{"id":"3e5537fd-3b05-4ccd-a858-541f52daba08","arxiv_id":"2411.08248","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"QA-Attack fuses attention-based and removal-based word ranking to locate vulnerable words in question-answering contexts and substitutes synonyms, fooling T5, LongT5, and BERT QA models.","lead":"This paper presents QA-Attack, a method that changes just a handful of carefully chosen words in a text passage to make question-answering AI models give wrong answers. It combines two ways of finding important words, attention scores and deletion tests, and then swaps the chosen words for similar ones, which could help researchers probe and harden real QA systems.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 'surpasses baselines' claim is undermined by an unfair TextFooler adaptation: removing the question from TextFooler handicaps it before comparison.","rationale":"The reader's weakest assumption focuses on the need for attention/logit access and on the unvalidated attention-as-importance proxy. Those are legitimate practical limitations, but they do not directly threaten the paper's central comparative claim: even if attention were unavailable, the RBR component could still produce attacks, and the paper's own ablation shows HRF outperforms RBR without proving that attention is essential. The more load-bearing issue is that the headline claim of surpassing baselines is evaluated with an apparently handicapped TextFooler baseline. Section 4.3 explicitly says TextFooler processes context only, with questions removed. Because TextFooler's word importance is computed from the model's predictive behavior, removing the question changes the very signal the algorithm uses, so this is not a fair comparison. This directly affects the central claim in the abstract and in the conclusion. The provided code repository is a positive sign, and the attack itself appears plausible; the concern is specifically about the comparative evaluation. A single re-run with a question-aware TextFooler adaptation would settle whether the reported dominance is real or an artifact of the adaptation. Until then, conditional acceptance with a required evaluation fix is the appropriate outcome, matching the reader's verdict. I therefore keep the verdict unchanged while disagreeing in emphasis with the reader's identified weakest assumption.","tokens_in":20345,"tokens_out":4764,"duration_ms":54217,"concrete_test":"Re-run the TextFooler baseline on a random subset of at least 1,000 SQuAD 1.1 instances using a question-aware adaptation: feed 'question [SEP] context' as the model input for TextFooler's word-importance scoring and BERT-MLM synonym substitution, with the same top-k budget and d=2 as QA-Attack, against the same T5 and LongT5 victim models. Compare the resulting F1/EM with the current reported values. If the margin between QA-Attack and TextFooler shrinks substantially (e.g., by more than 30%) or reverses, the abstract's 'surpasses existing adversarial techniques' claim must be revised. Report results over at least three seeds with standard deviations to also address the missing error bars.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The abstract claims QA-Attack 'surpasses existing adversarial techniques regarding success rate, semantics changes, BLEU score, fluency and grammar error rate.' The main comparative evidence for that claim is Tables 3–6, but Section 4.3 describes an unfair baseline: 'TextFooler, originally not designed for question-answering tasks, was adapted for our experiments. We modified it to process the context only (questions are removed).' TextFooler's importance scoring and synonym substitution are driven by the model's prediction change, and in QA the question is half of the model input. Removing the question during TextFooler's word selection removes the signal it would otherwise use to locate context words relevant to the query, so the baseline is handicapped relative to QA-Attack, which explicitly uses the question-context pair in its attention and removal rankings. The reported gap is large on some rows, e.g., LongT5/SQuAD 1.1 F1 of 35.31 for TextFooler vs. 7.38 for QA-Attack (Table 5), so this is not a second-order effect. If a question-aware TextFooler adaptation closes that gap, the headline comparative claim loses its main support. The 'attack works' claim may still stand, but the 'surpasses baselines' claim is not established by the current protocol. The lack of error bars and the duplicated TextFooler/T3 rows in Table 6 reinforce that the comparative numbers need independent verification.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes QA-Attack, a word-level adversarial attack for question-answering systems. Section 3 describes three components: Attention-based Ranking (ABR), which extracts attention scores from the victim transformer's encoder/decoder; Removal-based Ranking (RBR), which scores each context word by the change in output probability when the word is deleted; and Hybrid Ranking Fusion (HRF), which sums normalized scores and attacks the top-k words. Section 3.5 uses a BERT masked language model to generate d synonym candidates per target word, and Section 3.6 selects the candidate that maximizes the logit gap between original and attacked outputs. The experiments in Section 4 cover five datasets (SQuAD 1.1, SQuAD V2.0, NarrativeQA, NewsQA, BoolQ) and three victim model families (T5, LongT5, BERT base), comparing QA-Attack against TASA, TMYC, RobustQA, T3, and an adapted TextFooler, with additional ablation, defense, transferability, and efficiency analyses. The paper claims that QA-Attack deceives QA models and surpasses existing adversarial techniques in success rate, semantics preservation, BLEU score, fluency, and grammar error rate.","tokens_in":20640,"tokens_out":7257,"duration_ms":64179,"significance":"The proposed method is relevant to the adversarial robustness literature for QA. Its strengths include released code, evaluation on both informative and boolean query datasets, and a clean combination of attention- and deletion-based ranking with BERT-MLM synonym substitution. The ablation study in Section 4.5.1 supports the value of the fusion over either ranking alone, and the defense and transfer experiments in Sections 4.8 and 4.9 broaden the empirical scope. However, the headline claim of surpassing all baselines is currently supported only by single point estimates, and one baseline is adapted in a way that removes the question from its input. These issues must be fixed before the comparative claim can be accepted; the core phenomenon that word-level perturbations degrade QA accuracy is consistent with prior work and is not in doubt.","major_comments":[{"comment":"The TextFooler adaptation is unfair and undermines the comparative claim. The text states: 'TextFooler, originally not designed for question-answering tasks, was adapted for our experiments. We modified it to process the context only (questions are removed).' Since TextFooler selects words by the model's prediction change, removing the question removes the query signal from its importance estimates, whereas QA-Attack explicitly uses the question-context pair in ABR and RBR. The gap is large in places, e.g., Table 5, LongT5/SQuAD 1.1 F1: 35.31 for TextFooler vs. 7.38 for QA-Attack, so this is not a second-order effect. Please re-run TextFooler with a question-aware adaptation or remove the 'surpasses baselines' claim.","section":"Section 4.3"},{"comment":"No variance, confidence intervals, or significance tests are reported for any of the main comparisons. For instance, in Table 3 (T5, SQuAD 1.1), QA-Attack's F1 of 4.67 is compared with T3's 5.41 and RobustQA's 5.89; in Table 5 (LongT5, SQuAD V2.0), QA-Attack's F1 of 27.11 is compared with RobustQA's 29.01. These differences may be real, but with a single evaluation per cell the reader cannot assess whether they are within noise. Please report repeated runs, confidence intervals, or paired significance tests.","section":"Tables 3–6"},{"comment":"The BoolQ results contain duplicated rows that cannot both be correct. The TextFooler row for Bertbase and LongT5 is identical (F1 33.02, EM 11.57, ROUGE 65.11, BLEU 67.81, SIM 8.17), and the T3 row is likewise identical (F1 22.06, EM 11.02, ROUGE 76.17, BLEU 74.62, SIM 6.23). This indicates a copy-paste error and invalidates the BoolQ comparison for those entries; the authors should correct the table and re-run the affected experiments.","section":"Table 6"},{"comment":"The attention-ranking procedure is not specified precisely enough to reproduce. Algorithm 1 line 2 writes 'α ← [(c, A(q + C))]' and then filters 'if score ∈ C', while the prose says word-level scores are obtained by summing, averaging, and normalizing attention over all layers and heads. The manuscript should define the exact tensor operations, how question tokens are excluded from the context score, and how ABR is computed for victim models such as BERT base, whose attention is not the T5/UnifiedQA attention described in Section 3.2.","section":"Section 3.2 / Algorithm 1"},{"comment":"The threat model is internally inconsistent. Section 1 criticizes gradient-based methods because 'knowing victim models' internal information is unrealistic in practice,' yet Algorithm 1 takes as input both the victim's logits L and an attention network A for the victim model, and Section 3.6 uses per-token output logits to select candidates. The paper should state the assumed adversary capabilities explicitly and discuss how the method degrades when attention weights are unavailable.","section":"Section 1 vs. Section 3"}],"minor_comments":[{"comment":"Reference [63] is cited for RobustQA, but the bibliography entry is Yasunaga et al., 'Robust multilingual part-of-speech tagging via adversarial training,' which does not appear to be the RobustQA attack described in the text; please verify the citation.","section":"References"},{"comment":"There are several typographical issues: 'T able' appears in Tables 1, 3, 4, 5, and 8; Figure 2's caption uses 'HFR' instead of 'HRF'; and Table 8 lists 'NewQA' while the dataset is NewsQA.","section":"Tables and figures"},{"comment":"Table 9's caption lists 'SIM↑' while Tables 3–5 report SIM as '↓' (lower is better); please clarify the desired direction and keep the notation consistent across tables.","section":"Table 9"},{"comment":"The paper alternates between 'Tick Me If You Can' in Section 4.3 and 'Trick Me If You Can' in Section 1; please use one consistent title.","section":"Section 4.3"}],"recommendation":"major_revision","confidential_remarks":"The manuscript has a public code repository, which is a plus. My main concern is that the comparative section needs a careful re-run and a table consistency check before acceptance; the duplicate rows in Table 6 and the unjustified TextFooler adaptation are fixable but currently block the central comparison claim."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this is a plausible word-level attack for QA with a genuinely new, if modest, algorithmic twist, and the attack itself probably works. But the headline claim that it beats all existing attack methods is not backed by the current experiments, mainly because the TextFooler baseline was handicapped.\n\nWhat's new: HRF, a fusion of attention-based ranking and removal-based ranking for choosing which context words to replace. The components are established—deletion importance, BERT-MLM synonyms, attention-based selection—but the specific combination for QA is new and the algorithm is simple and transparent. The ablation showing HRF beating either ranking alone is the most convincing part. They also ship code.\n\nWhat it does well: the experimental coverage is broad: five datasets, three victim models, multiple metrics, plus transferability and defense experiments. If the numbers are accurate, the attack is effective: post-attack F1 on T5/SQuAD 1.1 drops to 4.67 from 88.9, consistent with prior adversarial work.\n\nSoft spots, in order of severity. First, the TextFooler adaptation is unfair: the authors removed the question from TextFooler's input. For a QA attack, the question is half the input; TextFooler's word importance is driven by prediction change on the full input, so this handicaps it. The gap on some rows is large (LongT5/SQuAD 1.1: 35.31 vs 7.38), so this is not second-order. The 'surpasses all baselines' claim is not established until a question-aware TextFooler is tested.\n\nSecond, no error bars anywhere. Comparative claims are point estimates, and some gaps are small (Table 3 SQuAD 1.1: T3 F1 5.41 vs QA-Attack 4.67), so we cannot judge whether differences are meaningful.\n\nThird, Table 6 has a copy-paste error: the LongT5 rows for TextFooler and T3 are identical to the Bertbase rows.\n\nFourth, the RobustQA citation [63] points to a POS-tagging robustness paper, not a QA attack.\n\nThere's also a scope limitation: ABR needs attention weights, so the method doesn't directly apply to APIs that hide attention. That's a limitation, not a flaw.\n\nWho it's for: adversarial NLP researchers looking for a simple baseline attack for QA robustness benchmarks. It deserves peer review with major revisions: fix the TextFooler baseline, add statistical support, correct the duplicated rows and citation.","headline":"A plausible and simple QA attack with a new attention-deletion fusion, but the comparative claim is undercut by an unfair TextFooler baseline and missing error bars.","tokens_in":21163,"tokens_out":3974,"would_cite":true,"duration_ms":34182,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"QA-Attack claims that fusing attention weights with deletion-based importance scores finds the context words whose synonym replacement flips a question-answering model's answer, for both informative and boolean questions.","keywords":["adversarial attack","question answering","word-level perturbation","attention mechanism","deletion ranking","hybrid ranking fusion","BERT masked language model","robustness"],"falsifier":"Run QA-Attack, then repeat with the attention score for every word replaced by a random permutation, or set to zero, while keeping the removal-based ranking unchanged; if attack success does not fall, the attention component of the fusion is not doing the work the paper claims. Alternatively, run the attack on a deployed model that exposes only answers and confidence scores, where the attention-based component cannot be applied at all.","tokens_in":20141,"feed_emoji":"🎯","tokens_out":5524,"duration_ms":54539,"temperature":0.7,"pith_summary":"Question-answering models remain vulnerable in ways that existing attacks only partially cover: most attack methods handle either informative questions that ask who, what, or where, or yes/no boolean questions, but not both, and they often need many edits or sacrifice fluency. This paper proposes QA-Attack, a word-level attack that treats both question types with one recipe: find the context words a QA model relies on by averaging its attention weights and by measuring how much its answer probability drops when each word is deleted, fuse the two rankings, and replace the top few words with synonyms suggested by a masked language model. The paper claims this hybrid ranking beats five existing attack methods across SQuAD, SQuAD 2.0, NarrativeQA, NewsQA, and BoolQ, on attack success, semantic preservation, fluency, and speed. If right, it shows that a small number of well-chosen word substitutions can reliably flip QA predictions while leaving the passage looking natural.","feed_headline":"One attack fools both yes/no and span QA models","feed_subtitle":"Replacing about five words with BERT-picked synonyms drops T5 F1 on SQuAD 1.1 from 88.9 to 4.67.","key_machinery":"The machinery is the pipeline in Algorithm 1. Attention-based Ranking (ABR) averages the attention scores of all layers and heads of the victim's encoder-decoder on the question-context pair, keeps only context-token scores, and normalizes them. Removal-based Ranking (RBR) computes, for each context word $c_i$, the importance $I_i = L_F(a \\mid q, C) - L_F(a \\mid q, C \\setminus c_i)$, meaning the drop in answer log-probability when that word is deleted. The Hybrid Ranking Fusion adds the two normalized scores per word, selects the top-$k$ words, generates $d$ synonym candidates for each by masking the word and asking BERT's masked language model, and chooses the candidate with the largest logit gap that flips the answer. The load-bearing idea is that attention and deletion measure different failure modes, so their sum finds words neither method alone would put first.","core_discovery":"The central claim is that Hybrid Ranking Fusion (HRF), which adds each word's normalized attention score from the victim model to its normalized deletion-based importance score, identifies the tokens whose replacement most reliably changes the answer, for informative and boolean questions alike. In the paper's experiments QA-Attack lowers F1 on the T5 SQuAD 1.1 model to 4.67 from an 88.9 baseline, and also produces adversarial contexts with higher ROUGE and BLEU scores and lower semantic similarity to the original context than the baselines it is compared with. The method selects the final adversary from a small candidate list by maximizing the gap between the logits of the original and the perturbed answer, limiting itself to a handful of substitutions, with topk equal to 5 by default.","pith_inferences":["Because the fusion step only needs attention weights and output logits, the same recipe could be adapted to other attention-based reading tasks such as fact-checking or natural language inference, where passage words rather than question words are the attack surface; that extension is not tested in the paper.","The paper does not compare HRF against a deletion-only ranking with attention scores replaced by random noise; such an ablation would isolate whether attention contributes real signal or merely correlates with deletion importance. This is an editorial suggestion, not a paper claim.","If attention-based ranking is tied to model internals, then the practical reach of QA-Attack is limited to white-box or open-weight systems; closed APIs that hide attention would only be attackable through the deletion component.","The logit-gap selection criterion implies the attack is strongest when the model's pre-attack confidence is high, so connecting attack success to model calibration could let defenders predict which examples are most at risk."],"forward_implications":["A single attack configuration works on both informative QA and boolean QA, so defenses cannot assume an attacker will specialize by question type.","With only about five word substitutions per passage, adversarial examples can preserve grammaticality and fluency while changing the model's answer, making the attack hard for a human reader to spot.","Adversarial samples generated against one QA model also degrade other QA models such as RoBERTa, DistilBERT, and MultiQA, so the vulnerabilities are not unique to the attacked architecture.","Light defenses like FGWS and RanMASK reduce but do not eliminate the attack's success, and retraining with adversarial examples helps until those examples exceed roughly 30 percent of the training data.","Larger BERT models are harder to attack than smaller ones, suggesting that model capacity itself contributes to robustness."],"supporting_citations":[{"why":"BERT is the victim model for the boolean experiments and the masked language model that generates synonym candidates.","marker":"[7]"},{"why":"T5 is the main informative-query victim model whose attention weights and output logits the attack uses.","marker":"[43]"},{"why":"UnifiedQA is the QA system from which the paper extracts attention scores for the attention-based ranking.","marker":"[21]"},{"why":"TextFooler is a word-level attack baseline adapted to context-only input and a key comparison for substitution-based attacks.","marker":"[18]"},{"why":"TASA is a sentence-level answer-sentence attack baseline that is compared on informative queries and shown to be inapplicable to boolean queries.","marker":"[5]"},{"why":"TMYC is a human-in-the-loop adversarial QA example baseline that QA-Attack is compared against.","marker":"[57]"},{"why":"RobustQA is a baseline attack that also uses synonym-based word substitution and is compared on all datasets.","marker":"[63]"},{"why":"T3 is a tree-autoencoder constrained adversarial text generation baseline used for targeted attack comparison.","marker":"[58]"},{"why":"SQuAD 1.1 is the primary informative-query dataset on which the headline F1 results are reported.","marker":"[45]"},{"why":"BoolQ is the boolean-query dataset used for the yes/no attack experiments.","marker":"[6]"}],"fun_headline_variants":["QA-Attack: 5 word swaps drop T5 F1 to 4.67 on SQuAD","Attention+deletion ranking picks words to swap and fools QA","Hybrid word-level attack drops T5 F1 to 4.67","5 synonym swaps deceive QA models, F1 88.9 to 4.67","Word-level adversarial attack works on yes/no and span QA"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method assumes the attacker can access both the victim model's attention weights and its output logits, and that averaged attention actually marks the words whose replacement will fool the model; if a deployed system hides attention, or if attention is uncorrelated with vulnerability, the claimed fusion collapses to deletion-only ranking.","fun_headline_variants_meta":{"raw":{"variants":["QA-Attack: 5 word swaps drop T5 F1 to 4.67 on SQuAD","Attention+deletion ranking picks words to swap and fools QA","Hybrid word-level attack drops T5 F1 to 4.67","5 synonym swaps deceive QA models, F1 88.9 to 4.67","Word-level adversarial attack works on yes/no and span QA"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000936,"raw_usage":{"total_tokens":3976,"prompt_tokens":887,"completion_tokens":3089,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":503,"completion_tokens_details":{"reasoning_tokens":2984}},"tokens_in":503,"tokens_out":3089,"duration_ms":22068,"temperature":1.0,"reasoning_tokens":2984,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T21:48:33.780423+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run QA-Attack, then repeat with the attention score for every word replaced by a random permutation, or set to zero, while keeping the removal-based ranking unchanged; if attack success does not fall, the attention component of the fusion is not doing the work the paper claims. Alternatively, run the attack on a deployed model that exposes only answers and confidence scores, where the attention-based component cannot be applied at all.","supporting_citations":[{"cited_title":"In: Proceedings of the 2019 Conference of the North American Chapter of the Association for Compu- tational Linguistics: Human Language Technologies","cited_arxiv_id":null,"evidence_quote":"BERT is the victim model for the boolean experiments and the masked language model that generates synonym candidates."},{"cited_title":"In: Cohn, T., He, Y., Liu, Y","cited_arxiv_id":null,"evidence_quote":"UnifiedQA is the QA system from which the paper extracts attention scores for the attention-based ranking."},{"cited_title":"Proceedings of the AAAI Conference on Artificial Intelligence 34(05), 8018–8025 (Apr 2020)","cited_arxiv_id":null,"evidence_quote":"TextFooler is a word-level attack baseline adapted to context-only input and a key comparison for substitution-based attacks."},{"cited_title":"In: Goldberg, Y., Kozareva, Z., Zhang, Y","cited_arxiv_id":null,"evidence_quote":"TASA is a sentence-level answer-sentence attack baseline that is compared on informative queries and shown to be inapplicable to boolean queries."},{"cited_title":"Transactions of the Association for Computational Linguistics 7, 387–401 (2019)","cited_arxiv_id":null,"evidence_quote":"TMYC is a human-in-the-loop adversarial QA example baseline that QA-Attack is compared against."},{"cited_title":"In: Walker, M., Ji, H., Stent, A","cited_arxiv_id":null,"evidence_quote":"RobustQA is a baseline attack that also uses synonym-based word substitution and is compared on all datasets."},{"cited_title":"In: Webber, B., Cohn, 26 T., He, Y., Liu, Y","cited_arxiv_id":null,"evidence_quote":"T3 is a tree-autoencoder constrained adversarial text generation baseline used for targeted attack comparison."},{"cited_title":"In: Su, J., Duh, K., Carreras, X","cited_arxiv_id":null,"evidence_quote":"SQuAD 1.1 is the primary informative-query dataset on which the headline F1 results are reported."},{"cited_title":"In: Burstein, J., Doran, C., Solorio, T","cited_arxiv_id":null,"evidence_quote":"BoolQ is the boolean-query dataset used for the yes/no attack experiments."}],"review_version":1}