The Impacts of Unanswerable Questions on the Robustness of Machine Reading Comprehension Models (2023)

Abstract: Pretrained language models have achieved super-human performances on many Machine Reading Comprehension (MRC) benchmarks. Nevertheless, their relative inability to defend against adversarial attacks has spurred skepticism about their natural language understanding. In this paper, we ask whether training with unanswerable questions in SQuAD 2.0 can help improve the robustness of MRC models against adversarial attacks. To explore that question, we fine-tune three state-of-the-art language models on either SQuAD 1.1 or SQuAD 2.0 and then evaluate their robustness under adversarial attacks. Our experiments reveal that current models fine-tuned on SQuAD 2.0 do not initially appear to be any more robust than ones fine-tuned on SQuAD 1.1, yet they reveal a measure of hidden robustness that can be leveraged to realize actual performance gains. Furthermore, we find that robustness of models fine-tuned on SQuAD 2.0 extends on additional out-of-domain datasets. Finally, we introduce a new adversarial attack to reveal of SQuAD 2.0 that current MRC models are learning.

## introduction machine reading comprehension (mrc) is a fundamental and challenging subfield of natural language processing (nlp) in which the computer simulates a human question-and-answer mechanism by extracting the answers to given questions based on provided contexts. mrc has many applications in the real world, such as conversational question answering @xcite and open-domain question answering @xcite @xcite . with the development of recent deep learning models, mrc has made significant performance gains. many high-quality mrc datasets 1 our code is publicly available at: https://github. com/sonqt/unanswerable-robustness . ) (v1) versus its counterpart finetuned on squad 2.0 @xcite (v2) under adversarial attack. while roberta v1 predicts "dartford" as the answer under attack, roberta v2 knows that "dartford" is not the correct answer but fails to focus back on "nevada", the correct answer for the given question. roberta v2 then predicts the tested question as unanswerable. and benchmarks @xcite @xcite have been proposed over the last few years. during the same time period, mrc systems have also achieved many new state-of-theart (sota) performances, matching or exceeding human-level standards on many benchmarks. nevertheless, skepticism persists about the real ability of mrc sota models @xcite @xcite . the use of these sota systems in realworld applications is still limited and encounters many challenges, one of which is the robustness of mrc systems @xcite to subtle changes in the language syntax that induce significant semantic changes. as to the true robustness of mrc systems, @xcite find that the two deep learning models bidaf @xcite and match-lstm @xcite trained on squad 1.1 @xcite achieve impressive performance but lose much of that performance when facing adversarial attacks. the adversarial examples proposed by @xcite insert sentences that feature a significant lexical overlap with the question into the context in order to distract models from predicting the correct answers (see figure 1 ). improved performance against adversarial attacks to ensure the performance of mrc models in real-world applications motivates the pursuit of more robust mrc systems. @xcite developed squad 2.0 featuring the same scenarios and questions as squad 1.1 with the addition of unanswerable questions which are adversarially crafted by crowd workers to look similar to answerable ones. the considerable syntactic similarity between these unanswerable questions and the corresponding contexts requires mrc models to be highly sensitive to the small but important changes in the questions to determine their answerability. therefore, we ask the question of how mrc models trained on squad 2.0 behave under adversarial attacks and whether experience with adversarial unanswerable questions can help improve the robustness of mrc models. in order to answer these questions, we systematically explore the performance differences of sota models @xcite @xcite fine-tuned on squad 1.1 versus those on squad 2.0. our findings are summarized as follows: ## attacks in out-of-domain settings: results we now seek to determine if this additional robustness of v2 models extends to other out-of-domain test sets. in particular, we evaluate our v1 and v2 models on development sets of other extractive question answering datasets. we summarized the characteristics of five out-of-domain datasets of mrqa 2019 in first, the performance on original (unattacked) problems shows that adversarial unanswerable questions in squad 2.0 have little negative effects on the generalization performance of mrc models. while the performance of v2 models is higher than that of v1 models on triviaqa and searchqa, v1 models outperform v2 models slightly on natural questions (0.8%), newsqa (0.2 %), and considerably on hotpotqa (6.5 %). on average, the generalization performance of v2 models to that of v1 models on out-of-domain unattacked problems is slightly worse (53.7% to 54.5%). however, on problems with adversarial attacks, v2 models significantly outperform v1 models in four out of the five datasets. specifically, on average, v2 models significantly outperform v1 models by 2.9% on newsqa, 4.7% on natural question, 4.8% on searchqa, and 5.2% on triviaqa. although v2 models do not show superior performance to v1 models on hotpotqa, the performance gap between v2 and v1 models after attacks decreases significantly thanks to the superior robustness of v2 models. overall, we conclude from ## new attack in this section, we explore why v2 models often incorrectly put forward "unanswerable" as an incorrect response to answerable questions under adversarial attacks. we hypothesize that mrc models trained with squad 2.0 have learned to identify target sentences with significant lexical overlap to decide whether the corresponding questions are unanswerable; the models rely primarily on that target sentence to determine their output. this undesirable behavior of mrc systems may prevent them from using the whole paragraph to accurately dataset question (q) distant supervision context (c) q ⊥ c dev squad crowdsourced ✗ wikipedia ✗ 10,507 hotpotqa crowdsourced ✗ wikipedia ✗ 5,904 triviaqa trivia ✓ web snippets ✓ 7,785 searchqa jeopardy ✓ web snippets ✓ 16,980 newsqa crowdsourced ✗ news articles ✓ 4,212 natural questions search logs ✗ wikipedia ✓ 12,836 to further understand this hypothesis, we introduce a negation attack, a new adversarial attack to attempt to fool models into giving incorrect "unanswerable" responses. in particular, we construct an attack statement that significantly overlaps with the question yet is easy to determine as contradicting the question; we form our negation attack by inserting "not" in front of the adjective. our attack (see we then examine the shifts in answers of v2 models when attacked with negation type. question in the effort of maintaining a level of abstraction, what choice is typically left independent? answer encoding context [...] one tries to keep the discussion abstract enough to be independent of the choice of encoding. [...] in the effort of maintaining a level of abstraction, base64 choice is typically left not independent. ## conclusion in this work, we investigate the effects of training mrc models with unanswerable questions on their robustness against adversarial attacks. we construct adversarial samples from answerable and unanswerable questions in squad 2.0 and evaluate three mrc models fine-tuned on either squad 1.1 (v1 models) or squad 2.0 (v2 models) independently. adversarial attacks on answerable questions reveal that v2 models initially show little improved robustness over v1 models yet possess a latent ability to deal with these attacks that v1 models do not; the correct responses are often hidden as second-best answers, an indicator of the "hidden robustness" of v2 models resulting from additional training on unanswerable questions. by eliminating the "unanswerable" option and forcing v2 models to output an answer to any answer-i c2u c2i c2c bert v2 14.4 45.4 17.7 22.5 roberta v2 21.6 41.8 17.5 19.1 spanbert v2 12.5 37.9 22.8 26.8 finally, to encourage future work in evaluating the robustness of mrc models trained on both answerable and unanswerable questions, we introduce a new type of adversarial attack to reveal the short-comings of mrc models. our experiments with the negation attack reveal that the performance of v2 mrc models drops significantly (around 50% f1). we hypothesize that the decline in the performance of v2 models is mainly due to how v2 models have learned to suboptimally identify target sentences in the context to use as their primary mechanism of response.