Papers with adversarial training
MRQA 2019 Shared Task: Evaluating Generalization in Reading Comprehension (D19-58)
Copied to clipboard
| Challenge: | MRQA datasets have been used to benchmark progress in general-purpose language understanding. |
| Approach: | They propose to combine 18 question answering datasets into one shared task to evaluate their generalization capabilities. |
| Outcome: | The best system achieved an average F1 score of 72.5 on the 12 held-out datasets, 10.7 absolute points higher than baseline based on BERT. |
Joint models for NLP (D18-3)
Copied to clipboard
| Challenge: | This tutorial reviews main approaches to joint modeling for statistical and neural methods. |
| Approach: | This tutorial reviews main approaches to joint modeling for both statistical and neural methods. |
| Outcome: | This tutorial reviews main approaches to joint modeling for statistical and neural methods. |
Efficient and Robust Knowledge Graph Construction (2022.aacl-tutorials)
Copied to clipboard
| Challenge: | Knowledge graph construction has appealed to the NLP community but has encountered similar issues such as efficiency and robustness. |
| Approach: | They propose to introduce efficient and robust knowledge graph construction techniques and discuss their results. |
| Outcome: | This tutorial will provide an overview of the latest and ongoing techniques for efficient and robust knowledge graph construction. |
Adversarial Removal of Demographic Attributes from Text Data (D18-1)
Copied to clipboard
| Challenge: | Recent advances in Representation Learning and Adversarial Training remove unwanted features from the learned representation. |
| Approach: | They show that demographic information of authors is encoded in the intermediate representations learned by text-based neural classifiers. |
| Outcome: | The proposed approach achieves higher accuracies on the same dataset, the authors show . they show that the proposed approach is effective in removing unwanted features from the learned representations. |
HotFlip: White-Box Adversarial Examples for Text Classification (P18-2)
Copied to clipboard
| Challenge: | Existing methods to create adversarial examples without explicit knowledge of model parameters are not effective. |
| Approach: | They propose an efficient method to generate white-box adversarial examples to trick a character-level neural classifier by an atomic flip operation. |
| Outcome: | The proposed method can be adapted to attack a word-level classifier with a few constraints. |
Self-Supervised Contrastive Learning with Adversarial Perturbations for Defending Word Substitution-based Attacks (2022.findings-naacl)
Copied to clipboard
| Challenge: | Existing methods to improve model robustness against word substitution-based adversarial attacks are too slow to generate adversarials on the fly. |
| Approach: | They propose an approach to improve the robustness of BERT models against word substitution-based adversarial attacks by leveraging adversarials for self-supervised contrastive learning. |
| Outcome: | The proposed method improves robustness of BERT models against word substitution-based adversarial attacks without using any labeled data. |
Does Representational Fairness Imply Empirical Fairness? (2022.findings-aacl)
Copied to clipboard
| Challenge: | Neural methods have been trained on datasets which embody cultural and societal stereotypes, captured in spurious correlations between target labels and protected attributes. |
| Approach: | They propose a debiasing method that encourages a latent space that separates instances based on target label, while mixing instances that share protected attributes. |
| Outcome: | The proposed method shows that representational fairness does not imply empirical fairness across methods. |
Quality-Aware Adversarial Ensemble for Singer Identification in 1960s Tamil Film Music (2026.eacl-srw)
Copied to clipboard
| Challenge: | 1960s Tamil film music lacks adequate metadata identifying playback singers in archival recordings. |
| Approach: | They propose a quality-aware adversarial ensemble approach based on variable audio degradation and instrumentation leakage confounding singer-specific features. |
| Outcome: | The proposed approach achieves 96.2% accuracy and 2.0% EER on a held-out test set of 52 clips. |
Arabic Synonym BERT-based Adversarial Examples for Text Classification (2024.eacl-srw)
Copied to clipboard
| Challenge: | Often, research studies quantifying the impact of adversarial text attacks have been applied only to models trained in English. |
| Approach: | They propose a word-level study of adversarial text examples in Arabic . they use a synonym attack with a BERT model to assess their robustness . |
| Outcome: | The proposed attack compares Arabic adversarial examples with their original examples and regains 2% accuracy after training. |
GAPO: Learning Preferential Prompt through Generative Adversarial Policy Optimization (2025.acl-long)
Copied to clipboard
Zhouhong Gu, Xingzhou Chen, Xiaoran Shi, Tao Wang, Suhang Zheng, Tianyu Li, Hongwei Feng, Yanghua Xiao
| Challenge: | Existing methods for achieving this require a limited understanding of constraints and can be hallucinating or brittle. |
| Approach: | They propose a framework that combines adversarial training dynamics with an encoder-only reward model to progressively learn and adapt to increasingly complex constraints. |
| Outcome: | Extensive experiments show that GAPO significantly outperforms existing methods like PPO, DPO, and KTO in fine-grained constraints. |
Answer-based Adversarial Training for Generating Clarification Questions (N19-1)
Copied to clipboard
| Challenge: | a goal of natural language processing is to develop techniques that enable machines to process naturally occurring language. |
| Approach: | They propose a model where hypothetical answers are latent variables that can guide the model into generating more useful clarification questions. |
| Outcome: | The proposed model outperforms retrieval-based models and ablations that exclude utility model and adversarial training on two datasets. |
TextAttack: A Framework for Adversarial Attacks, Data Augmentation, and Adversarial Training in NLP (2020.emnlp-demos)
Copied to clipboard
| Challenge: | TextAttack provides implementations of 16 adversarial attacks from the literature and supports a variety of models and datasets. |
| Approach: | They introduce a Python framework for adversarial attacks, data augmentation, and adversarially training in NLP. |
| Outcome: | This paper introduces a Python framework for adversarial attacks, data augmentation, and adversarially training in NLP. |
Robustness to Modification with Shared Words in Paraphrase Identification (2020.findings-emnlp)
Copied to clipboard
| Challenge: | Paraphrase identification models have been shown to be vulnerable and lack robustness in tasks such as text classification and natural language inference. |
| Approach: | They propose to modify an example such that a target model makes a wrong prediction by using beam search constrained by heuristic rules and a BERT-masked language model to generate substitution words compatible with the context. |
| Outcome: | The proposed model performance drops dramatically on modified examples, revealing the robustness issue. |
TaeBench: Improving Quality of Toxic Adversarial Examples (2025.naacl-industry)
Copied to clipboard
| Challenge: | Existing adversarial examples generate invalid or ambiguous examples that fool the systems into wrong detection. |
| Approach: | They propose an annotation pipeline for quality control of generated toxic adversarial examples (TAE) they use model-based automated annotation and human-based quality verification to assess quality requirements of a TAE dataset. |
| Outcome: | The proposed pipeline can transfer-attack SOTA toxicity content moderation models and services with adversarial training. |
Advancing the Robustness of Large Language Models through Self-Denoised Smoothing (2024.naacl-short)
Copied to clipboard
Jiabao Ji, Bairu Hou, Zhen Zhang, Guanhua Zhang, Wenqi Fan, Qing Li, Yang Zhang, Gaowen Liu, Sijia Liu, Shiyu Chang
| Challenge: | Existing adversarial attacks can cause LLMs to make wrong predictions on downstream tasks or generate harmful content misaligned with human values. |
| Approach: | They propose to use randomized smoothing to add noise to the input and then make predictions based on these denoised versions. |
| Outcome: | The proposed method surpasses existing methods in both empirical and certified robustness in defending against adversarial perturbations for both downstream tasks and human alignments (i.e., jailbreak attacks). |
Learnable Privacy Neurons Localization in Language Models (2024.acl-short)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) memorize and disclose private information, especially Personally Identifiable Information (PII) concerns regarding privacy and security within human society remain poorly understood. |
| Approach: | They propose to use learnable binary weight masks to localize PII-sensitive neurons within LLMs by deactivating localized privacy neurons. |
| Outcome: | The proposed method localizes PII-sensitive neurons across all layers and shows the property of PI I specificity. |
Semi-supervised Adversarial Text Generation based on Seq2Seq models (2022.emnlp-industry)
Copied to clipboard
| Challenge: | In contrast, adversarial training has been used in computer vision to improve models’ robustness due to the discrete nature of text. |
| Approach: | They propose a way to generate adversarial samples by using pseudo-labeled in-domain text data to train a seq2seq model for adversarials and combine it with paraphrase detection. |
| Outcome: | The proposed model generates realistic and relevant adversarial samples compared to other state-of-the-art models and recovers up to 70% of errors. |
Enhance Robustness of Sequence Labelling with Masked Adversarial Training (2020.findings-emnlp)
Copied to clipboard
| Challenge: | Adversarial training (AT) has shown strong regularization effects on deep learning algorithms by introducing small input perturbations to improve model robustness. |
| Approach: | They propose to use adversarial training to improve robustness from contextual information in sequence labelling tasks by masking or replacing some words in the sentence. |
| Outcome: | The proposed method shows significant improvements on accuracy and robustness of sequence labelling on CoNLL 2000 and 2003 benchmarks. |
Adversarially Improving NMT Robustness to ASR Errors with Confusion Sets (2022.aacl-short)
Copied to clipboard
| Challenge: | Existing methods for robustness against homophone errors are limited to homophones . substitution errors are the most common errors in NMT models . |
| Approach: | They propose an adversarial example generation method based on confusion sets that contain words easily confusable with a target word by ASR to conduct adversarially training for NMT models. |
| Outcome: | The proposed method improves on the clean test set and can be used in real-world scenarios. |
Adversarial Training for Machine Reading Comprehension with Virtual Embeddings (2021.starsem-1)
Copied to clipboard
| Challenge: | Neural networks are vulnerable to adversarial examples that have been mixed with certain perturbations. |
| Approach: | They propose a novel adversarial training method that perturbs the embedding matrix instead of word vectors to differentiate the roles of passages and questions. |
| Outcome: | The proposed method is effective universally and further improves the performance of MRC tasks. |
Robustness Evaluation of Text Classification Models Using Mathematical Optimization and Its Application to Adversarial Training (2022.findings-aacl)
Copied to clipboard
| Challenge: | Neural networks are vulnerable to adversarial examples due to slightly perturbed input data. |
| Approach: | They propose a method that evaluates the robustness of text classification models by an optimization problem that identifies a minimum synonym swap that changes the classification result. |
| Outcome: | The proposed method achieves high scores in human evaluations of grammatical correctness and semantic similarity for an IMDb dataset and implements adversarial training with the IMD and SST2 datasets. |
SeqAttack: On Adversarial Attacks for Named Entity Recognition (2021.emnlp-demo)
Copied to clipboard
| Challenge: | Named Entity Recognition (NER) is a task of recognizing named entities in a chunk of text. |
| Approach: | They investigate the portability of adversarial attacks from text classification to named entity recognition and the ability of adversary training to counteract these attacks. |
| Outcome: | The proposed framework and web application can be used to cherry pick adversarial examples and perform character-level and word-level attacks. |
READ: Improving Relation Extraction from an ADversarial Perspective (2024.findings-naacl)
Copied to clipboard
| Challenge: | Recent work in relation extraction (RE) has high generalization capability, but adversarial training methods rely on entities. |
| Approach: | They propose an adversarial training method specifically designed for relation extraction that introduces sequence- and token-level perturbations to the sample and uses a separate perturbation vocabulary to improve the search for entity and context perturbations. |
| Outcome: | The proposed method significantly improves accuracy and robustness in low-resource scenarios. |
Decoupling Adversarial Training for Fair NLP (2021.findings-acl)
Copied to clipboard
| Challenge: | Existing work assumes main task labels and protected attributes are available in the dataset, but protected labels are often unavailable or only available in limited numbers. |
| Approach: | They propose a method which uses only a small volume of protected labels to train adversarial models using a dataset with a discriminator. |
| Outcome: | The proposed method can be used to transfer private-labelled instances from one dataset to another without requiring large amounts of protected labels. |
OpenAttack: An Open-source Textual Adversarial Attack Toolkit (2021.acl-demo)
Copied to clipboard
Guoyang Zeng, Fanchao Qi, Qianrui Zhou, Tingji Zhang, Zixian Ma, Bairu Hou, Yuan Zang, Zhiyuan Liu, Maosong Sun
| Challenge: | Various attack models are distinct and implemented with different programming frameworks and settings, which hinders quick utilization and fair comparison of attack models. |
| Approach: | They propose an open-source textual adversarial attack toolkit to solve these issues by combining 15 typical attack models into one toolkit. |
| Outcome: | The proposed toolkit supports all attack types, multilinguality, and parallel processing. |
Synonym-unaware Fast Adversarial Training against Textual Adversarial Attacks (2025.findings-naacl)
Copied to clipboard
| Challenge: | Existing adversarial defense methods rely on predetermined linguistic knowledge and assume that attackers’ synonym candidates are known, which is often unrealistic. |
| Approach: | They propose a Fast Adversarial Training method that leverages single-step perturbation generation and effective perturbation initialization to improve model robustness without requiring synonym awareness. |
| Outcome: | Experiments show that the proposed method outperforms existing models under character-level and word-level attacks while still maintaining the correct syntax. |
Adversarial Attention Modeling for Multi-dimensional Emotion Regression (P19-1)
Copied to clipboard
| Challenge: | Empirical evaluation on EMOBANK corpus shows that our approach achieves notable improvements in r-values over the state-of-the-art baselines. |
| Approach: | They propose a neural network-based approach to multi-dimensional emotion regression which automatically rates multiple emotion dimension scores for an input text. |
| Outcome: | The proposed approach achieves notable improvements in r-values on both EMOBANK Reader’s and Writer’s multi-dimensional emotion regression tasks over the state-of-the-art baselines. |
On Adversarial Examples for Character-Level Neural Machine Translation (C18-1)
Copied to clipboard
| Challenge: | Using adversarial examples to measure robustness of deep learning models has become a standard procedure due to the difficulty of creating white-box adversarials for discrete text input. |
| Approach: | They propose two novel attacks which aim to remove or change a word in a translation, rather than simply break the NMT. |
| Outcome: | The proposed attacks are significantly stronger than their black-box counterparts in different attack scenarios, showing more serious vulnerabilities than previously known. |
Bridging the Gap between Native Text and Translated Text through Adversarial Learning: A Case Study on Cross-Lingual Event Extraction (2023.findings-eacl)
Copied to clipboard
| Challenge: | Recent research in cross-lingual learning has found that combining large-scale pretrained multilingual language models with machine translation can yield good performance. |
| Approach: | They propose a model architecture that jointly encodes a source language input sentence with its translation to the target language during training and takes a target language sentence with it as input during evaluation. |
| Outcome: | The proposed model architecture can integrate machine translation to improve event extraction while adding machine-translated data yields unstable performance due to representational gap. |
Disentangling Representations of Text by Masking Transformers (2021.emnlp-main)
Copied to clipboard
| Challenge: | Large pretrained models such as BERT encode a range of features into monolithic vectors, providing strong predictive accuracy across downstream tasks. |
| Approach: | They explore whether it is possible to learn disentangled representations by identifying existing subnetworks within pretrained models that encode distinct, complementary aspects. |
| Outcome: | The proposed method disentangles sentiment from genre in movie reviews, toxicity from dialect in Tweets, and syntax from semantics. |
Unsupervised Bilingual Lexicon Induction via Latent Variable Models (D18-1)
Copied to clipboard
| Challenge: | Existing methods for generating bilingual lexicons use parallel corpora or bilingual dictionaries. |
| Approach: | They propose a model which builds cross-lingual dictionaries using latent variable models and adversarial training with no parallel corpora. |
| Outcome: | The proposed model outperforms state-of-the-art models on several language pairs and reaches competitive performance. |
Improving Arabic Diacritization with Regularized Decoding and Adversarial Training (2021.acl-short)
Copied to clipboard
| Challenge: | Existing studies regard auto-generated knowledge instances as gold references, which limits their effectiveness since they are not always accurate and inferior instances can lead to incorrect predictions. |
| Approach: | They propose to use regularized decoding and adversarial training to appropriately learn from noisy knowledge instances for Arabic diacritization. |
| Outcome: | The proposed model outperforms existing models on two benchmark datasets even with flawed auto-generated knowledge. |
Adversarial Training for Satire Detection: Controlling for Confounding Variables (N19-1)
Copied to clipboard
| Challenge: | Existing methods for satire detection focus on satirical news based on article sources . satiric news are written with the aim of mimicking regular news in diction . |
| Approach: | They propose a model for satire detection with an adversarial component to control for the confounding variable of publication source. |
| Outcome: | The proposed model improves generalization performance to unseen publications with an adversarial component. |
SHARP: Search-Based Adversarial Attack for Structured Prediction (2022.findings-naacl)
Copied to clipboard
| Challenge: | SHARP is a new attack method for structured prediction models that solves several challenges. |
| Approach: | They propose a black-box adversarial attack method that uses a search-based optimization problem to attack adversarials. |
| Outcome: | The proposed method performs more potent attack than pioneer arts on two structured prediction tasks. |
Leave My Images Alone: Preventing Multi-Modal Large Language Models from Analyzing Images via Visual Prompt Injection (2026.acl-long)
Copied to clipboard
| Challenge: | Multimodal large language models are powerful tools for analyzing Internet-scale image data. |
| Approach: | They propose a method to protect images from unauthorized analysis by MLLMs . they embed a perturbation that acts as a visual prompt injection attack on MLMLs if a malicious actor downloads and queries an image . |
| Outcome: | The proposed method protects images from unauthorized analysis by MLLMs . it embeds a perturbation that acts as a visual prompt injection attack on MLMLs if a malicious actor downloads and queries the protected image . |
A robust self-learning method for fully unsupervised cross-lingual mappings of word embeddings (P18-1)
Copied to clipboard
| Challenge: | Existing methods to learn cross-lingual word embeddings have failed in more realistic scenarios . a fully unsupervised initialization and a robust self-learning algorithm are needed to improve the existing methods. |
| Approach: | They propose an unsupervised initialization method that exploits structural similarity of embeddings and a robust self-learning algorithm that iteratively improves it. |
| Outcome: | The proposed method achieves the best published results in standard datasets even surpassing previous supervised systems. |
Deconfounding Legal Judgment Prediction for European Court of Human Rights Cases Towards Better Alignment with Experts (2022.emnlp-main)
Copied to clipboard
| Challenge: | Legal Judgement Prediction systems without expert-informed adjustments can be vulnerable to shallow, distracting surface signals. |
| Approach: | They propose to use domain expertise to identify statistically predictive but legally irrelevant information and adopt adversarial training to prevent it from relying on it. |
| Outcome: | The proposed model aligns better with expert rationales than baseline models . the results are compared with an existing benchmark dataset of human rights cases . |
What’s in a Domain? Learning Domain-Robust Text Representations using Adversarial Training (N18-2)
Copied to clipboard
| Challenge: | a key roadblock is application to new domains, unseen in training. |
| Approach: | They propose a method to optimise in- and out-of-domain accuracy by combing domain-specific and domain-general components with adversarial training for domain. |
| Outcome: | The proposed method improves on domain adaptation and domain-adversarial training. |
Don’t take “nswvtnvakgxpm” for an answer –The surprising vulnerability of automatic content scoring systems to adversarial input (2020.coling-main)
Copied to clipboard
| Challenge: | Automated content scoring systems can be used on short answer tasks to save human effort, but can invite cheating strategies such as writing irrelevant answers. |
| Approach: | They generate adversarial answers for benchmark content scoring datasets based on different methods of increasing sophistication and examine countermeasures such as adversarials. |
| Outcome: | The proposed methods show that even simple methods can reduce content scoring performance but do not solve the problem. |
On Robustness of Prompt-based Semantic Parsing with Large Pre-trained Language Model: An Empirical Study on Codex (2023.eacl-main)
Copied to clipboard
Terry Yue Zhuo, Zhuang Li, Yujin Huang, Fatemeh Shiri, Weiqing Wang, Gholamreza Haffari, Yuan-Fang Li
| Challenge: | Existing techniques for parsing natural-language utterances are vulnerable to adversarial attacks, requiring large amounts of labelled data and expensive human annotation. |
| Approach: | They propose to enhance the adversarial robustness of a prompt-based semantic parser based on a language model trained on code by constructing a set of demonstration examples. |
| Outcome: | The proposed method can be enhanced without significant amounts of labelled data or expensive human annotations on in-domain semantic parsing data. |
Generating Reasonable and Diversified Story Ending Using Sequence to Sequence Model with Adversarial Training (C18-1)
Copied to clipboard
| Challenge: | Story generation is a challenging problem in artificial intelligence (AI) . previous work focused on learning statistical models of event sequences from large-scale text corpora . |
| Approach: | They propose to use adversarial training to generate reasonable story endings . their model includes a generator that defines the policy of generating a story ending . |
| Outcome: | The proposed model achieves better performance on the task of Story Cloze Test with an accuracy of 62.6% compared with state-of-the-art baseline methods. |
Robust Machine Comprehension Models via Adversarial Training (N18-2)
Copied to clipboard
| Challenge: | Existing models for the Stanford Question Answering Dataset suffer from a 50% decrease in F1 score during adversarial evaluation based on AddSent. |
| Approach: | They propose an alternative adversary-generation algorithm, AddSentDiverse, that significantly increases the variance within the adversarial training data by providing effective examples that punish the model for making certain superficial assumptions. |
| Outcome: | The proposed algorithm can achieve a 36.5% increase in F1 score while maintaining performance on the regular SQuAD task. |
Adversarial Multi-task Learning for End-to-end Metaphor Detection (2023.findings-acl)
Copied to clipboard
| Challenge: | Existing methods to learn basic sense discrimination (BSD) are limited in training data. |
| Approach: | They propose a multi-task learning framework to transfer MD knowledge to basic sense discrimination using word sense disambiguation. |
| Outcome: | The proposed framework can mitigate the data scarcity problem in metaphor detection. |
Thesis Proposal: Auditing and Mitigating Demographic Bias in Multi-Stage Retrieval Systems for Criminal Justice Applications (2026.acl-srw)
Copied to clipboard
| Challenge: | racial descriptors alter embedding similarity scores and retrieval rankings, a new study shows . rife-specific biases can displace relevant records outside top-10 results, the study concludes . |
| Approach: | They propose to detect, measure, and mitigate racial bias in NLP systems deployed in criminal justice contexts . they propose to develop and evaluate debiasing techniques, validate synthetic findings on authentic law enforcement data . |
| Outcome: | The proposed research examines how bias propagates across retrieval pipelines . it shows that racial descriptors alter embedding similarity scores and retrieval rankings . |
Undersensitivity in Neural Reading Comprehension (2020.findings-emnlp)
Copied to clipboard
| Challenge: | Existing models generalise well to in-distribution test sets, yet perform poorly on adversarially selected data. |
| Approach: | They propose an adversarial attack which searches among semantic variations of the question for which a model erroneously predicts the same answer, and with even higher probability. |
| Outcome: | The proposed attack reduces the vulnerability of models trained on SQuAD2.0 and NewsQA, and outperforms a conventional model by as much as 10.9% F1. |
Generating Natural Language Adversarial Examples through Probability Weighted Word Saliency (P19-1)
Copied to clipboard
| Challenge: | Existing approaches to attack text classification are limited due to the complexity of the problem. |
| Approach: | They propose a greedy algorithm to generate adversarial examples that maintain lexical correctness, grammatical correctiness and semantic similarity. |
| Outcome: | The proposed algorithm maintains lexical correctness, grammatical correctity and semantic similarity well and is hard for humans to perceive. |
Adversarial Training for Weakly Supervised Event Detection (N19-1)
Copied to clipboard
| Challenge: | Detecting and identifying events is an important subtask of event extraction. |
| Approach: | They build a large event-related candidate set with good coverage and apply an adversarial training mechanism to iteratively identify informative instances from the candidate set and filter out those noisy ones. |
| Outcome: | The proposed method significantly outperforms the state-of-the-art methods on two real-world datasets. |
Improving Zero-Shot Cross-Lingual Transfer Learning via Robust Training (2021.emnlp-main)
Copied to clipboard
| Challenge: | Pre-trained multilingual language encoders do not precisely align words and phrases across languages. |
| Approach: | They propose a learning strategy for training robust models by drawing connections between adversarial examples and failure cases of zero-shot cross-lingual transfer. |
| Outcome: | The proposed model can achieve good performance even if representations of different languages are not aligned well. |
KBGAN: Adversarial Learning for Knowledge Graph Embeddings (N18-1)
Copied to clipboard
| Challenge: | Existing knowledge graph embedding techniques lack the capability to access similarities between entities and relations. |
| Approach: | They propose an adversarial learning framework to improve knowledge graph embedding models . they use one knowledge graph embedded model as a negative sample generator . |
| Outcome: | The proposed framework improves the performance of knowledge graph embedding models on a link prediction task. |
Adaptation of Hierarchical Structured Models for Speech Act Recognition in Asynchronous Conversation (N19-1)
Copied to clipboard
| Challenge: | asynchronous domains lack large labeled datasets to train an effective speech act recognition model. |
| Approach: | They propose methods to leverage abundant unlabeled conversational data and available labeled data from synchronous domains to train an effective SAR model. |
| Outcome: | The proposed method outperforms existing methods when trained on in-domain data only. |
Retrieving Relevant Context to Align Representations for Cross-lingual Event Detection (2023.findings-acl)
Copied to clipboard
| Challenge: | Existing approaches to cross-lingual transfer learning for event detection are mixed with event-discriminative context. |
| Approach: | They propose a method where representations are augmented with additional context to bridge the gap between languages while enriching contextual information to facilitate ED. |
| Outcome: | The proposed model performs well on three languages. |
White-to-Black: Efficient Distillation of Black-Box Adversarial Attacks (N19-1)
Copied to clipboard
| Challenge: | Recent work in natural language processing generates adversarial examples using white-box access . a neural network can learn to emulate the behavior of a white- box attack and generalize well to new examples. |
| Approach: | They propose an adversarial training approach that assumes white-box access to an attacker's model and optimizes the input directly against it. |
| Outcome: | The proposed approach reduces example generation time by 19x-39x and exposes the Google Perspective API vulnerability. |
Signer Diversity-driven Data Augmentation for Signer-Independent Sign Language Translation (2024.findings-naacl)
Copied to clipboard
| Challenge: | Existing methods for sign language translation (SLT) rely on signer identity labels, which is often impractical and costly in real-world applications. |
| Approach: | They propose a signer diversity-driven data augmentation method that can generalize to signers not encountered during training. |
| Outcome: | The proposed method achieves state-of-the-art results without relying on signer identity labels. |
Issue Framing in Online Discussion Fora (N19-1)
Copied to clipboard
| Challenge: | In online discussion fora, speakers often make arguments by highlighting certain aspects of the topic. |
| Approach: | They propose to use a newswire and social media annotated corpus to detect issue frames in online discussions. |
| Outcome: | The proposed model can be applied to the domain of discussion fora using multi-task and adversarial training. |
Unsupervised Question Answering via Answer Diversifying (2022.coling-1)
Copied to clipboard
| Challenge: | Existing extractive question answering methods use labeled data to train QA models. |
| Approach: | They propose an unsupervised method by diversifying answers by using data construction, data augmentation and denoising filter. |
| Outcome: | The proposed method outperforms previous models on five benchmark datasets . it shows strong performance in the few-shot learning setting . |
Soft Representation Learning for Sparse Transfer (P19-1)
Copied to clipboard
| Challenge: | Using adversarial training, we can “soft-code” shared and private spaces to avoid sparse sharing. |
| Approach: | They propose to use adversarial training to “soft-code” shared and private spaces to avoid the shared space gets too sparse. |
| Outcome: | The proposed architecture avoids sparse sharing of shared and private spaces, and also deals with low-quality input. |
Text Processing Like Humans Do: Visually Attacking and Shielding NLP Systems (N19-1)
Copied to clipboard
Steffen Eger, Gözde Gül Şahin, Andreas Rücklé, Ji-Ung Lee, Claudia Schulz, Mohsen Mesgar, Krishnkant Swarnkar, Edwin Simpson, Iryna Gurevych
| Challenge: | Recent studies show that visual similarity can play a decisive role in assessing the meaning of characters. |
| Approach: | They investigate the impact of visual adversarial attacks on current NLP systems . they explore three shielding methods that significantly improve the robustness of the models . |
| Outcome: | The proposed methods improve performance but still fall behind non-attack scenarios. |
Adversarial Multitask Learning for Joint Multi-Feature and Multi-Dialect Morphological Modeling (P19-1)
Copied to clipboard
| Challenge: | Morphological tagging is challenging for morphologically rich languages due to the large combined target space and the need for more training data to minimize model sparsity. |
| Approach: | They propose to use multitask learning and adversarial training to address morphological richness and dialectal variations in the context of full morphology. |
| Outcome: | The proposed model achieves state-of-the-art for two dialectal variants: Modern Standard Arabic (high-resource “dialect”) and Egyptian Arabic (low-resourced dialect). |
CLINE: Contrastive Learning with Semantic Negative Examples for Natural Language Understanding (2021.acl-long)
Copied to clipboard
| Challenge: | Pre-trained language models are vulnerable to simple perturbations, causing poor robustness . recent studies show that adversarial training is useless or harmful for the model to detect these semantic changes. |
| Approach: | They propose to use adversarial training to improve the robustness of pre-trained models . they propose to construct negative examples with similar and opposite semantics . |
| Outcome: | Empirical results show that the proposed approach improves on sentiment analysis, reasoning, and reading comprehension tasks. |
Extracting Military Event Temporal Relations via Relative Event Time Prediction and Virtual Adversarial Training (2025.findings-naacl)
Copied to clipboard
| Challenge: | Existing models for extracting event temporal relations typically compare the relative times of events directly, neglecting the contextual information between event pairs. |
| Approach: | They propose a temporal relationship extraction model based on relative event time prediction and virtual adversarial training, MFRV. |
| Outcome: | The proposed model can capture and infer temporal relationships and can be generalized by generating adversarial samples. |
Adversarial Attack and Defense of Structured Prediction Models (2020.emnlp-main)
Copied to clipboard
| Challenge: | Existing approaches to building effective adversarial attackers focus on classification problems. |
| Approach: | They propose a framework that learns to attack a structured prediction model with feedbacks from multiple reference models. |
| Outcome: | The proposed framework is able to attack state-of-the-art models and boost them with training . it is based on a sequence-to-sequence model with feedbacks from multiple reference models . |
Enhancing Topic-to-Essay Generation with External Commonsense Knowledge (P19-1)
Copied to clipboard
| Challenge: | Existing methods for topic-to-essay generation are insufficient for generating novel, diverse, and topic-consistent paragraph-level text with a set of topics. |
| Approach: | They propose to integrate commonsense from external knowledge base into the generator through dynamic memory mechanism and adversarial training to further improve topic-consistency. |
| Outcome: | The proposed task is more novel, diverse, and topic-consistent than existing methods in terms of both automatic and human evaluation. |
Towards Robustness of Text-to-SQL Models against Synonym Substitution (2021.acl-long)
Copied to clipboard
Yujian Gan, Xinyun Chen, Qiuping Huang, Matthew Purver, John R. Woodward, Jinxia Xie, Pengsheng Huang
| Challenge: | Existing text-to-SQL models rely on lexical matching between words in NL questions and tokens in table schemas, which may break the schema linking mechanism. |
| Approach: | They propose a human-curated dataset for text-to-SQL translation . they replace schema-related words with manually selected synonyms . |
| Outcome: | The proposed model outperforms its counterparts without the defense. |
Parameter-efficient Modularised Bias Mitigation via AdapterFusion (2023.eacl-main)
Copied to clipboard
Deepak Kumar, Oleg Lesota, George Zerveas, Daniel Cohen, Carsten Eickhoff, Markus Schedl, Navid Rekabsaz
| Challenge: | Large pre-trained language models contain societal biases and carry along these biase . Current approaches to mitigate these bias impose debiasing by updating model parameters, effectively transferring model to irreversible debiased state. |
| Approach: | They propose to develop stand-alone debiasing functionalities separate from the model, which can be integrated into the model on-demand while keeping the core model untouched. |
| Outcome: | The proposed approach improves or maintains effectiveness of bias mitigation, avoids catastrophic forgetting in a multi-attribute scenario, and maintains on-par task performance while granting parameter-efficiency and easy switching between the original and debiased models. |
A Closer Look into the Robustness of Neural Dependency Parsers Using Better Adversarial Examples (2021.findings-acl)
Copied to clipboard
| Challenge: | Neural network-based models have been successful in a wide range of NLP tasks, but their performance is undermined by adversarial examples that would pose no confusion for humans. |
| Approach: | They propose a method to generate high-quality adversarial examples with a higher number of candidate generators and stricter filters and then verify their quality using automatic and human evaluations. |
| Outcome: | The proposed method improves the robustness of English parsing models by relying on adversarial training and model ensembling. |
Guided Dialogue Policy Learning without Adversarial Learning in the Loop (2020.findings-emnlp)
Copied to clipboard
Ziming Li, Sungjin Lee, Baolin Peng, Jinchao Li, Julia Kiseleva, Maarten de Rijke, Shahin Shayandeh, Jianfeng Gao
| Challenge: | Reinforcement learning methods suffer from sparse and unstable reward signals . alternating training of dialogue agent and reward model can get stuck in local optima . |
| Approach: | They propose to decompose adversarial training into two steps to improve dialogue policy learning. |
| Outcome: | The proposed method achieves remarkable task success rate using both on-policy and off-poly reinforcement learning methods. |
Evaluating Neural Model Robustness for Machine Comprehension (2021.eacl-main)
Copied to clipboard
| Challenge: | evaluating model robustness to adversarial attacks can provide deeper understanding of how deep neural networks work and what kind of linguistic information is actually captured by neural networks. |
| Approach: | They propose a method for strategic sentence-level perturbations to evaluate model robustness to adversarial attacks using character and word perturbations. |
| Outcome: | The proposed model improves model performance during adversarial attacks by using ensembles and predicts errors in adversarials. |
ARREST: Adversarial Resilient Regulation Enhancing Safety and Truth in Large Language Models (2026.eacl-long)
Copied to clipboard
| Challenge: | Large Language Models lack human cognition to balance factuality and safety . a common issue is representational misalignment in their activation space . |
| Approach: | They propose a framework that regulates drifted features and engages both soft and hard refusals in addition to factual corrections. |
| Outcome: | The proposed framework regulates falsehood into truthfulness and unsafe output into safe output without fine-tuning the model's parameters. |
Adversarial Preference Optimization: Enhancing Your Alignment via RM-LLM Game (2024.findings-acl)
Copied to clipboard
| Challenge: | Existing methods for training large language models require additional annotations to adjust to shifted distributions. |
| Approach: | They propose an algorithm that allows LLMs and reward models to update alternatively via a min-max game to improve their alignment. |
| Outcome: | The proposed framework improves existing alignment baselines in terms of LLM helpfulness and harmlessness. |
Cross-Lingual Leveled Reading Based on Language-Invariant Features (2021.findings-emnlp)
Copied to clipboard
| Challenge: | Leveled reading (LR) aims to automatically classify texts by the cognitive levels of readers. |
| Approach: | They propose to use adversarial training and cross-lingual pre-training methods to transfer LR knowledge from annotated data in resource-rich English to Chinese. |
| Outcome: | The proposed method captures language-invariant features between English and Chinese. |
Improving Grammatical Error Correction Models with Purpose-Built Adversarial Examples (2020.emnlp-main)
Copied to clipboard
| Challenge: | Existing methods for grammatical error correction are data-hungry and it is hard to train a seq2seq model with good performance without suf-Clean. |
| Approach: | They propose a method inspired by adversarial training to generate more meaningful and valuable training examples by continually identifying weak spots of a model and to enhance the model by gradually adding adversarials to the training set. |
| Outcome: | The proposed method improves generalization and robustness of GEC models by adding adversarial examples to the training set. |
A Disentangled Adversarial Neural Topic Model for Separating Opinions from Plots in User Reviews (2021.naacl-main)
Copied to clipboard
| Challenge: | Existing topic models may extract topics associated with writers’ subjective opinions mixed with those related to factual descriptions. |
| Approach: | They propose a neural topic model combined with adversarial training to disentangle opinion topics from plot and neutral ones. |
| Outcome: | The proposed model shows improved coherence and variety of topics, consistent disentanglement rate, and superior sentiment classification performance to other supervised topic models. |
Perturbations in the Wild: Leveraging Human-Written Text Perturbations for Realistic Adversarial Attack and Defense (2022.findings-acl)
Copied to clipboard
| Challenge: | ANTHRO extracts over 600K human-written text perturbations and leverages them for realistic adversarial attacks. |
| Approach: | They propose an adversarial text manipulation algorithm that inductively extracts over 600K human-written text perturbations and leverages them for realistic adversarials. |
| Outcome: | The proposed algorithm outperforms the TextBugger baseline with an increase of 50% and 40% in terms of semantic preservation and stealthiness when evaluated by layperson and professional human workers. |
CM-TTS: Enhancing Real Time Text-to-Speech Synthesis Efficiency through Weighted Samplers and Consistency Models (2024.findings-naacl)
Copied to clipboard
| Challenge: | Neural Text-to-Speech systems are a promising approach for high-fidelity speech synthesis . but the efficiency of multi-step sampling in Diffusion Models presents challenges . |
| Approach: | They propose a novel architecture grounded in consistency models to improve model convergence. |
| Outcome: | The proposed architecture achieves top-quality speech synthesis in fewer steps without adversarial training or pre-trained model dependencies. |
Improving Robustness of Language Models from a Geometry-aware Perspective (2022.findings-acl)
Copied to clipboard
| Challenge: | Recent studies have found that removing the norm-bounded projection and increasing search steps in adversarial training can significantly improve robustness. |
| Approach: | They propose friendly adversarial data augmentation and geometry-aware adversarial training to achieve stronger robustness using fewer search steps. |
| Outcome: | The proposed method can obtain stronger robustness using fewer steps than existing methods. |
Improving Cross-modal Alignment for Text-Guided Image Inpainting (2023.eacl-main)
Copied to clipboard
| Challenge: | Existing methods allocate most of computation to visual encoding, while light computation on modeling modality interactions. |
| Approach: | They propose a novel model for text-guided image inpainting by improving cross-modal alignment knowledge by using a vision-language encoder and an image generator. |
| Outcome: | The proposed model achieves state-of-the-art performance compared with other strong competitors on two vision-language datasets. |
Avoiding Reasoning Shortcuts: Adversarial Evaluation, Training, and Model Development for Multi-Hop QA (P19-1)
Copied to clipboard
| Challenge: | In multi-hop question answering, models need to connect multiple pieces of evidence scattered in a long context to answer the question. |
| Approach: | They propose to use a control unit that dynamically attends to the question at different reasoning hops to guide the model's multi-hop reasoning. |
| Outcome: | The proposed model outperforms baseline models but is limited on adversarial test. |
Document-Level Event Factuality Identification via Adversarial Neural Network (N19-1)
Copied to clipboard
| Challenge: | Document-level event factuality identification is crucial for discourse understanding in NLP . identifying document-level factual of events requires comprehensive understanding of documents . |
| Approach: | They propose to construct a corpus annotated with document- and sentence-level event factuality information on English and Chinese texts. |
| Outcome: | The proposed model outperforms baselines on the constructed corpus. |
Tasty Burgers, Soggy Fries: Probing Aspect Robustness in Aspect-Based Sentiment Analysis (2020.emnlp-main)
Copied to clipboard
| Challenge: | Existing ABSA test sets cannot be used to distinguish the sentiment of the target aspect from the non-target aspect. |
| Approach: | They propose a simple but effective approach to enrich ABSA test sets by disentangle the confounding sentiments of non-target aspects from the target aspect’s sentiment. |
| Outcome: | The proposed model can distinguish the sentiment of the non-target aspects from the target aspect’s sentiment by using the Aspect Robustness Test Set (ARTS). |
Optimising Equal Opportunity Fairness in Model Training (2022.naacl-main)
Copied to clipboard
| Challenge: | Existing methods to reduce bias have been shown to be effective over real-world datasets. |
| Approach: | They propose two new training objectives which directly optimise for the widely-used criterion of equal opportunity. |
| Outcome: | The proposed training objectives directly optimise for the widely-used criterion of equal opportunity while maintaining high performance over two classification tasks. |
An End-to-End Generative Architecture for Paraphrase Generation (D19-1)
Copied to clipboard
| Challenge: | Existing methods for generating paraphrases with linguistic knowledge are often domain specific and hard to scale, or yield inferior results. |
| Approach: | They propose an end-to-end conditional generative architecture for generating paraphrases via adversarial training which does not depend on extra linguistic information. |
| Outcome: | The proposed method outperforms existing models on automatic metrics and human evaluations on four public datasets. |
Improving Domain Adaptation Translation with Domain Invariant and Specific Information (N19-1)
Copied to clipboard
| Challenge: | Neural machine translation models are based on the encoder-decoder architecture, which makes them overfitting to frequent observations. |
| Approach: | They propose a method to explicitly model out-of-domain information in an encoder-decoder framework . they propose combining out- of-domain training data with out-out-of domain data . |
| Outcome: | The proposed method outperforms baselines on multiple data sets. |
Generating Natural Language Adversarial Examples (D18-1)
Copied to clipboard
| Challenge: | Recent research has shown that deep neural networks are vulnerable to adversarial examples, perturbations to correctly classified examples which can cause the model to misclassify. |
| Approach: | They propose to generate adversarial examples that fool well-trained sentiment analysis and textual entailment models by using a black-box population-based optimization algorithm. |
| Outcome: | The proposed model is able to fool well-trained sentiment analysis and textual entailment models with success rates of 97% and 70%, respectively. |
Adversarial Augmentation Policy Search for Domain and Cross-Lingual Generalization in Reading Comprehension (2020.findings-emnlp)
Copied to clipboard
| Challenge: | Reading comprehension models often overfit to nuances of training datasets and fail at adversarial evaluation. |
| Approach: | They propose a method that introduces multiple points of confusion within the context and shows dependence on insertion location of the distractor. |
| Outcome: | The proposed methods improve robustness against adversarial evaluation but weak generalization to the source domain and new domains and languages. |
Dual Adversarial Neural Transfer for Low-Resource Named Entity Recognition (P19-1)
Copied to clipboard
| Challenge: | Named entity recognition (NER) is an important step in most natural language processing (NLP) applications. |
| Approach: | They propose a dual-adversarial neural transfer method for addressing low-resource Named Entity Recognition (NER) they propose 'Generalized Resource-Adversarial Discriminator' and 'accidental training' |
| Outcome: | The proposed method improves on low-resource Named Entity Recognition (NER) with two variants, i.e., DATNet-F and DATNET-P, and adversarial training is adopted to boost model generalization. |
Evaluating and Enhancing the Robustness of Dialogue Systems: A Case Study on a Negotiation Agent (N19-1)
Copied to clipboard
| Challenge: | Recent research has demonstrated that goal-oriented dialogue agents can achieve striking performance when interacting with human users. |
| Approach: | They develop algorithms to evaluate the robustness of a goal-oriented dialogue agent by carefully designed attacks using adversarial agents. |
| Outcome: | The proposed attacks reduce the advantage of rewards between the attacker and the trained agent from 2.68 to -5.76 on a scale from -10 to 10 for randomized goals. |
Exploring Robust Overfitting for Pre-trained Language Models (2023.findings-acl)
Copied to clipboard
| Challenge: | Recent literature has revealed their vulnerability to crafted adversarial examples on a wide range of NLP tasks. |
| Approach: | They propose to combine regularization methods with adversarial training to mitigate robust overfitting for pre-trained language models by scaling the model's loss. |
| Outcome: | The proposed methods mitigate robust overfitting upon three top adversarial training methods and further promote adversarially robustness. |
Rethinking Style Transformer with Energy-based Interpretation: Adversarial Unsupervised Style Transfer using a Pretrained Model (2022.emnlp-main)
Copied to clipboard
Hojun Cho, Dohee Kim, Seungwoo Ryu, ChaeHun Park, Hyungjong Noh, Jeong-in Hwang, Minseok Choi, Edward Choi, Jaegul Choo
| Challenge: | Existing methods to train text style transfer models with adversarial loss degrade fluency compared to other metrics. |
| Approach: | They propose a method which leverages a pretrained language model to improve fluency by restructuring the discriminator and the model itself. |
| Outcome: | The proposed model achieves state-of-the-art on three public benchmarks and achieved state-outperformance on the overall metrics. |
Adversarial and Domain-Aware BERT for Cross-Domain Sentiment Analysis (2020.acl-main)
Copied to clipboard
| Challenge: | Cross-domain sentiment classification requires large amounts of labeled data. |
| Approach: | They propose to apply a pre-training language model BERT on unsupervised domain adaptation . they propose to distill domain-specific features in a self-supervised way . |
| Outcome: | The proposed model outperforms state-of-the-art methods on Amazon dataset . it can be applied to the unsupervised domain adaptation task without domain awareness . |
Influence Tuning: Demoting Spurious Correlations via Instance Attribution and Instance-Driven Updates (2021.findings-emnlp)
Copied to clipboard
| Challenge: | Existing approaches to interpret black-box models to learn spurious correlations are not well understood. |
| Approach: | They propose a procedure that leverages model interpretations to update parameters towards a plausible interpretation rather than an interpretation that relies on spurious patterns in data. |
| Outcome: | The proposed procedure outperforms baseline methods that use adversarial training in a controlled setup. |
Self-Supervised Dialogue Learning (P19-1)
Copied to clipboard
| Challenge: | Existing dialogue systems have failed to capture the order of utterances in coherent dialogues. |
| Approach: | They propose a self-supervised learning task to capture the flow of dialogues . they propose 'inconsistent order detection' task to predict whether utterance is ordered or misordered . |
| Outcome: | The proposed methods can be applied to open-domain and task-oriented dialogue scenarios and achieve state-of-the-art performance on the OpenSubtitiles and Movie-Ticket Booking datasets. |
Flooding-X: Improving BERT’s Resistance to Adversarial Attacks via Loss-Restricted Fine-Tuning (2022.acl-long)
Copied to clipboard
Qin Liu, Rui Zheng, Bao Rong, Jingyi Liu, ZhiHua Liu, Zhanzhan Cheng, Liang Qiao, Tao Gui, Qi Zhang, Xuanjing Huang
| Challenge: | Existing approaches to generating adversarial perturbations scale up the cost of training computational complexity by the number of gradient steps it takes to obtain the adversarials. |
| Approach: | They propose a flood method which aims at better generalization and a criterion to bring hyper-parameter-dependent flooding into effect with a narrowed-down search space by measuring how the gradient steps taken within one epoch affect the loss of each batch. |
| Outcome: | The proposed method improves BERT’s resistance to textual adversarial attacks by a large margin and achieves state-of-the-art robust accuracy on various text classification and GLUE tasks. |
Modular and On-demand Bias Mitigation with Attribute-Removal Subnetworks (2023.findings-acl)
Copied to clipboard
| Challenge: | Existing studies show that pre-trained language models can be used to mitigate societal biases and stereotypes. |
| Approach: | They propose a modular bias mitigation approach that integrates debiasing modules into the core model on-demand at inference time. |
| Outcome: | The proposed approach improves on-par with baseline finetuning on gender, race, and age protected attributes on three classification tasks with gender, age, and race as protected attributes. |
CAT-Gen: Improving Robustness in NLP Models via Controlled Adversarial Text Generation (2020.emnlp-main)
Copied to clipboard
| Challenge: | Existing adversarial text generation approaches can lead to generation lacking diversity or fluency, whereas perturbing in the intermediate representation space can lead a model to generate generations that are not related to the input. |
| Approach: | They propose to generate adversarial texts through controllable attributes that are known to be invariant to task labels. |
| Outcome: | The proposed model generates more diverse and fluent adversarial examples, compared to existing approaches, and is more robust against model re-training and different model architectures. |
Achieving Verified Robustness to Symbol Substitutions via Interval Bound Propagation (D19-1)
Copied to clipboard
Po-Sen Huang, Robert Stanforth, Johannes Welbl, Chris Dyer, Dani Yogatama, Sven Gowal, Krishnamurthy Dvijotham, Pushmeet Kohli
| Challenge: | Recent work has exposed the vulnerabilities of neural NLP models, e.g. with small, semantically invariant input alterations. |
| Approach: | They propose to model text classification under synonym replacements or character flip perturbations and then use a formal model verification method to verify its robustness. |
| Outcome: | The proposed models show little difference in terms of nominal accuracy, but have much improved verified accuracy under perturbations and come with an efficiently computable formal guarantee on worst case adversaries. |
Generating Classical Chinese Poems via Conditional Variational Autoencoder and Adversarial Training (D18-1)
Copied to clipboard
| Challenge: | Existing models for automatic poetry generation lack term novelty and thematic consistency. |
| Approach: | They propose a conditional variational autoencoder with adversarial training for classical Chinese poem generation. |
| Outcome: | The proposed model outperforms existing models on a large poetry corpus on 'classical Chinese' . it generates poems with novel terms and learns their thematic consistency with their titles. |
PARSE: An Efficient Search Method for Black-box Adversarial Text Attacks (2022.coling-1)
Copied to clipboard
| Challenge: | Neural networks are vulnerable to adversarial examples, i.e., under a black-box scenario. |
| Approach: | They propose a word-level search algorithm that searches for subareas under dynamic search space following the subarea importance. |
| Outcome: | The proposed algorithm can achieve comparable success rates to complex search methods while saving numerous queries and time. |
Targeted Adversarial Training for Natural Language Understanding (2021.naacl-main)
Copied to clipboard
| Challenge: | Existing adversarial training approaches focus on making adversarials less expensive or regularizing rather than replacing the standard training objective. |
| Approach: | They propose an algorithm to introspect current mistakes and prioritize adversarial training steps to where the model errs the most. |
| Outcome: | The proposed algorithm improves adversarial training for natural language understanding by introspecting mistakes and prioritizing training steps to where the model errs the most. |
Learn2Weight: Parameter Adaptation against Similar-domain Adversarial Attacks (2022.coling-1)
Copied to clipboard
| Challenge: | Prior black-box adversarial attacks assume that attackers can observe output labels from target models based on selected inputs. |
| Approach: | They propose a black-box adversarial attack where an attacker can transfer adversarials to a target domain and cause poor performance in target model. |
| Outcome: | The proposed attack is effective against similar-domain adversarial examples compared to standard black-box defense methods such as adversarials training and defense distillation. |
ARAML: A Stable Adversarial Training Framework for Text Generation (D19-1)
Copied to clipboard
| Challenge: | Existing generative adversarial networks suffer from the instability of reinforcement learning training algorithms such as policy gradient, leading to unstable performance. |
| Approach: | They propose a framework where the discriminator assigns rewards to samples acquired from a stationary distribution near the data rather than the generator’s distribution. |
| Outcome: | The proposed framework outperforms state-of-the-art text GANs with a more stable training process. |
ADDMU: Detection of Far-Boundary Adversarial Examples with Data and Model Uncertainty Estimation (2022.emnlp-main)
Copied to clipboard
| Challenge: | Existing methods show poor performance under Far Boundary (FB) adversarial examples. |
| Approach: | They propose to use a new technique to detect adversarial examples based on data and model uncertainty to outperform existing methods. |
| Outcome: | The proposed method outperforms existing methods by 3.6 and 6.0 AUC points under each scenario. |
DiffuseDef: Improved Robustness to Adversarial Attacks via Iterative Denoising (2025.acl-long)
Copied to clipboard
| Challenge: | Existing adversarial defense methods for natural language processing still pose challenges to adversarials. |
| Approach: | They propose a novel adversarial defense method that incorporates a diffusion layer as a denoiser between the encoder and the classifier. |
| Outcome: | The proposed method improves over existing adversarial defense methods and achieves state-of-the-art performance against black-box and white-box adversarials. |
Adversarial Training on Disentangling Meaning and Language Representations for Unsupervised Quality Estimation (2022.coling-1)
Copied to clipboard
| Challenge: | Existing methods for unsupervised quality estimation of machine translation are limited to several major language pairs. |
| Approach: | They propose a method to distill language-agnostic meaning embeddings from multilingual sentence encoders for unsupervised quality estimation of machine translation. |
| Outcome: | The proposed method achieves higher correlations with human evaluations on unsupervised translation quality estimation. |
R-AT: Regularized Adversarial Training for Natural Language Understanding (2022.findings-emnlp)
Copied to clipboard
| Challenge: | Currently, adversarial training is a popular and powerful regularization method in the natural language domain. |
| Approach: | They propose to regularize adversarial training via dropout by perturbing word embeddings . they find that R-AT can improve many models by reducing adversariality . |
| Outcome: | The proposed method can reduce the inconsistency between training and testing of models with dropout. |
Impact of Adversarial Training on Robustness and Generalizability of Language Models (2023.findings-acl)
Copied to clipboard
| Challenge: | Adversarial training is widely acknowledged as the most effective defense against adversarial attacks, but achieving both robustness and generalization requires a trade-off. |
| Approach: | They propose to compare pre-training data augmentation and training time input perturbations with embedding space perturbations to find out whether they improve generalization. |
| Outcome: | The proposed methods improve generalization and robustness of the trained models. |
Adversarial Authorship Attribution for Deobfuscation (2022.acl-long)
Copied to clipboard
| Challenge: | Existing authorship attribution approaches do not consider adversarial threat model . authors show adversarially trained authorship attributors can degrade effectiveness of existing obfuscators from 20-30% to 5-10% . |
| Approach: | They propose to use rule-based and learning-based text obfuscation approaches to counter authorship attribution. |
| Outcome: | The proposed approaches do not consider the adversarial threat model . authors show that adversarially trained attributors can degrade effectiveness of existing obfuscators from 20-30% to 5-10% . |
Answer-guided and Semantic Coherent Question Generation in Open-domain Conversation (D19-1)
Copied to clipboard
| Challenge: | Existing methods for question generation suffer from dullness and deviation problem, which can lead to deviated or dull questions. |
| Approach: | They propose two methods to enhance semantic coherence between question and answer by using a coherent score and adversarial training to explicitly control question generation. |
| Outcome: | The proposed methods outperform state-of-the-art baseline algorithms with large margins in raising semantic coherent questions. |
Adversarial Training for Low-Resource Disfluency Correction (2023.findings-acl)
Copied to clipboard
| Challenge: | Disfluencies can be introduced in conversational speech due to the conversational nature of speech and/or speech impairments such as stuttering. |
| Approach: | They propose an adversarial sequence-tagging model for Disfluency Correction . they evaluate it in Bengali, Hindi, and Marathi languages and use it to correct stuttering disfluencies . |
| Outcome: | The proposed technique improves in Bengali, Hindi, and Marathi languages . it also removes stuttering disfluencies in ASR transcripts introduced by speech impairments . |
Fair NLP Models with Differentially Private Text Encoders (2022.findings-emnlp)
Copied to clipboard
| Challenge: | Encoded text representations often capture sensitive attributes about individuals, raising privacy concerns and making models unfair to certain groups. |
| Approach: | They propose an approach that combines privacy and adversarial training to learn private representations which induces fairer models. |
| Outcome: | The proposed approach improves on four NLP datasets and shows that privacy and fairness can positively reinforce each other. |
Text Style Transferring via Adversarial Masking and Styled Filling (2022.emnlp-main)
Copied to clipboard
| Challenge: | Existing models for text style transfer suffer from two challenges: the word masking procedure may mistakenly remove unexpected words and the selected words in the word filling procedure lack diversity and semantic consistency. |
| Approach: | They propose a style transfer model with adversarial masking and styled filling techniques to solve these challenges. |
| Outcome: | The proposed model performs well on two benchmark text style transfer data sets. |
Towards Zero-Shot Knowledge Distillation for Natural Language Processing (2021.emnlp-main)
Copied to clipboard
| Challenge: | Knowledge distillation (KD) is a common knowledge transfer algorithm used for model compression across a variety of deep learning based natural language processing (NLP) solutions. |
| Approach: | They propose to use teacher training data for model compression . they investigate six tasks and find they can achieve between 75% and 92% of the teacher’s classification score while compressing the model 30 times. |
| Outcome: | The proposed solution achieves between 75% and 92% of the teacher’s classification score while compressing the model 30 times. |
Word-level Textual Adversarial Attacking as Combinatorial Optimization (2020.acl-main)
Copied to clipboard
| Challenge: | Existing word-level attack models are far from perfect because of unsuitable search space reduction methods and inefficient optimization algorithms. |
| Approach: | They propose a novel adversarial adversarialist model that incorporates word substitution and particle swarm optimization to solve two problems separately. |
| Outcome: | The proposed model achieves much higher success rates and crafts more high-quality adversarial examples as compared to baseline methods. |
Generating Plausible Counterfactual Explanations for Deep Transformers in Financial Text Classification (2020.coling-main)
Copied to clipboard
| Challenge: | Existing methods for generating textual-based explanations are highly implausible and damage a user’s trust in the automated system. |
| Approach: | They propose a method which first applies robust transformer models on a real-world, up-to-date, self-collected mergers and acquisitions dataset and then generates plausible, post-hoc, counterfactual explanations. |
| Outcome: | The proposed model improves model accuracy and human performance while generating plausible explanations based on human trials. |
Combating Adversarial Misspellings with Robust Word Recognition (P19-1)
Copied to clipboard
| Challenge: | a sub-field of word recognition models is emerging to combat adversarial spelling mistakes . imperceptible attacks can cause models to misclassify examples, but training robust models remains a challenge . |
| Approach: | They propose to place a word recognition model in front of a downstream classifier to combat adversarial spelling mistakes. |
| Outcome: | The proposed model outperforms adversarial training and off-the-shelf spell checkers in a word recognition task. |
Efficient Adversarial Training with Robust Early-Bird Tickets (2022.emnlp-main)
Copied to clipboard
| Challenge: | Existing methods to improve the robustness of pre-trained language models are expensive because of the need to generate adversarial examples via gradient descent. |
| Approach: | They propose an adversarial optimization method that searches for robust tickets with structured sparsity in the early stage and fine-tunes tickets in the remaining time. |
| Outcome: | The proposed method achieves up to 7 13 training speedups while maintaining comparable or even better robustness compared to the most competitive state-of-the-art methods. |
Model-tuning Via Prompts Makes NLP Models Adversarially Robust (2023.emnlp-main)
Copied to clipboard
| Challenge: | Pre-trained models are typically adapted to downstream tasks by appending a randomly initialized multilayer perceptron to their topmost representation layer and fine-tuning the entire model on a downstream task. |
| Approach: | They propose to append a multilayer perceptron to a CLS token and fine-tune the entire model on a downstream task. |
| Outcome: | The proposed model-tuning via prompts outperforms adversarial training-based state-of-art defenses by 3.5% and improves against adversarials by 8% over standard methods. |
Using Adversarial Examples in Natural Language Processing (L18-1)
Copied to clipboard
| Challenge: | Recent advances in machine learning have led to the use of adversarial examples in training of neural networks. |
| Approach: | They investigate the effect of using adversarial examples during training of recurrent neural networks whose text input is in the form of a sequence of word/character embeddings. |
| Outcome: | The proposed method provides regularization effect and enables training of models with greater number of parameters without overfitting. |
A Geometry-Inspired Attack for Generating Natural Language Adversarial Examples (2020.coling-main)
Copied to clipboard
| Challenge: | Existing techniques to generate adversarial examples for natural language are limited . previous research on adversarials focused on images, but this is not the case with natural language. |
| Approach: | They propose a geometry-inspired attack for generating natural language adversarial examples . they use deep neural networks to iteratively approximate the decision boundary . |
| Outcome: | The proposed attack fools natural language models with high success rates while replacing a few words. |
Cross-lingual Spoken Language Understanding with Regularized Representation Alignment (2020.emnlp-main)
Copied to clipboard
| Challenge: | despite promising results, current cross-lingual models suffer from imperfect cross-linguistic representation alignments between the source and target languages, which makes the performance sub-optimal. |
| Approach: | They propose a regularization approach to align word-level and sentence-level representations across languages without external resources. |
| Outcome: | The proposed model outperforms state-of-the-art models in few-shot and zero-shot scenarios and achieves comparable performance to supervised training with all training data. |
Coupling Distant Annotation and Adversarial Training for Cross-Domain Chinese Word Segmentation (2020.acl-main)
Copied to clipboard
| Challenge: | Fully supervised neural approaches have achieved significant progress in the task of Chinese word segmentation (CWS) however, they suffer from the cross-domain issue when they come to processing of out-of-domain data. |
| Approach: | They propose to use Chinese word as a target domain for distant annotation and adversarial training to reduce noise and maximize utilization of the source domain information. |
| Outcome: | The proposed method outperforms existing state-of-the-art methods on real-world datasets and significantly outperformed previous state- of-the art methods. |
Locket: Robust Feature-Locking Technique for Language Models (2026.acl-long)
Copied to clipboard
| Challenge: | Existing FLoTEs (e.g., password-locked models) fail to meet these criteria. |
| Approach: | They propose a feature-locking technique that is effective in refusing locked features . they propose scalable FLoTEs that can selectively disable specific features of a model . |
| Outcome: | The proposed solution is effective (100% refusal rate), utility-preserving ( 7% utility degradation), robust (5% attack success rate), and scalable to multiple features and clients. |
INTapt: Information-Theoretic Adversarial Prompt Tuning for Enhanced Non-Native Speech Recognition (2023.findings-acl)
Copied to clipboard
| Challenge: | Existing approaches to improve ASR performance with pre-trained models require updating the pre-training model weights. |
| Approach: | They propose a method that uses prompts concatenated to the original input to re-modulate attention of the pre-trained model. |
| Outcome: | The proposed model improves the performance of L2 English and increases similarity between L2 and L1 accents. |
CAPE: Context-Aware Private Embeddings for Private Language Learning (2021.emnlp-main)
Copied to clipboard
| Challenge: | Existing methods to obtain text representations or embeddings with these models encoding personally identifiable information may lead to privacy leaks. |
| Approach: | They propose a novel approach which combines differential privacy and adversarial learning to preserve privacy during training of embeddings. |
| Outcome: | The proposed approach reduces private information leakage by 3% over the current method. |
Cross-Domain Fake News Detection based on Dual-Granularity Adversarial Training (2025.coling-main)
Copied to clipboard
| Challenge: | Existing approaches to detect fake news in unseen domains are limited by domain-specific training. |
| Approach: | They propose a cross-domain fake news detection method based on adversarial training . they use a document-level and entity-level model to generate domain-independent representations . |
| Outcome: | The proposed method can detect fake news in unseen domains with the help of pre-trained language models. |
DARE: Towards Robust Text Explanations in Biomedical and Healthcare Applications (2023.acl-long)
Copied to clipboard
| Challenge: | Several explainability methods have been shown to be brittle in the face of adversarial perturbations of their inputs in the image and generic textual domains. |
| Approach: | They propose to adapt existing attribution robustness estimation methods to take into account domain-specific plausibility and to train networks that display robust attributions. |
| Outcome: | The proposed methods are able to characterize domain-specific plausibility and provide robust explanations on biomedical datasets. |
A Black-Box Attack on Code Models via Representation Nearest Neighbor Search (2023.findings-emnlp)
Copied to clipboard
| Challenge: | Existing methods for generating adversarial code examples face challenges such as limted availability of substitute variables and the creation of adversarials with noticeable perturbations. |
| Approach: | They propose a search seed based on historical attacks to find adversarial substitutes . they employ a pre-trained variable name encoder to map the search seed to a continuous vector space . |
| Outcome: | The proposed approach outperforms baseline methods in terms of ASR and QT. |
Context-based Virtual Adversarial Training for Text Classification with Noisy Labels (2022.lrec-1)
Copied to clipboard
| Challenge: | Recent studies show that deep neural networks can memorize noisy labels with limited training time. |
| Approach: | They propose a virtual adversarial training method to prevent a classifier from overfitting to noisy labels. |
| Outcome: | The proposed method performs the adversarial training in the context rather than the inputs. |
FAME: Feature-Based Adversarial Meta-Embeddings for Robust Input Representations (2021.emnlp-main)
Copied to clipboard
| Challenge: | Recent work on word embeddings and pre-trained language models has shown the large impact of language representations on natural language processing (NLP) models across tasks and domains. |
| Approach: | They propose feature-based adversarial meta-embeddings with an attention function that is guided by word-specific properties, such as shape and frequency, to handle subword-based embeddings. |
| Outcome: | The proposed model improves performance in downstream tasks even with word embeddings from transformers. |
Avoiding the Hypothesis-Only Bias in Natural Language Inference via Ensemble Adversarial Training (2020.emnlp-main)
Copied to clipboard
| Challenge: | Neural models pick up on annotation artefacts and spurious correlations, resulting in learning sentences that suffer from the same biases. |
| Approach: | They propose to tackle this problem by using adversarial training to reduce the bias in sentence representations by using an ensemble of adversaries. |
| Outcome: | The proposed approach produces more robust models outperforming previous de-biasing efforts when generalised to 12 other NLI datasets. |
PromptAttack: Probing Dialogue State Trackers with Adversarial Prompts (2023.findings-acl)
Copied to clipboard
| Challenge: | Toward building more robust and reliable conversational systems, we introduce a prompt-based learning approach to automatically generate effective adversarial examples to probe DST models. |
| Approach: | They propose a prompt-based learning approach to automatically generate effective adversarial examples to probe DST models. |
| Outcome: | The proposed framework leads to the greatest reduction in accuracy and the best attack success rate while maintaining good fluency and a low perturbation ratio. |
Self-Reflection Improves Safety of Large Reasoning Models (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing safety alignment methods are shallow and do not address deeper risks and attacks in reasoning processes. |
| Approach: | They propose a technique that introduces a special Self-Reflection token to enable LRMs to perform self-reflection during generation and recover from harmful outputs. |
| Outcome: | The proposed approach outperforms the baseline model in terms of safety and helpfulness, and significantly improves model safety without adversarial training. |
DSRM: Boost Textual Adversarial Training with Distribution Shift Risk Minimization (2023.acl-long)
Copied to clipboard
| Challenge: | Existing adversarial training methods require multi-step gradient ascents or word substitutions to obtain adversarials, which impairs the effectiveness of adversariarial training. |
| Approach: | They propose a procedure for instead adversarial training with only clean data that estimates the adversarials loss by perturbing the input data’s probability distribution rather than their embeddings. |
| Outcome: | The proposed procedure reduces time consumption by up to 70% compared to current best-performing adversarial training methods. |
Towards Open Domain Event Trigger Identification using Adversarial Domain Adaptation (2020.acl-main)
Copied to clipboard
| Challenge: | supervised event trigger identification models can generalize better across domains . prior work focused on annotating specific categories of events or narratives from specific domains. |
| Approach: | They propose to use adversarial domain adaptation framework to build supervised event trigger identification models which can generalize better across domains. |
| Outcome: | The proposed model improves on literature and news domains with no labeled data. |
Adversary-Aware DPO: Enhancing Safety Alignment in Vision Language Models via Adversarial Training (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Adversary-aware DPO (ADPO) is a training framework that explicitly considers adversary. |
| Approach: | a new framework integrates adversarial training into a pre-trained large language model to enhance safety alignment . adversary-aware DPO provides a framework that explicitly considers adversary . |
| Outcome: | a new training framework outperforms baselines in safety alignment and general utility of large language models. |
How to Leverage Demonstration Data in Alignment for Large Language Model? A Self-Imitation Learning Perspective (2024.emnlp-main)
Copied to clipboard
| Challenge: | Existing methods for fine-tuning large language models are not suitable for task-dependent tasks. |
| Approach: | They propose a generalized self-imitation learning framework which aligns large language models with offline demonstration data. |
| Outcome: | The proposed framework outperforms baselines in many challenging benchmarks . it is available on github.com/tengxiao1/GSIL . |
End-to-end Adversarial Sample Generation for Data Augmentation (2023.findings-emnlp)
Copied to clipboard
| Challenge: | Existing methods for generating adversarial samples have deceived many neural inference models, such as text classification and machine translation. |
| Approach: | They propose an adversarial sample generator that consists of a conditioned paraphrasing model and a condition generator and introduce a pretrained discriminator to help the adversarial sample generator adapt to the data characteristics. |
| Outcome: | The proposed approach improves the performance of the trained model on several tasks and is robust for various attacking techniques. |
Knowing False Negatives: An Adversarial Training Method for Distantly Supervised Relation Extraction (2021.emnlp-main)
Copied to clipboard
| Challenge: | Existing methods for relation extraction ignore the incompleteness of existing knowledge bases . current methods are too weak and cause noises when training and testing are not based on training data. |
| Approach: | They propose a method to automatically align unstructured text with relation instances in a knowledge base . they use heuristics to leverage the memory mechanism of deep neural networks to find out possible FN samples . |
| Outcome: | Experiments on two wildly-used benchmark datasets show the effectiveness of the proposed method. |
A Curious Case of Searching for the Correlation between Training Data and Adversarial Robustness of Transformer Textual Models (2024.findings-acl)
Copied to clipboard
| Challenge: | Existing studies show that fine-tuned textual transformer models are vulnerable to adversarial text perturbations. |
| Approach: | They extract 13 different features representing a wide range of input fine-tuning corpora properties and use them to predict adversarial robustness of the fine- tuned models. |
| Outcome: | The proposed framework can be used as an additional tool for robustness evaluation since it saves 30x-193x runtime compared to the traditional technique and can be easily used under adversarial training. |
Attention-Focused Adversarial Training for Robust Temporal Reasoning (2022.lrec-1)
Copied to clipboard
| Challenge: | Current adversarial training approaches for NLP add adversarials to the embedding layer, ignoring other layers. |
| Approach: | They propose an enhanced adversarial training algorithm for fine-tuning transformer-based language models . they add the adversarials to multiple hidden states or attention representations of the model layers . |
| Outcome: | The proposed model improves performance on several temporal reasoning benchmarks and establishes new state-of-the-art results. |
Generative Adversarial Training with Perturbed Token Detection for Model Robustness (2023.emnlp-main)
Copied to clipboard
| Challenge: | Existing adversarial training methods use discrete tokens to deceive models . current approaches use embeddings, whereas actual text-based training uses discrete text tokens. |
| Approach: | They propose a framework that integrates gradient-based learning, adversarial example generation and perturbed token detection to enhance adversariarial robustness. |
| Outcome: | The proposed framework surpasses the state-of-the-art results of ChatGPT by 10% in average accuracy. |
Macedon: Minimizing Representation Coding Rate Reduction for Cross-Lingual Natural Language Understanding (2023.findings-emnlp)
Copied to clipboard
| Challenge: | Existing approaches to learn cross-lingual models require limited data to perform cross-linguistic tasks. |
| Approach: | They propose a method to remove language-associated information via minimizing representation coding rate reduction. |
| Outcome: | The proposed model outperforms state-of-the-art models on cross-lingual tasks. |
Large Language Models Are Better Adversaries: Exploring Generative Clean-Label Backdoor Attacks Against Text Classifiers (2023.findings-emnlp)
Copied to clipboard
| Challenge: | Backdoor attacks manipulate model predictions by inserting malicious "poison" instances that contain a specific pattern or "trigger." |
| Approach: | They propose an attack that inserts style-based triggers into training and test data by using a poison selection technique to improve the effectiveness of both LLMBkd and existing backdoor attacks. |
| Outcome: | The proposed attack achieves high success rates across a wide range of styles with little effort and no model training. |
HypoNLI: Exploring the Artificial Patterns of Hypothesis-only Bias in Natural Language Inference (2020.lrec-1)
Copied to clipboard
| Challenge: | Recent studies have shown that for models trained on datasets for natural language inference (NLI), it is possible to make correct predictions by looking at the hypothesis while completely ignoring the premise. |
| Approach: | They propose to derive adversarial examples in terms of the hypothesis-only bias and explore eligible ways to mitigate such bias. |
| Outcome: | The proposed models can be used to mitigate the hypothesis-only bias by using down-sampling and adversarial training. |
AGD: Adversarial Game Defense Against Jailbreak Attacks in Large Language Models (2025.acl-long)
Copied to clipboard
Shilong Pan, Zhiliang Tian, Zhen Huang, Wanlong Yu, Zhihua Wen, Xinwang Liu, Kai Lu, Minlie Huang, Dongsheng Li
| Challenge: | Existing defenses, including post-training alignment and prompt engineering, struggle with adaptability to out-of-distribution (OOD) attacks. |
| Approach: | They propose an adversarial game-based defense method that dynamically adjusts LLMs’ internal representations to achieve a balanced trade-off between helpfulness and harmlessness. |
| Outcome: | The proposed method improves LLMs’ safety over all baselines. |
Is Robustness Transferable across Languages in Multilingual Neural Machine Translation? (2023.findings-emnlp)
Copied to clipboard
| Challenge: | Existing studies have focused on bilingual machine translation with a single translation direction. |
| Approach: | They propose a robustness transfer analysis protocol to analyze the transferability of robustness across different languages in multilingual neural machine translation. |
| Outcome: | The proposed protocol shows that the robustness gained in one translation direction can transfer to other translation directions. |
Fair Text Classification with Wasserstein Independence (2023.emnlp-main)
Copied to clipboard
| Challenge: | a novel method for mitigating group fairness in text classification remains an open challenge . a recent paper focuses on the problem of group fair in the domain of natural language processing . |
| Approach: | They propose a method for mitigating group fairness in neural text classification . they use adversarial training to induce Wasserstein independence between representations . |
| Outcome: | The proposed method exhibits a comparable or better fairness-accuracy trade-off compared to existing methods. |
Making MLLMs Blind: Adversarial Smuggling Attacks in MLLM Content Moderation (2026.findings-acl)
Copied to clipboard
Zhiheng Li, Zongyang Ma, Yuntong Pan, Ziqi Zhang, Xiaolei Lv, Bo Li, Jun Gao, Jianing Zhang, Chunfeng Yuan, Bing Li, Weiming Hu
| Challenge: | Multimodal Large Language Models (MLLMs) are increasingly being deployed as content moderators . however, they exploit the Human-AI capability gap and create adversarial environments . smuggling attacks exploit the human-AI gap and exploit the vulnerability . |
| Approach: | They construct a benchmark to evaluate the vulnerability of MLLMs as content moderators . they identify three root causes: limited capabilities of vision encoders, robustness gap in OCR . |
| Outcome: | The proposed model exploits the Human-AI capability gap and is vulnerable to smuggling attacks. |
Stop Hardening Everything: A Training-Free Neuron-Level Defense for Neural Ranking Models (2026.acl-long)
Copied to clipboard
| Challenge: | Existing defenses for neural ranking models are data-centric and require retraining and adversarial data generation. |
| Approach: | They propose a model-centric defense that addresses vulnerability at its architectural source without costly retraining or adversarial data generation. |
| Outcome: | The proposed approach outperforms state-of-the-art models on MS MARCO and TREC 19 while maintaining strong performance on clean data. |
ORTicket: Let One Robust BERT Ticket Transfer across Different Tasks (2024.lrec-main)
Copied to clipboard
| Challenge: | Pretrained language models are susceptible to subtle perturbations and require multiple adversarial training during fine-tuning to improve their robustness. |
| Approach: | They propose a novel adversarial defense method ORTicket that fine-tunes a model for downstream tasks. |
| Outcome: | The proposed method achieves comparable robustness to other defense methods while maintaining the efficiency of fine-tuning. |
Defending Jailbreak Prompts via In-Context Adversarial Game (2024.emnlp-main)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) demonstrate remarkable capabilities across diverse applications, but concerns regarding their security persist. |
| Approach: | They propose an adversarial game that leverages agent learning to extend knowledge to defend against jailbreaks. |
| Outcome: | The proposed game shows that LLMs safeguarded by ICAG exhibit significantly reduced jailbreak success rates across various attack scenarios. |
Representation Bending for Large Language Model Safety (2025.acl-long)
Copied to clipboard
Ashkan Yousefpour, Taeheon Kim, Ryan Sungmo Kwon, Seungbeen Lee, Wonje Jeung, Seungju Han, Alvin Wan, Harrison Ngan, Youngjae Yu, Jonghyun Choi
| Challenge: | Existing safety-enhancing techniques, such as fine-tuning with human feedback or adversarial training, are still vulnerable as they address specific threats and fail to generalize across unseen attacks. |
| Approach: | They propose a new approach that disrupts representations underlying harmful behaviors in Large Language Models by using loss-based fine-tuning. |
| Outcome: | The proposed approach outperforms existing methods such as Circuit Breaker, RMU, and NPO with 95% reduction in attack success rates across diverse jailbreak benchmarks. |
Adapters Mixup: Mixing Parameter-Efficient Adapters to Enhance the Adversarial Robustness of Fine-tuned Pre-trained Text Classifiers (2024.emnlp-main)
Copied to clipboard
| Challenge: | Existing studies show that augmenting the training data of pre-trained language models with parametric fine-tuning methods can enhance their robustness under adversarial attacks. |
| Approach: | They propose an approach that fine-tunes PLMs with adapters and adversarial augmentation via mixup to leverage existing knowledge from a set of pre-known attacks. |
| Outcome: | The proposed approach achieves best trade-off between training efficiency and robustness under adversarial attacks compared to baselines on five downstream tasks across six varied black-box attacks and 2 PLMs. |
CLMTracing: Black-box User-level Watermarking for Code Language Model Tracing (2025.emnlp-main)
Copied to clipboard
| Challenge: | Open-source code language models (code LMs) are a growing threat for intellectual property protection. |
| Approach: | They propose a black-box code LM watermarking framework that uses rule-based watermarks and utility-preserving injection method for user-level model tracing. |
| Outcome: | The proposed framework shows that it performs well across multiple state-of-the-art code LMs and is harmless compared to existing baselines. |
Unveiling Vulnerability of Self-Attention (2024.lrec-main)
Copied to clipboard
| Challenge: | Existing studies focus on manipulating word inputs, but they lack generalization to versatile real-world attacks. |
| Approach: | They propose a powerful perturbation technique which perturbs the attention scores within the SA matrices via meticulously crafted attention masks. |
| Outcome: | The proposed perturbation technique achieves high attack success rate (98%) and low cost. |
Improving LLM Code Reasoning via Semantic Equivalence Self-Play with Formal Verification (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing approaches to training large language models fail to capture deep semantic properties and edge cases. |
| Approach: | They propose a framework that leverages Liquid Haskell proofs for validating equivalence and execution-based counterexamples for inequivalent training. |
| Outcome: | The proposed framework achieves 13.3pp accuracy gain on EquiBench and consistent gains on PySecDB. |
Identifying and typifying demographic unfairness in phoneme-level embeddings of self-supervised speech recognition models (2026.findings-acl)
Copied to clipboard
| Challenge: | a number of studies have been done to improve ASR for speaker groups, but there is still room for improvement . authors propose a framework typifying two types of error in phoneme embeddings . |
| Approach: | They propose a framework typifying two types of error that can occur in phoneme modeling . they propose random error/high variance in phonemes embedding vs systematic error/embedding bias . |
| Outcome: | The proposed framework typifies errors in phoneme modeling in ASR systems . it shows that training only on a single, typically disadvantaged SG improves performance . |
Beyond Static Synthetic Noise: Assessing the Robustness of Large Language Models to Natural Context Variation in the Real World (2026.findings-acl)
Copied to clipboard
| Challenge: | Current robustness evaluation methods rely on static synthetic perturbations to stress-test models. |
| Approach: | They propose a framework for automatically evaluating QA models under naturally occurring textual perturbations by replacing context passages with revised Wikipedia edit histories. |
| Outcome: | The proposed framework replaces context passages with revised Wikipedia edit histories to improve model performance. |
Small Data, Big Noise: Adversarial Training for Robust ParameterEfficient Fine-Tuning (2026.findings-acl)
Copied to clipboard
| Challenge: | Parameter-Efficient Fine-Tuning (PEFT) is essential for adapting foundation models to downstream tasks, but current methods struggle with robustness to noise and performance degradation on limited training data. |
| Approach: | They propose a framework that brings adversarial training to PEFT to enhance model robustness and generalization, outperforming alternative approaches. |
| Outcome: | Experiments with two variants of the proposed framework show that it outperforms existing methods in low-resource settings and under word-level and character-level corruptions. |