Improving Question Answering Model Robustness with Synthetic Adversarial Data Generation (2021)

Abstract: Despite recent progress, state-of-the-art question answering models remain vulnerable to a variety of adversarial attacks. While dynamic adversarial data collection, in which a human annotator tries to write examples that fool a model-in-the-loop, can improve model robustness, this process is expensive which limits the scale of the collected data. In this work, we are the first to use synthetic adversarial data generation to make question answering models more robust to human adversaries. We develop a data generation pipeline that selects source passages, identifies candidate answers, generates questions, then finally filters or re-labels them to improve quality. Using this approach, we amplify a smaller human-written adversarial dataset to a much larger set of synthetic question-answer pairs. By incorporating our synthetic data, we improve the state-of-the-art on the AdversarialQA dataset by 3.7F1 and improve model generalisation on nine of the twelve MRQA datasets. We further conduct a novel human-in-the-loop evaluation and show that our models are considerably more robust to new human-written adversarial examples: crowdworkers can fool our model only 8.8% of the time on average, compared to 17.6% for a model trained without synthetic data.

## introduction large-scale labelled datasets like squad @xcite and @xcite have been driving forces in natural language processing research. over the past few years, however, such "statically collected" datasets have been shown to suffer from various problems. in particular, they often exhibit inadvertent spurious statistical patterns that models learn to exploit, leading to poor model robustness and generalisation @xcite @xcite @xcite . wikipedia "old english was not static, and its usage covered a period of 700 years, from the anglo-saxon settlement of britain in the 5th century to the late 11th century … albert baugh dates old english from 450 to 1150, a period of full inflections, a synthetic language. perhaps around 85 per cent …" @xmath0, where data is collected with both humans and models in the annotation loop. usually, these humans are instructed to ask adversarial questions that fool existing models. dynamic adversarial data collection is often used to evaluate the capabilities of current state-of-the-art models, but it can also create higher-quality training data @xcite due to the added incentive for crowdworkers to provide challenging examples. it can also reduce the prevalence of dataset biases and annotator artefacts over time @xcite , since such phenomena can be subverted by model-fooling examples collected in subsequent rounds. however, dynamic data collection can be more expensive than its static predecessor as creating examples that elicit a certain model response (i.e., fooling the model) requires more annotator effort, resulting in more time spent, and therefore higher cost per example. in this work, we develop a synthetic adversarial data generation pipeline, making novel contributions to the answer selection, question generation, and filtering and re-labelling tasks. we show that dynamic adversarial data collection can be made more sample efficient by synthetically generating (see figure 1 ) examples that improve the robustness of models in terms of performance on adversariallycollected datasets, comprehension skills, and domain generalisation. we are also the first to evaluate models in-theloop for robustness to human adversaries using the macro-averaged validated model error rate, demonstrating considerable improvements with crowdworkers only able to fool the model-in-theloop 8.8% of the time on average, compared to 17.6% for our best baseline. the collected dataset will form part of the evaluation for a new round of the dynabench qa task. foot_0 2 related work ## synthetic data generation we develop a synthetic data generation pipeline for qa that involves four stages: passage selection, answer candidate selection, question generation, and synthetic data filtering and re-labelling. due to the complexity of the system, we study each of these in isolation, and then combine our best identified approaches for the final systems. we evaluate each component both intrinsically and on their contribution to downstream qa performance on the adversarialqa test sets and an unseen split of the squad1.1 dev set. the final synthetic data generation pipeline consists of: ## measuring model robustness based on the findings in the previous section, we select four final models for robustness evaluation: individual models are selected for the best combined and equally-weighted performance on a split of the squad validation set and all three adver-sarialqa validation sets. we first evaluate model robustness using three existing paradigms: adversarially-collected datasets, checklists, and domain generalisation. we also introduce adversarial human evaluation, a new way of measuring robustness with direct interaction between the human and model. ## discussion and conclusion in this work, we develop a synthetic adversarial data generation pipeline for qa, identify the best components, and evaluate on a variety of robustness measures. we propose novel approaches for answer candidate selection, adversarial question generation, and synthetic example filtering and relabelling, demonstrating improvements over existing methods. furthermore, we evaluate the final models on three existing robustness measures and achieve state-of-the-art results on adversarialqa, improved learnability of various comprehension skills for checklist, and improved domain generalisation for the suite of mrqa tasks. we then put the synthetically-augmented models back in-the-loop in an adversarial human evaluation setting to assess whether these models are actually harder for a human adversary to beat. we find that our best synthetically-augmented model is roughly twice as hard to beat. our findings suggest that synthetic adversarial data generation can be used to improve qa model robustness, both when measured using standard methods and when evaluated directly against human adversaries. looking forward, the methods explored in this work could also be used to scale the dynamic adversarial annotation process in multiple ways. synthetic adversarial data generation could facilitate faster iteration over rounds of adversarial human annotation as it reduces the amount of human data required to effectively train an improved qa model. generative models could also help guide or inspire human annotators as they try to come up with more challenging examples. furthermore, while our work focuses on improving adversarial robustness, this approach is not limited to the adversarial setting. we believe that our findings can motivate similar investigations for tasks where data acquisition can be challenging due to limited resources, or for improving different aspects of robustness, for example for model bias mitigation.