When Claims Evolve: Evaluating and Enhancing the Robustness of Embedding Models Against Misinformation Edits (2025)

Abstract: Online misinformation remains a critical challenge, and fact-checkers increasingly rely on claim matching systems that use sentence embedding models to retrieve relevant fact-checks. However, as users interact with claims online, they often introduce edits, and it remains unclear whether current embedding models used in retrieval are robust to such edits. To investigate this, we introduce a perturbation framework that generates valid and natural claim variations, enabling us to assess the robustness of a wide-range of sentence embedding models in a multi-stage retrieval pipeline and evaluate the effectiveness of various mitigation approaches. Our evaluation reveals that standard embedding models exhibit notable performance drops on edited claims, while LLM-distilled embedding models offer improved robustness at a higher computational cost. Although a strong reranker helps to reduce the performance drop, it cannot fully compensate for first-stage retrieval gaps. To address these retrieval gaps, we evaluate train- and inference-time mitigation approaches, demonstrating that they can improve in-domain robustness by up to 17 percentage points and boost out-of-domain generalization by 10 percentage points. Overall, our findings provide practical improvements to claim-matching systems, enabling more reliable fact-checking of evolving misinformation.

## introduction the spread of misinformation, false or inaccurate information, is considered to be one of the biggest short-term threats to the cohesion within and between nations @xcite . while misinformation spreads fast @xcite , manual verification and debunking of false claims takes time. to speed up the fact-checking process, a growing body of research has focused on developing tools to help support human fact-checkers @xcite @xcite . claim: covid-19 is only as deadly as the seasonal flu fact check: covid-19 has a significantly higher mortality rate than seasonal flu, with greater severity and hospitalizations covid-19 is only as deadly as the seasonal flu covid-19 deadly seasonal flu' nuh more dan di covid-19 is as as the flu onli dedli siznl casing dialect typos covid-19 is as deadly as the seasonal flu not negation llm rewrite corona virus common cold is only as deadly as the entity repl. covid-19 is deadly than the seasonal flu. no more one such approach is claim matching, the task of determining whether a given claim has already been fact-checked or retrieving relevant fact-checks @xcite @xcite . claim matching has shown strong potential in reducing the time human fact-checkers spend verifying repeated or previously debunked claims, by ensuring that once a costly human fact-check is written, it can be linked to all relevant instances of that claim to provide context to others encountering it. however, current claim matching approaches are typically trained on datasets composed of previously fact-checked claims @xcite , excluding the vast majority of unverified claims in the wild. this limits models' exposure to the noisy, diverse, and evolving nature of misinformation as it appears in real-world contexts. as a result, these models may perform well in controlled, in-domain evaluations but generalize poorly to settings characterized by unpredictable figure 2 : an overview of our approach: (1) we generate candidate rewrites using an llm as a perturber, followed by another llm as a verifier of these perturbations. (2) next, we assess the robustness of various embedding models within a multi-stage retrieval pipeline. (3) finally, we examine the impact of train-and inferencetime mitigation approaches on improving robustness for weaker embedding models. user behaviour. as users interact with and share misinformation online, they often introduce various edits to claims, such as replacing entities, introducing common social-media slang, or rewriting a claim in a different dialect @xcite as shown in figure 1 . while these edits may be subtle and not affect the matching fact-check, @xcite show that mutated claims are more likely to spread widely on social media compared to non-mutated claims. thus, current claim-matching methods need to be robust to user claim edits to curb the spread of misinformation effectively. at the core of claim matching tasks is the reliance on sentence embedding models to represent input claims and fact-checks during retrieval. there has been growing interest in developing generalpurpose sentence embeddings designed to handle a wide range of tasks @xcite . however, their effectiveness in taskspecific applications remains uncertain, as different domains demand varying notions of similarity @xcite . fact-checking is one such domain where fact-checkers need to retrieve sentences that may be evaluated under the same factual basis, even if they are not strictly semantically equivalent, a nuance that general-purpose embeddings mostly trained on semantic textual similarity datasets @xcite may struggle to capture. to tackle the challenge of embedding model brittleness in real-world settings, we study the robustness of sentence embedding models to userdriven misinformation edits and propose mitigation strategies to improve robustness. we introduce a taxonomy of real-world edits drawn from fact-checking scenarios and evaluate model robustness on the downstream task of claim matching (figure 2 ). our analysis shows that widely used embedding models are highly sensitive to user-informed misinformation edits, and that even strong rerankers fail to fully mitigate these weaknesses. however, we demonstrate that both traintime and inference-time mitigation approaches can significantly improve in-domain and out-of-domain robustness. based on these findings, our key contributions are as follows: 1 • we propose a novel perturbation framework for generating valid and natural claim edits, resulting in a new dataset for evaluating robustness of sentence embedding models. evaluating embedding model robustness several studies have examined the robustness of embedding models across different settings. rafiei @xcite evaluate robustness of embedding models adversarially using textattack @xcite and propose using gradientbased @xcite perturbed embeddings to enhance robustness. @xcite examine how different sentence encoders represent sentence pairs with high lexical overlap, showing that training datasets influence similarity notions. closely related to our work, @xcite assess laser @xcite against usergenerated content and apply knowledge distillation @xcite to improve robustness. however, prior work largely evaluates embeddings in isolation, despite their role in larger systems: e.g., candidate selection in multistage retrieval @xcite or retrievalaugmented generation (rag) pipelines @xcite . the impact of representation differences on end-to-end system performance remains unclear. for example, we examine whether the robustness of embedding models in first-stage retrieval meaningfully affects the overall performance of a multistage retrieval system when a strong reranker is applied, addressing this gap. ## results we begin by evaluating the robustness of embedding models used for first-stage retrieval under various perturbation types. for each embedding model and perturbation type, we compute the ∆retrieval gap by comparing the map@k performance difference between the unperturbed and casing typos negation entity replacement llm rewrite dialect stage model truecase upper least most shallow double atleast 1 all least most aae jamaican pidgin singlish checkthat22 first-stage retrieval bm25 +0.0 +0.0 -15.2 -15.0 +0.5 -2.6 -2.7 -12.4 -0.8 -0.2 -9.2 -6.7 -5.0 -1.6 all-distilroberta-v1 -0.4 -35.4 -15.8 -13.9 +1.8 +2.4 -3.0 -5.4 +3.5 +5.3 -4.4 -11.4 -6.6 -0.7 all-minilm-l12-v2 +0.0 +0.0 -8.2 -13.6 +3.5 +4.4 -2.9 -2.5 +3.1 +4.4 -6.7 -10.0 -5.8 +0.2 all-mpnet-base-v2 +0.0 +0.0 -8.3 -8.4 +0.2 -4.2 -3.1 -9.8 +1.0 +1.8 -3.8 -7.5 -8.5 -1.3 all-mpnet-base-v2-ft +0.0 +0.0 -8.6 -12.8 -1.4 -4.2 -1.8 -8.6 -1.3 -1.7 -3.8 -4.0 -8.5 -3.2 sentence-t5-base -2.5 -15.8 -2.9 -7.1 -21.4 -12.2 -3.3 -5.7 +2.3 +2.0 -0.9 -8.2 -5.5 -0.1 sentence-t5-large -1.0 -9.9 -2.1 -5.4 -27.2 -14.7 -0.9 -5.4 +1.8 +1.7 +0.8 -3.4 -3.2 +2.0 sentence-t5-large-ft -0.6 -9.7 -1.8 -3.6 -11.7 -6.6 -2.5 -1.6 +2.2 +1.0 +1.5 -2.4 -3.7 +1.2 instructor-base -1.1 -9.4 -4.4 -3.2 -3.7 -3.8 -1.7 -8.0 +0.1 -0.8 -1.1 -4.0 -4.3 -1.5 instructor-large -0.7 -4.5 -1.1 -1.7 -4.1 -4.9 +0.1 -2.5 +0.0 -0.9 -0.9 -2.5 -4.1 -2.0 sfr-embedding-mistral -0.6 -0.6 -0.7 -0.5 -1.2 -2.9 -0.8 -1.1 +0.1 +0.7 -1.9 -0.9 -1.2 -2.2 nv-embed-v2 +0.0 -0.6 +0.7 +-0.0 -0.5 -2.4 +0.2 -0.3 -0.1 -0.2 -1.0 -0.2 -0.9 -1.2 reranking recovery bm25 +10.9 +10.7 +22.9 +20.0 +6.1 +7.2 +12.7 +18.5 +9.8 +9.3 +14.4 +15.1 +14.0 +13.1 all-distilroberta-v1 +20.0 +30.4 +26.5 +24.7 +13.4 +11.8 +21.4 +16.4 +15.8 +14.0 +20.1 +25.9 +20.9 +17.5 all-minilm-l12-v2 +18.7 +19.4 +19.3 +25.2 +11.9 +7.0 +22.9 +19.3 +13.6 +14.4 +21.8 +23.1 +18.4 +19.6 all-mpnet-base-v2 +18.7 +19.4 +20.6 +21.1 +12.3 +13.5 +21.0 +25.4 +15.5 +14.9 +21.2 +22.4 +21.3 +17.4 all-mpnet-base-v2-ft +5.9 +6.6 +10.0 +16.5 +0.9 +5.3 +9.4 +11.3 +6.4 +6.7 +9.2 +8.8 +14.3 +10.2 sentence-t5-base +14.9 +22.7 +14.9 +18.7 +22.6 +16.0 +15.4 +20.5 +10.1 +10.4 +14.3 +19.9 +18.3 +13.5 sentence-t5-large +13.6 +19.9 +15.2 +18.6 +23.6 +16.8 +15.5 +20.6 +13.8 +12.9 +15.5 +16.4 +14.2 +13.4 sentence-t5-large-ft +5.3 +14.1 +6.1 +7.7 +8.1 +6.6 +7.7 +8.4 +3.4 +4.0 +3.3 +6.3 +9.1 +4.4 instructor-base +5.5 +12.3 +6.1 +6.2 +0.9 +3.1 +7.0 +14.2 +4.2 +5.0 +5.6 +8.5 +8.9 +6.3 instructor-large +2.2 +5.8 +1.0 +2.2 -1.1 +0.5 +1.8 +3.6 +0.2 +2.3 +1.2 +3.4 +4.9 +3.9 sfr-embedding-mistral +0.7 +1.9 -1.2 -0.5 -4.3 -1.8 +2.0 +2.1 -0.3 -0.7 +1.2 +0.0 +1.4 +3.3 nv-embed-v2 -2.2 -0.7 -4.2 -2.3 -8.2 -3.1 -2.1 -2.5 -2.8 -1.7 -1.8 -2.9 -1.8 -0.3 overall pipeline bm25 -0.2 -0.4 -3.5 -5.9 -3.1 -5.5 -1.2 -3.2 -1.1 -1.0 -5.9 -2.6 -2.3 +0.8 all-distilroberta-v1 -0.8 -25.5 -9.4 -9.2 -5.2 -5.8 -2.5 -7.4 -1.1 -1.0 -4.7 -6.0 -6.1 -3.6 all-minilm-l12-v2 -0.8 -0.1 -8.7 -7.6 -3.5 -5.3 -0.6 -2.4 -1.2 +1.0 -4.4 -6.1 -6.5 +0.6 all-mpnet-base-v2 -0.6 +0.1 -5.9 -4.7 -6.7 -7.5 -0.3 -1.3 -1.9 -1.7 -1.8 -4.2 -6.3 -2.4 all-mpnet-base-v2-ft -0.6 +0.1 -3.8 -1.7 -6.3 -5.9 +1.0 -2.2 -0.5 -0.6 -1.0 -1.4 -0.7 +0.6 sentence-t5-base -0.7 -6.2 -1.5 -1.5 -11.2 -8.9 -1.6 -0.3 -0.6 -0.7 +0.1 -2.0 -0.5 +0.2 sentence-t5-large -2.1 -4.8 -2.3 -2.0 -18.5 -12.4 -1.7 -1.5 +1.0 +0.0 +1.6 -1.9 -4.0 +0.7 sentence-t5-large-ft -0.1 -0.4 -1.4 -1.3 -9.2 -6.8 -0.2 +0.2 +1.1 +0.6 +-0.0 -1.5 +0.5 +0.7 instructor-base -0.8 -2.3 -3.3 -2.1 -7.7 -6.3 +0.2 -0.9 -0.4 -0.5 -0.8 -1.4 -0.8 -0.6 instructor-large -0.8 -0.9 -2.4 -1.8 -7.5 -8.4 -0.5 -0.8 -1.0 +0.1 -1.5 -1.5 -1.1 +0.1 sfr-embedding-mistral -1.0 +0.2 -2.2 -1.1 -6.4 -6.7 +0.1 +0.9 -0.9 -0.7 -1.8 -2.2 -0.9 +0.1 nv-embed-v2 -0.6 +0.4 -2.6 -1.2 -7.6 -6.3 -0.6 +0.0 -1.1 -0.1 -1.4 -2.2 -1.3 -0.3 factchecktweet first-stage retrieval bm25 +0.67 +0.00 -9.16 -11.91 +2.39 +5.89 -2.60 -19.17 +2.57 -2.11 -6.71 -10.22 -11.09 -2.39 all-distilroberta-v1 -1.30 -23.85 -7.86 -13.42 +5.04 +10.50 +0.85 -11.12 +4.31 +1.39 -6.19 -8.71 -12.79 -7.15 all-minilm-l12-v2 +0.00 +0.00 -13.57 -17.58 +2.67 +5.10 -3.62 -11.33 +2.16 -2.92 -7.14 -15.27 -14.08 -9.86 all-mpnet-base-v2 +0.00 +0.00 -9.20 -11.21 -0.42 -0.77 -3.55 -3.71 -6.06 -9.19 -6.87 -8.56 -8.64 -9.11 all-mpnet-base-v2-ft +0.00 +0.00 -6.31 -8.15 +3.76 -1.28 -4.08 -12.65 +2.69 +1.61 -4.01 -5.84 -6.97 -3.85 sentence-t5-base -0.11 -8.68 -6.79 -8.32 -11.81 -11.60 +1.90 -2.13 -5.56 -4.55 -2.45 -9.27 -8.61 -4.19 sentence-t5-large -0.01 -6.23 -6.28 -7.57 -16.71 -5.94 -0.03 -11.90 -3.73 -6.12 -5.51 -6.64 -8.15 -5.30 sentence-t5-large-ft -0.98 -5.32 -6.04 -6.85 -7.17 -1.05 -0.19 -11.31 -3.34 -2.34 -3.50 -4.12 -6.49 -4.16 instructor-base -0.74 -8.27 -4.69 -8.27 +2.84 +0.18 -1.76 -10.37 -2.45 -4.40 -2.50 -4.66 -7.32 -6.03 instructor-large -0.40 -3.40 -4.61 -5.68 -1.09 -4.71 -2.33 -11.84 -0.02 -2.75 -2.64 -2.22 -3.25 -5.73 sfr-embedding-mistral -0.87 -0.40 +0.26 -4.22 +0.91 +2.59 -1.53 -9.36 -0.25 -0.80 -3.13 +0.15 -1.74 +1.44 nv-embed-v2 -1.34 -1.08 -1.39 -3.00 +0.12 -1.19 -1.34 -12.95 -2.08 -2.56 -3.19 -3.23 -3.36 -5.09 reranking recovery bm25 +4.90 +5.81 +12.48 +11.32 +5.62 +6.08 +12.02 +13.51 +9.73 +12.17 +11.87 +15.82 +17.19 +8.41 all-distilroberta-v1 +11.96 +16.04 +19.17 +14.79 +14.00 +15.78 +13.32 +12.99 +14.50 +15.37 +14.73 +22.34 +21.46 +16.21 all-minilm-l12-v2 +12.00 +12.88 +19.30 +17.98 +14.57 +11.65 +17.59 +13.48 +13.05 +19.75 +19.98 +28.30 +18.27 +20.96 all-mpnet-base-v2 +11.86 +12.41 +15.40 +18.35 +17.12 +17.39 +19.57 +15.43 +16.95 +22.70 +19.22 +18.41 +16.27 +17.29 all-mpnet-base-v2-ft +10.91 +11.49 +11.98 +12.14 +9.36 +14.69 +17.68 +13.66 +10.65 +13.94 +13.11 +15.25 +17.50 +13.42 sentence-t5-base +13.31 +17.32 +18.16 +16.99 +18.20 +22.56 +11.86 +12.26 +19.35 +17.23 +15.88 +23.02 +20.56 +19.53 sentence-t5-large +14.10 +18.15 +20.92 +15.65 +23.16 +19.55 +16.20 +18.94 +18.41 +20.15 +19.15 +19.33 +18.91 +19.23 sentence-t5-large-ft +10.16 +11.92 +14.91 +13.07 +13.44 +14.25 +15.44 +12.97 +14.50 +12.54 +13.88 +16.42 +18.49 +11.77 instructor-base +9.86 +12.17 +11.41 +9.51 +6.93 +10.69 +15.38 +12.80 +13.08 +16.61 +10.08 +13.45 +16.43 +11.59 instructor-large +7.98 +8.41 +14.71 +10.25 +10.92 +13.66 +15.38 +15.92 +10.72 +14.11 +9.49 +11.92 +12.40 +15.40 sfr-embedding-mistral +6.68 +6.64 +9.04 +8.67 +7.51 +8.35 +12.32 +12.00 +11.69 +12.12 +13.80 +14.58 +14.28 +9.24 nv-embed-v2 +2.30 +2.40 +4.16 +0.54 +2.50 +5.72 +6.72 +4.04 +6.59 +7.03 +2.09 +4.29 +3.85 +4.12 overall pipeline bm25 +0.11 +0.35 -4.04 -7.95 +1.55 +3.31 -0.28 -19.10 +4.56 +2.26 -1.83 -1.78 -0.89 -0.98 all-distilroberta-v1 -1.85 -20.33 -6.93 -16.88 +4.87 +9.32 -3.71 -18.23 +1.09 -1.22 -7.62 -2.91 -7.48 -7.09 all-minilm-l12-v2 -0.25 +0.63 -8.95 -14.28 -0.29 +3.37 -4.88 -19.25 +1.22 +2.33 -1.14 -1.30 -9.80 -2.88 all-mpnet-base-v2 +0.11 +0.66 -7.50 -6.55 +4.23 +5.91 -3.93 -10.48 -2.50 -0.12 +0.21 -2.51 -4.50 -3.96 all-mpnet-base-v2-ft -0.18 +0.40 -5.91 -7.59 +0.86 +4.59 -3.93 -9.96 +1.44 +3.55 -1.84 -1.44 -0.41 -1.37 sentence-t5-base -0.29 -4.84 -0.44 -3.13 -5.75 +1.10 -0.80 -3.90 +4.02 +2.84 +4.06 +4.19 +2.57 +5.97 sentence-t5-large -0.50 -2.67 -0.57 -7.13 -11.83 -1.27 -3.37 -6.13 -1.06 -1.96 -1.73 -2.98 -4.61 -1.44 sentence-t5-large-ft +0.35 -2.24 -2.04 -4.69 -5.24 +4.73 +0.81 -11.86 +0.55 -0.56 +1.23 +2.84 +2.85 -1.55 instructor-base +0.77 -4.45 -3.17 -8.65 -0.61 +4.45 -0.98 -11.37 +2.19 +3.71 -0.81 +0.51 +0.71 -2.83 instructor-large -0.96 -3.52 -1.70 -7.23 -1.90 +1.75 -1.42 -11.71 -0.78 -0.21 -3.89 -1.14 -1.59 -1.06 sfr-embedding-mistral -0.21 +0.22 +0.83 -4.02 +0.12 +5.66 +1.45 -10.21 +2.73 +2.54 -0.80 +2.36 +1.08 -0.78 nv-embed-v2 +0.22 +0.58 +0.63 -4.59 +0.61 +4.48 +0.77 -11.68 +1.64 +1.58 -1.27 +0.91 +0.31 -1.14 llm-distilled embeddings exhibit superior robustness. our analysis shows a smaller ∆retrieval gap for sfr-embedding-mistral and @xcite . we hypothesize that this robustness stems from the increased representational capacity afforded by the larger scale of the backbone model from which the embeddings are derived, a characteristic shown to enhance robustness to adversarial inputs @xcite . this robustness also extends to dialectical variations and social-media typos, which may be due to the increasing importance of social media data in the training corpora of recent generative models @xcite @xcite . in contrast, bert-based and t5-based models are primarily trained on less diverse, standardised corpora, making them less robust to lexical variations. nli-fine-tuned embedding models such as sentence-t5 demonstrate low robustness to negation. sentence embedding models primarily trained on natural language inference (nli) datasets, such as t5 @xcite , exhibit a large ∆retrieval gap under negation. this may stem from treating contradiction hypotheses as hard-negatives during training with contrastive loss @xcite , making the models highly sensitive to negation @xcite . in contrast, models trained on more diverse datasets (e.g., all-distilroberta-v1, all-minilm-l12-v2, all-mpnet-base-v2) demonstrate greater robustness to negation and, in some cases, even show improvements. bm25, meanwhile, remains robust to negation, as it is affected minimally by small lexical changes. finally, double negation rewrites claims in a form closely aligned with fact-checks (e.g., "it is not true . . . "), and may lead to retrieval improvements for some embedding models as observed on factchecktweet. embedding models with case-sensitive tokenizers struggle with casing variations. embedding models such as all-distilroberta-v1 and t5based models with case-sensitive tokenizers, which distinguish between tokens like apple and apple, show significant retrieval performance gaps on casing-perturbed claims. in contrast, embedding models with case-insensitive tokenizers exhibit robustness to casing differences, showing minimal to no retrieval gaps. while this behavior is expected for case-sensitive models, in retrieval tasks where casing differences are irrelevant, applying casing normalization or using a case-insensitive model can be an effective solution. ## discussion and conclusion real-world claim matching systems must handle not only factual but also edited claims, which often arise as users engage with misinformation online. embedding models used in these systems must therefore be robust to such user-informed misinformation edits. however, standard benchmarks like mteb @xcite , primarily evaluate sentence embedding models on clean, generalist tasks and fail to capture this challenge. to address this gap, we introduce a perturbation generation framework that produces natural and valid claim edits. this framework creates a more realistic evaluation test bed for sentence embedding models. although developed for claim matching, these perturbations have broader relevance and can help select embedding models for other downstream tasks that involve user-generated inputs. our evaluation shows that widely-used embedding models are highly sensitive to user edits, while llm-distilled embeddings offer greater robustness. reranking helps, but even strong rerankers cannot fully recover performance under perturbation. to address the retrieval gaps, we show that train-and inference-time approaches can improve embedding model robustness and generalize to out-of-domain settings with different trade-offs. knowledge distillation and finetuning are train-time interventions that require generating synthetic data or collecting costly human annotated data with additional computational costs for training and re-embedding fact-checks. on the other hand, claim normalization is a "trainfree" inference-time mitigation that depends on an llm and may introduce significant latency and cost to the overall pipeline. encouragingly, prior work @xcite shows that rewriting capabilities can be distilled into smaller models, offering a practical compromise. overall, our study offers practical insights for improving claim matching systems, ultimately empowering human fact-checkers to retrieve relevant fact-checks with greater reliability.