Title: Adaptive Distraction: Probing LLM Contextual Robustness with Automated Tree Search
Venue: NeurIPS 2025
Accepted: yes
Keywords: Large Language Models

Robustness Evaluation

Tree Search

Contextual Perturbation
Abstract: Large Language Models (LLMs) often struggle to maintain their original performance when faced with semantically coherent but task-irrelevant contextual information. Although prior studies have explored this issue using fixed-template or retrieval-based distractions, such static methods show limited effectiveness against contemporary models. To address this problem, we propose a dynamic distraction generation framework based on tree search, where the generation process is guided by model behavior. Without modifying the original question or answer, the method efficiently produces challenging adaptive distractions across multiple datasets, enabling systematic stress testing of LLMs’ contextual robustness. Experiments on four benchmarks demonstrate that the generated distractions lead to an average performance drop of over 45\% for mainstream models. Further comparisons of mitigation strategies show that prompt-based optimization methods yield limited gains, whereas post-training approaches (e.g., DPO) significantly enhance the model's contextual robustness. The results indicate that these issues do not stem from knowledge deficits in LLMs, but from a fundamental inability to maintain consistent reasoning under contextual distraction, posing a major challenge to the reliability of LLMs in real-world applications.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nAdaptive distractions generated by automated tree search can cause large language models to lose over 45% accuracy. While prompt-based defenses offer limited protection, post-training approaches like DPO significantly improve robustness to such distractions.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n\n- The method exposes fundamental vulnerabilities in large language models by generating adaptive distractions that cause significant performance drops.\n- Extensive experiments show that the approach is effective across multiple benchmarks and model types.\n\nWeaknesses / Limitations\n\n- My main concern is that constructing such \"contextually plausible\" distractions essentially examines model robustness in scenarios where the provided context conflicts with the model's own knowledge—that is, where the context supports one answer while the model's prior knowledge suggests another. In many of the case studies presented, adding distractions appears to transform the problem from open-book QA into a reading comprehension task. For instance, the question \"What is the best medicine?\" plus the context \"Many people find that healing often requires patience and allows for natural recovery over time.\" will naturally lead to the answer \"Time is the best medicine.\" In such cases, the context itself biases the model toward certain options. The evaluation then becomes more about how the model chooses between conflicting external knowledge sources, a problem already widely discussed in the literature on knowledge conflicts—where it is well established that models are easily influenced by contextual information.\n\n     Furthermore, when it comes to dataset selection, many questions without fixed answer options do not have absolute ground-truth answers. In these scenarios, requiring the model to follow the given context may actually be more aligned with the model's training objectives and practical applications (e.g., retrieval-augmented generation scenarios). Thus, I am not convinced that discouraging the model from using the context—especially through DPO training—would be meaningful or desirable on such datasets.\n\n- Some important details are missing. For example, where is the DPO (Direct Preference Optimization) training data from? What are the labels, and how are they generated? How is the training actually performed? I could not find these clarifications in Section B1 or the main text.\n\n- Based on the above, I am concerned that after DPO training, the model may not be able to follow instructions well, or may struggle in settings where it needs to answer questions using context (e.g., RAG scenarios). It would be helpful to see experiments or discussion on how the method generalizes to tasks requiring instruction-following or context-dependent reasoning.\n\n- Why set the temperature to 0.001 instead of 0?\n\nQUESTIONS:\nPlease refer to the Weaknesses\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 2, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 1, "ORIGINALITY": 1, "DATE": "2025-06-10"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces a novel framework for evaluating the contextual robustness of Large Language Models (LLMs). The authors address the issue that LLMs' performance often degrades when presented with task-irrelevant but  semantically coherent information, a phenomenon they term \"adaptive distraction.\" The core of their contribution is a dynamic distraction generation method based on an automated tree search. This process is guided by the target model's own behavior, starting with a classifier to filter for susceptible questions and then using a proxy model to iteratively generate distracting context aimed at inducing model failure. The framework is systematically evaluated across four benchmark datasets and a wide range of modern LLMs, demonstrating a significant average performance drop of over 45%. The paper further explores mitigation strategies, finding that prompt-based methods offer little benefit, while post-training techniques like Direct Preference Optimization (DPO) can substantially enhance robustness.\n\nSTRENGTHS AND WEAKNESSES:\n### **Strengths**\n\n\\* **Significance:** The paper tackles a highly significant and timely problem. As LLMs are integrated into real-world applications, their reliability in noisy, complex environments is paramount. This work provides a rigorous and scalable method to stress-test and quantify a critical failure mode—vulnerability to contextual distractions—which is a crucial step towards building more reliable systems.\n\n\\* **Originality and Novelty:** The proposed method is novel and sophisticated. While prior work has explored static or retrieval-based distractions, this paper's use of an adaptive, model-guided tree search to generate adversarial context is a clear advancement. The integration of a pre-filtering classifier and a value function guided by simulation success rates constitutes a well-designed, original framework for this problem.\n\n\\* **Quality of Evaluation:** The empirical evaluation is extensive and of high quality. The authors test their method on a diverse and relevant set of twelve modern LLMs, including both proprietary and open-weight models. The use of four different QA benchmarks demonstrates the broad applicability of the vulnerability. Furthermore, the comparison against multiple baselines and the thorough investigation of mitigation strategies (both prompting and fine-tuning) add significant depth and value to the experimental results. The inclusion of detailed ablation studies on the value function and classifier further strengthens the paper's claims.\n\n\\* **Clarity:** The paper is exceptionally well-written and clearly structured. The methodology is presented logically, aided by a helpful diagram (Figure 1) and formal problem definitions. The results are clearly tabulated and discussed, and the appendices provide extensive details on hyperparameters, prompts, and additional experiments, ensuring high reproducibility.\n\n###  **Weaknesses**\n\n\\* **Scalability and Computational Cost:** The primary weakness of the proposed method is its computational expense. A tree-search process that involves multiple calls to powerful LLMs for generation (proxy model) and simulation (victim model) at each node is inherently costly. While the authors have cleverly incorporated efficiency strategies like a pre-filtering classifier and early stopping, the scalability of this approach for very large datasets or its integration into an online training loop remains a significant challenge. The paper acknowledges this cost but could benefit from a more detailed analysis of the cost-benefit trade-off.\n\n\\* **Limited Scope of Tasks:** The experiments are primarily focused on multiple-choice question-answering tasks. While the authors show generalization to a math reasoning benchmark, it is still a format with a single, verifiable ground truth. It is less clear how the core mechanics of the framework—particularly the error-guided perturbation based on incorrect options and the success rate simulation—would apply to more open-ended tasks like summarization, translation, or creative writing, where defining \"failure\" is more nuanced.\n\n\\* **Lack of Statistical Significance Testing:** The paper presents extensive results but lacks reporting of confidence intervals or statistical significance tests for its main claims. Given the stochastic nature of LLM responses (even with low temperature), reporting error bars across multiple runs would strengthen the reliability of the reported accuracy drops and comparison between methods. The authors acknowledge this in the checklist, citing computational cost, but it remains a methodological weakness.\n\nQUESTIONS:\n1. **On the Cost-Benefit of Tree Search:** The tree search is computationally intensive. Your ablation study on the value function shows that using the full function is better than simpler versions. However, could you provide a more direct comparison between a simple, one-step \"Error-Guided Perturbation\" (generating one distraction for each wrong option and stopping) versus the full, multi-level tree search? Specifically, what is the marginal gain in performance drop achieved by searching at depths > 1, and is this gain worth the exponential increase in computational cost?\n2. **Generalizability to Open-Ended Tasks:** Your framework relies on a discrete set of incorrect answers to guide the perturbation generation. How do you envision adapting this \"Error-Guided Perturbation\" to more open-ended tasks like text summarization or story generation, where there isn't a clear set of \"wrong options\"? Would the guidance have to be based on more abstract principles (e.g., generating distractions that encourage factual inaccuracies or stylistic deviations)?\n3. **Qualitative Analysis of Failures:** The case studies in the appendix are insightful. Could you provide a more systematic qualitative analysis of the failure modes? For instance, are the models failing primarily by latching onto superficial keywords introduced in the distraction (a \"shallow\" failure), or are the distractions causing a more fundamental breakdown in the model's reasoning process (a \"deep\" semantic confusion)?\n4. **Sensitivity to Hyperparameters:** The value function includes constants $\\alpha=2$ and $\\gamma=1$. How were these values chosen? Have you performed any sensitivity analysis to determine how robust the search process is to changes in these hyperparameters?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 4, "IMPACT": 4, "ORIGINALITY": 3, "DATE": "2025-07-02"}

comments: SUMMARY:
Previous static methods like fixed-template distractions are not effective to contemporary models. Therefore, in this paper, the authors put forward a method that can produce distractions dynamically based on tree search. Experiments validate the effectiveness of the proposed method in distractions. The authors also explore the performance of defense methods like prompt-based methods and fine-tuning-based methods like DPO.

STRENGTHS AND WEAKNESSES:
This paper has the following strengths:
- This method is clearly motivated and presented.
- Extensive experiments validate the effectivenss of the proposed method.
- The findings of mitigation methods are also useful for future research.

This paper has the following minor weaknesses:
- Lack of evaluations on latest reasoning models.
- It is unclear how the prompt template will affect the final results.

QUESTIONS:
I have the following questions/suggestions:
- It would be better to conduct experiments on some latest models like Qwen3 [1] and GPT-o3.
- In line 197, the tempature is set to 0.001during evaluation. Would using 0 be a more conventional choice for the evaluation?
- Could the author try another prompt template on a few models to observe the performance.
- For the background colors in Table1, a clear definition of the color assignments for each range would be beneficial.


------
**References**  
[1] Yang, An, et al. "Qwen3 technical report." arXiv preprint arXiv:2505.09388 (2025).

LIMITATIONS:
yes
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-03

comments: SUMMARY:
This paper presents a distraction generation framework that employs tree search and is guided by model behavior. The generated adaptive distractions—semantically coherent, answer-preserving contextual additions—can significantly impair the performance of large language models. Experiments on multiple-choice QA datasets demonstrate the effectiveness of the framework.

STRENGTHS AND WEAKNESSES:
1. The framework offers a dynamic evaluation of LLM contextual robustness.
2. The adaptive distractions lead to substantial performance degradation, with an average accuracy drop exceeding 45%, highlighting vulnerabilities even in advanced LLMs.

QUESTIONS:
1. Most experiments are conducted on multiple-choice question answering benchmarks. The method relies on incorrect answers to generate distractions. To enhance the framework utility, further experiments on generation tasks and safety tasks are needed, alongside comparisons with strong baselines. A brief experiment on MATH500 is noted in the appendix, but it is insufficient. 

2. How are answers obtained during evaluation? Is it through testing probabilities or using chain-of-thought reasoning before providing an answer? 

3. In Table 2, it would be beneficial to include several cases that compare perturbed questions generated by different methods. Additionally, what is the significant difference between DyVal2 and the proposed method? 

4. Regarding the mitigation methods, the details of the data and training for DPO are unclear. Would having the model first repeat the question before answering help mitigate the issue?

LIMITATIONS:
Please refer to the questions.
TITLE: Official Review
CLARITY: 3
IMPACT: 2
ORIGINALITY: 2
DATE: 2025-07-04