A Novel Metric for Measuring the Robustness of Large Language Models in Non-adversarial Scenarios (2024)

Abstract: We evaluate the robustness of several large language models on multiple datasets. Robustness here refers to the relative insensitivity of the model’s answers to meaning-preserving variants of their input. Benchmark datasets are constructed by introducing naturally-occurring, non-malicious perturbations, or by generating semantically equivalent paraphrases of input questions or statements. We further propose a novel metric for assessing a model robustness, and demonstrate its benefits in the non-adversarial scenario by empirical evaluation of several models on the created datasets.

## introduction with the increase in the prominence and use of large language models (llms), there has been tremendous activity in evaluating various aspects of these models' behavior and its alignment with desirable qualities, such as accuracy, safety and privacy. the property of model robustness-the ability of a model to produce semantically equivalent output given meaning-preserving input-has been addressed from various perspectives: sensitivity to the wording of instruction template @xcite @xcite , example choice and ordering for in-context learning (icl) tasks @xcite , perturbing the order of premises in logical reasoning tasks @xcite , as well as model resilience to adversarial prompts (e.g., @xcite ; @xcite ; @xcite ). model robustness (or insensitivity) to naturallyoccurring, non-malicious variations in their input, such as the question in a question-answering (qa) task, or the statement in a classification task, has received relatively little attention (although see @xcite for sensitivity to typos, and raj et al. 1 all our datasets are available on huggingface. benchmarking the robustness of a model to variations in its input typically involves measuring the degree of performance decrease in the perturbed instance set, compared to the original example. for assessing the resilience of llms to adversarial attacks, the main metric that has been put forward in prior studies is performance drop rate (pdr), which is the fractional decrease in the average perturbed instances' score, relative to the original example @xcite . as discussed in section 3.1, pdr has two main drawbacks: first, since it measures fractional decrease, it is inherently an asymmetric function of its inputs; a fixed increase in performance after perturbation receives a larger magnitude pdr than the reversed decrease in performance. second, since fractional change from 0 is undefined, the pdr is undefined in the specific case when the original score was zero but the average over perturbed instance set scores higher, as in the example in while performance improvement is not typical to adversarial tests, it can easily happen in the sce-context: a function f is said to be continuously differentiable if the derivative f'(x) exists and is itself a continuous function. though the derivative of a differentiable function never has a jump discontinuity, it is possible for the derivative to have an essential discontinuity. for example, the function 1 ) and its perturbed variants (2-6), where simple superficial perturbations were applied to obtain variants (2-4), and a paraphrasing model produced variants (5-6). the llm's answer to the original question is incorrect, two of the variants -( 2 ) and ( 4 ) -obtained the correct answer ("no"). variants' distinctions from the original phrasing are highlighted, where not easily visible. much effort has been invested recently in leaderboards for multi-faceted evaluation of foundation models (e.g., liang et al. (2023) 3 ). a broader impact of this study lies in the adoption of the proposed metric for benchmarking the robustness of llms in non-adversarial scenarios. ## conclusions we evaluate the robustness of several llms on multiple diverse datasets, by expanding them with non-malicious, naturally-occurring perturbations, and measuring models' resilience to these variants in user input. we propose and evaluate a novel application of a statistical effect size metric for assessing model robustness in tasks with binary-or proportion-valued evaluation scores, and demonstrate its benefits in the non-adversarial scenario.