Deep Learning NLP domain lacks procedures for the analysis of model robustness. In this paper we propose a framework which validates robustness of any Question Answering model through model explainers. We propose that output of a robust model should be invariant to alterations that do not change its semantics. We test this property by manipulating question in two ways: swapping important question word for 1) its semantically correct synonym and 2) for word vector that is close in embedding space. We estimate importance of words in asked questions with Locally Interpretable Model Agnostic Explanations method (LIME). With these two steps we compare state-of-the-art Q&A models. We show that although accuracy of state-of-the-art models is high, they are very fragile to changes in the input. We can choose architecture that is more immune to attacks and thus more robust and stable in production environment. Morevoer, we propose 2 adversarial training scenarios which raise model sensitivity to true synonyms by up to 7% accuracy measure. Our findings help to understand which models are more stable and how they can be improved. In addition, we have created and published a new dataset that may be used for validation of robustness of a Q&A model. Up-to-date advancements in natural language processing show that it is possible to achieve high accuracy on tasks that from human point of view require language understanding. However, recent research on adversarial examples revealed shortcomings of neural network models, despite their great performance on selected datasets BID10 . Most adversarial examples studies in Question Answering (Q&A) task focus on designing sophisticated attacks that prove overstability understood as an inability of the model to distinguish sentences that answer the question from sentences that have words in common with the question BID3 . BID5 and BID2 also show that the whole question itself is not crucial to get the right answer. Despite growing research in the area of adversarial attacks, little is still known about the source of lacking robustness of Q&A models and effective ways of overcoming this problem. In order to come up with a solution it is crucial to understand the inner workings of task specific architectures and benchmark their performance on adversarial attacks.In this work we propose a model agnostic framework that checks stability of three state-of-the-art Q&A architectures in terms of their ability to respond to semantically similar questions. We formulate two aspects which are subject to tests: semantic input stability (relying on true semantics) and numerical input stability (purely induced by similarity between word embeddings). These terms are explained later on in the article. We state that a robust and reliable Q&A model should be invariant to changes in the input until they induce semantic changes. Having said that, we state that a stable model must display higher semantic input stability measure than numerical input stability measure. We claim that a robust Q&A model should possess high sensitivity to true semantics, as opposed to closeness between word embeddings. Otherwise, attacks based on commonly accessible sets of embeddings become possible, including antonymous questions, as antonyms are often close in embedding space.We make the following contributions:• We investigate robustness of the model in the face of semantic and numerical changes to the input.• We use output of Locally Interpretable Model Agnostic Explanations BID9 to create attacks.• We offer 2 approaches to adversarial training which increase model sensitivity to true semantic differences by a maximum of 7% in accuracy.• We release a collection of 1500 semantically coherent questions from SQuAD dataset BID8 preprocessed by LIME and human annotators, that we used in this study, as a reference dataset for further works on this problem.In section 2 we explain measures and tools that we used in the study. In section 3 we conduct experiments on three popular Q&A architectures, then we introduce two modifications to one of the models in order to increase ability to answer semantically similar questions and finally we refer to related work and conclude. In our study we focused on one particular aspect of model robustness -ability to answer semantically coherent questions. We show that performance of all tested models decreases once we change important question words indicated by LIME. However, we observe that models have higher performance once we swap tokens in questions for words close in their embedding space defined by word vectors they were trained on, in comparison to accuracy obtained by asking semantically correct questions. We manage to increase ability of the model to answer this kind of questions but it does not mean that they understand semantics -it is reflected in increased accuracy of questions with GloVe embeddings once we test our newly trained models on num-Dataset.We show that the reason behind the success of some adversarial examples lies in the way input words are represented. Popular embeddings do not include knowledge about real meaning of the words, but rather incorporate knowledge about their context. Our work serves as a starting point for future research on more semantically-conscious representation of words.
We propose a model agnostic approach to validation of Q&A system robustness and demonstrate results on state-of-the-art Q&A models. Addresses the problem of robustness to adversarial information in question answering. Improving robustness of machine comprehension/question answering.