Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Models

By Boxin Wang, Chejian Xu, Shuohang Wang, Zhe Gan, Yu Cheng, Jianfeng Gao, Ahmed Hassan Awadallah, Bo Li. 2021

308 citations recorded by the source corpus.

Large-scale pre-trained language models have achieved tremendous success across a wide range of natural language understanding (NLU) tasks, even surpassing human performance. However, recent studies reveal that the robustness of these models can be challenged by carefully crafted textual adversarial examples. While several individual datasets have been proposed to evaluate model robustness, a principled and comprehensive benchmark is still missing. In this paper, we present Adversarial GLUE (AdvGLUE), a new multi-task benchmark to quantitatively and thoroughly explore and evaluate the vulnerabilities of modern large-scale language models under various types of adversarial attacks. In particular, we systematically apply 14 textual adversarial attack methods to GLUE tasks to construct AdvGLUE, which is further validated by humans for reliable annotations. Our findings are summarized as follows. (i) Most existing adversarial attack algorithms are prone to generating invalid or ambiguous adversarial examples, with around 90% of them either changing the original semantic meanings or misleading human annotators as well. Therefore, we perform a careful filtering process to curate a high-quality benchmark. (ii) All the language models and robust training methods we tested perform poorly on AdvGLUE, with scores lagging far behind the benign accuracy. We hope our work will motivate the development of new adversarial attacks that are more stealthy and semantic-preserving, as well as new robust language models against sophisticated adversarial attacks. AdvGLUE is available at https://adversarialglue.github.io.

Subfields: Artificial Intelligence, Natural Language Processing, Evaluation & Benchmarks

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Natural Language Processing

In Evaluation & Benchmarks

Citations in the corpus

Adversarial Training for High-Stakes Reliability (2022, background): “Several recent datasets and benchmarks are constructed with human-in-the-loop adversaries, such AdversarialNLI [39], AdversarialGLUE [40], and DynaBench [41].”
Data Governance in the Age of Large-Scale Data-Driven Language Technology (2022, background): “There has also been an increased focus on analyzing other dimensions of data quality and stewardship [102, 107, 121, 123], with several noteworthy initiatives aiming to document both existing [9, 20, 30, 43], and newly developed [16, 60, 136] resources.”
Documenting Geographically and Contextually Diverse Data Sources: The BigScience Catalogue of Language Data and Resources (2022, background): “…to aid NLP researchers in documenting their own datasets (Gao et al., 2020; Biderman et al., 1http://commoncrawl.org/ 2022; Gehrmann et al., 2021; Wang et al., 2021) and even to retrospectively document and analyze datasets that were developed and released by others without thorough…”
Exploring the Limits of Domain-Adaptive Training for Detoxifying Large-Scale Language Models (2022, unknown): “However, they also exhibit undesirable behaviors in terms of ethical, robustness, privacy, and nonfactual generation issues [10, 22–26].”
A Survey on Evaluation of Large Language Models (2023, methodology): “By summarizing and analyzing existing efforts on LLMs evaluation, we may identify the current success and failure cases of LLMs, derive new trends for evaluation protocols, and most importantly, propose new challenges and opportunities for future research.”
Universal and Transferable Adversarial Attacks on Aligned Language Models (2023, unknown): “Existing adversarial benchmarks for LLMs [Wang et al., 2021, Zhu et al., 2023] focus on generating attacks that aim to fool specific tasks, such as sentiment analysis or natural language inference.”
ReCode: Robustness Evaluation of Code Generation Models (2022, background): “There are also works that propose to incorporate code structures for models to better understand the semantic information, including GraphCodeBERT (Guo et al., 2021) and CodeT5 (Wang et al., 2021b).”
Prompting GPT-3 To Be Reliable (2022, methodology): “For domain shift , MRQA (Fisch et al., 2019) trains on six machine reading datasets from the source domain and tests on six different target domains; for perturbations , AdvGLUE (Wang et al., 2021) craft adversarial versions of GLUE (Wang et al., 2018) based on automatic adversarial perturbations an”
Can large language models reason about medical questions? (2022, background): “28 Therefore, deploying LLMs into sensitive areas such as healthcare must be operated with great care.”
Better Diffusion Models Further Improve Adversarial Training (2023, background): “…for specific scenarios, including adversarial patches (Hingun et al., 2022; Lian et al., 2022; Pintor et al., 2023), language-related tasks (Wang et al., 2021; Li et al., 2021), autonomous vehicles (Xu et al., 2022), multiple threat models (Hsiung et al., 2022), and common corruptions (Mu…”
PromptRobust: Towards Evaluating the Robustness of Large Language Models on Adversarial Prompts (2023, unknown): “We argue this offers an innovative lens to assess the robustness of language models, complementing insights from existing benchmarks like AdvGLUE (Wang et al., 2021), and AdvGLUE++(Wang et al., 2023a).”
XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Models (2023, background): “Overall, we hope that XST EST can offer a new di-mension along which to evaluate LLMs, and complement other evaluations to help make LLMs both more helpful and less harmful.”
On the Robustness of ChatGPT: An Adversarial and Out-of-distribution Perspective (2023, methodology): “Eventually, we leverage several recent datasets for our evaluation: AdvGLUE [54] and ANLI [32] for adversarial robustness and two new datasets for OOD robustness: Flipkart review [49] and DDXPlus medical diagnosis datasets [46].”
Auditing large language models: a three-layered approach (2023, background): “Particularly relevant for our purposes is AdvGLUE [195], which evaluates LLMs’ vulnerabilities to adversarial attacks in different domains using a multi-task benchmark.”
On Evaluating Adversarial Robustness of Large Vision-Language Models (2023, background): “…flexible (e.g., beyond word replacement) and semantically preserving methods are proposed to produce natural language adversarial examples [9, 49, 50, 52, 53, 70, 78, 102, 104, 110], as well as benchmarks and datasets to more thoroughly evaluate the adversarial robustness of LMs [56, 90–92].”
HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal (2024, unknown): “Numerous attacks specific to text models have been proposed (Ebrahimi et al., 2017; Iyyer et al., 2018; Li et al., 2018; Jin et al., 2020; Li et al., 2020; Guo et al., 2021), as well as specific high-quality benchmarks for text attacks (Wang et al., 2021).”
Large Language Models Can Be Easily Distracted by Irrelevant Context (2023, methodology): “…input perturbations for natural language tasks, including model-agnostic input transformations (Liang et al., 2022; Ravichan-der et al., 2022, inter alia ) and adversarial example generation against individual models (Jia & Liang, 2017; Shi et al., 2018; Morris et al., 2020; Wang et al., 2021).”