A Multilingual Evaluation of NER Robustness to Adversarial Inputs (2023)

Abstract: Adversarial evaluations of language models typically focus on English alone. In this paper, we performed a multilingual evaluation of Named Entity Recognition (NER) in terms of its robustness to small perturbations in the input. Our results showed the NER models we explored across three languages (English, German and Hindi) are not very robust to such changes, as indicated by the fluctuations in the overall F1 score as well as in a more fine-grained evaluation. With that knowledge, we further explored whether it is possible to improve the existing NER models using a part of the generated adversarial data sets as augmented training data to train a new NER model or as fine-tuning data to adapt an existing NER model. Our results showed that both these approaches improve performance on the original as well as adversarial test sets. While there is no significant difference between the two approaches for English, re-training is significantly better than fine-tuning for German and Hindi.

## introduction nlp systems are traditionally evaluated and compared against a gold standard, which is generally immutable. recent research has shown that even the nlp systems that perform well on the standard test set show a significant drop in performance even for small perturbations in the input test data, across a range of nlp tasks @xcite . although this strand of research covered many tasks, it has been exclusively focused on english, with a few exceptions (e.g., @xcite , for hebrew). further, to our knowledge, the primary usage of such adversarial test sets have been in either evaluating nlp models or in usage as additional, augmented data to improve model robustness, without much focus on using the new data for fine-tuning, instead of re-training. a better understanding of fine-tuning with adversarial test sets is important, and useful in most real-world scenarios, where we may not have access to the original training data while having access to the trained model itself. named entity recognition (ner) is among the most common nlp tasks both in research and in industry applications @xcite . although much progress has been made on ner over the past decades, existing ner systems were also shown to be sensitive to small changes in input data in the past @xcite . original: it was the second costly blunder by syria_loc in four minutes . altered: it was the second costly blunder by hyderabad_org in four minutes . altered: it was the second costly blunder by hyderabad_loc in four hours . even recent large language models such as chat-gpt struggle with sequence tagging tasks such as ner, across multiple languages @xcite @xcite , which clearly illustrates that ner is far from being considered solved. in this backdrop, considering the significance of ner in research and practical scenarios, a better understanding of how a model's predictions change with slight changes in input becomes an important issue to address. hence, we explore the following questions in this paper: our contributions are summarized as follows: starting with a conceptual background (section 2), we describe our methods for adversarial dataset creation (section 3) and the general experimental setup (section 4) followed by a detailed discussion of our results (section 5) and a summary (section 6), focusing on the ethical impacts, limitations and broader impact towards the end. ## related work evaluating using multiple datasets is one of the ways to assess the robustness and generalization capabilities of nlp models. developing challenge sets, and generating adversarial datasets that can potentially cause a model to fail, are some possibilities in this direction @xcite @xcite . adversarial data generation in nlp focuses on surfacelevel perturbations to the input text, proposing various means of insertion/deletion/swapping of words/characters/sentences @xcite @xcite . other approaches such as paraphrasing @xcite , generating semantically similar text using other deep learning models @xcite , using a human-in-the-loop @xcite were also explored in the past. while many of the proposed methods are black-box approaches, assuming no knowledge about the nlp models themselves, some of the approaches are white box, with more access to the inner workings of a model @xcite @xcite , and some models implement both @xcite . we focus on one specific nlp task -ner, and only work on blackbox methods in this paper. in terms of the strategies to protect models against adversarial attacks, the most common approach followed by past nlp research has been to incorporate adversarial data into the training process, through data augmentation, or using adversarial training as a regularization method (see @xcite and zhang et al. (2020) for a detailed overview). using adversarial data for full re-training of a model (as is the case with data augmentation) assumes access to the original data and the model, which is not practical in many realworld scenarios. one possibility to explore in such cases is to test whether using adversarial data to fine-tune a trained ner model improves its robustness. we compare using the adversarial data (through data augmentation) for re-training an ner model versus using it only for fine-tuning a previously trained ner model in this paper. ## adversarial test set creation our adversarial dataset creation methods can be broadly classified into two approaches -replacing entities and changing contexts. all except one method work for all the three languages we tested, and can be easily expanded to add other languages. relevant code and generated datasets are provided as supplementary material foot_1 . ## experimental setup we experimented with three english, two german, and one hindi ner datasets foot_5 . the first half of our experiments focused on testing the ner models on adversarial test sets, following which we compared the effects of adversarial fine-tuning and data augmentation on the performance of the ner models. all the experiments were carried out on a high performing computing resource that ran an nvidia a100 gpu with 32 gb ram. further details on the experimental setup are as follows. ## results our experiments aimed at understanding the robustness of ner models to adversarial test sets and exploring whether adversarial data augmentation and fine tuning will help boost the performance on adversarial test sets. the results of these experiments are discussed below. ## conclusions and discussion we explored simple, language agnostic approaches to generate adversarial test sets for ner and demonstrated their generalizability by testing on six datasets covering three languages -english, german and hindi. while exact results differ depending on language/datasets, our key findings from these experiments can be summarized as follows: the proposed approaches and tested languages/models are by no means comprehensive, and extending this work to include more ner models, adding new languages, and developing new adversarial data generation methods for ner is an obvious next step, as the current results provide enough evidence on the sensitivity of state of the art ner models to adversarial inputs. the methods we employed for adversarial fine-tuning/re-training too are just a starting point towards exploring the use of adversarial data in building more robust ner systems. we only explored one paraphraser for this task. the usefulness of the recent generative language models for creating such test data can be an interesting next step in this direction.