{"id":"94d75530-c806-432d-8a74-02ae39453bf3","arxiv_id":"2501.00066","paper_version":2,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"Sequential fine-tuning across related bias-detection tasks tends to raise adversarial attack success rates, but the size-resilience pattern the paper highlights is not borne out by its own data.","lead":"This paper tests whether fine-tuning a language model on one bias-detection task before fine-tuning on another changes how easily the model can be attacked. It finds that this transfer route often increases attack success rates, but the effect does not depend cleanly on model size.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Scale-resilience claim is not identified: GPT-2-family mean ΔASR is non-monotonic (11.6, 12.7, 1.3, 5.3) and model size is confounded with LoRA vs full fine-tuning, so the abstract's 'larger models exhibit greater resilience' lacks controlled support.","rationale":"The first clause of the central claim (transfer learning often increases ASR) has some support in Table 1, where most entries are positive. However, the second clause—'larger models exhibit greater resilience'—is the paper's claimed novelty and is the weakest part. The data in Table 1 and Table 2 contradict the monotonic size trend within the GPT-2 family, and the comparison across model families conflates model size with adaptation method (full fine-tuning vs LoRA). This is not merely a disagreement with external consensus; it is an internal inconsistency between the stated conclusion and the reported measurements. Because the scale claim drives RQ2 and the abstract, and because no seeds or error bars are provided to distinguish real trends from noise, the central claim is unsupported as written. The reader's REJECT verdict remains appropriate; no adjustment is needed.","tokens_in":17206,"tokens_out":4613,"duration_ms":42097,"concrete_test":"Re-run the transfer-learning protocol on GPT-2, GPT-2-medium, and GPT-2-large (all full fine-tuning, same LR schedule, Adam, 6 epochs) on the same three MBIB targets with at least 5 random seeds per condition, and compute mean ΔASR and 95% bootstrap CIs separately for A2T and TextFooler. If mean ΔASR does not monotonically decrease with size (e.g., GPT-2-medium ≥ GPT-2 base, or CIs overlap), the scale-resilience claim fails. As a secondary check, fine-tune GPT-2-XL both with full fine-tuning and LoRA to separate the size effect from the adaptation-method confound.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central novelty is the scale claim in the abstract and Section 3.2.1: 'larger models within each family (GPT-2, BERT, RoBERTa) exhibited smaller increases in ASR due to transfer learning.' Table 1's own GPT-2 family means contradict this: average ΔASR for GPT-2 base, medium, and large are 11.6%, 12.7%, and 1.3%, so medium is worse than base; adding GPT-2-XL (5.3%, LoRA) makes the size trend non-monotonic. Table 2 reinforces the inconsistency: the fraction of sequences with ASR increase is 83.3%, 91.7%, 50.0%, and 75.0% across the GPT-2 family. The cross-family size comparison is also confounded: BERT/RoBERTa/GPT-2 (≤762M) use full fine-tuning, while Gemma-2B, Phi-2, and GPT-2-XL use LoRA, so 'larger models' are not compared under the same adaptation method. Since each result is a single run with no seeds or error bars reported (Section 2.3 lists only an LR range), the observed differences could reflect training noise or hyperparameter effects rather than a scale effect. The paper's own Section 3.1.1 concedes 'mixed results' for LoRA models, yet the abstract states the scale claim unconditionally. Thus the load-bearing novelty is unsupported as stated.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies whether transfer learning (pre-training on a related bias dataset followed by fine-tuning on a target bias dataset) affects the adversarial robustness of text classifiers. Using three MBIB bias datasets, two attacks (TextFooler and A2T), and models ranging from BERT/GPT-2 to Gemma/Phi, the authors report that transfer learning often increases Attack Success Rate (ASR) while sometimes improving original accuracy, and they claim that larger models show greater resilience to this effect. The paper also includes an adversarial-training experiment (RQ4). The appendix provides per-sequence raw results for all transfer sequences.","tokens_in":17493,"tokens_out":5812,"duration_ms":52286,"significance":"If the scale-resilience finding were sound, it would be practically relevant: practitioners could expect larger models to be safer under transfer. The paper's strength is that it reports raw per-sequence results in the appendix and covers several architectures and bias domains. However, the headline scale claim is not supported by the paper's own Table 1: the GPT-2 family is non-monotonic in size, and model size is confounded with LoRA versus full fine-tuning. Because the paper's main novelty rests on this unsupported claim, the current contribution is limited to a descriptive observation that transfer learning often increases ASR.","major_comments":[{"comment":"The claim that 'larger models within each family (GPT-2, BERT, RoBERTa) exhibited smaller increases in ASR' is directly contradicted by the GPT-2 family: the average delta-ASR values are 11.6% for GPT-2, 12.7% for GPT-2-medium, 1.3% for GPT-2-large, and 5.3% for GPT-2-XL. The non-monotonic pattern, with medium worse than base, breaks the size-resilience premise stated in the abstract. This undermines the paper's central novelty.","section":"Section 3.2.1 and Table 1"},{"comment":"Model size is confounded with adaptation method: BERT, RoBERTa, and GPT-2 (up to 762M parameters) use full fine-tuning, while Gemma-2B, Phi-2, and GPT-2-XL use LoRA. Consequently, cross-family comparisons of 'larger models' cannot be attributed to scale alone. Section 3.1.1 itself concedes 'mixed results' for LoRA models, yet the abstract states the scale claim unconditionally.","section":"Section 2.6 and Section 3.1.1"},{"comment":"All results are reported from single runs with no error bars, standard deviations, or significance tests. The learning rate is selected from a wide range (5e-6 to 4e-4) and the best model is chosen on validation, so the observed delta-ASR differences (e.g., 1.9% vs. 20.4%) could reflect training noise or hyperparameter selection rather than a true effect of transfer learning. This lack of statistical grounding weakens every quantitative comparison in the paper.","section":"Section 2.3 and Table 1"},{"comment":"The example 'on the Hate Speech dataset, GPT-2 experiences a mean 20.4% increase in ASR' is factually incorrect. Table 1 shows GPT-2's Hate Speech delta-ASR is 1.94%; the 20.4% value corresponds to the Gender Bias dataset. This misattribution undermines the credibility of the narrative around the performance-robustness trade-off.","section":"Section 3.1 and Table 1"}],"minor_comments":[{"comment":"The header of Table 8 lists 'OAcc ASR ASR' with a duplicated 'ASR' column; the third column should presumably be 'AUA'.","section":"Table 8"},{"comment":"The explanations involving 'false memories' and 'shortcut learning' are speculative and not tested by the experiments; they should be framed as hypotheses rather than conclusions.","section":"Section 3.1.1"},{"comment":"The learning rate range is very broad; the paper should report the exact learning rate used for each model, since this is essential for reproducibility.","section":"Section 2.3"},{"comment":"The percentages in Table 2 are not accompanied by the number of sequences considered per model; without this denominator, the percentages are difficult to interpret.","section":"Table 2"},{"comment":"Figures 2 and 3 are referenced but do not appear in the text provided; they should include axis labels and, if possible, error bars or per-point values consistent with Table 1.","section":"Figures 2 and 3"}],"recommendation":"reject","confidential_remarks":"The paper's central claim about scale resilience is contradicted by its own GPT-2 family data and is confounded by the LoRA/full-fine-tuning split. The single-run nature of the experiments further weakens confidence. The authors might improve the manuscript by substantially weakening the scale claim and adding multi-seed experiments, but in its current form the main contribution is not supported."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Worth a look if you care about fine-tuning and robustness, but the abstract oversells. The genuinely new thing is the measurement grid: three bias-detection datasets, ten model variants, direct fine-tuning versus sequential transfer across datasets, two attacks, and a table of relative ASR changes. That mapping is not in the cited prior work, and the raw numbers are presented for every sequence. Credit where due: the measurements are direct, no parameters were fitted to produce the headline ASR/AUA values, and Section 3.1.1 explicitly concedes 'mixed results' for the LoRA models. That honesty is good.\n\nThe soft spots are real. The abstract's 'larger models exhibit greater resilience' is the load-bearing novelty, and Table 1 does not support it. Within the GPT-2 family, average delta ASR is 11.6% for base, 12.7% for medium, 1.3% for large, and 5.3% for XL. Non-monotonic. Table 2 shows the same pattern: 83.3, 91.7, 50.0, 75.0. The cross-family size comparison is confounded because the large models use LoRA while BERT/RoBERTa/GPT-2 use full fine-tuning. The paper says so itself, which makes the unconditional abstract claim even harder to accept.\n\nThere is also a concrete error in Section 3.1: the text says GPT-2 on Hate Speech shows a 20.4% ASR increase with a 3.67% accuracy gain, but the table shows the 20.4% is for Gender Bias, and Hate Speech is 1.94%. The example is mislabeled.\n\nThe methodological floor is low: single runs, no seeds, no error bars, no code, and ASR is averaged across TextFooler and A2T, which have very different strengths, without discussion. That matters because several observed deltas are small enough to be noise. The broad 'ASR often increases' trend is visible in the raw data, but the effect sizes are modest and the clean size law is not there.\n\nWho is this for? Someone assembling a table of fine-tuning robustness observations might mine Appendix B. A reader wanting a reliable statement about scale effects should look elsewhere. I'd send it to review only if the authors fix the mislabeled example, qualify the scale claim to what the data actually shows, and either add seeds/error bars or clearly mark the results as single-run exploratory. That is a substantial revision. Still, the underlying empirical question is reasonable and this specific grid isn't in the literature, so a serious referee could give useful guidance. My own verdict is reject as written, but it deserves referee time rather than a desk rejection.","headline":"A useful new empirical grid on sequential fine-tuning and adversarial robustness, but the abstract's scale-resilience claim is contradicted by the paper's own GPT-2 family numbers.","tokens_in":18030,"tokens_out":1937,"would_cite":false,"duration_ms":17548,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Transfer learning often raises attack success even when accuracy improves, and scale appears to soften the effect.","keywords":["adversarial robustness","transfer learning","fine-tuning","large language models","attack success rate","LoRA","bias detection","text classification"],"falsifier":"Re-run the GPT-2 family (base, medium, large, XL) with at least 10 random seeds per condition, identical learning rates and epochs, and measure ΔASR between direct fine-tuning and transfer. The size-resilience claim is falsified if the median ΔASR of GPT-2-large is not smaller than that of GPT-2-medium, or if the sign of the effect reverses across seeds.","tokens_in":16995,"feed_emoji":"🛡️","tokens_out":4701,"duration_ms":43351,"temperature":0.7,"pith_summary":"This paper argues that applying transfer learning to language models—first fine-tuning on one bias-detection dataset, then fine-tuning on a related target dataset—frequently increases a model's vulnerability to adversarial attacks, measured as attack success rate (ASR), even in cases where standard accuracy improves. The authors test this across five model families (BERT, RoBERTa, GPT-2, Gemma, Phi) and three bias-classification datasets, using TextFooler and A2T attacks. They claim that within a model family, larger models tend to show smaller ASR increases from transfer learning, and that the effect is more variable and sometimes reversed for LoRA-adapted billion-parameter models. The work matters because transfer learning is standard practice, and if accuracy gains mask robustness losses, deployed models could be systematically more attackable than their benchmarks suggest.","feed_headline":"Transfer learning makes small LLMs easier to attack","feed_subtitle":"Accuracy often rises while vulnerability grows; larger models appear to resist the effect.","key_machinery":"The key machinery is a controlled comparison protocol: for each model, train (a) direct fine-tuning on the target dataset and (b) transfer learning from one large bias dataset to the target small dataset, then measure the relative change in Attack Success Rate (ΔASR) under two attacks. TextFooler generates adversarial examples by replacing important words with semantically similar substitutes; A2T uses gradient-based word importance and counter-fitted embeddings. For billion-parameter models the authors use LoRA (low-rank adaptation), which freezes base weights and trains small random adapters. The load-bearing quantity is the relative ΔASR between the two training regimes, and the paper's size-resilience claim is an observed inverse relationship between model parameter count and this ΔASR.","core_discovery":"The central discovery is an empirical regularity: the average Attack Success Rate (ASR) of a model fine-tuned directly on a target dataset is usually lower than the ASR of the same model after it has first been trained on a different but related dataset and then transferred to the target. This holds across most of the 30 model-dataset combinations reported, with an average relative ASR increase often in the 8–30% range for smaller models, while original accuracy typically rises by 1–8%. The paper further finds that the size of the ASR increase shrinks as model size grows within the BERT, RoBERTa, and GPT-2 families, and that models adapted with LoRA show mixed, sometimes beneficial robustness shifts. The authors also report that adding 10% adversarial examples during transfer learning reduces ASR and raises accuracy-under-attack, at the cost of clean accuracy.","pith_inferences":["Because the large models were adapted with LoRA and the small ones with full fine-tuning, model size is entangled with adaptation method; the size-resilience claim may partly be an effect of LoRA's parameter isolation rather than scale itself.","The datasets are all bias-detection tasks that share a similar label scheme; the transfer here is between closely related domains, so the 'transfer learning' effect may be smaller than in more distant domain adaptation, meaning the robustness loss could be even larger in real multi-stage pipelines.","A practical metric suggested by the data: compute ΔASR per point of ΔOAcc ('robustness elasticity of transfer'); models with high positive elasticity would be flagged as unsafe to transfer even when accuracy improves.","The variability in LoRA results (e.g., improved ASR on political bias for Phi-2 and Gemma) hints that adapter rank, initialization, or training order, rather than model scale, may be the controlling factor; a controlled study varying adapter rank at fixed size would test this."],"forward_implications":["If the pattern holds, safety evaluation for fine-tuned LLMs should measure attack success rate or accuracy-under-attack, not just accuracy, because transfer learning can raise vulnerability while benchmarks improve.","Smaller models deployed after transfer learning would be the highest-risk targets, since their ASR increases are largest.","LoRA-adapted large models cannot be assumed to follow the same trend; their robustness after transfer varies by sequence and can even improve, so they need individual robustness checks.","Including a fraction of adversarial examples during transfer learning is a viable mitigation: it lowers ASR and boosts accuracy-under-attack at a moderate cost to clean accuracy.","The size-resilience trend implies that scaling model size may be one route to safer transfer, independent of architecture family."],"supporting_citations":[{"why":"Supplies the MBIB Hate Speech, Political Bias, and Gender Bias datasets used for all pre-training and target fine-tuning.","marker":"[13]"},{"why":"Supplies the TextFooler word-level black-box attack used to measure attack success rate.","marker":"[8]"},{"why":"Supplies the A2T gradient-based white-box attack used to measure attack success rate.","marker":"[16]"},{"why":"Defines the LoRA low-rank adaptation method used for Gemma, Phi-2, and GPT-2-XL.","marker":"[7]"},{"why":"Defines the GPT-2 model family whose size progression anchors the scale-resilience comparison.","marker":"[11]"},{"why":"Defines the BERT architecture used in the encoder-based family comparisons.","marker":"[2]"},{"why":"Defines the RoBERTa architecture used as a second encoder-based family.","marker":"[9]"},{"why":"Provides the baseline empirical observation that fine-tuning can affect robustness, which this paper extends to transfer scenarios.","marker":"[15]"}],"fun_headline_variants":["Transfer learning boosts accuracy but opens attack holes","Small LLMs get 8–30% more attackable after transfer","Fine-tune LLMs? Expect higher adversarial success","Transfer learning: accuracy up, but ASR spikes for small models","Larger LLMs resist transfer's adversarial side effect"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The paper assumes the difference in attack success rate between transfer learning and direct fine-tuning is caused by the transfer process itself, not by single-run training noise, learning-rate tuning, or by pairing small models with full fine-tuning and large models with LoRA.","fun_headline_variants_meta":{"raw":{"variants":["Transfer learning boosts accuracy but opens attack holes","Small LLMs get 8–30% more attackable after transfer","Fine-tune LLMs? Expect higher adversarial success","Transfer learning: accuracy up, but ASR spikes for small models","Larger LLMs resist transfer's adversarial side effect"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000117,"raw_usage":{"total_tokens":1022,"prompt_tokens":835,"completion_tokens":187,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":451,"completion_tokens_details":{"reasoning_tokens":106}},"tokens_in":451,"tokens_out":187,"duration_ms":2846,"temperature":1.0,"reasoning_tokens":106,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T23:18:54.212359+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the GPT-2 family (base, medium, large, XL) with at least 10 random seeds per condition, identical learning rates and epochs, and measure ΔASR between direct fine-tuning and transfer. The size-resilience claim is falsified if the median ΔASR of GPT-2-large is not smaller than that of GPT-2-medium, or if the sign of the effect reverses across seeds.","supporting_citations":[{"cited_title":"Introducing mbib-the first media bias identification benchmark task and dataset collection","cited_arxiv_id":null,"evidence_quote":"Supplies the MBIB Hate Speech, Political Bias, and Gender Bias datasets used for all pre-training and target fine-tuning."},{"cited_title":"Is bert really robust? a strong baseline for natural language attack on text classification and entailment","cited_arxiv_id":null,"evidence_quote":"Supplies the TextFooler word-level black-box attack used to measure attack success rate."}],"review_version":1}