Paper: Perturbed examples reveal invariances shared by language models (ICLR-2024)

Reviewer comment (Theory):
Section 3: "four independent components" -> I am not sure if these four are really independent, does transformation and constraint dependent on each other?

Author response:
**Are the four components really independent? Does transformation and constraint depend on each other?**

We intentionally designed the independence of the four components from an implementation perspective by defining them separately in the code. This intentional design choice enables researchers and practitioners to define new linguistic capabilities tailored to their specific tasks in a modular fashion. We do agree that while defining a linguistic-capability one may implicitly weigh the interdependence of these components. For example, practitioners may choose not to impose specific constraints with particular transformations, or vice versa.

Reviewer comment (Evaluation):
I'm a bit puzzled with the results of BERT-Tiny in Fig. 4, especially regarding the poor OOD-agreement but high invariances. Does this mean that the predictions of both models are quite different (hence poor agreement), but within the individual model the predictions do not change when it is given original and pertubed samples?

Author response:
**Puzzled with results of BERT-Tiny. Does this mean that the predictions of both models are quite different (hence poor agreement), but within the individual model the predictions do not change when it is given original and perturbed samples?**

Precisely! We find that while larger target models (e.g., BERT-Base) disagreed with BERT-Tiny (as reference model) on individual samples (lower agreement), they still shared invariances i.e., the larger target models didn’t have substantial differences in their predictions on original and perturbed samples.

Reviewer comment (Evaluation):
Is there any interesting findings on the model agreement on original input vs. pertubed input?

Author response:
**Any interesting findings on the model agreement on original input vs. perturbed input?**

We didn’t observe any atypical trends on the model agreement on original input (IID-Agreement) and perturbed input (OOD-Agreement). We found them to mostly follow similar trends across many different settings. Along similar lines, a recent work in computer vision has also observed that IID-agreement and OOD-agreement are highly correlated with each other. [1]

Reviewer comment (Presentation):
Mention the tasks being used in the experiments at the beginning of the paper. It was not clear until Section 3.3 that you focus on text classification and language modeling.

Author response:
*Mention the tasks being used in the experiments at the beginning of the paper:* Thanks for the suggestion, we added a pointer to the tasks being used in experiments in the concluding paragraph of the Introduction.

Reviewer comment (Reproducibility):
Would be helpful to add more details regarding how the pertubed input is constructed for each linguistic capability. It is currently mentioned as the limitation (inefficient search methods), but i is unclear how inefficient since there is no explanation about it.

Author response:
*Unclear how inefficient is perturbation generation:* The major computation costs for SCoPE can be attributed to the process of generating invariant perturbations w.r.t the reference model. Importantly, this is a one-time process (per reference model) and we can reuse the perturbations generated for a particular reference model for comparison with different target models. This cost varies depending on the linguistic capability. For instance, generating perturbations for Synonym-Invariance takes $\approx 1.2$ seconds per sample, for BERT-Base as a reference model. We have added a few results on the compute costs for perturbation generation in the supplementary material Sec. K. Please let us know If there are other specific details regarding perturbed input generation we can further clarify.

Reviewer comment (Presentation):
I think the results for fairness capability is quite interesting. If there is space, might consider to put it in the main text.

Author response:
*results for fairness capability is quite interesting. If there is space, might consider to put it in the main text:* We are glad to note that you find the fairness capability results quite interesting. Unfortunately, space constraints prevent us from providing a detailed discussion on the fairness capability results in the main paper. However, should our work be accepted, we plan to incorporate these findings into the main paper, as we would have access to an additional page.

Reviewer comment (Evaluation):
The paper fails to present a clear motivation and justification for the proposed metrics. For an auxiliary metric to be of interest to a practitioner, it needs to be predictive of what the practitioner cares about.

Author response:
**Why do shared invariances tell us about performance in the wild?; Motivation of shared-invariances beyond OOD agreement**

Being invariant to perturbations in data that are not intrinsically relevant to the task labels is helpful for models to generalize beyond their training distribution [1, 2]. Therefore, comparing the invariances shared between the two models can shed light on how similarly they will generalize on data that deviates from the training distribution. This is particularly interesting when considering models with distinct design choices (e.g., distillation, model size), as low values of shared invariance signify that the design choice renders the model susceptible to perturbations that it was originally robust to. In this work, we investigate three distinct perturbations – synonym-based word substitution, inducing misspellings, and protected category-based word substitution (fairness), that preserve the underlying sentiment of a sentence for a sentiment classification task. Through our experiments, we uncover several insights such as – distilling BERT makes it more susceptible to perturbations along certain linguistic capabilities (Typo-Invariance) than others, larger models encode a more diverse set of invariances compared to comparably accurate smaller models, etc.

We would also like to clarify that we introduce novel measures of shared invariances based on the motivations described above. If existing metrics were able to capture the degree of shared invariance, then there would be no need to introduce new metrics. This is why we tested OOD-agreement, since it is one of the popular metrics to quantify the behavioral similarity of two models. To quantify the relationship between invariance- and agreement-based metrics, we conducted a correlation analysis between OOD-agreement and Soft-SCoPE which revealed poor correspondence in certain important cases. Therefore, if one wants to investigate the shared invariance between models, then using a metric like Soft-SCoPE is more desirable.

Reviewer comment (Evaluation):
The abstract refers to learning about “differences in model performance in the wild” as the motivation, but there is no explanation of how measuring the proposed invariance-based metrics for pairs of models can help better understand the models’ “performance in the wild.”

Author response:
**Why do shared invariances tell us about performance in the wild?; Motivation of shared-invariances beyond OOD agreement**

Being invariant to perturbations in data that are not intrinsically relevant to the task labels is helpful for models to generalize beyond their training distribution [1, 2]. Therefore, comparing the invariances shared between the two models can shed light on how similarly they will generalize on data that deviates from the training distribution. This is particularly interesting when considering models with distinct design choices (e.g., distillation, model size), as low values of shared invariance signify that the design choice renders the model susceptible to perturbations that it was originally robust to. In this work, we investigate three distinct perturbations – synonym-based word substitution, inducing misspellings, and protected category-based word substitution (fairness), that preserve the underlying sentiment of a sentence for a sentiment classification task. Through our experiments, we uncover several insights such as – distilling BERT makes it more susceptible to perturbations along certain linguistic capabilities (Typo-Invariance) than others, larger models encode a more diverse set of invariances compared to comparably accurate smaller models, etc.

We would also like to clarify that we introduce novel measures of shared invariances based on the motivations described above. If existing metrics were able to capture the degree of shared invariance, then there would be no need to introduce new metrics. This is why we tested OOD-agreement, since it is one of the popular metrics to quantify the behavioral similarity of two models. To quantify the relationship between invariance- and agreement-based metrics, we conducted a correlation analysis between OOD-agreement and Soft-SCoPE which revealed poor correspondence in certain important cases. Therefore, if one wants to investigate the shared invariance between models, then using a metric like Soft-SCoPE is more desirable.

Reviewer comment (Novelty):
The main justification for the proposed metrics is that they don’t correlate with OOD agreement, but simply stating that a new metric is different from existing ones is not a valid justification and constitutes a logical fallacy.

Author response:
**Why do shared invariances tell us about performance in the wild?; Motivation of shared-invariances beyond OOD agreement**

Being invariant to perturbations in data that are not intrinsically relevant to the task labels is helpful for models to generalize beyond their training distribution [1, 2]. Therefore, comparing the invariances shared between the two models can shed light on how similarly they will generalize on data that deviates from the training distribution. This is particularly interesting when considering models with distinct design choices (e.g., distillation, model size), as low values of shared invariance signify that the design choice renders the model susceptible to perturbations that it was originally robust to. In this work, we investigate three distinct perturbations – synonym-based word substitution, inducing misspellings, and protected category-based word substitution (fairness), that preserve the underlying sentiment of a sentence for a sentiment classification task. Through our experiments, we uncover several insights such as – distilling BERT makes it more susceptible to perturbations along certain linguistic capabilities (Typo-Invariance) than others, larger models encode a more diverse set of invariances compared to comparably accurate smaller models, etc.

We would also like to clarify that we introduce novel measures of shared invariances based on the motivations described above. If existing metrics were able to capture the degree of shared invariance, then there would be no need to introduce new metrics. This is why we tested OOD-agreement, since it is one of the popular metrics to quantify the behavioral similarity of two models. To quantify the relationship between invariance- and agreement-based metrics, we conducted a correlation analysis between OOD-agreement and Soft-SCoPE which revealed poor correspondence in certain important cases. Therefore, if one wants to investigate the shared invariance between models, then using a metric like Soft-SCoPE is more desirable.

Reviewer comment (Writing):
It is unclear if a notation for the source of perturbed candidates x’ is missing from Equation 1.

Author response:
**Is a notation for the source of perturbed candidates x’ missing from Equation 1?**

We assume that by “source” here, the reviewer means initialization of $x’$. As discussed in Section 3.1, the linguistic capability $C$ perturbs $x$ to obtain the $x’$. Hence, the source of the $x’$ here is $x$. We subject the optimization procedure to disregard trivial solutions i.e., $x = x’$. We have updated Equation-1 in the paper to reflect the same more clearly.

Reviewer comment (Presentation):
A table showing examples of (x, x’) pairs is necessary for a paper like this.

Author response:
**A table showing examples of (x, x’) pairs is a must for a paper like this.**

Thanks for the suggestion. We have added the same in the supplementary materials Sec. L.

Reviewer comment (Writing):
There are numerous issues with the presentation of the definition of Hard-SCoPE and Soft-SCoPE. Considering that the new measure is the main contribution made in this paper, this is a significant weakness. The reviewer could not attempt to infer the definition from its implementation, since the submission was not supplemented by code.

Author response:
*Notation delta_m1 is never formally defined:* $\Delta \vec{m}^{\}$ is the change in a model – $m$’s, output probability distribution in the presence of a perturbation ($x \rightarrow x’$), i.e., $\Delta \vec{m}^{\} = m(x')-m(x)$. Thus, Soft-SCoPE between two models Soft-SCoPE ($m_2$ | $m_1$) is high if the change (or effect of the perturbation) in two models ($\Delta \vec{m_1}^{\}$,$\Delta \vec{m_2}^{\}$) is similar (in both direction and magnitude) and low otherwise. We've improved the description for the same on Page-5/6.

Reviewer comment (Writing):
The notation $\Delta \vec{m}$ is never formally defined, making it impossible to understand the definition of Soft-SCoPE.

Author response:
*Notation delta_m1 is never formally defined:* $\Delta \vec{m}^{\}$ is the change in a model – $m$’s, output probability distribution in the presence of a perturbation ($x \rightarrow x’$), i.e., $\Delta \vec{m}^{\} = m(x')-m(x)$. Thus, Soft-SCoPE between two models Soft-SCoPE ($m_2$ | $m_1$) is high if the change (or effect of the perturbation) in two models ($\Delta \vec{m_1}^{\}$,$\Delta \vec{m_2}^{\}$) is similar (in both direction and magnitude) and low otherwise. We've improved the description for the same on Page-5/6.

Reviewer comment (Writing):
In Hard-SCoPE and Soft-SCoPE, the expectation is said to be taken over $(x, x') \in (X, X')$, but the domain $(X, X')$ is not defined. A first interpretation could be that this is a cartesian product $X \times X'$, implying that $x, x'$ are taken iid—however, this does not seem to align with the textual description of SCoPE. An alternative way to denote taking $x$ and its corresponding perturbation is suggested in the summary.

Author response:
*Notation suggestions for perturbations and metrics:* Thanks for the suggestion regarding the alternative way of denoting notations. We have incorporated those suggestions and modified some of the notation definitions accordingly. In Hard-SCoPE and Soft-SCoPE the expectation is now over $x \in X$ and we denote the corresponding perturbed samples $x’$ in each equation by $C(x; m)$, where $m$ is the reference model. Additionally, while generating $x’$, we disregard the trivial solution i.e., $x = x’$, and optimize for a perturbation that minimizes the objective function $\mathcal{L}(m(x),m(x'))$.

Reviewer comment (Theory):
The definition of a perturbation in this paper is unclear or disagreeable. For example, on page 4, $X'$ is defined as the image of $X$ under $C(\cdot, m)$, but this does not retain the mapping of inputs $x$ to their perturbations $C(x, m)$. Furthermore, $C$ is not well defined since the domain of the argmin is not specified. If the domain is taken to be $X$ and the loss function is the $\ell_1$-norm difference, then $C$ becomes the identity function (assuming the loss has no non-trivial zeroes).

Author response:
*Notation suggestions for perturbations and metrics:* Thanks for the suggestion regarding the alternative way of denoting notations. We have incorporated those suggestions and modified some of the notation definitions accordingly. In Hard-SCoPE and Soft-SCoPE the expectation is now over $x \in X$ and we denote the corresponding perturbed samples $x’$ in each equation by $C(x; m)$, where $m$ is the reference model. Additionally, while generating $x’$, we disregard the trivial solution i.e., $x = x’$, and optimize for a perturbation that minimizes the objective function $\mathcal{L}(m(x),m(x'))$.

Reviewer comment (Theory):
In Soft-SCoPE, since the attenuating factor $\mathrm{decay}(\mathrm{dist}(\cdot, \cdot))$ appears to be constant with respect to the random variables, it can be taken out of the expectation. Therefore, Soft-SCoPE is essentially Hard-SCoPE multiplied by a factor that depends on $m_1$ and $m_2$ (in an undefined way, see Point 2).

Author response:
C1. $\Delta \vec{m}^{\} = m(x')-m(x)$ is the change in model $m$’s output for a specific base-perturbed sample pair i.e., a particular base sample $x \in X$ and its perturbed counterpart $x’ = C(x; m_{ref})$, where $m_{ref}$ is the reference model which may not be the same as $m$. We have revised Equation 3 as the decay(dist($\Delta \vec{m_1}^{\}$, $\Delta \vec{m_2}^{\}$)) term depends on $x \in X$.  

C4. As alluded to in C1, the Soft-SCoPE formulation incorporates the decay(dist(., .)) term within the expectation. Hence, we use the expectation notations for the sake of consistency.

Reviewer comment (Writing):
On page 6, it is written that "Hard-SCoPE can only take binary values i.e., 0 or 1". The reviewer interprets this as meaning that the Hard-SCoPE of two models can be either 0 or 1, but this is not consistent with the remainder of the text.

Author response:
*Hard-SCoPE of two models can be either 0, or 1:* Thank you for the pointer. Your understanding is correct, we meant that the Hard-SCoPE of two models for a particular base-perturbed pair can either be 0 or 1. We have added clarifications on Page-6.

Reviewer comment (Experiments):
The goal of the experiments should be to argue for the utility of the novel measure. This could be accomplished by using the measure to obtain novel insights or by dissecting it with fine-grained experiments, but this is not done.

Author response:
**Experiments lack depth; correlations are either expected**

We perform extensive experiments demonstrating the utility of the proposed measure across many different settings – different tasks (text classification and language modeling), datasets (SST2 and AG-News), linguistic capabilities (Synonym-Invariance, Typo-Invariance, Fairness), models (BERT-, InstructGPT-family), etc. Please let us know if you have are other specific suggestions for detailed experiments, and we would happy to follow up with them during the discussion period.

Reviewer comment (Evaluation):
In Section 3, the authors compare the measure to naive pointwise measures (IID/OOD agreement). The main experiments (Sections 4 and 5) compare different model pairs using Soft-SCoPE, Hard-SCoPE, and pointwise agreement, displayed via bar charts with textual descriptions. The results are superficial: correlations are either expected (e.g., BERT-Base SCoPE correlates with model size) or uninterpretable (e.g., this is not the case for BERT-Tiny). When deeper conclusions are offered, they are speculative ("we hypothesize").

Author response:
**Experiments lack depth; correlations are either expected**

We perform extensive experiments demonstrating the utility of the proposed measure across many different settings – different tasks (text classification and language modeling), datasets (SST2 and AG-News), linguistic capabilities (Synonym-Invariance, Typo-Invariance, Fairness), models (BERT-, InstructGPT-family), etc. Please let us know if you have are other specific suggestions for detailed experiments, and we would happy to follow up with them during the discussion period.

Reviewer comment (Writing):
The usage of the term "capability" is confusing in the context of perturbations based on synonyms or permutations of characters in a word. In NLP, a capability typically refers to a task (e.g., sentiment analysis, summarization). It is unclear how these perturbations are related to capabilities as generally used.

Author response:
*Relationship with perturbation:* As discussed in the Introduction and Related Works, we follow prior works [1, 2] in defining linguistic capabilities. A linguistic capability evaluates a model’s competence on a particular aspect of knowledge and understanding required to solve an NLP task by validating its input-output behavior under the corresponding scenario. Thus, these linguistic capabilities (such as invariance to synonyms, or variance to negation) are required by NLP models to perform a particular task (sentiment classification) well. One way to evaluate a model’s linguistic capabilities is via perturbations i.e., perturbing the input along the concept encoded by a linguistic capability (e.g., replacing words with synonyms, negating sentences) and evaluating whether the model’s prediction on the perturbed input aligns with human judgment. Thus, the perturbation generation rules are closely defined by the linguistic capability of interest.

Reviewer comment (Experiments):
It is unclear whether the choice of perturbations was arbitrary or particularly appropriate for exploring SCoPE. The results in Sections 4 and 5 could have been similar with other perturbations, pointing to the generic nature of the results.

Author response:
*Specific capabilities:* We focus on the particular linguistic capabilities i.e., Synonym-Invariance, Typo-Invariance, and Fairness as there is rich literature studying them in NLP, albeit from an adversarial robustness perspective as they concern the reliability of many real-world systems, such as spam detection, toxicity classification, and fake news detection [3, 4, 5]. We would like to emphasize that the primary goal of this work is to a) introduce a general framework for comparing shared invariances along a linguistic capability and b) proposing novel measures of behavioral shared invariance. The list of linguistic capabilities can be easily expanded by researchers and practitioners in the future based on the specifications of their research questions and tasks as they would only need to define the specific transformation and constraints.

Reviewer comment (Presentation):
The diagram in the left part of Figure 5 is unintelligible despite multiple attempts to interpret it. The diagram on the right would be clearer as a table, especially given there are only three data points.

Author response:
*Could not understand the diagram in the left part of Figure 1:* 
Consider a model – $m$, trained on a binary classification task where the labels correspond to two classes – Class-A and Class-B. 
For a particular input – $x$, we can visualize the output softmax probabilities of $m$ i.e., m(x) = [0.8, 0.2] via vectors on a 2-D plane where the y-axis corresponds to the Class-A probability score (0.8 here) and x-axis corresponds to the Class-B probability score (0.2 here). 
In Figure 1 (left), we visualize the output softmax probability vectors for three models $m_1$, $m_2$, and $m_3$ for a pair of original-perturbed sample ($x$, $x’$), where $x’ = C(x; m_1)$. Note, in this example $m_1$ is the reference model, while  $m_2$ and $m_3$ are target models.
We observe that both $m_2$ and $m_3$ remain consistent in their predictions i.e., $y_{m_{2}}(x)$ = $y_{m_{2}}(x’)$ and $y_{m_{3}}(x)$ = $y_{m_{3}}(x’)$, as they predict Class-B on both original and perturbed samples. Thus, the Hard-SCoPE values – Hard-SCoPE ($m_2 \mid m_1$) and Hard-SCoPE ($m_3 \mid m_1$) is 1. However, we note that the effect of the perturbation (in both direction and magnitude), as measured by $\Delta \vec{m}^{\} = m(x')-m(x)$ , is much more aligned for one pair of target-reference model i.e., $\Delta \vec{m_3}^{\}$ and $\Delta \vec{m_1}^{\}$ than the other pair $\Delta \vec{m_2}^{\}$ and $\Delta \vec{m_1}^{\}$. 
Thus, the reliance on (argmax) predictions to quantify shared invariances by Hard-SCoPE obscures the finer differences between the effect of the perturbation. As motivated by this example, we propose a softer measure of shared-invariances – Soft-SCoPE that accounts for such differences and assigns higher values when the effect of the perturbation in both models is similar (e.g., 1 for $\Delta \vec{m_3}^{\}$ and $\Delta \vec{m_1}^{\}$) and low values otherwise (e.g., 0.6 for $\Delta \vec{m_2}^{\}$ and $\Delta \vec{m_1}^{\}$).

*Diagram on the right would be clearer if presented by a table, as there are only three data points:*
We keep Figure 1 (right) as a figure as the key focus here is not on the three data points – $\Delta \vec{m_1}^{\}$, $\Delta \vec{m_2}^{\}$ and $\Delta \vec{m_1}^{\}$, but rather on the smooth variation of the Soft-SCoPE score as the effect of perturbation in the target model becomes less/more aligned with that in the reference model.

Reviewer comment (Writing):
Commas before/after "i.e." are inconsistent throughout the paper. A specific dialect (American or British English) should be chosen and applied consistently.

Author response:
**Additional / minor issues**

Thank you for these suggestions, we have incorporated them in the paper.

Reviewer comment (Writing):
On page 3, it is unclear what the argmin is over. Presumably, it is over $x' \in X'$, but $X'$ uses $C$ in its definition on the following page.

Author response:
*Notation suggestions for perturbations and metrics:* Thanks for the suggestion regarding the alternative way of denoting notations. We have incorporated those suggestions and modified some of the notation definitions accordingly. In Hard-SCoPE and Soft-SCoPE the expectation is now over $x \in X$ and we denote the corresponding perturbed samples $x’$ in each equation by $C(x; m)$, where $m$ is the reference model. Additionally, while generating $x’$, we disregard the trivial solution i.e., $x = x’$, and optimize for a perturbation that minimizes the objective function $\mathcal{L}(m(x),m(x'))$.

Reviewer comment (Writing):
On page 4, the phrase "and constraint modifications of words that are stopwords" is likely intended to be "constrain" (a verb) rather than "constraint" (a noun).

Author response:
**Additional / minor issues**

Thank you for these suggestions, we have incorporated them in the paper.

Reviewer comment (Writing):
On page 4, there is a grammatical issue with the sentence beginning "We perform experiments along one...".

Author response:
**Additional / minor issues**

Thank you for these suggestions, we have incorporated them in the paper.

Reviewer comment (Writing):
On page 4, it is unclear what the argmax is over. Presumably, it is over $k \in [c]$. Additionally, this equation would be more readable if centered rather than inline.

Author response:
**Additional / minor issues**

Thank you for these suggestions, we have incorporated them in the paper.

Reviewer comment (Writing):
On page 4, the definition of $X'$ should use set builder notation; replace the $\forall$ with a colon or vertical line.

Author response:
**Additional / minor issues**

Thank you for these suggestions, we have incorporated them in the paper.

Reviewer comment (Writing):
On page 5, in defining the acronym, "**SH**ared-**C**-apabilities..." contains an unnecessary hyphen and the **H** does not appear in the acronym.

Author response:
**Additional / minor issues**

Thank you for these suggestions, we have incorporated them in the paper.

Reviewer comment (Writing):
On page 5, "(ref Eq. 1)" uses "ref" in a way that is likely a typo; "see" would be clearer.

Author response:
**Additional / minor issues**

Thank you for these suggestions, we have incorporated them in the paper.

Reviewer comment (Presentation):
On page 6, use \mathrm{} for operators such as "decay" and "dist".

Author response:
**Additional / minor issues**

Thank you for these suggestions, we have incorporated them in the paper.

Reviewer comment (Reproducibility):
The computational cost of computing SCoPE is not reported in the paper or appendices. For a new measure, it would be useful to know how expensive it is to compute. For example, in Section 5, black-box models are evaluated via random output samples; the monetary barrier to reproducing these experiments and any compute-accuracy trade-off should be clarified.

Author response:
**What is the cost of computing SCoPE?**

The major computation costs for SCoPE can be attributed to the process of generating invariant perturbations with respect to the reference model. Importantly, this is a one-time process (per reference model) and we can reuse the perturbations generated for a particular reference model for comparison with different target models. This cost varies depending on the linguistic capability, and we have added a few results on the same in the supplementary material Sec. K. There is no substantial additional compute overhead on computing the SCoPE-based metrics, once perturbations are generated.

Regarding the compute-accuracy tradeoff:
In Section H of the supplementary materials, we discuss the reliability of our proposed metrics as the number of base samples (X) decreases. Specifically, we report the mean metric values and the 95% confidence interval of this estimate computed over 100 trials for many values of the base-sample count. We find that our metrics provide tight confidence intervals for as low as 50 base samples. For experiments in Section-5, since the reference model was fixed as GPT-2, the costs were primarily due to running each GPT-3.5 model on 100 base-perturbed sample pairs. At the time of conducting the experiments, it cost us $\approx 55$\$ to generate all the results in Section-5.

Reviewer comment (Writing):
The paper extensively uses the term "behavioral invariances". It is unclear what is "behavioral" about these, whether this term is common in the literature, and whether it distinguishes them from other invariances. Since "behavior" connotes cognitive or semantic aspects, and typo-invariance is syntactic, using just "invariance" might be clearer.

Author response:
**What is behavioral about the invariances?**

The invariances shared between models can be evaluated either at the output level, which we refer to as the behavior of the model, or at the representation level, examining whether the model maintains very similar representations (at some intermediate layer) for perturbed and original samples. In the related works section, we discuss works [6] that compute representational shared-invariances between two computer vision models, and elaborate why their setups may not be directly applicable to natural language processing.

Reviewer comment (Experiments):
Description of experimental methodology needs to be clarified.

Author response:
Thank you for your review Reviewer yXpb. 

We have added descriptions for the previously undefined acronyms, namely, IID (Independent and identically distributed) and OOD (Out-of-Distribution) data in the paper. We have also included additional experiment details related to different NLP tasks in the concluding paragraph of the Introduction. Please let us know if there are any other specific details that we can further clarify.

Reviewer comment (Writing):
IID not defined.

Author response:
Thank you for your review Reviewer yXpb. 

We have added descriptions for the previously undefined acronyms, namely, IID (Independent and identically distributed) and OOD (Out-of-Distribution) data in the paper. We have also included additional experiment details related to different NLP tasks in the concluding paragraph of the Introduction. Please let us know if there are any other specific details that we can further clarify.