mlsanityData to 7 Oct 2026

TASA: Deceiving Question Answering Models by Twin Answer Sentences Attack

arXiv 2210.15221 ↗First posted 27 Oct 2022cs.CL cs.AIcited by 15

Not on the map. Why?

Abstract (arXiv)

We present Twin Answer Sentences Attack (TASA), an adversarial attack method for question answering (QA) models that produces fluent and grammatical adversarial contexts while maintaining gold answers. Despite phenomenal progress on general adversarial attacks, few works have investigated the vulnerability and attack specifically for QA models. In this work, we first explore the biases in the existing models and discover that they mainly rely on keyword matching between the question and context, and ignore the relevant contextual relations for answer prediction. Based on two biases above, TASA attacks the target model in two folds: (1) lowering the model's confidence on the gold answer with a perturbed answer sentence; (2) misguiding the model towards a wrong answer with a distracting answer sentence. Equipped with designed beam search and filtering methods, TASA can generate more effective attacks than existing textual attack methods while sustaining the quality of contexts, in extensive experiments on five QA datasets and human evaluations.

Key facts. Cited by 15 papers in the map (data through 7 Oct 2026). Builds on 33 of its 45 references that are in the map. First posted on arXiv 27 Oct 2022.

Builds on

33 of 45 references.

References · 33

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2016SQuAD: 100,000+ Questions for Machine Comprehension of Textcited by 4,115
  5. 2018HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answeringcited by 3,686
  6. 2017TriviaQA: A Large Scale Distantly Supervised Challenge Dataset for Reading Comprehensioncited by 2,895
  7. 2018Know What You Don't Know: Unanswerable Questions for SQuADcited by 1,538
  8. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  9. 2019SpanBERT: Improving Pre-training by Representing and Predicting Spanscited by 832
  10. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 709
  11. 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 663
  12. 2017Adversarial Examples for Evaluating Reading Comprehension Systemscited by 568
21 more
  1. 2018Universal Sentence Encodercited by 485
  2. 2018Generating Natural Language Adversarial Examplescited by 422
  3. 2018TextBugger: Generating Adversarial Text Against Real-world Applicationscited by 376
  4. 2016NewsQA: A Machine Comprehension Datasetcited by 330
  5. 2019What BERT is not: Lessons from a new suite of psycholinguistic diagnostics for language modelscited by 317
  6. 2018Adversarial Example Generation with Syntactically Controlled Paraphrase Networkscited by 282
  7. 2016Bidirectional Attention Flow for Machine Comprehensioncited by 278
  8. 2019MRQA 2019 Shared Task: Evaluating Generalization in Reading Comprehensioncited by 183
  9. 2017Generating Natural Adversarial Examplescited by 182
  10. 2018QANet: Combining Local Convolution with Global Self-Attention for Reading Comprehensioncited by 164
  11. 2019Combating Adversarial Misspellings with Robust Word Recognitioncited by 162
  12. 2016Counter-fitting Word Vectors to Linguistic Constraintscited by 138
  13. 2020Contextualized Perturbation for Textual Adversarial Attackcited by 136
  14. 2017Deep Text Classification Can be Fooledcited by 105
  15. 2020UnNatural Language Inferencecited by 68
  16. 2019Understanding Dataset Design Choices for Multi-hop Reasoningcited by 50
  17. 2018Sentence-Level Fluency Evaluation: References Help, But Can Be Spared!cited by 43
  18. 2021DAGN: Discourse-Aware Graph Network for Logical Reasoningcited by 28
  19. 2022Phrase-level Textual Adversarial Attack with Label Preservationcited by 23
  20. 2021Multi-granularity Textual Adversarial Attack with Behavior Cloningcited by 21
  21. 2019BAG: Bi-directional Attention Entity Graph Convolutional Network for Multi-hop Reasoning Question Answeringcited by 19

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 4; 2024: 7; 2025: 3; 2026: 1.

15 papers.

Sort:

By area:

  1. 2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 281
  2. 2023A Survey of Safety and Trustworthiness of Large Language Models through the Lens of Verification and Validationcited by 91
  3. 2024MirrorCheck: Efficient Adversarial Defense for Vision-Language Modelscited by 19
  4. 2024NLP Verification: Towards a General Methodology for Certifying Robustnesscited by 14
  5. 2023Guiding LLM to Fool Itself: Automatically Manipulating Machine Reading Comprehension Shortcut Triggerscited by 10
  6. 2024Toward Robust RALMs: Revealing the Impact of Imperfect Retrieval on Retrieval-Augmented Language Modelscited by 8
  7. 2024Desiderata for the Context Use of Question Answering Systemscited by 7
  8. 2024Benchmark Granularity and Model Robustness for Image-Text Retrievalcited by 5
  9. 2024Asking Again and Again: Exploring LLM Robustness to Repeated Questionscited by 5
  10. 2026JevOut: Natural Context Can Flip Decision Modelscited by 4
  11. 2025Counterfactual Evaluation for Blind Attack Detection in LLM-based Evaluation Systemscited by 3
  12. 2025Pay Attention to Real World Perturbations! Natural Robustness Evaluation in Machine Reading Comprehensioncited by 2
3 more
  1. 2025Light as Deception: GPT-driven Natural Relighting Against Vision-Language Pre-training Modelscited by 1
  2. 2023From text to multimodal: a survey of adversarial example generation in question answering systemscited by 0
  3. 2024Instant Answering in E-Commerce Buyer-Seller Messaging using Message-to-Question Reformulationcited by 0