Towards Robustness of Text-to- SQL Models Against Natural and Realistic Adversarial Table Perturbation (2022)

Abstract: The robustness of Text-to-SQL parsers against adversarial perturbations plays a crucial role in delivering highly reliable applications. Previous studies along this line primarily focused on perturbations in the natural language question side, neglecting the variability of tables. Motivated by this, we propose the Adversarial Table Perturbation (ATP) as a new attacking paradigm to measure robustness of Text-to-SQL models. Following this proposition, we curate ADVETA, the first robustness evaluation benchmark featuring natural and realistic ATPs. All tested state-of-the-art models experience dramatic performance drops on ADVETA, revealing significant room of improvement. To defense against ATP, we build a systematic adversarial training example generation framework tailored for better contextualization of tabular data. Experiments show that our approach brings models best robustness improvement against ATP, while also substantially boost model robustness against NL-side perturbations. We will release ADVETA and code to facilitate future research.

## introduction the goal of text-to-sql is to generate an executable sql query given a natural language (nl) question and corresponding tables as inputs. by helping non-experts interact with ever-growing databases, this task has many potential applications in real life, thereby receiving considerable interest from both industry and academia @xcite @xcite . recently, existing text-to-sql parsers have been found vulnerable to perturbations in nl questions @xcite @xcite . for example, @xcite removed the explicit mentions of database items in a student name citizenship score semester a country x 92 fall b country y 90 spring a country x 89 b country y 85 fall c country z 97 spring original table list names and citizenships of students who achieved top 3 scores. select student name, citizenship from student order by score desc limit 3 select student name from student order by score desc limit 3 (missing nationality) select student name, instructor name, citizenship from student order by grade desc limit 3 student name nationality score semester a country x 92 fall b country y 90 spring a country x 89 spring b country y 85 fall c country z 97 spring rpl perturbed table student name citizenship score semester instructor name grade a country x 92 fall d 6 b country y 90 spring e 6 a country x 89 spring e 6 b country y 85 fall d 5 c country z 97 spring f 5 add perturbed table figure 1 : adversarial examples based on table perturbations for a text-to-sql parser. leaving the nl question unchanged, both replacement of column names (e.g., replace "citizenship" with "nationality") and addition of associated columns (e.g., add "instructor name" based on "student name"; add "grade" based on "score") mislead the parser to incorrect predictions. ideally, atp should be conducted based on two criteria: (i) human experts consistently write correct sql queries before and after table perturbations, yet parsers fail; (ii) perturbed tables look natural and grammatical, and are free from breakage of human language conventions. accordingly, we carefully design principles for rpl/add and manually curate the adversarial table perturbation (adveta) benchmark based on three existing datasets. all evaluated state-of-the-art text-to-sql models experience drastic performance drops on adveta: on adveta-rpl, the average relative percentage drop is as high as 53.1%, whereas on adveta-add is 25.6%, revealing models' lack of robustness against atps. empirically, model robustness can be improved by adversarial training, i.e. re-train models with training set augmented with adversarial examples @xcite . however, due to the different natures of structured tables and unstructured text, well-established text adversarial example generation approaches are not readily applicable. motivated by this, we propose an effective contextualized table augmentation (cta) approach that better leverages tabular context information and carry out ablation analysis. to summarize, the contributions of our work are three-fold: ## adversarial table perturbation we propose the adversarial table perturbation (atp) paradigm to measure robustness of text-to-sql models. for an input table and its associated nl questions, the goal of atp is to fool text-to-sql parsers by perturbing tables naturally and realistically. more specifically, human sql experts can consistently maintain their correct translations from nl questions to sql with their understanding of language and table context. formally, atp consists of two approaches: replace (rpl) and add. in the rest of this section, we first discuss our consideration of table context, then introduce conduction principles of rpl and add. ## adveta benchmark following rpl and add principles, we manually curate the adversarial table perturbation (adveta) benchmark based on three mainstream text-to-sql datasets, spider @xcite , wikisql @xcite and wtq @xcite . for each table from the original development set, we conduct rpl/add annotation separately, perturbing only table columns. for its associated nl-sql pairs, we leave the nl questions unchanged and adapt gold sqls accordingly. as a result, adveta consists of 3 (spider/wtq/wikisql) * 2 (rpl/add) = 6 subsets. we next introduce annotation details and characteristics of adveta. ## conclusion we introduce adversarial table perturbation (atp), a new paradigm for evaluating model robustness on text-to-sql and define its conduction principles. we curate the adveta benchmark, on which all state-of-the-art models experience dramatic performance drop. for defense purposes, we design the cta framework tailored for tabular adversarial training example generation. while cta outperforms all baseline methods in robustness enhancement, there is still an unfilled gap from the original performance. this calls for future exploration of the robustness of text-to-sql parsers against atp.