Evaluating the Robustness of Discrete Prompts (2023)

Abstract: Discrete prompts have been used for fine-tuning Pre-trained Language Models for diverse NLP tasks. In particular, automatic methods that generate discrete prompts from a small set of training instances have reported superior performance. However, a closer look at the learnt prompts reveals that they contain noisy and counter-intuitive lexical constructs that would not be encountered in manually-written prompts. This raises an important yet understudied question regarding the robustness of automatically learnt discrete prompts when used in downstream tasks. To address this question, we conduct a systematic study of the robustness of discrete prompts by applying carefully designed perturbations into an application using AutoPrompt and then measure their performance in two Natural Language Inference (NLI) datasets. Our experimental results show that although the discrete prompt-based method remains relatively robust against perturbations to NLI inputs, they are highly sensitive to other types of perturbations such as shuffling and deletion of prompt tokens. Moreover, they generalize poorly across different NLI datasets. We hope our findings will inspire future work on robust discrete prompt learning.

## introduction pre-trained language models (plms) have been successfully adapted to a wide range of natural language processing (nlp) tasks using promptbased learning @xcite @xcite such as sentiment classification @xcite , natural language inference (nli) @xcite , relation extraction @xcite , cross-lingual inference @xcite . however, manually writing prompts that generalize well is very challenging for several reasons such as (a) it might not always be possible to recruit domain-expert human annotators, (b) human annotators might not be able to cover all corner cases by writing prompts, and (c) there can be disagreements between human annotators regarding the coverage of a particular prompt. to address these challenges, automatic learning of discrete prompts has been proposed such as ad-vtrigger @xcite , autoprompt (ap; @xcite , warp @xcite , and rlprompt @xcite . although discrete prompt learning methods have achieved good performance in numerous downstream tasks by automatically learnt prompts, such automatic prompts seem to be significantly different from the manually-written ones. for example, considering the fact that discrete prompt learning methods are trained in a few-shot setting where they use only a small number of training instances, the seemingly counter-intuitive nature of the discrete prompts learnt by automatic methods raises concerns about their robustness. for example, how will the performance of a target task change if we add small random perturbations to the prompts learnt by ap? and whether the prompts learnt by ap generalize to out-of-domain data?. to study these issues, in this paper we evaluate the robustness of discrete prompts learnt by automatic prompt learning methods and compare that with manuallywritten prompts and direct fine-tuning of plms. an evaluation of the robustness of discrete prompts is important for two main reasons. first, given that discrete prompt learning methods are learning those prompts from a small set of training instances, it is important that they cover the core patterns that generalize to the target task and not simply capture some random artefacts in the training samples. second, unlike embedding-based continuous prompts @xcite , discrete prompts @xcite @xcite are represented in natural language and supposed to be interpretable. however, if a discrete prompt learning method is less robust, a seemingly harmless perturbation such as removing a punctuation character can significantly alter the performance of a downstream task. in contrast to the numerous work that has used prompts for fine-tuning plms, to the best of our knowledge, the robustness of discrete prompts to random or adversarial perturbations has not been systematically studied. to address this gap, we use ap as a concrete example of a widely-used method and evaluate its robustness under different types of carefully designed perturbations. however, we note that our perturbation techniques are not limited to ap and can be used for any discrete prompt learning method. we compare the performance of ap-learnt prompts against fine-tuning using manually-written prompts (mp), and headbased fine-tuning (hft), where we fine-tune both the classifier head and the plm parameters. from our evaluation, we find several interesting facts about the robustness of discrete prompts as summarized below. in particular, the performance of ap on mnli is much worse than that on cb. this is in contrast to the superior performance of ap on sick-e @xcite , another nli dataset, as reported by @xcite . ## experiments let us first describe experimental settings common to all experiments. prompting and fine-tuning methods: we compared the following methods. datasets: we used nli as an evaluation task to compare the robustness of discrete prompting methods. the nli task has been used in multiple previous studies to evaluate and/or propose novel prompt learning methods because it is a fundamental task related to many nlp applications (shin et al., 2020; scao and rush, 2021; webson and pavlick, 2022). it is important to use the same nli task and datasets in our experiments to facilitate fair comparisons and reach reproducible conclusions. we used the two datasets: commitmentbank (cb; de marneffe et al., 2019) foot_2 (a corpus of short texts), and multi-genre natural language inference corpus (mnli; williams et al., 2018) foot_3 (a crowdsourced collection of sentence pairs for nli). each sentence pair is labelled with entailment, neutral, or contradiction. plm: in our experiments, we used the same pretrained language model to evaluate ap, mp, and hft equally. specifically, we used roberta-large (355m parameters) 5 (liu et al., 2019), which has been used in much prior work in prompt learning (shin et al., 2020; scao and rush, 2021). the plm was trained on five datasets, including book-corpus foot_5 , english wikipedia foot_6 , cc-news foot_7 , open-webtext foot_8 , and stories foot_9 . the texts were tokenised using a byte-level byte-pair encoding (bpe; sennrich et al., 2016) vocabulary of size 50,000. evaluating the robustness of prompts: we used rate of degradation (rod) @xcite to evaluate robustness, which is defined as the decrease in accuracy of the target task due to the perturbations added to the prompt. if the rod of a model is small after the inclusion of a perturbation, the model is considered to be robust against that perturbation. specifically, we first calculate the respective accuracies acc x and acc x * on the same evaluation set for both prompt x and its perturbated version x * . using the average accuracies avg-acc x and avg-acc x * over m prompts x 1 , ..., x m , we calculate the rod as (avg-acc xavg-acc x * )/avg-acc @xmath0. ## conclusion we investigated the robustness of discrete prompts under different perturbations. we found that although discrete prompts remain relatively robust against token deletion, it is highly sensitive to other types of perturbations such as token shuffling. for adversarial perturbations to the input, discrete prompts were robust to weak perturbations without label changes, but ap was more robust than mp for perturbations with label changes. moreover, they generalize poorly across different datasets annotated for nli. we hope our analysis will inspire future work to develop methods that learn both accurate as well as robust discrete prompts.