Model Agnostic Answer Reranking System for Adversarial Question Answering (2021)

Abstract: While numerous methods have been proposed as defenses against adversarial examples in question answering (QA), these techniques are often model specific, require retraining of the model, and give only marginal improvements in performance over vanilla models. In this work, we present a simple model-agnostic approach to this problem that can be applied directly to any QA model without any retraining. Our method employs an explicit answer candidate reranking mechanism that scores candidate answers on the basis of their content overlap with the question before making the final prediction. Combined with a strong base QAmodel, our method outperforms state-of-the-art defense techniques, calling into question how well these techniques are actually doing and strong these adversarial testbeds are.

## introduction as reading comprehension datasets @xcite @xcite @xcite and models @xcite @xcite have advanced, qa research has increasingly focused on out-ofdistribution generalization @xcite and robustness. @xcite and @xcite show that appending unrelated distractors to contexts can easily confuse a deep qa model, calling into question the effectiveness of these models. although these attacks do not necessarily reflect a real-world threat model, they serve as an additional testbed for generalization: models that perform better against such adversaries might be expected to generalize better in other ways, such as on contrastive examples @xcite . in this paper, we propose a simple method for adversarial qa that explicitly reranks candidate answers predicted by a qa model according to a notion of content overlap with the question. specifically, by identifying contexts where more named entities are shared with the question, we can extract answers that are more likely to be correct in adversarial conditions. the impact of this is two-fold. first, our proposed method is model agnostic in that it can be applied post-hoc to any qa model that predicts probabilities of answer spans, without any retraining. second but most important, we demonstrate that even this simple named entity based questionanswer matching technique can be surprisingly useful. we show that our method outperforms state-of-the-art but more complex adversarial defenses with both bidaf @xcite and bert @xcite on two standard adversarial qa datasets @xcite . the fact that such a straightforward technique works well calls into question how reliable current datasets are for evaluating actual robustness of qa models. ## related work over the years, various methods have been proposed for robustness in adversarial qa, the most prominent ones being adversarial training @xcite @xcite , data augmentation @xcite and posterior regularization @xcite . among these, we compare our method only with techniques that train on clean squad @xcite for fairness. @xcite use a syntax-driven encoder to model the syntactic match between a question and an answer. @xcite use a prior approach @xcite to maximize mutual information among contexts, questions, and answers to avoid overfitting to surface cues. in contrast, our technique is more closely related to retrieval-based methods for opendomain qa @xcite and multi-hop qa @xcite : we show that shallow matching can improve the reliability of deep models against adversaries in addition to these more complex settings. methods for (re)ranking of candidate passages/answers have often been explored in the context of information retrieval @xcite , content-based qa @xcite and open-domain qa @xcite . similar to our approach, these methods also exploit some measure of coverage of the query by the candidate answers or their supporting passages to decide the ranks. however, the main motive behind ranking in such cases is usually to narrow down the area of interest within the text to look for the answer. on the contrary, we use a reranking mechanism that allows our qa model to ignore distractors in adversarial qa and can also provide model-and task-agnostic behavior unlike the commonly used learning-based (re)ranking mechanisms. in yet another related line of research, @xcite reveal the simplistic nature and certain important shortcomings of popular qa datasets. @xcite conclude that the simple nature of the questions in the cnn/daily mail reading comprehension dataset @xcite allows a qa model to perform well by extracting single-sentence relations. @xcite perform an ex-tensive study with multiple well-known qa benchmarks to show several troubling trends: basic model ablations, such as making the input questionor passage-only, can beat the state-of-the-art performance, and the answers are often localized in the last few lines, even in very long passages, thus possibly allowing models to achieve very strong performance through learning trivial cues. although we also question the efficacy of well-known adversarial qa datasets in this work, our core focus is on exposing certain issues specifically with the design of the adversarial distractors rather than the underlying datasets. ## approach neural qa models are usually trained in a supervised fashion on labeled examples of contexts, questions, and answers to predict answer spans; we represent these as (s, e) tuples, where s represents the sentence and e the candidate span. prior work @xcite @xcite has noted that the end-to-end paradigm can overfit superficial biases in the data causing learning to stop when simple correlations are sufficient for the model to answer a question confidently. by explicitly enforcing content relevance between the predicted answer-containing sentence and the question, we can combat this poor generalization. specifically, we explicitly score the candidate sentences as per the word-level overlap in named entities common to both the question and a sentence. we refer to our method as model agnostic answer reranking system (maars). figure 1 illustrates the workflow of maars. maars can be applied to any arbitrary qa model that predicts answer span probabilities. first, we use the base qa model to compute the n best answer spans @xmath0, e 1 ), . . . , (s n , e n )} for a context-question pair (c, q) where n is a hyperparameter. any answer span not lying in a single sentence is broken into subspans that lie in separate sentences and a is updated accordingly. next, we extract the set of candidate sentences l from the context containing these n answer spans. for the question and each sentence, we compute a set of named entity chunks using an open-source allennlp @xcite ner model. we then compute the set of words inside named entity chunks from each candidate sentence ner(l k ) ∀ l @xmath1; note that ner(•) refers to a set of words and not a set of named entities. each candidate sentence l k is then given a score sc(l k ) = ner(l k ) ∩ ner(q) and the answer spans are reranked per the scores of the sentences containing them. in the case of ties or if there are multiple spans in the same candidate sentence, they are reranked among themselves according to the original ordering as per the qa model. finally, the span with the highest rank after reranking is chosen as the final answer. compared to the base qa model, this approach only relies on an additional ner model that can be used without any retraining of the base model. note that the architecture doesn't depend on any specific tagger, and the other content matching models like word matching could also be used in the system here. ## conclusion in this work, we introduce a simple and model agnostic post-hoc technique for adversarial question answering (qa) that predicts the final answer after re-ranking candidate answers from a generic qa model as per their overlap in relevant content with the question. our results show the potential of our method through large performance gains over vanilla models and state-of-the-art methods. we also analyze common failure points in our method. finally, we reiterate that our main contribution is not the heuristic defense itself but rather its ability to paint a more complete picture of the current state of affairs in adversarial qa. we seek to illustrate that our current adversaries are not strong and generic enough to attack a wide variety of qa methods, and we need a broader evaluation of our defenses to meaningfully gauge our progress in adversarial qa research.