R obu T : A Systematic Study of Table QA Robustness Against Human-Annotated Adversarial Perturbations (2023)

Abstract: Despite significant progress having been made in question answering on tabular data (Table QA), it’s unclear whether, and to what extent existing Table QA models are robust to task-specific perturbations, e.g., replacing key question entities or shuffling table columns. To systematically study the robustness of Table QA models, we propose a benchmark called RobuT, which builds upon existing Table QA datasets (WTQ, WikiSQL-Weak, and SQA) and includes human-annotated adversarial perturbations in terms of table header, table content, and question. Our results indicate that both state-of-the-art Table QA models and large language models (e.g., GPT-3) with few-shot learning falter in these adversarial sets. We propose to address this problem by using large language models to generate adversarial examples to enhance training, which significantly improves the robustness of Table QA models.

## introduction table qa uses structured table as world knowledge to answer questions. in recent years, transformerbased models @xcite @xcite @xcite achieve remarkable results on existing table qa benchmark datasets @xcite @xcite . despite significant progress, state-of-the-art models are only evaluated within the same distribution, which does not provide insight into the model's robustness against out-of-domain distribution or adversarial data @xcite , and recent studies @xcite @xcite revealed that existing models are vulnerable to adversarial perturbations. for example, @xcite observed significant performance degradation after a sentence-level question perturbation. @xcite showed that state-of-the-art table original question perturbed question how many times did the runner-up score more than 0 points? what is the number of second-place teams that scored at least 1 points? figure 1 : examples of adversarial perturbation over table header (blue), table content (orange), and question (purple). table qa model predicts a correct answer on the original example but fails on perturbed ones. qa models exhibited a dramatic performance drop after randomly shuffling the row or column order of the input table. however, previous works primarily focus on a single type of adversarial perturbation and rely on rule-based perturbation methods that are limited in linguistic richness. we fill this gap through a comprehensive evaluation of table qa model robustness. in this paper, we constructed a new benchmark, robut, to systematically evaluate the robustness of table qa models (figure 1 ). robut was built upon the development set of wtq @xcite , wikisql-weak @xcite , and sqa @xcite datasets. specifically, we designed 10 types of adversarial perturbations at three different levels (i.e., table header, table content, and natural language question), with a total number of 138,149 human-annotated perturbed examples. we evaluated state-of-the-art table qa models @xcite @xcite @xcite and few-shot learning with large language models (llms) on robut. the experiments revealed that all models significantly degrade performance in our adversarial sets, while large llms, such as gpt-3 @xcite and codex @xcite , are more robust. for example, gpt-3 outperforms all other table qa models on both word-level and sentencelevel question perturbations. motivated by the findings that llms are more robust against human-annotated adversarial perturbations, we developed leta, a llm-enhanced table qa augmentation framework that uses llms to generate adversarial examples to enhance model training. specifically, we prompted gpt-3 or codex to simulate human annotation and generate adversarial training examples for all perturbation types. experimental results showed that fine-tuning on these adversarial training examples significantly improves model robustness. we summarize three major contributions: table qa model robustness. ## related work table qa question answering over tables has received significant attention as it helps non-expert users interact with complex tabular data. this problem is originally framed as semantic parsing, also known as text-to-sql parsing @xcite @xcite , in which the parser takes both question and table header as input, and predicts a sql query that is directly executable to get the answer. however, training state-of-the-art text-to-sql parsers require large amounts of expensive sql annotations, limiting its applicability to real scenarios; in addition, these text-to-sql parsers make a simplified assumption that only table headers are necessary while ignoring the value of table contents. to mitigate these issues, recent works ignore generating sql queries, and instead follow retrieve then reason paradigm @xcite @xcite @xcite @xcite , which first retrieve information from the table, and conduct human-like reasoning to answer the question. with the help of pre-training on large scale table corpus, these approaches have achieved remarkable results on several table qa benchmarks, including wikitablequestions (pasupat and liang, 2015), wikisql-weak @xcite , and sqa @xcite . more recently, @xcite found that llms @xcite with few-shot in-context learning shows promise on the table qa task. robustness in table-relevant task assessing model robustness is crucial for building trustworthy models @xcite @xcite @xcite . recent work @xcite @xcite has focused on evaluating the robustness of text-to-sql parsing models, and designed test sets with perturbations including nlq input, table headers, and sql queries. a major limitation is that these perturbations (e.g., lexical substitutions) are often targeted at a vulnerable key component that is specific to text-to-sql parsing: schema linking @xcite , which matches table headers question keywords. our study is focused on table qa in general, and we make two key differences: first, in addition to existing perturbations, we also perturbed table contents, valuable information that is often dismissed by text-to-sql models. second, unlike previous works that used human to verify perturbations generated from heuristics or models, we directly adopted human-annotated perturbations to ensure high data quality. adversarial data generation existing works have proposed data augmentation and adversarial training techniques to improve model robustness. in the field of table-relevant tasks, @xcite applied the bert-attack model @xcite to generate adversarial training questions to im-dataset type # tables # examples wtq @xcite complex qa 2,108 22,033 wikisql-weak @xcite simple qa 24,241 80,654 sqa @xcite conversational qa 982 6,066 @xcite to generate adversarial data. for example, the evaluation data for nlq-level perturbation in the dr.spider benchmark @xcite were generated using llm-prompting methods @xcite . in contrast, we created our test sets through human annotation, and applied llms to generate adversarial training examples to enhance training table qa models. ## robut benchmark we constructed robut to comprehensively evaluate the robustness of table qa models against task-specific adversarial perturbations annotated by human experts. to ensure the high annotation quality of robut benchmark, we first designed the following three annotation principles: following the aforementioned annotation principles, we curated robut based on the development set foot_0 of three mainstream table qa datasets: wtq @xcite , which contains human-annotated questions over wikipedia tables and requires complex reasoning; weaklysupervised wikisql @xcite , which requires models to filter and optionally aggregate on table cell values to obtain the answer; and sqa @xcite , in which annotators decompose questions originally from wtq to a sequence of questions (2.9 questions per sequence on average). the statistics of these three table qa datasets are shown in we designed a total of 10 perturbation types on four different levels (i.e., table header, table content, natural language question, and mix). and as we have three subsets, our final dataset includes 30 test sets in total. each test set contains parallel preperturbation and post-perturbation data to measure model robustness against the perturbation. in total, robut contains 138,149 pairs of examples, including 39,471 examples from robut-wtq, 83,816 examples from robut-wikisql, and 14,862 examples from robut-sqa. ## diagnostic experiments table qa models on our constructed benchmark, robut. 4.1 experimental setup compared table qa models we evaluated the following four representative table qa models on robut, which first pre-trained on the collected large table corpus and then fine-tuned on the downstream table qa tasks. table qa examples. we also evaluated the gpt-3 @xcite model in a few-shot setting. implementation details since robut only includes evaluation data, we fine-tuned the large version of each table qa model using the original table qa training set and obtained three variants for wtq, wikisql-weak, and sqa. as wtq and sqa datasets have multiple official train/dev splits for the purpose of cross-validation, we used the split of random-split-1-train for finetuning. specifically, wtq training set contains 11,321 examples, wikisql-weak training set contains 56,355 examples, and sqa training set contains 4,257 sequences. we randomly split each official training set into a train/dev set with a ratio of 8:2 for fine-tuning. we ran 20 epochs with a batch size of 128 for each fine-tuning experiments and selected the best fine-tuning checkpoint based on the validation loss on the splitted dev set. in terms of gpt-3 few-shot experiments, we used text-davinci-003 via the public ope-nai apis foot_2 with two-shot prompting. similar to chen (2022), we used a temperature of 0.7 without any frequency penalty and without top-k truncation. an example of "chain-of-thought" prompt prefix is shown in figure 6 in appendix. evaluation metrics we used exact match accuracy as the evaluation metric, which checks whether the predicted answers are equal to the ground truth. for sqa, we reported the average accuracy for sequential questions. we used the following three metrics to evaluate model robustness: pre-perturbation accuracy over preperturbation data; post-perturbation accuracy over post-perturbation data; robustness accuracy as the ratio of the correct predictions on both preand post-perturbation data versus the correct predictions on pre-perturbation data. ## leta framework motivated by the diagnostic results that llms are more robust against human-annotated perturbations, we adopted llms to enhance the robustness of smaller (i.e., less than 1b parameter) and fine-tuned table qa models. specifically, we introduced llm-enhanced table qa augmentation (leta) framework, which generates adversarial training examples at scale using the llm prompting method, to improve model robustness against human-annotated adversarial perturbations. specifically, for each perturbation type in robut, we designed task-specific "chain-ofthought" prompts @xcite to guide the gpt-3 (i.e., text-davinci-003) or codex (i.e., code-davinci-002) models to generate adversarial examples to enhance the training set. we repeated example generation three times to create diverse training data. we next discuss the details for each augmentation level. ## adversarial training experiments in this section, we evaluate leta on our constructed benchmarks, robut. ## conclusion this work proposes robut, the first benchmark for table qa robustness. robut measures the robustness of table qa models against different levels of human-annotated perturbations. experimental results showed that state-of-the-art models exhibited significant performance drops on our robut benchmark. to address this issue, we designed the leta framework, which utilizes llmpromoting methods to generate adversarial training examples to enhance table qa model robustness. we believe that our work will raise awareness among researchers about the importance of robustness in table qa models. chen zhao is supported by the darpa ptg program. any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the darpa.