.0 = 0.2
64.4 1.2
Table Adversarial Robustness results BoolQ and AG News dataset using GPT-2 model. All experiments run on different seeds and the performance is reported over fixed test set of size 1000. The best- best-performing robust accuracies are bolded and second best robust accuracies are underlined.
DBPedia
Clean Acc
TextFooler
TextBugger
BertAttack
Misspellings
MLP-FT
97.3=0.7
1..
68.74:0.9
72.4=
65.7
MLP-FT + Adv
97.2=004
56,1 #002
76.4-100.3
78.3=0.6
72.2
MVP
97.0=0.5
57.2
77.2
80.6=0.7
74.3
MVP + Adv
97.3=009
82.7=10.4
90.3-10.2
88.5 11.8
86,4
MRPC
Clean Ace
TexiFooler
TextBugger
BertAttack
Misspellings
MLP-FT
87.9=066
41.5#112
50,2+110
61.1=11
51.7=110
MLP-FT Adv
87.2=0.4
42.1
53,44007
64.1=0.1
54.2+0.4
MVP
88,4=0.4
44.8 +0.1
56,6+t..1
68.8=005
57.3=0.9
MVP Adv
87.1=1.2
46.6:11.2
60.7+.0.
72.1 10.9
65.8
Table 6: Adversarial performance of RoBERTa-base model on 2 additional datasets. All accuracy values are reported for fixed test set of size 1000 and averaged over different seeds. The highest accuracies bolded, and the second-besti is underlined. MVP is the most robust, and preserves (or improves) the clean accuracy.
Additional Datasets We further extend our re- sults on two diverse datasets-DDBeddall (Zhang et al., 2015a), a 14-class news classification dataset, and MRPC (Dolan and Brockett, 2005), a para- phrase detection dataset. Results on these are pre- sented for the MLP-FT and MVP training schemes for RoBERTa-base model in Table 6.
C.2 Results on Causal Language Models
Causal Language Models have not been tradition- ally fine-tuned for downstream classification tasks. This is evident also from the exclusion of fine- tuning results in the original GPT-2 paper (Radford et al., 2019). In this work, we try to evaluate the clean and adversarial robustness of GPT-2 models, when adapted to downstream tasks. To implement MVP, we use the Causal I Language Modeling (CLM) head to get the next word prediction logits. Since using the CLM head, is imperative that the prompt templates are appended the back and have the [MASK] as the last token.
The experiments provide additional evidence support our findings about the adversar- ial robustness conferred by model-tuning via prompts (MVP) as opposed the conventional ap- proach of MLP-FT. Without adversarial training, MVP improves over MLP-BB FTT by an average of 6% on the MRPC dataset across 4 different attacks. Re- sults on the DBPedia dataset also show consistent improvements of MVP over MLP-FT. In particular, we find that MVP improves on average (across 4 different attacks) by 10% over MLF-FT, and MVP + the adversarial training counterpart of MLP FT. setting where the num- ber of labels is many, we in fact see a larger relative gain by using MVP over the conventional approuch MLP-FT.
We find that on the BoolQ dataset MLP-FT achieves robust accuracy of 20.2% and MVP achieves a robust accuracy of 28.78% 19.7% (Ta- ble 5), which is large improvement. Similar to our findings in the main paper, 1-step adversarial training on MVP (MVP Adv) yields robust ac- curacy of 30.1 1 % which a massive improvement over MLP-FT and MLP-FP FT + Ady which obtains a robust accuracy of 22.0%. Interestingly, we also
adv improves by 16%

---

SST2
MLF-FT
MLP-FT Adv
Free LB++
MADA
InfoBert
MVP
MVP Adv
Clean Ace
91.9 4..2
90.9 40.3
92.1 +0.8
92.1 009
91.7 40.6
91.7 +0.4
91.8 +0.7
TextFooler
38.3 +1.00
41.
42.2 +1.0
41.7 =0.5
43.1 40.8
44.6 +0.7
47.7 #.66
TexiBugger
60.4 40.4
40.5
63.0 +0.7
60.9 -0.4
64.6 40.6
65.1 +0.1
67.8 #0.4
Bertattack
68.7 +0.55
70.1 40.8
72.0 #0.9
70.3 00.
72.8 40.6
75.9 +0.7
78.9
Misspellings
39.2 10.4
42,4 40.4
43.4 +0.4
40.2 00.7
43.1 40.7
45.6
49.2 +00
AG News
MLP-FT
MLP-FT Adv
Free LB++
MADA
InfoBert
MVP
MVP Adv
Clean Acc
93.7 40.4
93.2
93.4 :0.2
92.8 =0.5
93.8 40.3
93.7 10.5
94.0 #0.6
TextFooler
$7.5.007
44.3 +1.0
43.5 #0.2
41.8 =0,9
44.0 11.
46.3 :12
53.7 20.1
TextBugger
10.6
64.1 40.2
63.4 10.8
62.6=11
64.1 40.8
66.0 10.4
69.2 113
Bertattack
78.1 #122
80.1 40.2
80.9 #0.1
=066
80.7 20.6
82.1 1:077
83.4 20.4
Misspellings
76,8 #0.8
40.2
79.5 10.7
76.9
81.5 40.7
84.3 2.3
BoolQ
MLP-FT
MLP-FT Adv
Free LB++
MADA
InfoBert
MVD
MVP Adv
Clean Ace
71.1 #1.3
10.9
70.7 +0.2
71.1
71.8 10.6
71.4
71.3 #0.3
TextFooler
21.8 4:4.4
29.8 40.8
29.5 #0.6
25.4 =08
29.9 40.2
31.1 +:13
43.1 =007
TextBugger
36.8 1:3.
41.3
42.8 10.6
41.6
42.6 10.6
44.4 4:2.8
49.9 #00
Bertattack
1:1.2
57.8 +0.7
58.2 #0.9
57.8 =0.6
58.9 40.8
60.1 +:0.6
63.2 0:0.7
Misspellings
55.1 1:100
58.1 4:033
59.4 4007
56.2
59.1 40.6
60.1 1:1.0
63.2 #.0.8
Table Adversarial performance of BERT-base model different datasets. All accuracy values are reported for fixed test set of size 1000 and are averaged over 3 different seeds. The highest accuracies are bolded, and the second- best are underlined. MVP is the most robust, and preserves (or improves) the clean accuracy.
notice that for MLP-FT and MLF-FT Adv, it is difficult to achieve a good clean generalization performance whereas MVP and MVP + Adv per- form much better on the clean test set. These ob- servations are in line with the results in our main paper. On the AG News dataset, MVP performs significantly better than MLP-FTT and MVP + Adv performs better than MLP-FT + Adv. These results show that MVP is not only good way of finetun- ing BERT-like MLMs but can also improve Causal Language Models both in terms of clean accuracy and robustness to adversarial perturbations.
Configuration
Time taken (in sec)
MLP-FT
23.25 (0.95
1 Template
2..45=0.225 (T)
2 Templates
27.51=0.45 (1.15x
3 Templates
32.81=0.30
(1.34xT)
4 Templates
35.65+0.44 (1.45xT)
Table 8: Inference latency comparison across different configurations.
D Extended Analysis
C.3 Sample
Efficiency and Effective Robustness
D.1 Latency of Using Multiple Templates
We demonstraate the sample efficiency MVP on BoolQ dataset (Figure 4a) in addition to the discus- sion about AG News in $..1. Interestingly we find that MLP-FT is unable to achieve better accuracy compared to even random classifiers with 200 exam- ples but MVP performs much better in the low data regime (< 200 examples). We also provide more evidence on the effective robustness of MVP by pre- senting the effective robustness results on AG News (Figure 4b). Even for AG News, we notice that the curve is much steeper for MV2 than MLP-FT.
We present the latency numbers and compare them with the latency of the standard MLP FT approach. Specifically, the time required for 2000 forward passes of data from the IMDb datuset with batch size of is represented T 2..45+00.25 seconds. The results are presented in Table 8.
In summary, using multiple templates makes pre- dictions about 1.45x slower, however, this leads to improved robustness.

---

80
vocabulary words.
We did not perform any dedicated prompt tun- ing for selecting the prompts. Instead, prompts were either chosen directly or inspired by the Open- Prompt repository. The selected prompts led to a marginal (2%) increase in model robustness during fine-tuning. Unlike typical few-shot or in-context learning methods, approach aligns more closely with the idea of prompt tuning. For more advanced techniques and further potential improvements in prompt tuning, readers are referred to Hu et al. (2022).
60
Accuracy (in %%
Robust Clean
MVP MLP
40
20
100
200
500
1000
2000
3016)
4000
Train set size
(a) Clean adversarial accuracies RoBERTa- base model on BoolQ dataset for varying amounts of training data.
D.3
Why does using "dummy candidate words" not hurt model robustness?
In our paper, we note that using dummy candidate words like Jack and Ann, instead of class labels, does not hurt model robustness. However, this is very similar to random projection layers, why does this not impact model robustness similarly? We note that using dummy candidate words leads modifying an embedding size 768 x (where the number of candidate words) so that they now have a new "meaning". The effective number of "new parameters" is much lower than the parameters in the "dense 768x 768 layer" in the Roberta model. However, in terms of new parameter complexity, this is similar to our ablation "Project As one may note, using Project CLS also improves robustness over MLP-FT. This because we avoid the dense 768x768 layer.
60
Robast Accuracy (in %6)
40
30
84
86
90
Clean Accuracy
(b) Clean vs adversarial performance of RoBERTa base model the AG News dataset. We find that models tuned via prompts (MV?) yield more robust models compared fine-tuning MI.P heads for the same clean accuracy.
Figure 4: (a) Models trained with MVP are signifi- cantly more sample efficient as compared to those with MLF-FT. (b) We find that models tuned via prompts yiel) more robust models compared to fine-tuning MLP heads for the same clean accuracy (details $5.1).
Additionally, we conducted a new experiment of using empty slots in the vocabulary of Roberta and compared it with using "dummy candidate words" and "class labels". For the BoolQ dataset, using Roberta model, we summarize the results in Table 10.
D.2 Benefits from Prompt Tuning
Based on these accuracies above we find that:
1. Using class labels is better than using "dum- my/untrained words" for both clean and robust accuracy, which supports the random param- eter vulnerability hypothesis.
To assess the benefit of Prompt tuning, we con- ducted series of experiments. Interestingly, even an empty template with just a [MASK] token, which would be considered a weak prompt, showed significant performance improvements over the standard technique of MLP-FT. We present these results for 4 different prompt choices in Table 9, The choice of prompts used has very little effeet model robustness in the fine-tuning regime. We tabulate the robustness results corresponding dif- ferent prompts below (for the BoolQ dataset). Here the first four prompts are the prompts we used and "Ruby emerald [MASK]" " is a random prompt from
2. The robustness achieved upon using com- pletely untrained slots similar to that when using dummy candidate words. This suggests that when compared to class labels, modifying dummy words has a similar loss in robustness as with modifying untrained words.
The MVP models (with random/empty candidate words) are more robust than

---

Template
Clean Accuracy
Robust Accuracy
Answer to the question is [MASK]
0.5
3..
[SEP]
[MASK]
81.7
36.1+0.1
Ithink
[MASK]
81.9
3.2
[SEP] The answer is [MASK]
82.0+
38.1+0.1
[SEP]
Ruby emerald [MASK]
81.4 = 0.5
36.8 = 0.4
None (MLP-F1)
8..6
28.2
Table 9: Model robustness per template chosen for the BoolQ dataset.
Method
Candidate Choice
Clean Accuracy
Robust Accuracy
MLP-FT
N/A
80.6 = 1.5
28.2 - 1.6
ProjectCLS
N/A
81.3 + 0.5
37.4 1.2
MVP
Class Labels
82.0 = 0.6
42.9 0.5
MVP
Dummy Candidate Words (Jack/Ann)
80.9 + 0.3
42.1 0.4
MVP
Empty Slots
81.3 0.3
41.2 0.7
Table 10: Comparison of different choices of candidate words and their accuracies when training Roberta model the BoolQ dataset.
ProjectCLS (which already bridges the robustness gap from MLP-FT). These gains are explained by the pre-training task align- ment hypothesis, where pre-training (and fine- tuning) the model with the task of (MASK) infilling helps make the downstream model robust.
in (Li et al., 2021), and use Pmax 0.1 for BoolQ and SST2 in all experiments. We use a query budget of 100 for BERT-Attack and a query budget of 300 for adver- sarial misspellings as these attacks are very slow.
Pmax = 0.3 for AG News
D.4 Impact of Ensembling the Candidates
Recall that in the main paper, we ensemble multi- ple templates and aggregate their predictions. In this subsection, we also investigate the impact of ensembling candidate words rather than templates, Based the results in Table 11, find that this is not as helpful as ensembling multiple templates.
Training Hyperparameters & Model Selection We train all models including the baselines with patience 10 epochs, for a maximum of 20 epuchs, and choose the best model based on validation accu- racy. For the datasets that do not contain publicly available validation set, we set aside 10% of the training set for validation. In the case of baseline defenses that use adversarial training, perform model selection based ad advessaiial accuracy rather than clean accuracy. We use candidate answer set containing only the class label names and we aver- age over 4 prompt templates all the MVP models. We use batch size of 32 for MLP-FT and a batch size of 8 for MVP models. The learning rate is set as 1 5 for all the models. We use the Adam W opti- mizer along with the default linear scheduler (Wolf et al., 2020). In all the MVP Ady and MLP-FT Ady models, use a use 1-step adversarial train- ing with max E norm of 1 1.0. For the state-of-the-art basclines, we use the same hyperparameters as prescribed by the original papers.
E Hyperparameter Details
Attack Hyperparameters TextFooler and TextBugger use a word substitution attack that searches viable substitutions of word from set of synonyms. We restrict the size of the synonym set to 50 for TextFooler which is the default value used by Jin et al. (2020) and to 5 which is the de- fault value used by Li et al. (2018). Both TextFooler and TextBugger use Universal Sentence Encoder (USE), that poses a semantic similarity constraint on the perturbed sentence. We use the default value of 0.84 as the minimum semantic similarity. An- other important attack parameter is the maximum percentage modified words (pmax). As discussed

---

Configuration
Clean Accuracy
Robust Accuracy
prompt 4 candidates
0.3
0.5
prompt candidate
81.9::0.8 82.0=t0.6
35.9:10.2
prompt candidate
42.9++0.5
Table 11: Impact of different ensembling configurations on clean and robust accuracy of Roberta model on the BoolQ
dataset.
Perturbed Examples
Unperturbed Examples
Labeling Instructions
X
Incruction This study intendedds suskone commonit et anwerrrte partuthations actuall meeningfut
Q1. Annotator Accuracy
74%
85%
the sentrncee bekow natrral quast ore. the manipolddd mak small codiicationo to the tox.
Q2. Annotator Confidence
75%
90%
No
54%
82%
Each inpubie
lower-caeed manuaity
Q3. Perturbed? Unsure
17%
12%
Labele Fukae (5), Troe (1).
Yes
29%
06%
The quection never advercariall perturbed. Only the supporting contewt
your
world
any the queationec
Table 12: Summary the responses from the user study. The total number of presented examples is 250, out of which 83 are unperturbed and 167 are adversarially per- turbed.
Perceived Lobel Felso)
Confidence your
being mea]
Adwerorts (1 being mood; what chance that the sentence was pertutted uning wond subestutionn?
Figure 5: snapshot of the instructions for completing study.
F Human Study
Despite the improvements brought to adversarial robustness by our proposed modification (MVP + Adv), we note that there is still significant drop in robust accuracy opposed to the clean accuracy of the model. We conduct human study in order (i) assess the viability of adversarial attacks, and (ii) estimate human performance against adversar- ial attacks. More specifically, we provide machine learning graduate students 250 input examples and ask the following questions:
First, we find that humans achicved 11% lower accuracy on adversarial examples as compared to clean examples (85% - 74%) with average con- fidence on the label of perturbed examples being 15% lower (90% - 75%) (Table 12). Next, we also discover that human annotators suspect 29% of adversarial examples be perturbed as opposed to only 6% of clean examples. Through this study, we also find that in 47% of the cases, the input is either manipulated so significantly that is easily detectable or the original label not preserved, signifying that MVP may be more robust than what statistics suggest in $5. Further details are available in Appendix F.l.
1. What is the perceived label of the sentence? (Answer options: True or False)
2. On scale of 1 to 3, what is their confidence about this label?
F1 Details of Interface
3. Was this sentence adversarially manipulated? (Answer options: options: Yes, Unsure, or No)
We present snapshot of our interface that provides detailed instructions for our users (Figure 5). We provide a detailed overview of the questions asked in the user study. Annotators were provided with boolean question and an accompanying context to answer the question and asked were asked to annotate the following:
We use the BoolQ dataset and strictly instruct our annotators to not use any external knowledge but the only context of the given passage. We use sam- ples that were successfully attacked by TextFooler for MVP Adv model with RoBERTa backbone. As a control for the study, 33% of all sentences are unperturbed sentences from the original dataset. The underlying model achieves a clean accuracy 81.7% and a robust accuracy of 54.0%.
1. What should be the answer to the question? (only use the context) Given the boolean ques- tion and the context, we ask the annotators whether the answer to the question is True or False. We also

---

request the annotators only use the given context and refrain from using any external knowledge.
2. How confident are you about the label above? Once the annotator has answered question 1, we ask them to rate how confident they feel about the label they assigned to the input. The options provided are "Uncertain", "Somewhat Certain" and "Certain". Based on their response we assign confidence of 1, if the annotator was certain, assign 0.5 if the notator was somewhat certain, and assign the annotator was uncertain to calculate the average confidence.
3. Do you think that the sentence is adversari- ally perturbed? (using word substitutions) Do use your own knowledge the world to swer this question. We also ask the annotators, the input was adversarially perturbed. The options provided to the user are "No", "Unsure" and "Yes".
The annotators helped us annotate 250 such examples out of which 167 were adversarially perturbed and 83 were clean. An overview of the responses from this study is presented in Table 12, and the key takeaways are discussed in Scction F.


Reviews:
[{"review_id": "JNK2ekiizK", "reviewer": "Reviewer_CusV", "summary": "", "questions": "1. How does method scale to different classification tasks. How difficult would designing the prompts be ?\n\n2. Did you discard any prompts which did not perform well ?", "limitations": "", "rating": 3, "confidence": 4, "soundness": 4, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your careful assessment of our work and thought-provoking questions. We are happy to see that you found our method to be sound which led to strong gains accompanied by a meaningful analysis. We address your concerns below.\n\n---\n\n\n> ### What is the inference latency of using multiple templates?\n\nWe present the latency numbers below and also compare them with the latency of the standard MLP-FT approach. In particular, we measure the time required for 2000 forward passes of data from the IMDb dataset with a batch size of 1. T= 24.45 ± 0.25 secs.\n\nConfiguration | Time |\n---- | ---- |\nMLP-FT | 23.25 ± 0.37 secs (0.95*T)\n1 Template |   24.45 ± 0.25 secs (T)\n2 Templates|  27.51 ± 0.45 secs (1.15 * T)\n3 Templates|  32.81 ± 0.30 secs (1.34 * T)\n4 Templates| 35.65 ± 0.44 secs (1.45 * T)\n\nIn summary, using multiple templates makes predictions about 1.45x slower, but leads to improved robustness. We will include these results in the draft. \n\n---\n> ### Discussion on OOD robustness: \n\nWe performed **new experiments** to assess the out-of-distribution robustness of MVP, MLP-FT, and LPFT based on your feedback, and present results below. We use 5 sentiment classification datasets, namely SST2, Amazon Polarity, IMDb, Movie Rationales, and Rotten Tomatoes. We fine-tune a Roberta model on 1000 examples of each of these datasets and evaluate on every other dataset. The full table of results is provided below, but in summary, we see that across 5 different models (and 20 evaluations) the average accuracy for MVP (89.65%) is 2% more than MLP-FT and 1.3% more than that of LP-FT. \n\n|  | | SST2 | | | | | Amazon | Polarity | | | | IMDb | | | | | Movie | Rationales | | | | Rotten | Tomatoes |  \n|------------------|----------------|--------------|-------------|-------------------|-------------------|-------------------------|--------------|-------------|-------------------|-------------------|-----------------|--------------|-------------|-------------------|-------------------|---------------------|--------------|-------------|-------------------|-------------------|---------------------|--------------|-------------|\n| **Train\\\\Eval** | **MVP** | **MLP-FT** | **LPFT** | | | **MVP** | **MLP-FT** | **LPFT** | | | **MVP** | **MLP-FT** | **LPFT** | | | **MVP** | **MLP-FT** | **LPFT** | | | **MVP** | **MLP-FT** | **LPFT** |  \n| SST2 | 91.31 | 91.2 | 91.9 | | | 92.8 | 89.21 | 90.1 | | | 89.45 | 87.65 | 87.9 | | | 86 | 85.93 | 86.23 | | | 86.12 | 83.21 | 84.09 |\n| Amazon Polarity | 90.86 | 88.53 | 88.98 | | | 92.9 | 92.9 | 93.4 | | | 92 | 91.2 | 91.1 | | | 85.92 | 83.92 | 84.23 | | | 86.12 | 83.3 | 84.5 | \n| IMDb | 84.4 | 81.42 | 83.5 | | | 91.85 | 88.8 | 88.7 | | | 92.2 | 91.85 | 92.4 | | | 91.95 | 89.95 | 90.15 | | | 81.92 | 78.14 | 80.12 |\n| Movie Rationales | 89.91 | 85.89 | 85.45 | | | 92.5 | 89.05 | 90.7 | | | 91.7 | 90.6 | 91.6 | | | 94.4 | 93.46 | 94.3 | | | 87.36 | 83.02 | 83.43 |\n| Rotten Tomatoes | 92.43 | 92.08 | 92.9 | | | 92.6 | 89.5 | 90.4 | | | 90.9 | 88.55 | 90.2 | | | 86.45 | 83.92 | 84.67 | | | 87.15 | 87.05 | 87.2 |\n| **Average** | 89.782 | 87.824 | 88.546 | | | 92.53 | 89.892 | 90.66 | | | 91.25 | 89.97 | 90.64 | | | 88.944 | 87.436 | 87.916 | | | 85.734 | 82.944 | 83.868 |\n\nThese results show that MVP is superior to MLP-FT and LPFT for both adversarial and OOD robustness. In summary, LPFT helps reduce the impact of random parameter vulnerability, but MVP additionally allows pre-training task alignment (the second hypothesis) hence resulting in superior performance and no fundamental trade-off be it OOD or adversarial robustness.\n\n\n---\n> ### How does the method scale to different classification tasks? \n\nIn our work, we evaluate the effectiveness of MVP on 5 different datasets–AG News (4-class topic classification), SST2 (binary sentiment classification), BoolQ (boolean question answering), DBPedia14 (14-class topic classification), and MRPC (paraphrase detection). For each of these tasks, we made no particular adaptations to make the method work. Therefore, there is almost no cost to setting up a new task, both in terms of complexity (like the method scales to tasks with a large number of labels like 14 in DBpedia) and style (like paraphrase detection in the case of MRPC).\n\n> ### How are prompts selected for new tasks? \n\n(1) We do not do any prompt tuning to make MVP work and do not discard any prompts. For the most part, we selected prompts from (or took inspiration from) the [OpenPrompt repo](https://github.com/thunlp/OpenPrompt/tree/main/scripts/TextClassification) whenever the corresponding datasets were available. (2) The choice of prompts used has very little effect on model robustness in the fine-tuning regime. For instance, we find that using an empty template with just a [MASK] token (which would be at the extreme end of making the prompt weak) also performs very well. These templates are provided in Appendix A and detailed per-prompt accuracies may be found in response to Reviewer QuR4.\n\n---\nOnce again, thank you for these pointers that have further strengthened our work. We will include our new results in the final draft and look forward to clarifying any remaining concerns.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "1. Using prompts to avoid adding random parameters for adversarial robustness is a nice approach and it works on the datasets presented in the paper. MVP shows better adversarial robustness compared to fine-tuning without sacrificing on accuracy.\n\n2. The experiments confirm the issue with adding random features in the fine-tuning stage as raised by Kumar e. al 2022 etc. fine-tuning using prompts is an alternate to the LPFT.", "reasons_to_reject": "1. Lack of discussion and analysis on the inference latency as more templates are added for MVP. \n\n2. This paper would have benefited from a direct comparison between LPFT and MVP on both OOD generalization and Adversarial robustness. Both these approaches combat the \"brittleness\" of the fine-tuning process. It would have been interesting to see LPFT vs MVP using different number of prompts. A discussion on the relative advantages of each approach would have added to this work.\n ", "questions_to_authors": "1. How does method scale to different classification tasks. How difficult would designing the prompts be ?\n\n2. Did you discard any prompts which did not perform well ?", "paper_topic_and_main_contributions": "This work explores the adversarial robustness of model-tuning via prompts (MVP) and compares it to models which are fine-tuned.  MVP here is not an efficient tuning method and all the weights of the model are trained during fine-tuning on prompts. During inference they ensemble the results from different prompts. The authors demonstrate that their method has better robustness under a number of perturbation methods on 5 classification datasets. Moreover they demonstrate sample efficiency over fine-tuning. ", "excitement": 3, "reproducibility": 4, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "wZGI5Py8Ob", "reviewer": "Reviewer_nbR2", "summary": "", "questions": "How much improvement do we expect prompt tuning to give, beyond MVP+Adv?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 4, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your positive assessment of our work. We are happy to see that you appreciate the strong empirical gains and simplicity of the proposed approach and the clear analysis and human study. We address your concerns below:\n\n---\n> *Reasons To Reject:* Only tested on datasets that are simple classification tasks (BoolQ is 2 classes, AGNews contains 4 classes).\n\nWe want to clarify that this is _not_ the case. We perform experiments on 5 different datasets. Among these, DBPedia is a 14-class classification problem, and results for the same are presented in Table 5 in the appendix. Secondly, regarding evaluating on more complex datasets, we also perform experiments on MRPC (paraphrase detection) and results for the same are also in Table 5 of the Appendix. Due to space constraints, we were only able to include results for 3 datasets in the main paper. In summary, we perform our experiments on five different datasets—AG News (4-class topic classification), SST2 (binary sentiment classification), BoolQ (boolean question answering), DBPedia14 (14-class topic classification), and MRPC (paraphrase detection). We hope this addresses your concerns.\n\n---\n> ### How much benefit do you get from Prompt tuning?\n\nTo assess the benefit of Prompt tuning, we perform a series of experiments. For instance, we find that using an empty template with just a [MASK] token (which would be at the extreme end of making the prompt weak) also performs very well. These templates are provided in Appendix A. We excluded this discussion in the submission, but we see the value in the same following your comments. We report the model robustness per template chosen for the BoolQ dataset.\n\nTemplate | Clean Accuracy | Robust Accuracy \n---- | ---- | ---- |\nAnswer to the question is [MASK]        |            81.5 ± 0.5       |      38.5 ± 0.7\n[SEP] [MASK]                                       |            81.7 ± 0.6        |     36.1 ± 0.4\nI think [MASK]                                       |            81.9 ± 0.8        |     35.9 ± 0.2                                        \n[SEP] The answer is [MASK]                 |           82.0 ± 0.3        |     38.1 ± 0.1\nNone (MLP-FT) |      80.6 ± 1.5       |       28.2 ± 1.7\n\nSo to answer your question: (1) We did not do any prompt tuning for selecting the prompts, and selected them from (or took inspiration from) the [OpenPrompt repository](https://github.com/thunlp/OpenPrompt/tree/main/scripts/TextClassification) wherever available. (2) The choice of prompts used has a small (2%) effect on model robustness in the fine-tuning regime (unlike few shot or in-context learning regimes). (3) We believe that other prompt tuning methods (eg. https://aclanthology.org/2022.acl-long.158/) may yield further improvements. Benchmarking them is an interesting future direction that is outside the scope of this work.\n\n---\n\nWe hope this further strengthens your confidence in MVP. Additionally, you may also be interested in seeing the results of **out-of-distribution robustness** evaluation in [response to Reviewer CusV](https://openreview.net/forum?id=R4yb4m7Nus&noteId=XZi0p9TBKK) which further expands the relevance of our work.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "- Strong experiment results, especially wrt adversarial robustness. \n- Human annotators validated efficacy of adversarial example set\n- Sound ablation studies and clear analysis that explains the results\n- MVP + Adv outperforms MLP-FT + Adv handily", "reasons_to_reject": "- Only tested on datasets that are simple classification tasks (BoolQ is 2 classes, AGNews contains 4 classes).\n- No evaluation for datasets with larger number of classes, no evaluation for non-classification tasks.\n", "questions_to_authors": "How much improvement do we expect prompt tuning to give, beyond MVP+Adv?", "paper_topic_and_main_contributions": "The paper contributes a novel method to generate a prediction called MVP which is a constrained infilling task (the constrain the tokens we infill to the class categories they are interested in for a particular task) while also attaching a prompt. Further experiments show that MVP is adversarially robust and performing adversarial training on top of this method yields significant improvements in adversarial robustness. The resulting robustness stems from a few design choices (1) removal of the randomly initialized fully connected layer to reduce feature distortion (2) similarity to the pretraining task of Masked Language Modeling.", "excitement": 4, "reproducibility": 5, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "WTPIMut1Me", "reviewer": "Reviewer_QuR4", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": 4, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your careful assessment of our work and we are happy to see that you found our work to be sound and the proposed method interesting. We would like to emphasize that fine-tuning of language models is an important paradigm in the current landscape of NLP research, where researchers are moving back from “general-purpose” large models, to “task-specific” smaller models (for computational constraints) and/or more accurate models (for instance, even the GPT-3.5 API now supports fine-tuning). Model tuning via prompts is a simple modification that all fine-tuning approaches could easily adopt to enhance robustness.\n\nFirst, we would like to point out that we found two sources that lead to the robustness difference between MVP (our proposed approach of model-tuning via prompts) and MLP-FT (standard fine-tuning) — \n**first**, as you also note in your review, is the random parameter vulnerability of MLP-FT, and **second**, is the alignment between the pre-training and fine-tuning tasks. We believe the second source explains some of the questions you raised in your review. We now address your concerns below.\n\n---\n\n> ### Why does using “dummy candidate words” not hurt model robustness, akin to random projection layers?\n\nThis is a great and valid concern. Using dummy words like Jack and Ann leads to modifying an embedding of size 768 x C (where C is the number of candidate words) so that they now have a new “meaning”. The effective number of “new parameters” is much lower than the parameters in the “dense 768x768 layer” in the Roberta model. Your suggestion is similar—in terms of parameters to be tuned—to our ablation “Project-CLS” in Figure 3a. As you may see, using ProjectCLS also improves robustness over MLP-FT. This is because we avoid the dense 768x768 layer.\n\nAdditionally, **we conducted the new experiment of using empty slots in the vocabulary of Roberta** (which we thought was a great suggestion!) and compared it with using “dummy candidate words” and “class labels”. For the BoolQ dataset, using a Roberta model, we summarize the results below.\n\nMethod  | Candidate Choice | Clean Accuracy | Robust Accuracy |\n----|----|----|----|\nMLP-FT | N/A | 80.6 ± 1.5 | 28.2 ± 1.6\nProject-CLS| N/A | 81.3 ± 0.5 | 37.4 ± 1.2\nMVP | Class Labels         |      82.0 ± 0.6       |     42.9 ± 0.5       \nMVP | Dummy Candidate Words (Jack/Ann)      |     80.9 ± 0.3        |    42.1 ± 0.4\nMVP | Empty Slots\t  |       81.3 ± 0.3      |      41.2 ± 0.7\n\n\nBased on these accuracies above we find that \n1. Using class labels is better than using “dummy/untrained words” for both clean and robust accuracy, which supports the random parameter vulnerability hypothesis.\n2. The robustness achieved upon using completely untrained slots is similar to that when using dummy candidate words. As you also guessed, this suggests that when compared to class labels, modifying dummy words has a similar loss in robustness as with modifying untrained words. \n3. The MVP models (with random/empty candidate words) are more robust than Project-CLS (which already bridges the robustness gap from MLP-FT). These gains are explained by the pre-training task alignment hypothesis, where pre-training (and fine-tuning) the model with the task of [MASK] infilling helps make the downstream model robust.\n\n\n---\n\n> ### How are prompts selected, and what is the robustness of different prompts?\n\nWe did not perform any sort of prompt tuning for selecting the prompts, and selected prompts primarily from the [OpenPrompt repository](https://github.com/thunlp/OpenPrompt/tree/main/scripts/TextClassification). Further, the choice of prompts used has very little effect on model robustness in the fine-tuning regime. We tabulate the robustness results corresponding to different prompts below (for the BoolQ dataset). Here the first 4 prompts are the prompts we used and \"Ruby emerald [MASK]\" is similar to your suggestion of \"foo bar [MASK]\": \n\nTemplate | Clean Accuracy | Robust Accuracy \n---- | ---- | ---- |\nAnswer to the question is [MASK]        |            81.5 ± 0.5       |      38.5 ± 0.7\n[SEP] [MASK]                                       |            81.7 ± 0.6        |     36.1 ± 0.4\nI think [MASK]                                        |           81.9 ± 0.8        |     35.9 ± 0.2                                     \n[SEP] The answer is [MASK]                 |           82.0 ± 0.3        |     38.1 ± 0.1\nNone (MLP-FT) |      80.6 ± 1.5       |       28.2 ± 1.7\n[SEP] Ruby emerald [MASK]                 |            81.4 ± 0.5        |     36.8 ± 0.4   \n\n\n---\n\n> ### How can we be sure that robustness gains are not just from ensembling templates?\n\nWe had the exact same concern and for that reason, we conducted an experiment to evaluate the impact of varying the “number of templates”. While adding more templates does increase model robustness, even using a single template is significantly more robust than MLP-FT. One may also wonder, how can we be sure that attacking an MVP model does not get a “false” sense of robustness because it is harder to fool the model this way. To be sure of this, we run experiments on pre-training task alignment where we find that **MVP models _without pre-training_ are actually less robust than MLP-FT**. These results are in Table 3 of the main paper. Hopefully, these findings alleviate your concern.\n\n---\n\n> ### What is the impact of ensembling the candidates (1 prompt + 4 candidates)\n\nThis is not as helpful as ensembling multiple templates, we provide the requested numbers and comparisons below:\n\nConfiguration | Clean Accuracy | Robust Accuracy \n---- | ---- | ---- |\n1 prompt + 4 candidates |  81.9 ± 0.3        |    37.4 ± 0.5\n1 prompt + 1 candidate |  81.9 ± 0.8 | 35.9 ± 0.2\n4 prompt + 1 candidate |  82.0 ± 0.6 | 42.9 ± 0.5\n\n---\n\nAdditionally, you may also be interested in seeing the results of **out-of-distribution robustness** evaluation in [response to Reviewer CusV](https://openreview.net/forum?id=R4yb4m7Nus&noteId=XZi0p9TBKK) which further expands the relevance of our work.\n\nThank you for your valuable comments. Your questions made us re-think some exciting questions and we believe that the follow-up analysis has further strengthened the work. We look forward to resolving any remaining concerns.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "- The idea of prompt tuning for robustness is interesting. The author states the motivation from the point of view of random parameter vulnerability. \n- The explanation makes sense and the experimental results are strong.", "reasons_to_reject": "- A key motivation for the paper is that vanilla fine tuning strategy by adding some random parameters can harm the model's performance and robustness . However, some experimental results of the proposed method contradict motivation, making the idea less convincing. By replacing candidates with dummy words such as Jack, John, Ann, the model is still robust. In my opinion, such labels are no better than a random projection layer. How can this avoid hurting the parameters of the model? \nIn pretrained models, many word embeddings are undertuned or even untuned. For example, some dummy tokens are left for further use. What if you use these words?\n\n- Since the paper highlights the usefulness of prompts for robustness, further experimental study is needed. For example, how do you choose the prompts? How do different prompts affect the robustness of the model? As a baseline, what if you use some dummy prompts, such as \"foo bar (mask)\"? \n\n- It remains unclear whether robustness arises from the prompt-tuning strategy itself or from some tricky ensemble-style strategy, i.e. by using different models (prompts) with different class logits whose signal may fool the attacker. In Table 2, what is the adversarial accuracy of each prompt? What is the result of \"1 prompt + 4 candidates\"?", "questions_to_authors": "", "paper_topic_and_main_contributions": "The paper proposes a novel prompt-based tuning strategy that helps increase the robustness of the model. Experimental results show that it can outperform previous sota methods.", "excitement": 3, "reproducibility": 4, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper introduces Model-tuning via Prompts (MVP) as a novel approach to enhance adversarial robustness in NLP models. MVP involves fine-tuning a model on prompts and ensemble results during inference, demonstrating superior robustness without accuracy loss on various datasets. Reviewers found the idea is interesting and the experiments are strong. They also raise concerns about limited evaluations on simple tasks, the need for a comparison with LPFT, and the scalability of MVP. Overall, this paper is of high quality and I therefore recommend acceptance.
Decision: Accept-Main