Adversarial Attacks on Question Answering Systems - Evaluating the Robustness of BERT Models

This research aims at understanding the performance of BERT-based question answering (QA) systems in the presence of adversarial attacks. This is important as these systems are now being used in important applications. The study aims at assessing the effectiveness of BERT, RoBERTa, and ELECTRA models when faced with adversarial attacks, including a new attack called Contextual Embedding Inversion Attack (CEIA). The research objectives are to compare the influence of various attack types, investigate whether fine-tuning enhances the models’ resilience, and compare the proposed CEIA with other approaches. The approach is to apply five attack methods (AddAny, AddSent, CEIA, DPAEG, and TextFooler) on the base and fine-tuned models on the SQuAD 2.0 dataset. The analysis of the results shows that TextFooler proves to be the most powerful attack across all the models and CEIA is seen to be highly transferable while at the same time able to preserve the text quality. Fine-tuning greatly improves the model’s resilience, and ELECTRA is the most immune to adversarial attacks. The study also reveals that the effectiveness of an attack is closely linked to the quality of the text, which is an issue when trying to design effective yet invisible adversarial samples. The implications of these findings for the development and deployment of QA systems are that a more extensive evaluation should be done concerning various types of attacks, and fine-tuning can be a promising approach to counteract attacks. The research is valuable to the advancement of deep learning in NLP and advances the development of question answering systems.