Effects of Human Adversarial and Affable Samples on BERT Generalization
Authors: Aparna Elangovan
Estrid He
Yuan Li
Karin Verspoor
Venue: EMNLP 2023 Findings (2023)
Keywords: BERT
Generalization
Robustness in NLP
TL;DR: We investigate how various proportion of label preserving and label alternative samples impact robustness.

Abstract: BERT-based models have had strong performance on leaderboards, yet have  been demonstrably worse in real-world settings requiring generalization. Limited quantities of training data is considered a key impediment to achieving generalizability in machine learning. In this paper, we examine the impact of training data quality, not quantity, on a model's generalizability. We consider two characteristics of training data: the portion of human-adversarial (h-adversarial) samples, i.e.  sample pairs with seemingly minor differences but different ground-truth labels, and human-affable (h-affable) training samples, i.e. sample pairs with minor differences but the same ground-truth label. We find that for a fixed size of training samples, having  10-30% h-adversarial instances improves the precision, and therefore F_1, by up to 20 points in the tasks of text classification and relation extraction. Increasing h-adversarials beyond this range can result in performance plateaus or even degradation. In contrast, h-affables may not  contribute to a model's generalizability and may even degrade generalization performance.

Effects of Human Adversarial and Affable Samples on BERT Generalization
Aparna Elangovan', Jiayuan He Yuan Li and Karin Verspoor
'The University of Melbourne, Australia
2RMIT University, Australia
aparnaeês unimelb. edu. au
(jiayuan.he he, yuan. 1i, karin. verspoor edw. au
Abstract
Training set
Alien language
Label
timbuktu scia ghy
Positive
Random
shyp meyo mlue
Neutral
BERT-based models have had strong perfor- mance leaderboards, yet have been demon- strably worse in real-world settings requiring generalization. Limited quantities of training data is considered key impediment to achiev- ing generalizability in machine learning. In this paper, we examine the impact of training data quality, not quantity, on a model's generaliz- ability. We consider two characteristics train- ing data: the portion of human-adversane adversarial). i.e. sample pairs with seemingly minor differences but different ground-truth la- bels, and human-affable (h-affable) training samples, i.e. sample pairs with minor differ- ences but the same ground-truth label. We find that for fixed size of training samples, rule thumb, having 10-30% h-adversarial instances improves the precision, and there- fore Fj. by up to 20 points in the tasks of text classification and relation extraction. Increas- ing b-adversarials beyond this range result in performance plateaus or even degradation. contrast, h-affables may not contribute to model's 's generalizability and may even degrade generalization performance.
timbuktu scio ghy timbuktu meyo ghy Neutral
Positive
H-adversarial
Table 1: With Random training examples, model or even humans can associate any one of the words "timbuktu". "gby" or "scio" with positive label. Using the human adversarial pair (H-adversarial), it becomes more obvious that "scio" is an indicator for the positive label, and not "timbuktu" or "ghy".
(h-
language understanding, Pham al. (2021) exam- ined correct predictions of BERT-based classifiers, trained on GLUE tasks such as natural language inference (NLI). They found that 75% to 90% of these predictions were unchanged despite randomly shuffling words to render an input incoherent and blocking the inference. Flangovan et al. (2022) found that for protein relation extraction model based BioBERT (Lee al., 2019), the precision dropped by over 50 points compared test per- formance when applied scale unseen data out of the official test set.
Conventional wisdom machine learning is: the more data, the better. Limited training data is acknowledged as a key obstacle to achieving gen- eralizability. In this paper, we study how human adversarial samples (h-adversarials) and human affable samples (h-affables) can impact generalisa- tion performance. We define b-adversarials as sam- ples that look very similar to each other, but have different ground-truth labels. We use the term "hu- man adversarial" to differentiate it from adversarial machine learning which aims to fool the machines into making incorrect predictions by applying mi- nor perturbations ground-truth label of the perturbed sample remains the same its corresponding source (Goodfellow et al., 2015). We define h-affable samples as train- ing samples that are very similar and have the same ground-truth label.
1 Introduction
Deep learning models have dominated natural lan- guage processing (NLP) task leaderboards seen in benchmarks such GLUE (Wang al., 2018), 8), where the model performance is assessed using a held-out test set. However, the performance of
these models may not be replicable outside a given test set (Hendrycks et al., 2020), or they may not capture any relevant understanding of how lan- guage works (Bender et al., 2021). Benchmark test sets may not be sufficiently representative (Elango- et al., 2021). These factors make it difficult to know when model will work in practice and raise questions about model generalizability.
source sample, where the
As an example of a possible disconnect between NLP models and what might be considered to be

---

The intuition behind h-adversarials is explic- itly guide the model learn discriminatory features through training data, thus reducing reliance on spurious features (See Table I). The concept of h-adversarials is also known by many other names such as counterfactual training data (Kaushik et al., 2020; Sen et al., 2021) or contrast sets (Gardner et al., 2020). We also hypothesize, that h-affable training samples, or samples that similar an- other but have minor differences that preserve the label, can potentially result in redundant informa- tion in the training data, reinforcing possibly spuri- ous patterns and worsening a model's performance. Therefore, annotating large volumes of training data with a high ratio of h-affables can potentially make the data annotation efforts ineffective.
sample generated by applying å changes to s but the ground -tunh label remains the same:
(2)
In this paper, we focus on the tasks of text clas- sification and relation extraction, where sample corresponds to text. Given reference sample and another sample we measure their input difference 8%.a using the word error rate based on Levenshtein edit distance (Miller al., 2009):
8 I+
[
where is the number of insertions, D is the total number of delctions, S is the total number sub- stitutions required to transform sample s to sample 8, and |wa| is the total number of words in the ref- erence sample 8. Note that other distance metrics can also be adopted here. However, we keep the distance metric simple and explainable to examine the learned features of deep learning models.
Data augmentation strategies for adding train- ing samples by making minor perturbations that preserve (h-affables) or alter (h-adversarials) in- stance labels have been shown to improve model robustness (Wang et al., 2022). Here, we explore the question, "How do various proportions of h- affables and h-adversarials in training samples af- fect the model's 's generalization performance" We examine three NLP classification tasks, including text classification, relation extraction, and keyword detection, and perform an empirical study the impact of h-adversarial and h-affable samples. The experimental results confirm our hypothesis - with fixed training data size, a model's performance can exhibit a significant improvement with mod- erate proportion of h-adversarial samples, while h-affable samples can contribute to lowering model performance. These results reveal how data quality, not data quantity alone, may affect model perfor- mance, thereby providing insights into data anno- tation and curation procedures. With limited data annotation budgets, creating high-quality training samples is critical to guide a model towards learn- ing discriminative features. Ultimately, this will lead to robust generalization performance.
Given a training set for an NLP classification task, we define the h-adversarial rate rill' for the class label and /' as the portion of samples in class that have an h-adversarial sample in class l:
1, if E [1, 59h
ūy [Sy
otherwise
JI' Th = |S]
(3)
Here, Si is the set of training samples labelled with I, Sy is the set of samples labelled with 1', and ñp is the number of samples labelled with l' that are within edit distance to at least one sample labelled with I, i.e., can be derived by applying less than changes to another sample with label 1.
The value of 7'l'' can range between [0, [S]]], where indicates that there are no h-adversarial samples for label + When rhy is greater than 1, it indicates that a single source sample St can have multiple h-adversarial samples šy. It's worth- while to note that in such cases, these h-adversarials are all similar to s; in terms of input, and may h- affables for each other.
2 H-adversarials and h-affables
Given source sample assigned with the ground- truth label 1, we define h-adversarial sample šy as sample generated by applying d changes to such that is changed to a different label I", where 8 is less than pre defined threshold
We define h-affable rate as T for label I follows:
1,
if E [ 1,|S[]] 80 <c
f4 = [
otherwise
8<c Sp
11
70
The S
(4)
Similarly, we define h-affable sample šy as

---

where ñn is the number of samples that can be transformed by applying less than e changes from another sample with the same label. The value of 'hr can range between [o, 1].
(Cont)² (Gardner et al., 2020). To test the impact of h-adversarial samples, we use the manually curated h-adversarial samples that come with the official training set.
The h-adversarial and h-affable samples can be curated by domain experts, and also can be gen- erated automatically in some cases if appropriate rules can be defined given the context of task. Taking binary relation extraction task as an exam- plc, a given source text annotated with participating entities can be used to generate multiple samples by marking different entities as involved in the re- lationship. as shown in Table 2. For the given text with 11 words with 4 entities mentioned, C3 = 6 training samples can be automatically generated. At most 4 substitutions
3.1.2 Self-Labelled Keywords And-Or detection
The Keywords And-Or detection (KDAO) task is binary text classification (CLS) task that we de- fine in this paper, where labels can be generated automatically. As such, we can generate training and test samples automatically, as well as the h- affables and h-adversarials. This allows us to eval- uate model performances on data at scale.
For this task, we assume two non-overlapping sets of keywords, Ka and Kg- Given an input text W with n words (wi, W2, ( ..,, wx), positive la- bel is assigned, if and only if the input text (1) contains at least two words from set K, and (2) at least 1 word from set Kg. Hence, this mimics a combination Boolean And and Or operators resulting in the equation shown below. The pseudo- code is available in Appendix 1.
required change one sample to another, with maximum sample differ- ence of ga.ä = 0.36.
3 Method
We examine the impact of h-adversarials and h- affables on three different NLP classification tasks, including text classification, relation extraction, and customized keyword detection task (detailed in Section 3.1.2). Next, we introduce these tasks and datasets, focusing on the generation of h- adversarials and h-affables in these tasks.
match, VT, 1l, wi Ka A Awy Ka
matchs(W) = V==w E Kg
lab)l(W) = matcha (W) A matchs(W)
Although KDAO is a ingly naive, surprisingly, our experiments show that this task is a non-trivial task for BERT, requiring over 8,000 training samples to reach 80% Fl (see Figure 4) compared to IMDB sentiment analysis, which only requires 2000 samples to reach over 80% accuracy as shown in Table 4.
task that is seem-
3.1 Tasks and datasets
We describe three main tasks, evaluated in several datasets. These are summarized in Table 3.
3.1.1 Counterfactual IMDB
This task aims to predict the binary sentiment (pos- itive negative) of given user review. We use the IMDB dataset (IMDB-C) created by Kaushik al. (2020). The original dataset (Kaushik al., 2020) has around 3400 samples. From the original dataset we randomly sample 2000 samples (IMDB- C-2K) and 500 samples (IMDB-C-5H) for each run, and this is repeated for 5 different runs. To evaluate the generalizability of model, we use three datasets that provide labelled user reviews in different domains other than IMDB: (a) Amazon polarity test set'; (b) Yelp polarity test set?; (c) SemEval-2017 twitter dataset for Task4-B test set? (Rosenthal al., 2017) (d) IMDB contrast test set
We create the dataset for this task using the col- lection of PubMed abstracts that contains 18 mil- lion abstracts of medical journals. For training, we filter and only keep abstracts with 100 250 words, from which we sample 2400 abstracts, re- sulting in a training set with a positive sample rate of 25% We use 2,000 samples for training and set aside 400 abstracts as the validation set. To test the generalizability of model, we create very large test set by randomly sampling 500,000 PubMed abstracts from the collection.
Automatic generation of h-adversarials & h- affables. The h-adversarial/h-affabll samples in the KDAO task can be generated automatically.
'httss//hugginngface co/datasets/amazon polarity htttp://tugginnffee..oddit
http:s//ggiuubb.cmmaalaaaaaoooo sets/blob/main//Ne Dattaaa//mman//MDDddaaaatttttttt contrast.tsv hhtps::/ffppcchi http:///fwp.cciiim...... nim.nih. www.nhhoo///ummmm//hscciinn
/hups://alt..o tttp///taattrr.oooo .er...rg//.oo........ wwg.semmeaa221777a/a//dddoodoo
soo-full-traiiing--ee data-for--eeeeeeee fww.seeeeaall--00--aaaee-

---

#
Type
label
Text
Gene NLCR inhibits KLK3 and EFGR, but has no effect on MAPK.
REL-1
Pp
P
Gene MARKER-A inhibits MARKER-B and EFGR, but has no effect on MAPK.
REL-2
N
Gene MARKER-A inhibits KLK3 and EFGR, but has no effect on MARKER-B.
RFI-3
N
Gene NICR inhibirs MARKER-A and EFGR, but has no effect on MARKER-B.
REL-4
8p
P
Gene MARKER-A inhibits KLK3 and MARKER-B B but has no effect on MAPK
The lasagne was awesome, was the spagetti.
CLS-11
P
The lasagne was awesome, so was the spagetti.
CLS-2
80
The lasagne was under cooked, so was the spagetti.
Table 2: Examples of how a single Original sample can be transformed to Positive and Negative samples either automatically (c.g.. binary relation extraction) or with domain expertise (c.g., text classification). sy: original sample with positive label; 5y/5, transformed samples with minor changes Sp. For relation extraction, we follow previous works (Zhang ct al., 2019) to mark participating entities with special markers (MARKER-A and MARKER-B) For relation extraction, REL-1 (sp) has 2 h-adversarials, REL-2 (5,, and REL-3 (6,,). REL-2 and REL-3 also act as b-adversarials for REL-4 (5p). REL-- and REL-3 are also a pair of h-affables for the label N, while REL-I and REL-44 are pair of h-affables for label P. For text classification (sentiment classification), CLSS2 forms an adversarial sample for CLS-1 if threshold set 0.25.
Dataset
Task
Tr+% %
Train
Tc+5
Test
affables. We transform positive samples to h- adversarial negatives following the method pre-
ChemProtC3
REL
27.0
767
11.6
S744
KDAO
CLS
25.0
2000
4,8
500000
IMDB-C-5H-Amzn
CLS
50.0
500
50.0
400000
sented in Table 2: shuffling the positions of the markers that are used to mark the participating entities of the relationship. The affable samples are samples from the same abstract with the same ground-truie label but have different entities partic-
IMDB-C-5H-YYll
CLS
50.0
500
50.0
38000
IMDB-C-5H-Sene
CLS
50.0
500
50,0
6000
IMDB-C-5H-Com
CLS
50.0
500
50.0
488
IMDB-CC22--Am
CLSS
50.0
2000
50,0
400000
IMDB-C-2K-Yelh Yelp
CLS
50.0
2000
50.0
38000
MMDB-C-2K-Sem
CLS
50.0
2000
50.0
6000
IMDB-C-22 Cont
CLS
50.0
2000
50.0
488
ipating in the relationship as shown in Table 2.
Table 3:
All datasets have two classes: positive and negative. The percentage of samples with positive labels is reported for training (Tr+%) and test (Tc+%) data.
3.2 Models and experiment settings
We employ BERT models for all tasks, selecting the uppropriate variant based on the corpus domain of each dataset. For IMDB datasets, we use the standard BERT-base-cased model (Devlin et al., 2019) well as RoBERTa-base (Liu et al., 2020). For KDAO and ChemProt-C33 which are from the biomedical domain, ct al., 2019), a variant of BERT model that fur- ther trained on PubMed abstracts using the masked language modelling task.
Given a source sample with a positive label, an h-adversarial sample can be generated by replacing the word that matches with Ka with random non-keyword word so the label changes from Pos- itive to Negative. The sample code is available in Appendix A.2. To generate h-affable samples, insert a random word into the abstract at a random location. Since the abstract will still contain the key words to be detected, the label remains to be Posi- tive. The full code is available in Appendix A.3.
employ BioBERT (Lee
In our experiments using BERT and BioBERT, we use a learning rate of 1e-05. For RoBERTa, we use learning rate of 7e-06. We use a batch size of 64 with gradient accumulation, with early stopping patience of 10 epochs with maximum epoch of 200 iterations. We set the distance threshold for computing h-adversarial and h-affable rate as 0.25, In order to account for BERT stability (Mosbach et al., 2021), for each set of experiments, we repeat our training procedure with different random seeds 5 times and report the results of all runs.
3.1.3 ChemProt
The ChemProt dataset (Krallinger et al., 2017) is curated for a relation extraction task (REL) for ex- tracting types (5 types of positive + negative) of relationship between chemicals and proteins from PubMed abstracts. In order to simplify the task into a binary classification problem, we select one class (annotated as "CPR:3" in the original dataset) the positive class and re-annotate the dataset by mapping the remaining classes as negative exam- ples. We refer to this dataset as ChemProt-C3.
Experiments and results
Experiment-A: Varying h-adversarials rate. In this set of experiments, we study the effect of h-
Automatic generation of h-adversarials & h-

---

Precision
Recall
100
100
100
ChemProtC
75
75
75
50
50
50
25
25
25
8.0
8.0
0.2
8.0
0.4
100
1
3
1
2
1
KDAD
25
25
8.0
0.2
0.4
0.6 0.8
0.2
0.4
0.6
0.8
0.0
0.2
0.4
0.6
0.8
fM
Figure I: Impact of h-adversarial rate for Positive class (r fixed-size training data BioBERT. Precision starts to increase by 10 20 points around 10% to 30% t-aaversarial rate. Shaded region shows standard error. Indicators # p-value 0.1, ** < 0.05, *** p 0.001 significance of performance compared the case where 'h 0.0.
adversarial rate, where we hold the training size and the positive sample rate constant. To introduce h-adversarial samples to the training set, we ran- domly choose a subset positive samples from ex- isting training samples, transforming them to nega- tive samples to obtain corresponding h-adversarial samples (see Section 3.1.3). To maintain the size of training data and the positive sample rate, then randomly drop existing negative samples. The h-affables rate held constant at zero this set of experiments.
Test
pn Thy
IMDB-C-SH
IMDB-C-2K
0.0
84.0 (0.8)
88.2 (0.6)
0.1
86.2 (0.4)
88.9 (0.4)
Amazon
0.2
85.2 (0.9)
88.4 (0.3)
0.3
85.2 (1.2)
88.7 (0.7)
0.9
85.1 (1.3)
86.9 (0.7)
0.0
79.9 (2.0)
86.5 (1.0)
0.1
86.3 (0.4)
89.2 (0.3)
Cont
0.2
86.1 (0.9)
89.2 (0.2)
0.3
87.0 (1.3)
89.3 (0.3)
0.9
91.3 (0.5)
92.9 (0.3)
0.0
(5.4)
73.0 (3.6)
Result-A: For fixed training size, low to mod- erate h-adversarial rates improve performance: Table 4 on BERT shows that for the IMDB-C-22 and IMDB-C-5H datasets, the peak accuracy is achieved at around @r = 0.1, where we see marginal improvements (up to 2 absolute points) for Amazon and Yelp test sets, but 7-point im- provement for SemEval test. However, for the IMBD-contrast test set, we find that the peak perfor- mance is at @r 0.9, as shown in Table For RoBERTa, as shown Table 5, @y <= 0.3 gen- erally has the highest performance for all datasets, except SemEval where the peak performance is at @n - 0.0. KDAO dataset also achieves peak performance at @p he 0.1, increasing pre-
0.1
77.0 (1.7)
77.8 (1.4)
SemEval
0.2
(2.1)
70.3 (3.1)
0.3
(3.8)
73.7 (3.8)
0.9
(4.6)
70.4 (1.1)
0.0
85.3 (0.6)
90.0 (0.4)
0.1
87.5 (0.5)
90.1 (0.2)
Yelp
0.2
(1.1)
89.9 (0.3)
0.3
85.0 (2.8)
90.0 (0.5)
0.9
85.5 (1.6)
87.0 (0.7)
Table 4: Performance in Accuracy (aM ) on BERT when varying in IMDB-C fixed size training set and evaluated on Amazon, SemEval, IMDB-Contrast test set and Yelp. (Note: оM
Standard error)
cision from 32.7 (am 1.1) + 48.1 (a 1.7), thus increasing Fl from 47.6 (aM 1.3) 62.9 (aw 1.3), where σM represents the standard error. For the ChemProt-C3 dataset, the precision increases steadily from @r = 0.0 + @r = 0.3, achiev- ing its peak precision of 46.8 (σM 1.4) thus in-
creasing Fl from 39.4 (a 2.7) 55.3 (a 1.3) as shown in Figure Increasing P beyond this does not improve Fl or accuracy for any of the datasets as shown on Figure and Table and fact IMDB-C and and ChemProt-CS seem to drop performance, Increasing h-adversarial rates does

---

Test
p Th
IMDB-C-SH
IMDB-C-2K
precision drops at around 0.6. We also find that lower range of h-affable rates, e.g., between 0.0 and
0.0
76.0
90.6 (0.4)
0.1
68.1 (6.3)
90.0 (1.1)
0.3, the difference in h-affable rate does not seem to make significant difference to the performance.
Amazon
0.2
75.6 (6.8)
(2.0)
0.3
85.9 (1.1)
90.6 (0.7)
0.9
(7.0
(2.5)
Experiment-C: Varying training size. In this set of experiments, we study the learning curves of models over experience (amount of training data), by gradually adding more samples to the training set. We consider three ways of adding samples: (a) adding more training data that random sam- ples where the h-adversarial and h-affable rates are held at zero; (b) only adding positive and nega- tive h-affable samples where the h-adversarial rate is kept as zero; and (c) adding a mixed set of h- adversarial samples and random samples where the h-adversarial rate @r -0.1 and the h-affable rate is kept as zero -0.0. @r.0r..0). For all sce- narios, keep the positive sample rate constant
0.0
73.9 (7.3)
(0.4)
0.1
66.6 (9.1)
92.2 (0.4)
Cont
0.2
82.1 (8.0)
90.0 (2.4)
0.3
92.2 (0.6)
92.0 (0.4)
0.9
85.0 (8.9)
91.8 (2.5)
0.0
62.7 (1.5)
76.6 (1.9)
0.1
51.6 (4.6)
(4.4)
SemEval
0.2
60.3 (5.0)
(3.3)
0.3
57.7 (1.6)
(4.6)
0.9
(5.9)
(3.7(4.6)
0.0
(4.6)
(0.3)
0.1
68.9 (6.6)
91.8.
Yelp
0.2
77.7 (7.1)
88.3 (2.0)
0.3
86.7 (0.9)
92.2 (0.5)
when adding more samples.
0.9
78.5 (7.5)
87.0 (2.4)
Table 5: Performance in Accuracy (a ) on RoBERTa when varying The in IMDB-C fixed size training set and evaluated on Amazon, SemEval, IMDB-Contrast test set and Yelp.
Result-C: When baseline (@r""" perfor- mance is low, adding smaller percentages of h-adversarials boosts performance compared to adding random samples while adding h- affables make almost no difference. When base- line dataset ( ( (@r"" performance is relatively low (in our experiments less than 80% score), we see that adding 10% h-adversarials tially improve performance. This is observed for the KDAO dataset shown in Figure 4, where the F1 improves by up to 20 points compared adding random samples. As the Fl reaches approx- imately 80% or above, the performance improve- ments through adding h-adversarials are similar to adding random samples in Figure 4. For the IMDB- C-5H evaluated on SemEvva @ @- we see strong boost 70.2 (a M 5.4) - 77.0 (a 1.7), while the boost for Amazon and Yelp is relative small, 84.0 (a M 0.8) 86.2 (ar 0.4) and 85.3 (a 0.6) > 87.5 (a 0.5) respectively as shown in Table 4. The improvements in performance compared to baseline for Amazon, SemEval and Yelp further narrow down for IMDB-C-2K compared to IMDB- C-5H as shown in Table 4. From Figure 4, we ob- serve that adding more h-affables to training data does not seem improve the model, even when the training size increases from 2,000 to 10,000 samples on the KDAO task. This demonstrates that adding more similar training data that preserve the label need not improve the performance.
not seem to significantly impact recall as shown in Figure ChemProt-C3 and KDAO datasets.
Experiment-Bs Varying h-affables rate. this set of experiments, we study the effect h-affable rate. We also hold the training size and the posi- tive sample rate constant in this setting, and only increase the h-affables rate. We further consider 2 cases: varying the h-affable rate for Positive and Negative class. To vary the h-affables rate for pos- itives, we generate affable positive samples using the method detailed in Section 3.1 and randomly drop non-affable positives to maintain the positive sample rate, and vice versa for varying h-affable samples for negatives. In both scenarios, the h- adversarial rate is held constant at zero.
substan-
Result-B: For a fixed training size, high h- affables rates for Positive class eventually de- grade recall while high h-affable rates for Nega- tive class eventually degrade precision. Figure 2 and Figure 3 show that the h-affable rate for Posi- tive class affects the recall, while the h-affable rate for Negative class affects the precision of model. We see that when the h-affable rate for positives increases beyond 0.3, recall starts to drop in both tasks. For the negative sample h-affable rate, the

---

Precision
Recall
100
100
100
ChemProtC
75
75
75
50
50
50
25
25
25
8.0
0.6
8.0
8.0
0.4
100
1
KDAD
25
25
8.0
0.2
0.4
0.6 0.8
0.2
0.4
0.6
0.8
0.0
0.2
0.4
0.6
0.8
Figure 2: With fixed size training data, high h-affable rate for Positive class drops recall. Recall starts to drops around b-affable rate 0.3, Shaded region shows standard error. Indicators p-value < 0.1, ** p< 0.05, *** p 0.001 compared of 0.0 performance. (Bottom) Performance on KDAO task. (Top) Performance on ChemProt-C3.
Precision
Recall
F1
ChemPratt)
75
75
50
50
25
25
8.0
0.2
0.4
0.6
0.8
8.0
0.7
0.4
0.6
0.8
0.0
0.2
0.4
0.6
0.8
100
100
100
75
75
KOMD
50
50
25
8.0
0.2
0.6
0.8
9.0
0.2
0.4
0.8
0.0
0.2
0.4
0.6
Figure With fixed size training data, high h-affable rate for Negative class drops precision. Precision drops around h-affable rate of 0.6. Shaded region standard error. Indicators p-value 0.1, ** 0.05, *** 0.001 significance compared to rit 0.0 performance. (Bottom) Performance on KDAO task. (Top) Performance on ChemProt-C3.
5 Discussion
Augmenting training data with h-affables leads to almost no improvement even when increasing the volume from 2,000 to 10,000 samples. When h- affables have to be manually annotated, this would imply wasted resources. The lack of improvement from adding h-affables also shows that data aug- mentation strategies that rely on generating more similar samples may not improve generalizability. Our results also support findings that data augmen- tation strategies using synonym replacement or ran- dom swapsinsertions//lletiiss may not improve performance much beyond 2000 samples when evaluated on text classification task (Wei and Zou, 2019). For fixed amount of training data, higher
5.1 Directing data curation efforts
Our experiments show that smaller percentage of h-adversarials have the potential to substantially boost performance compared to adding random samples. Increased proportions of h-adversarials beyond about 30% do not result in performance improvements
degrade performance compared adding random samples. Given that manually creating h-adversarial samples is more time consuming than simply annotating random samples, it may be most effective to add small percentage of h-adversarials during data curation.

---

Precision
Recall
100
11-9-00
966
80
80
80
60
60
haadvvrsstraas
20
random
h-attables
2000
2000
10000
2000
training size
Figure 4: Impact of adding training data evaluated on KDAO task with 500,000 test samples. Adding h-adversarials (rh 0.1) with random samples improves performance more quickly when the number of training samples is limited (<6,000). Adding diverse random samples (rhy = 0, rit = 0, r 0) increases performance almost linearly for precision and therefore Fj. Recall sees marginal improvements. Adding only positive and negative h-affables make very little or almost difference improvements despite increasing the training size from 2,000 10,000. Shaded region shows standard error, p-value compares random to h-adversarial performance.
h-affable rate for positive samples degrades recall and higher rate of h-affable negative samples de- grades precision. Investigating these phenomena further, we find that an early paper on adversar- ial training in image classification (Kurakin et al., 2017) reports that adversarial training lowers the accuracy on the original clean test examples even though it improves on the adversarial samples (gen- erated through automatic perturbation).
ble 5 shows that when RoBERTa is trained IMDB-C-5H and IMDB-C-2K, peak performance on SemEval dataset is observed when there no h-adversarials, i.e. @-f" This phenomena where introducing no h-adversarials can sometimes potentially achieve good performance shows the stochastic nature of neural network training pro- cedure and that b-adversarials may not always be able guide the neural network to learn the dis- criminatory features.
5.2
Data curation for relation extraction
6 Related works
As previously mentioned, relation extraction tasks that extract multiple entities from single para- graph or abstract can have naturally occurring high rates of h-adversarials and h-affables. Hence, for relation extraction where multiple training sam- ples can be generated from the same source text, we recommend that annotators curate at most training sample for each type of relationship from given source text. Drawing multiple training samples from the same source text can result in more h-affables or excessively increase the rate of h-adversarials, leading to degraded performance. addition, explicitly annotating negative samples from text that is not part of the positive samples can potentially improve performance by lowering the b-adversarial rate and increasing the percentage of random samples.
Data augmentation strategies improve robustness
Data augmentation strategies involving minor per- turbations to the input samples can be label altering or label preserving improve robustness (Wang et al., 2022). Label altering perturbations either manually created (Kaushik al., 2020), generated using generative adversarial networks (Robeer et al., 2021). Label preserving strategies (Jin et al., 2020; Wei and Zou, 2019; Feng et al., 2021) are far more common as they are casier to automate, and may have some benefits particu- larly in low-resource settings such specific do- mains (Wang et al., 2020). Label altering pertur- bations are known improve robustness (Kaushik et al., 2020; Udomcharoenchaikit et al., 2022).
be
5.3 Consistency of rule of thumb
6.2 BERT Generalizability
Our experiments show that generally low moder- ate (as thumb rule 10 30%) h-adversarial rates improve generalization performance, although need not be always the case. For instance, Ta-
McCoy al., 2020 train 100 BERT models on nat- ural language inference (NLJ) task using MNLI dataset (Williams al., 2018) with the exact same settings and dataset and find that the results are

---

fairly consistent; ranging from 83.6% 84.8% when evaluated on MNLI test set. However, the performance varied substantially when evaluated on the distinct HANS dataset with accuracy rang- ing from 4% to 76% (McCoy et al., 2020). This highlights key challenge in relying on test set performance as the primary indicator of generaliz- ability, i.e., the results may not be reproducible in dataset other than the official test set. One explana- tion that McCoy al. (2019) suggest is that BERT models learn correlations such as lexical overlap from the training data, and take advantage of the same correlations on the test data.
Limitations
Our work investigates BERT generalizability in the context of small set of text classification and relation extraction tasks. Our findings empir- ically indicate how 10-30% of h-adversarial rate improves performance, especially when the base- line (b-adversarial rate 0%) performance is low, Further investigation is required to understand why increasing the h-adversarial rate further results in performance plateaus or even degradation. Further analysis is also required for other tasks such as Named Entity Recognition (NER) and Question Answering (QA) tasks as well as multi-class clas- sification problems. Finally, implications for the increasingly -aga-pareetter large language models remain to be explored.
Elangovan et al. (2021) find that higher percent- age overlap in the unigrams, bigrams and trigrams between train and test can also cause inflated test set performance. The adversarial GLUE bench- mark (Wang et al., 2021) shows a 52 point drop on BERT models compared to evaluating against the GLUE benchmark (Wang et al., 2018). Thus, mod- els learning shortcuts or spurious correlations will not be able to generalize to other real-world data, which, however, will not be reflected through the evaluation using relatively simple test sets. Strate- gies such as adding h-adversarial instances may support improved robustness.
Ethics Statement
We comply with the ACL Ethics Policy". This work has created a resource from public reposi- tories (PubMed), or re-analyzed existing datasets. No human annotation was performed. Our focus is on empirical study of model robustness under generalization.
7 Conclusion
References
Data annotation and curation is the most human intensive, expensive and time consuming aspect of developing machine learning applications. Curat- ing large volumes of data without understanding how the data distribution contributes improving a model can result in misdirected effort. In addi- tion, the resulting models with poor generalization performance may be inadequate to automate or aid manual curation efforts. Hence, understanding the characteristies of training samples is key to ensur- ing that the right variety of samples are collected to create robust machine learning applications. In work, we find that additional similar examples sharing a label, h-affables, may not contribute to improving performance despite increasing train- ing data quantity. Similar examples with divergent labels, h-adversarials, add more value.
Emily M. Bender, Timnit Gebru, Angelina McMillan- Major, and Shmargaret Shmitchell. 2021. On the dangers of stochastic parrots: Can language mod- els be too big? In Proceedings of the 2021 ACM Conference Fairness, Accountability, and Trans- parency, FAceT '21, page 610-623, New York, NY, USA. Association for Computing Machinery.
Jacob Devlin, Ming- Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-training of deep bidirectional transformers for language under- standing. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Tech- nologies, Volume (Long and Short Pupers), pages 4171-4186 Minneapolis, Minnesota. Association for Computational Linguistics.
Aparna Elangovan, Jiayuan He, and Karin Verspoor. 2021. Memorization generalization Quantify- ing data leakage NLP performance evaluation. Proceedings of the 16th Conference of the European Chapter of the Association for Computational Lin- guisticx: Main Volume, pages 1325-1335, Online. Association for Computational Linguistics.
Our work contributes insights into the prepara- tion of high-quality training data support robust model generalization. Specifically, we demonstrate how moderate quantities of h-adversarials in combi- nation with more diverse samples can substantially improve robustness.
"https://www aclweb. wttp://w.wrgopota//ooooooo al-code-ethic.

---

Apama Elangovan. Yuan Li. Douglas E V Pires, Melissa Davis, and Karin Verspoor. 2022. Large- scale protein-protein post-translational modification extraction with distant supervision and confidence calibrated BioBERT. BMC Bioinformatics, 23(1):4.
International Conference on Learning Representa- tions, ICLR 2017, Toulon, France, April 24-26. 2017, Conference Track Proceedings. OpenReview.net.
Jinhyuk Lee, Wonjin Yoon, Sungdong Kim, Donghyeon Kim, Sunkyu Kim, Chan Ho So, and Jaewoo Kang. 2019. Biobert: a pre-trained biomedical language representation model for biomedical text mining. Bioinformatics, 36(4):1234-1240
Steven Y. Feng, Varun Gangal, Jason Wei, Sarath Chan- dar, Soroush Vosoughi, Teruko Mitamura, and Ed- uard Hovy. 2021. A survey of data augmentation approaches for NLP. In Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021, pages 968 988, Online. Association for Computa- tional Linguisties.
Yinhan Liu, Myle Ott. Naman Goyal, Jingfei Du, Man- dar Joshi, Danqi Chen, Omer Levy, Mike Lewis. Luke Zettlemoyer, and Veselin Stoyanov. 2020. bofbert]a: A robustly optimized (bert) pretraining approach.
Matt Gardner, Yoav Artzi, Victoria Basmov, Jonathan Berant, Ben Bogin, Sihao Chen, Pradeep Dasigi, Dheeru Dua, Yanai Flazar, Ananth Gottumukkala,, Nitish Gupta, Hannanch Hajishirzi, Gabriel Ilharco, Daniel Khashabi, Kevin Lin, Jiangming Liu, Nel- son F. Liu, Phoebe Mulcaire, Qiang Ning. Sameer Singh, Noah A. Smith, Sanjay Subramanian, Reut Tsarfaty, Eric Wallace, Ally Zhang, and Ben Zhou. 2020. Evaluating models' local decision boundaries via contrast sets. In Findings of the Association for Computational Linguistics: EMNLP 2020, pages 1307-1323, Online. Association for Computational Linguistics.
R. Thomas McCoy, Junghyun Min, and Tal Linzen. 2020. BERTs of a feather do not generalize together: Large variability in generalization across models with similar test set performance. Third BlackboxNLP Workshop on Analyzing and In- terpreting Neural Networks for NLP. pages 217-227, Online, Association for Computational Linguistics.
Proceedings of the
Tom McCoy, Ellic Pavlick, and Tal Linzen. 2019. Right for the wrong reasons: Diagnosing syntactic heuris- ties in natural language inference. In Proceedings of the 57th Annual Meeting of the Association for Com- putational Linguistics, pages 3428-33 3428-3448, Florence. Italy, Association for Computational Linguisties.
lan Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and harnessing adversar- ial examples. In International Conference Learn- ing Representations.
Frederic P. Miller, Agnes F. Vandome, and John McBrewster. 2009. Levenshtein Distance: Informa- lion Theory, Computer Science, String (Computer Science), String Metric, Damerau? 2 evensstein Dis- tance, Spell Checker, Hamming Distance. Alpha Press.
Dan Hendrycks, Xiaoyuan Liu, Eric Wallace, Adam Dziedzic, Rishabh Krishman, and Dawn Song. 2020. Pretrained transformers improve out-of-distributin robustness. In Proceedings of the 58th Annual Meet- ing of the Association for Computational Linguistics, pages 2744-2751, Online. Association for Computa- tional Linguistics.
Marius Mosbach, Maksym Andriushchenko, and Diet- rich Klakow. 2021. On the stability of fine-tuning (bert): Misconceptions, explanations, and strong baselines. In International Conference on Learning Representations.
Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2020. Is bert really robust? a strong base- line for natural language attack on text classification and entailment. Proceedings of the AAAI Conference on Artificial Intelligence, 34(05):8018 8018-8025.
Thang Pham, Trung Bui, Long Mai, and Anh Nguyen. 2021. Out of order: How important is the sequen- tial order of words in a sentence in natural language understanding tasks? In Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021, pages 1145- Online. Association for Computa- tional I. Linguistics.
Divyansh Kaushik, Eduard Hovy, and Zachary Lipton. 2020. Learning the difference that makes differ- ence with counterfactually-auuee auggeette data. In Inter- national Conference on Learning Representations.
Marcel Robeer, Floris Bex, and Ad Feelders. 2021. Gen- erating realistic natural language counterfactuals. Findings of the Association for Computational Lin- guistics: EMNLP 2021, pages 3611-3625, Punta Cana, Dominican Republic. Association for Compu- tational Linguistics.
Martin Krallinger, Obdulia Rabal, Saber Ahmad Akhondi, Martín Pérez Pérez, Jesus Santamaría, Gael Pérez Rodríguez. Georgios Tsatsaronis, Ander Intxaurondo, J. A. Lopez, Umesh K. Nandal, Erin M. van Buel, Ambika Chandrasckhar, Marleen Roden- burg, Astrid Lægreid, Marius A. Doornenbal, Julen Oyarzábal, Anália Lourenço, and Alfonso Valen- cia. 2017. Overview of the biocreative vi chemical- protein interaction track.
Sara Rosenthal, Noura Farra, and Preslav Nakov, 2017. SemEval- 2017 task 4: Sentiment analysis in Twitter. In Proceedings of the 7 11th International Workshop Semantic Evaluation (SemEval-2017), pages 502- 518, Vancouver, Canada. Association for Computa- tional Linguistics.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. 2017. Adversarial machine learning at scale. In 5th

---

Indira Sen, Mattia Samory, Fabian Flöck, Claudia Wag- ner, and Isabelle Augenstein. 2021. How does coun- terfactually augmented data impact models for social computing constructs? In Proceedings of the 2021 Conference on Empirical Methods Natural Lan- guage Processing, pages 325-344, Online and Punta Cana, Dominican Republic. Association for Compu- tational Linguistics.
Chapter of the Association for Computational Lin- guisties: Human Language Technologies, Volume (Long Papers), pages 11 12-1122, New Orleans, Louisiana. Association for Computational Linguis- tics.
H. Zhang, R. Guan, F. Zhou, Y. Liang, Z. Zhan, L. Huang, and X. Feng. 2019. Deep residual convolu- tional neural network for protein- protein interaction extraction. IEEE Access, 189354--9365
Can Udomcharoenchaiki,, Wuttikorn Ponwitayarat, Patomporn Payoungkhandee, Kanruethai Masuk, Weerayut Buaphet, Ekapol Chuangsuwanich, and Sarana Nutanong. 2022. Mitigating spurious relation in natural language understanding with coun- terfactual inference. In Proceedings of the 2022 Con- ference Empirical Methods in Natural Language Processing, pages 11308-118 1331,, Abu Dhabi, United Arab Emirates. Association for Computational Lin- guistics.
Alex Wang, Amanpreet Singh, Julian Michael, Felix Hill, Omer Levy, and Samuel Bowman. 2018. GLUE: multi-task benchmark and analysis platform for nat- ural language understanding. In Proceedings of the 2018 EMNLP Workshop BlackboxNLP: Analyzing and Interpreting Neural Networks for NLP, pages 353-355, Brussels, Belgium. Association for Com- putational Linguistics.
Boxin Wang, Chejian Xu, Shuohang Wang, Zhe Gan, Yu Cheng, Jianfeng Gao, Ahmed Hassan Awadal- lah, and Li. 2021. Adversarial glue: A multi- task benchmark for robustness evaluation of language models. CoRR, abs/2111.... 1.00240..
Xuezhi Wang. Haohan Wang, and Diyi Yang. 2022. Measure and improve robustness in NL. models: A survey. In Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguisties: Human Language Tech- nologies, pages 4569 4586, Seattle, United States. Association for Computational Linguistics.
Yuxia Wang, Fei Liu, Karin Verspoor, and Timothy Baldwin. 2020. Evaluating the utility of model con- figurations and data augmentation on clinical seman- tie textual similarity. In Proceedings of the 19th SIG- BioMed Workshop on Biomedical Language Process- ing, pages 105-111 111, Online. Association for Compu- tational Linguistics.
Jason Wei and Kai Zou. 2019. EDA: Easy data augmen- tation techniques for boosting performance text classification tasks. In Proceedings of the 2019 Con- ference on Empirical Methods in Natural Language Processing and the 9th International Joint Confer- ence on Natural Language Processing (EMNLP- IJCNLP), pages 6382-6388, Hong Kong, China. As- sociation for Computational Linguistics.
Adina Williams, Nikita Nangia, and Samuel Bowman. 2018. A broad-coverage challenge corpus for sen- tence understanding through inference. Proceed- ings of the 2018 Conference of the North American

---

A Appendix
A.1 Algorithm Pseudo-code
Algorithm Keywords And-Or detection
1: procedure LABELABSTRAACT(aaarrroa
2: scta < ["activation". "urggerr", "interact", "inhibit", "regulate", "suppress")
3: acta - 1----"eenn,, "protein", "chemical""
4: abstract <- Lower(abstract)
5: has_seta + any(set,)) in abstract
6:
has_poin has_poir_sely +- any Two(sefs) in ebstract
7:
if has_set, and saa__pair_sete then
8:
label Poositive
9:
else
10:
label Neegatvve end if
11:
12:
return label
13:
end procedure
A.2 KDAO H-adversarial sample generation code
A.2.1 Transform positive sample into negative sample
keywordsl =' aacctivtaionn "trigger'',
"interact" "'ihibit
''regulate "suppress'")
keywords2 I'genee', "protein "chemical
def randomly substitute s (x):
words for x. split "") if not any (k. w. lower O for keywordsl +keywordss))
key up random choice ([0, 1])
key = 0:
for keywordsl:
insensitive = re compile (re. r eseape (k), re IGNORFCASEE) w = up. random. randint (0, len (words)-1)
= insensitive... sub (words(w) x)
else:
for in keywords2:
insensitive = re compile (re. escape (k), re IINORECASEE) = np. random. randint (0, len (words)-1)
= insensitive. sub (words [w], x)
return X
A.2.2 Transform a negative sample into positive sample
keywordsl (aacttvationn "trigger" "interact" " "'iniibi "rregulaee" "'suppress'"
keywords2 ('Ignee": "pprotei''. "chemical ']
def randomly add kx):
key np. random. randint (0. Jen (keywordsl)- -11)
_ey_i2 = np. random. randint (0, len (keywords2)-l)
key_1 1 keywords1 key_il]
keys_2 = keywords2 I: key_i21 (eywords2/key_i. key
words = x. split "
Ien 11 up random. randintl (0. (words)-1)
12 random. randint (0, len (words)-l
13 random. randint (0, len (words)-I)

---

words. insert (1l., key_1)
words. insert (12, keys_2 (01)
words. insert (13 keys_2 (1])
return
j.join (words)
A.3 KDAO H-affables sample generation code
def
(x):
words x. split (" '))
11 random. randint (0, len words)
12 np. random. randint (0, Ien words)-1)
ranromm randint (0, words)-ll
op. random. raa.aam..andiiim... randint (0, len (words) 1-1)
words, insert (1I, words/wl]]
up. random............. randint (0, len (words) ) 1))
words. insert (12 words [w2])
np. random. randint (0, len (words) 1)) words. insert (13, words [w3]
return ". join (words)
A.4 BERT training and inference
A.4.1
Infrastructure and cost
BERT model trained Amazon p3.2xlarge instance for around to 10 hours each depending on the training data set. In addition, inference on 500,000 record took each for each run and was run on 5 g4dn.xlarge instances in parallel. The cost of p3.2xlarge 3.06 USD an hour and g4dn.xlarge is 0.526 USD per hour.
A.5
Software Packages used
We used the following packages
matplotlib==3443
5agemaker=22.11555 15.0
scikit-plot=0.3377
pandas==1.1.4
torch==1.4.0
transformers==4..33
0c.kil-caam=0.24.11
sc16y<=1.6.0


Reviews:
[{"review_id": "oRu7S0Cjx0", "reviewer": "Reviewer_V7ws", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": 4, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you so much for your review comments.\n \nWe agree with your review comments that the rule of thumb of 10-30% might vary based on the generalization datasets used and we will explicitly call that out in our discussion in our manuscript. Our key take away is that low to moderate proportions of h-adversarials help improve generalization in combination with diverse random samples and the exact proportion will vary depending on the dataset as you have rightly pointed out.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "* The paper does an exhaustive analysis of the types of examples, and finds that with a moderate number of similar examples with differing labels, generalization is better\n* With more similar examples that have the same labels, spurious correlations degrade generalization\n", "reasons_to_reject": "* The analysis can be improved by comparing the h-adversarial and h-affable ratios in the generalization datasets through auto evaluation metrics. The rule of thumb of 10-30% might vary based on the generalization datasets we evaluate on.", "questions_to_authors": "", "paper_topic_and_main_contributions": "The paper aims to understand the effects of similar examples and their labels in an adversarial training set for better generalization across 3 tasks, for BERT models.", "excitement": 4, "reproducibility": 4, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "qBVYsQ7dPj", "reviewer": "Reviewer_dy3Y", "summary": "", "questions": "", "limitations": "", "rating": 2, "confidence": 2, "soundness": 2, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for reviewing our paper. Our paper is an analysis paper and the main contribution and novelty is the insights into the behavior of h-adversarials and h-affables at varying proportions.\n\n1.\tOur main contribution and novelty is to examine/ analyse the impact of various proportions of h-adversarials and h-affables on generalizability, whereas proposing methods to generate such h-adversarial of h-affable samples, either manually or automatically, is covered in other papers [Kaushik et-al 2020, Wang et al 2022, both cited on our paper] and in papers such as “Generating Realistic Natural Language Counterfactuals (Robeer et al., Findings 2021)” which we can also include and explicitly call out that generation of such samples is covered in previous works.\n\n2.\tOur motivation, is to improve robustness (generalization) when we have limited resources for data curation. In such cases, only limited quantity of data can be curated, then the only other lever is to improve the data quality to mitigate the effects of limited data. More specifically, our contribution is analyzing the impact of how various proportions of h-adversarials and h-affables affect generalization performance. For instance, does robustness improve as we add more h-adversarials, is it worth spending more time collecting and annotating such samples? Our experiments indicate that this is not the case and only low to moderate proportions in combination with diverse samples help in generalization. The significance of our contribution is in analyzing the impact of such samples, allowing curators to focus on annotating the right samples given a fixed number of samples to annotate (a real-world constraint as cost is proportional to how many samples are required, especially in expert domains) to improve generalizability. Hence, in our experiments, in-order to evaluate generalizability we have used cross domain datasets or test datasets not sourced from the same single split where possible.  In our datasets we have ensured this for 4/5 datasets, except for ChemProt dataset where we could not find an alternative test set. Our experiments have been conducted quite rigorously on very large test sets ranging from 6000 to 500,000 samples with 5 random seed runs across 5 datasets in 2 different domains across 2 different tasks, with reported standard error and the results have been consistent.\n\n\n\n3.\tThank you for providing feedback on how to improve the readability of our paper. We will add clearer descriptions of how h-adversarials and h-affables are generated, in addition to existing examples on table 2, subsections “Automatic generation of h-adversarials & h- affables.”  under “3.1.2 Self-Labelled Keywords And-Or detection” and “3.1.3 Chemprot”.   We can also cover existing works in “Related works” section and provide a systematic summary of existing methods used to generate such h-adversarial or h-affable samples, citing works of (Kaushik et-al ICLR 2020, Wang et al 2022, both cited on our paper] and as well as “Generating Realistic Natural Language Counterfactuals (Robeer et al., Findings 2021)”. \n\n4. Thanks for your suggestion. We can expand  on  data augmentation techniques is related to our paper. Work such as “An Empirical Survey of Data Augmentation for Limited Data Learning in NLP” Chen et al 2023) ” report at most 2-3 points boost on news classification datasets using label preserving methods. We can explicitly cover this in our related works section, in addition to what is already covered in “section 6 - Data augmentation strategies to improve robustness.”  Our paper is an analysis paper that investigates how various proportion of h-adversarials and h-affables affect generalizability. We report experimental performance on  where the training datasets that have label-altering (h-adversarial`) samples with a corresponding cross domain test-set to evaluate generalization. \n\n4.\tThank you pointing out the need to highlight content in Table 1. We will include that", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "1. This paper clearly claims their contribution and limitation.\n2. The authors make a discussion in detail after analyzing different h-adversarials/affables rates in a fixed training size and the impact of varying training sizes.\n3. The experimental results provide beneficial insights into data annotation and curation procedures when employing BERT in a real-world context.\n", "reasons_to_reject": "1. The technical novelty of generating adversarial and affable samples is limited. And only one approach to discussing the effects of human adversarial and affable samples seems not enough representative.\n2. The motivation is ambiguous, the authors mentioned that \"limited training data is acknowledged as a key obstacle to achieving generalizability\". However, they examine the impact of data quality, the reason the considering data quality instead of quantity needs to be claimed.\n3. The description of generating h-adversarials and h-affables is unclear.\n4. The experiment lacks a comparison between the proposed approach and existing data augmentation strategies.\n", "questions_to_authors": "", "paper_topic_and_main_contributions": "In this paper, since improving the generalization of BERT in real-world scenarios, the authors consider two data augmentation methods including generating samples with seemingly minor differences but different ground-truth labels (h-adversarial) and the samples are quite minor differences meanwhile the same ground-truth labels (h-affable). The authors conduct experiments on text classification, relation extraction and keyword detection to discuss the impacts of model performance and generalization via augmenting h-adversarial and h-affable instances.", "excitement": 2, "reproducibility": 3, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"Typos_Grammar_Style_and_Presentation_Improvements": "1.  The textual information with highlights will be clear in the example of Table 1.\n2.  As seen in reasons to reject 2&3\n", "Missing_References": "[1] Altinisik, Enes, et al. \"Impact of adversarial training on robustness and generalizability of language models.\" arXiv preprint arXiv:2211.05523 (2022)."}, "extra_text": {}}, {"review_id": "FMwkBVGAvE", "reviewer": "Reviewer_6RJa", "summary": "", "questions": "Please refer to the section of \"Reasons To Reject\".", "limitations": "", "rating": 2, "confidence": 3, "soundness": 2, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for reviewing our paper. Our paper is an analysis paper and the main contribution and novelty is the insights into the behavior of h-adversarials and h-affables at varying proportions.\n\n1.\tH-adversarials training samples are known by many other names in literature as “counterfactuals”, “label-altering perturbations”, “contrast-sets”, there is no single consistent terminology to represent such samples (mentioned in Line 76-79) and our main contribution is understanding how various proportions of such samples affect generalization performance. The motivation behind of h-adversarial is that subtle differences in the input that changes the target labels allows the model to understand the linguistic features instead of relying of spurious features that machine learning models often do. For instance, consider the example “Book is good” à Positive sentiment, “Book is awful” à Negative, then it is clear then the terms ‘Book is” is NOT a discriminatory feature that changes the sentiment, but “good” and “awful” are words that change the sentiment, allowing the model to quickly learn key linguistic features. We will explicitly make the terminology and the context of h-adversarials much clearer. H-affables are label-preserving perturbations, e.g., “The book is good”, “The book is great” both are positive examples of sentiment analysis task.  The motivation behind H-affables is that common data augmentation strategies in NLP, use paraphrasing, replacing words with synonyms so that the label remains the same. Hence, in our work we study their effectiveness in improving model generalizability.\nAs you have suggested, if the terminology and description is creating confusion among readers, we will definitely improve them inanition to the existing examples in table 2 for relation extraction and sentiment analysis task. We can also emphasize that our key contribution is understanding how various proportions of such samples affect generalization performance.  \n\n2.\tOur novelty and contribution *involves analyzing how various proportions of h-adversarials and h-affables affect generalizability* as mentioned in Line 90, and there has been little or no investigation  into how various ratios of these samples affect generalization.  Our observation, that is consistent across 5 datasets in 2 domains evaluated across 5 random seed runs on very large test sets (6000 to 500,000 samples for various datasets) indicates that low to moderate h-adversarials improve generalizability by 10-20 points and h-affables don’t. We also show that only low to moderate proportions in combination with diverse samples help in generalization. This will give guidance and help in future dataset curation process when there is limited resources (e.g., labour, monetary) to annotate limited samples.  \n\n3.\t10-30% extra h-adversarial samples does not add computation cost (GPU machine cost) since in the experiments,  the total number of training sample is kept the same -- we simply replace a subset of randomly selected random diverse samples with h-adversarials. We aim to analyze when we have fixed number of training samples, how the proportion of h-adversarials/h-affables affect the results. In terms of human annotation cost, it depends on whether h-adversarials were automatically or manually generated. Manual generation of h-adversarials would be expensive, as we have to rely on human expertise to  construct such samples as opposed to simply labelling them, hence all the more reason to be optimal with the proportion of such samples. Kaushik et al paper (cited in our works) that produced the IMDB-C dataset uses 90% h-adversarial rate, which can be optimized further, as our results demonstrate that peak performance can be achieved just 10% h-adversarials according to our results.\n\n4.\tThank you for your suggestion, we can include report existing work. Existing data augmentation approaches such as “An Empirical Survey of Data Augmentation for Limited Data Learning in NLP” report at most 2-3 points boost on news classification datasets using label preserving methods. One challenge we have is that we can only report experimental performance on datasets that have label-altering (h-adversarial`) training samples with corresponding cross domain test sets to evaluate generalization performance for an apples to apples comparison. The only one we found to the best of our knowledge is Kaushik et al ICLR 2020 paper (cited in our works), but we could not report their performance as we are could not get them to confirm the version of Amazon, SemEval and Yelp test sets they were using. Secondly, Kaushik et al 2020 report single run results, hence we are not sure whether they reported peak / average / random performance across one or several runs. We can include their results with an astrix as we are not sure of which version of test-sets they have used. Regardless, our analysis is more about how various proportions of such sample impact performance while Kaushik’s work assumes over 90% h-adversarial rate.\n\n\n4. Thank for pointing this out. We will fix the alignments.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "1. The empirical study of this paper is comprehensive. This paper focuses on two NLP tasks including text classification and relation extraction. And it uses two representative BERT for corresponding tasks. The illustration results from Figure 1 to 4 are helpful for learning the results in analysis. ", "reasons_to_reject": "1. There is a lack of discussion on what motivates the design of h-adversarials and h-affables. For example, in traditional adversarial training, the motivation for designing adversarial examples is that there exist samples around an original sample that makes the model change its prediction easily so we should include them for training. But for this paper, although h-adversarials and h-affables are defined in the beginning of the paper, it is unclear what they mean actually in training and why they matter. This is an important question for the general audience to understand the main idea of the paper, but unfortunately, it is not answered in the paper. For instance, it is still hard to get the idea of H-adversarial even taking a careful look at Table 1. And the alien language looks really weird and not helpful for the general audience to catch the idea in the beginning of the paper.\n2. The paper seems to pay more attention to presenting an empirical study of the effect of h-adversarials and h-affables for NLP model generalization. The discussion in Section 5 is limited given that there is a lack of novel methods for improving generalization ability based on the observation in Section 4. Actually, for a general audience, they will be benefitted more from reasonable treatment in future research and it is unlikely for them to reimplement the empirical study.\n3. There is a lack of discussion on what 10-30% extra h-adversarial can cost in training. For example, do they lead to extra training cost that is unbearable in real-world implementation?  And how much time cost are needed for generation? This should be covered despite the benefit it may bring in training.\n4. There is a lack of comparison with other data augmentation methods in experiments, e.g., label altering and label preserving.", "questions_to_authors": "Please refer to the section of \"Reasons To Reject\".", "paper_topic_and_main_contributions": "This paper proposes two characteristics of training samples, i.e., human adversarial and human affable ones. It mainly investigates the question of how these two types of samples affect the generalizability of the BERT model. ", "excitement": 2, "reproducibility": 3, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"Typos_Grammar_Style_and_Presentation_Improvements": "Equations in L225 - L227 are not aligned."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper studies the effect of two types of data manipulation on the generalization ability of Bert models. Reviewers gave different recommendations for this paper. R1 found this paper insightful to study the interaction between these two augmentations. R2 and R3 found this paper rather narrow due to concerns about the training size, unclear comparison, and limited tasks. The AC read the full paper and the discussions and stood with R1. The motivation and the scope of this paper have been clearly described, and the authors conducted most of their study under a fixed training size. Increasing the training size leads to even more improvements. Hence, there AC deemed this paper made good empirical discovery and should be accepted to Findings.
Decision: Accept-Findings