Analyzing Dynamic Adversarial Training Data in the Limit
Not on the map. Why?
Abstract (arXiv)
To create models that are robust across a wide range of test inputs, training datasets should include diverse examples that span numerous phenomena. Dynamic adversarial data collection (DADC), where annotators craft examples that challenge continually improving models, holds promise as an approach for generating such diverse training sets. Prior work has shown that running DADC over 1-3 rounds can help models fix some error types, but it does not necessarily lead to better generalization beyond adversarial test data. We argue that running DADC over many rounds maximizes its training-time benefits, as the different rounds can together cover many of the task-relevant phenomena. We present the first study of longer-term DADC, where we collect 20 rounds of NLI examples for a small set of premise paragraphs, with both adversarial and non-adversarial approaches. Models trained on DADC examples make 26% fewer errors on our expert-curated test set compared to models trained on non-adversarial data. Our analysis shows that DADC yields examples that are more difficult, more lexically and syntactically diverse, and contain fewer annotation artifacts compared to non-adversarial examples.
Key facts. Cited by 24 papers in the map (data through 14 Oct 2026). Builds on 49 of its 72 references that are in the map. First posted on arXiv 16 Oct 2021.
Builds on
49 of 72 references.
References · 49
- 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,599
- 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,372
- 2014Explaining and Harnessing Adversarial Examplescited by 7,364
- 2019BERTScore: Evaluating Text Generation with BERTcited by 5,512
- 2016SQuAD: 100,000+ Questions for Machine Comprehension of Textcited by 4,148
- 2019HellaSwag: Can a Machine Really Finish Your Sentence?cited by 4,100
- 2019ALBERT: A Lite BERT for Self-supervised Learning of Language Representationscited by 2,790
- 2017A Broad-Coverage Challenge Corpus for Sentence Understanding through Inferencecited by 2,682
- 2015A large annotated corpus for learning natural language inferencecited by 1,847
- 2018FEVER: a large-scale dataset for Fact Extraction and VERificationcited by 1,375
- 2019DROP: A Reading Comprehension Benchmark Requiring Discrete Reasoning Over Paragraphscited by 903
- 2019Right for the Wrong Reasons: Diagnosing Syntactic Heuristics in Natural Language Inferencecited by 876
37 more
- 2019Adversarial NLI: A New Benchmark for Natural Language Understandingcited by 807
- 2018Annotation Artifacts in Natural Language Inference Datacited by 671
- 2017The NarrativeQA Reading Comprehension Challengecited by 597
- 2021Dynabench: Rethinking Benchmarking in NLPcited by 459
- 2019Learning the Difference that Makes a Difference with Counterfactually-Augmented Datacited by 439
- 2018SWAG: A Large-Scale Adversarial Dataset for Grounded Commonsense Inferencecited by 333
- 2018Hypothesis Only Baselines in Natural Language Inferencecited by 295
- 2020Pretrained Transformers Improve Out-of-Distribution Robustnesscited by 294
- 2018Adversarial Example Generation with Syntactically Controlled Paraphrase Networkscited by 286
- 2020On the Stability of Fine-tuning BERT: Misconceptions, Explanations, and Strong Baselinescited by 255
- 2018Stress Test Evaluation for Natural Language Inferencecited by 213
- 2021What Will it Take to Fix Benchmarking in Natural Language Understanding?cited by 203
- 2018Constituency Parsing with a Self-Attentive Encodercited by 199
- 2019Build it Break it Fix it for Dialogue Safety: Robustness from Adversarial Human Attackcited by 176
- 2019Are We Modeling the Task or the Annotator? An Investigation of Annotator Bias in Natural Language Understanding Datasetscited by 175
- 2020Recipes for Safety in Open-domain Chatbotscited by 170
- 2020Adversarial Filters of Dataset Biasescited by 160
- 2020What Can We Learn from Collective Human Opinions on Natural Language Inference Data?cited by 153
- 2018Breaking NLI Systems with Sentences that Require Simple Lexical Inferencescited by 134
- 2020Beat the AI: Investigating Adversarial Human Annotation for Reading Comprehensioncited by 131
- 2018Combining Fact Extraction and Verification with Neural Semantic Matching Networkscited by 120
- 2021The Perils of Using Mechanical Turk to Evaluate Open-Ended Text Generationcited by 97
- 2019Compositional Questions Do Not Necessitate Multi-hop Reasoningcited by 88
- 2020Look at the First Sentence: Position Bias in Question Answeringcited by 84
- 2018Practical Obstacles to Deploying Active Learningcited by 68
- 2020DynaSent: A Dynamic Benchmark for Sentiment Analysiscited by 63
- 2019MultiQA: An Empirical Investigation of Generalization and Transfer in Reading Comprehensioncited by 60
- 2018Performance Impact Caused by Hidden Bias of Training Data for Recognizing Textual Entailmentcited by 59
- 2021Dynaboard: An Evaluation-As-A-Service Platform for Holistic Next-Generation Benchmarkingcited by 53
- 2021Fool Me Twice: Entailment from Wikipedia Gamificationcited by 50
- 2020ANLIzing the Adversarial Natural Language Inference Datasetcited by 36
- 2021On the Efficacy of Adversarial Data Collection for Question Answering: Results from a Large-Scale Randomized Studycited by 31
- 2021Does Putting a Linguist in the Loop Improve NLU Data Collection?cited by 29
- 2020Counterfactually-Augmented SNLI Training Data Does Not Yield Better Generalization Than Unaugmented Datacited by 27
- 2021What Ingredients Make for an Effective Crowdsourcing Protocol for Difficult NLU Data Collection Tasks?cited by 23
- 2017Mastering the Dungeon: Grounded Language Learning by Mechanical Turker Descentcited by 10
- 2020Asking Crowdworkers to Write Entailment Examples: The Best of Bad Optionscited by 8
Built on by
Citing papers per year: 2021: 2; 2022: 6; 2023: 8; 2024: 6; 2025: 2.
24 papers.
Sort:
By area:
- 2022Red Teaming Language Models with Language Modelscited by 1,026
- 2022Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learnedcited by 729
- 2023Poisoning Language Models During Instruction Tuningcited by 269
- 2022Adversarial Training for High-Stakes Reliabilitycited by 60
- 2024Learning diverse attacks on large language models for robust red-teaming and safety tuningcited by 54
- 2025Which of These Best Describes Multiple Choice Evaluation with LLMs? A) Forced B) Flawed C) Fixable D) All of the Abovecited by 52
- 2025Agentic Web: Weaving the Next Web with AI Agentscited by 45
- 2021Models in the Loop: Aiding Crowdworkers with Generative Annotation Assistantscited by 31
- 2022Dynatask: A Framework for Creating Dynamic AI Benchmark Taskscited by 16
- 2022A Theory of Dynamic Benchmarkscited by 16
- 2024Improving Adversarial Data Collection by Supporting Annotators: Lessons from GAHD, a German Hate Speech Datasetcited by 13
- 2021Adversarially Constructed Evaluation Sets Are More Challenging, but May Not Be Faircited by 12
12 more
- 2024Efficient Lifelong Model Evaluation in an Era of Rapid Progresscited by 10
- 2022Benchmarking Long-tail Generalization with Likelihood Splitscited by 9
- 2023On the Limitations of Simulating Active Learningcited by 9
- 2023Adversarial Fine-Tuning of Language Models: An Iterative Optimisation Approach for the Generation and Detection of Problematic Contentcited by 7
- 2024Adversarial Training: A Surveycited by 6
- 2023Can Large Language Models Change User Preference Adversarially?cited by 5
- 2023JAB: Joint Adversarial Prompting and Belief Augmentationcited by 5
- 2023From Adversarial Arms Race to Model-centric Evaluation: Motivating a Unified Automatic Robustness Evaluation Frameworkcited by 3
- 2023No Offense Taken: Eliciting Offensiveness from Language Modelscited by 3
- 2023On Degrees of Freedom in Defining and Testing Natural Language Understandingcited by 1
- 2024How the Advent of Ubiquitous Large Language Models both Stymie and Turbocharge Dynamic Adversarial Question Generationcited by 1
- 2024Zero-shot Factual Consistency Evaluation Across Domainscited by 0
- 2025Agentic Web: Weaving the Next Web with AI Agents28 Jul 2025
- 2025Which of These Best Describes Multiple Choice Evaluation with LLMs? A) Forced B) Flawed C) Fixable D) All of the Above19 Feb 2025
- 2024Adversarial Training: A Survey19 Oct 2024
- 2024Zero-shot Factual Consistency Evaluation Across Domains7 Aug 2024
- 2024Learning diverse attacks on large language models for robust red-teaming and safety tuning28 May 2024
- 2024Improving Adversarial Data Collection by Supporting Annotators: Lessons from GAHD, a German Hate Speech Dataset28 Mar 2024
- 2024Efficient Lifelong Model Evaluation in an Era of Rapid Progress29 Feb 2024
- 2024How the Advent of Ubiquitous Large Language Models both Stymie and Turbocharge Dynamic Adversarial Question Generation20 Jan 2024
- 2023JAB: Joint Adversarial Prompting and Belief Augmentation16 Nov 2023
- 2023No Offense Taken: Eliciting Offensiveness from Language Models2 Oct 2023
- 2023Adversarial Fine-Tuning of Language Models: An Iterative Optimisation Approach for the Generation and Detection of Problematic Content26 Aug 2023
- 2023From Adversarial Arms Race to Model-centric Evaluation: Motivating a Unified Automatic Robustness Evaluation Framework29 May 2023
12 more
- 2023On Degrees of Freedom in Defining and Testing Natural Language Understanding24 May 2023
- 2023On the Limitations of Simulating Active Learning21 May 2023
- 2023Poisoning Language Models During Instruction Tuning1 May 2023
- 2023Can Large Language Models Change User Preference Adversarially?5 Jan 2023
- 2022Benchmarking Long-tail Generalization with Likelihood Splits13 Oct 2022
- 2022A Theory of Dynamic Benchmarks6 Oct 2022
- 2022Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learned23 Aug 2022
- 2022Adversarial Training for High-Stakes Reliability3 May 2022
- 2022Dynatask: A Framework for Creating Dynamic AI Benchmark Tasks5 Apr 2022
- 2022Red Teaming Language Models with Language Models7 Feb 2022
- 2021Models in the Loop: Aiding Crowdworkers with Generative Annotation Assistants16 Dec 2021
- 2021Adversarially Constructed Evaluation Sets Are More Challenging, but May Not Be Fair16 Nov 2021
- 2022Red Teaming Language Models with Language Modelscited by 1,026
- 2024Learning diverse attacks on large language models for robust red-teaming and safety tuningcited by 54
- 2023Adversarial Fine-Tuning of Language Models: An Iterative Optimisation Approach for the Generation and Detection of Problematic Contentcited by 7
- 2023Can Large Language Models Change User Preference Adversarially?cited by 5
- 2023JAB: Joint Adversarial Prompting and Belief Augmentationcited by 5
- 2023No Offense Taken: Eliciting Offensiveness from Language Modelscited by 3
- 2024Learning diverse attacks on large language models for robust red-teaming and safety tuning28 May 2024
- 2023JAB: Joint Adversarial Prompting and Belief Augmentation16 Nov 2023
- 2023No Offense Taken: Eliciting Offensiveness from Language Models2 Oct 2023
- 2023Adversarial Fine-Tuning of Language Models: An Iterative Optimisation Approach for the Generation and Detection of Problematic Content26 Aug 2023
- 2023Can Large Language Models Change User Preference Adversarially?5 Jan 2023
- 2022Red Teaming Language Models with Language Models7 Feb 2022
- 2025Agentic Web: Weaving the Next Web with AI Agentscited by 45
- 2025Agentic Web: Weaving the Next Web with AI Agents28 Jul 2025
- 2023Poisoning Language Models During Instruction Tuningcited by 269
- 2022Adversarial Training for High-Stakes Reliabilitycited by 60
- 2025Which of These Best Describes Multiple Choice Evaluation with LLMs? A) Forced B) Flawed C) Fixable D) All of the Abovecited by 52
- 2021Models in the Loop: Aiding Crowdworkers with Generative Annotation Assistantscited by 31
- 2022Dynatask: A Framework for Creating Dynamic AI Benchmark Taskscited by 16
- 2022A Theory of Dynamic Benchmarkscited by 16
- 2024Improving Adversarial Data Collection by Supporting Annotators: Lessons from GAHD, a German Hate Speech Datasetcited by 13
- 2021Adversarially Constructed Evaluation Sets Are More Challenging, but May Not Be Faircited by 12
- 2024Efficient Lifelong Model Evaluation in an Era of Rapid Progresscited by 10
- 2022Benchmarking Long-tail Generalization with Likelihood Splitscited by 9
- 2023On the Limitations of Simulating Active Learningcited by 9
- 2024Adversarial Training: A Surveycited by 6
12 most cited of 16 All 16 (JSON)
- 2025Which of These Best Describes Multiple Choice Evaluation with LLMs? A) Forced B) Flawed C) Fixable D) All of the Above19 Feb 2025
- 2024Adversarial Training: A Survey19 Oct 2024
- 2024Zero-shot Factual Consistency Evaluation Across Domains7 Aug 2024
- 2024Improving Adversarial Data Collection by Supporting Annotators: Lessons from GAHD, a German Hate Speech Dataset28 Mar 2024
- 2024Efficient Lifelong Model Evaluation in an Era of Rapid Progress29 Feb 2024
- 2024How the Advent of Ubiquitous Large Language Models both Stymie and Turbocharge Dynamic Adversarial Question Generation20 Jan 2024
- 2023From Adversarial Arms Race to Model-centric Evaluation: Motivating a Unified Automatic Robustness Evaluation Framework29 May 2023
- 2023On Degrees of Freedom in Defining and Testing Natural Language Understanding24 May 2023
- 2023On the Limitations of Simulating Active Learning21 May 2023
- 2023Poisoning Language Models During Instruction Tuning1 May 2023
- 2022Benchmarking Long-tail Generalization with Likelihood Splits13 Oct 2022
- 2022A Theory of Dynamic Benchmarks6 Oct 2022
12 newest of 16 All 16 (JSON)