FVQA 2.0: Introducing Adversarial Samples into Fact-based Visual Question Answering (2023)

Abstract: The widely used Fact-based Visual Question Answering (FVQA) dataset contains visually-grounded questions that require information retrieval using common sense knowledge graphs to answer. It has been observed that the original dataset is highly imbalanced and concentrated on a small portion of its associated knowledge graph. We introduce FVQA 2.0 which contains adversarial variants of test questions to address this imbalance. We show that systems trained with the original FVQA train sets can be vulnerable to adversarial samples and we demonstrate an augmentation scheme to reduce this vulnerability without human annotations.

## introduction knowledge-based visual question answering (kb-vqa) lies at the intersection of computer vision, natural language processing, and information retrieval. a kb-vqa system must access external knowledge sources to find a correct and complete answer, a task that is sometimes hard for humans. fact-based visual question answering (fvqa) @xcite is a vqa task in which visually-grounded questions and answers about images are grounded by knowledge-graph (kg) triplets taken from several 'common sense' knowledge bases, such as conceptnet @xcite , webchild @xcite , and dbpedia @xcite . for instance, "question: which thing in the image can be used for scooping food? answer: spoon" is associated with the kg triplet "spoon -usedfor -scooping food". these questions are challenging in that retrieving information from external kgs is necessary. the original fvqa dataset @xcite ) has several readily observed limitations. first, the dataset is small (5486 samples) and the annotations are limited to a single answer per question, ignoring other correct answers. this limitation arises from the fvqa creation process in which annotators were first asked to select a kg triplet on which they would ask a question about an image. this approach prevented the annotators from labeling other valid kg triplets. secondly, the dataset is highly imbalanced. some triplets and answers are frequently used, but other kg triplets and answers are severely underrepresented in training. for example, there are 1,129 possible answers in total, but over 90% of questions focus on only a half of them; 792 (70%) answers appear less than 3 times; only 4,216 out of ∼220k triplets are used. these limitations lead to a potential problem: kb-vqa systems trained on this dataset overfit on these frequently used triplets and perform poorly on variants that contain other valid triplets or other images. also, extensive overlap between training and test can lead to an unrealistically high question answering baseline performance. we noted that a question with a triplet unseen in training is often answered with 'person', since it is the most frequent answer in the original data distribution. to overcome these limitations, we introduce an enlarged test set that contains two types of adversarial samples (as shown in fig. 1 ): (1) fixq: the question remains the same, but is associated with a different image and a different correct answer. this ensures that a system is less able to achieve high performance if it is biased by language patterns in questions; (2) fixa: the answer remains the same, but the question is asked in a different way. this favours systems that do more than make straightforward associations between questions and answers based on the training data. in contrast to the original test set, this new set further challenges kb-vqa system to retrieve knowledge from kbs and answer questions without being biased towards frequent answers in the original dataset. we show that models trained on the original fvqa training sets are significantly less robust on these adversarial test samples. q: which object in this image is a kind of sport equipment? a: snowboard q: which object in this image is a kind of sport equipment? a: surfboard q: which object in this image is a kind of land transportation device? a: snowboard [[snowboard]] is a subclass of [[sports equipment]] [[surfboard]] is a subclass of [[sports equipment]] [[racket]] is a subclass of [[sports equipment]] [[snowboard]] is a subclass of [[land transportation device]] ... is a subclass of [[device powered by kinetic energy]] obtain templates from original questions obtain alternative kg triplets construct fixq questions construct fixa questions given that it is hard to guarantee a good triplet coverage during annotation, we explore an augmentation scheme to address this problem without costly human annotation of large-scale adversarial training samples. our scheme generates slightly noisy adversarial samples that improve the coverage of valid kg triplets to enhance model training. our contributions are: vqa 2.0 @xcite collects 'complementary images' such that each question is associated with a pair of images that result in different answers. @xcite derive new s3vqa questions from manually defined question templates. they annotated spans of objects that could be replaced, and then substituted them with a com-plicated substitute-and-search system. in contrast to their labour-intensive annotation work, our adversarial samples are collected through a semiautomatic approach that fully leverages the structural information in kgs to significantly reduce the human work required. more broadly, in knowledge-graph question answering (kg-qa), work has exploited kg to generate synthetic data in unseen domains @xcite @xcite . our work extends visually-grounded questions with valid common sense kg triplets. for each template, we construct new questionanswer pairs by exploring the node structure of the kg. for example, "bottle -/r/usedfor -hold water" is also a valid triplet from conceptnet, whose head and relation are the same as the original triplet. a new question "q: what is used for holding water in this image? a: bottle" can now be constructed. template filtering. we focus on questions about object concepts that are transferable to other images, ignoring a small portion (<10%) of fvqa questions to which the answers are based on particular scenes (e.g. 'what can you often find in the place shown in this picture?'). human annotators are employed to filter out nontransferable templates, such as questions that contain specific object positioning ("what is the object in the lower right of this image used for?"). this process takes around 1 hour with two annotators to obtain 440 valid templates after removing highly similar templates. ## fvqa 2.0 statistics the numbers of samples in each set are provided in ## experiments baseline systems we use several fvqa systems for comparison foot_2 : fvqa @xcite , the baseline system provided in the official fvqa dataset paper; gcn @xcite , a model that leverages graph convolutional networks (gcns) to aggregate features from visual/language/fact modalities; mucko @xcite , the current state-of-the-art system that uses gcns to combine visual, fact, and semantic graphs. we test our augmentation scheme on several systems that have code available: ravqa-nodpr and ravqa-dpr (lin and byrne, 2022), t5 (raffel et al., 2020)-based models that transform images into texts (e.g. objects, attributes, and image captions) and the dpr version additionally uses dense passage retrieval @xcite to retrieve documents from knowledge bases foot_3 ; trig @xcite , a model that is similar to ravqa-dpr but different in embedding fusion; zs-f-vqa @xcite , an fvqa system that obtains the final prediction by fusing the individual predictions in answer/fact/relation graphs. metrics. we report accuracy and standard deviation over 5 splits (sec. 4). in calculating accuracy for open-ended generation systems (ravqa/trig), a question is considered successfully answered if the generated answer string is an exact match to the ground-truth answer node, which is the closest kg node to the ground-truth answer string (shortest in levenshtein distance computed from node names). by incorporating adversarial variants in training, all systems achieve much better performance on the challenging adversarial set, e.g. ravqa-nodpr is improved from 71.48% to 82.38% (+10.9%). the performance on the standard and adversarial test sets now match well, with the gap reduced from more than 10% to ∼3%, showing that the augmentation scheme significantly improves systems' reliability and robustness. the relative improvement is slightly less (+8.1%) for ravqa-dpr, which is expected given that it is a retrieval-based system designed to answer both seen and unseen questions with its strong retrieval ability. zs-f-vqa benefits 0-10 10-20 20-30 30-40 40-50 50-max answer occurrences in fvqa 0 20 40 60 80 100 accuracy (%) 36 55 62 69 83 80 58 74 72 90 86 91 trained with original data trained with augmented data 0 50 100 150 200 250 300 answer occurrences in the training set standard train set augmented train set figure 3: ravqa-dpr accuracy on adversarial questions and answer occurrences in the standard/augmented training sets. they are grouped by the number of answer occurrences in the original fvqa dataset. for example, a question is counted towards the '0-10' group if its answer appears less than 10 times in the original dataset. analysis of model vulnerability. as shown in fig. 2 , ravqa systems trained with original training sets perform better on fixa questions (∼88%) than on fixq questions (∼69%). this suggests that systems perform worse when asked the same questions on different images. this is potentially because the language patterns seen in training bias the models to frequent choices, lowering the fixq generalizability. in contrast, systems are less distracted by different ways of asking for the same answer, potentially due to the strong language modelling capability of t5 used by them. the augmentation scheme improves systems on both types of questions significantly (by ∼10% on each), showing the value of adversarial samples in training. fig. 3 plots the ravqa-dpr performance on the adversarial test set questions that are grouped by their answer occurrences in the original fvqa dataset. the answer distribution of the original dataset affects adversarial performance greatly: systems perform much worse on questions whose answers appear less frequently in fvqa. in contrast, the performance deterioration that arises from answer rarity is mitigated significantly after augmentation. the augmentation scheme (red v.s. green curve in fig. 3 ) compensates for the imbalanced answer distribution by providing more question variants so that systems are trained on both popular and rare answers. ## conclusion we show that the fvqa test sets are not sufficiently indicative of true system performance through providing a new human-verified adversarial test set that contains adversarial variants of the original test set questions. we show the value of adversarial samples in kb-vqa datasets by showing an augmentation scheme that leverages structural information in kgs to create augmentation questions for training, which improves models' robustness to adversarial variants. we release the dataset and the codes in github ( https://github.com/linweizhedragon/retrievalaugmented-visual-question-answering ).