{"id":"70df18fa-561f-4de4-bfd1-7fbffa751c5f","arxiv_id":"2502.07101","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"SMAB uses multi-armed bandit sampling and masked-language-model replacements to estimate word-level sensitivity of text classifiers, and applies it to accuracy prediction and adversarial text generation.","lead":"This paper introduces SMAB, a multi-armed bandit system that estimates how much each word drives a text classifier's prediction by replacing words with language-model alternatives and counting label flips. These word sensitivities are then used to predict accuracy drops across languages and to craft adversarial examples with higher success rates.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"SMAB's global sensitivity is computed from an OR of a random and a best-case flip indicator (Eq. 2 + binarization), so even with infinite pulls it does not converge to Hahn singleton sensitivity; it is a biased, occurrence-count-dependent statistic.","rationale":"The reader correctly identified the fidelity of SMAB to Hahn sensitivity as the load-bearing assumption, but I sharpen the concern from 'unverified convergence' to 'definitionally biased target.' The algorithm's own equations show that L_w is the OR of a random and a best-case flip indicator, so the running average in Eq. 3 cannot converge to the mean flip rate that 'singleton sensitivity' denotes. This is an internal inconsistency, not merely a disagreement with prior consensus. It matters because all three applications—CHECKLIST separation, accuracy proxy, and adversarial attacks—use the estimated sensitivity values as if they were comparable across words; an occurrence-count-dependent bias would break that comparability. The concrete test would settle the issue by comparing SMAB against exact singleton sensitivity on a small dataset. I do not recommend outright rejection because the SMAB values may still be a useful heuristic, and the test could reveal a high rank correlation with the exact quantity; if so, the paper would need only to redefine what it estimates and add the comparison. The limitations section acknowledges scope restrictions but does not address this estimator-fidelity gap, so the conditional verdict is appropriate.","tokens_in":18815,"tokens_out":8453,"duration_ms":83403,"concrete_test":"On a small subset (e.g., 50 sentences from SST-2 and 50 from CHECKLIST), compute exact per-word singleton sensitivity by enumerating all top-50 (or all vocabulary) MLM replacements for each occurrence and averaging flip indicators under the target classifier, using the same replacement distribution as SMAB. Run SMAB with the same classifier and MLM for the same words, then compare: (a) Spearman rank correlation between SMAB G_w and the exact mean flip rate; (b) a regression of G_w on exact mean flip rate, occurrence count, and their interaction. If G_w is significantly predicted by occurrence count after controlling for exact flip rate, or rank correlation is below about 0.8, the estimator is measuring a different statistic and the central claim needs revision.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim is that SMAB scales up Hahn et al.'s singleton/block sensitivity. But the estimator defined in Section 2.3 does not estimate that quantity. After sampling up to 10 MLM replacements for all sentences containing a word w, the algorithm selects one random instance s1 with reward r1 and the highest-reward instance s2 with reward r2 from P_w, then sets L_w = 0.9*r1 + 0.1*r2 (Eq. 2), and 'We assign L_w to 1 if L_w > 0' before Eq. 3. Since rewards are flip indicators, this binarized L_w equals 1 iff r1=1 OR r2=1, i.e., a single flip in either of two cherry-picked instances. The global update Eq. 3 is a running average of these OR indicators over pulls. Exact singleton sensitivity for a word is, up to the replacement distribution, the average flip probability over replacements for each occurrence. The SMAB estimator instead converges to E[r1 OR r2], which is strictly larger than E[r1] for nontrivial flip probabilities and grows with the number of occurrences/replacements through the max term r2. Frequent words are therefore systematically inflated, and the ranking of words by G^t is not comparable across words; there is no convergence to Hahn sensitivity even as T goes to infinity. The paper never reports a comparison against exact singleton or block sensitivity on a small dataset, so this definitional mismatch is the load-bearing gap. If the mismatch is real, the CHECKLIST separation, the KLD-vs-accuracy proxy, and the attack gains are all mediated by a different statistic than claimed.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes SMAB, a two-level multi-armed bandit framework for estimating word-level local (sentence-level) and global (dataset-level) sensitivities of a text classifier, following the sensitivity notion of Hahn et al. (2021). The framework is applied to three tasks: a case study on a CheckList-generated sentiment dataset to identify high- and low-sensitivity words, a cross-lingual/cross-model study using KL divergence between sensitivity distributions as an unsupervised accuracy proxy, and two adversarial attack settings (PromptAttack with GPT-3.5 and Llama-2, and ParaphraseAttack on Rotten Tomatoes). The authors report improvements over baselines, including a claimed 15.58% improvement in attack success rate and a 12.00% improvement in human-judged adversariality for paraphrase attacks.","tokens_in":19185,"tokens_out":9681,"duration_ms":80636,"significance":"If the claims held, SMAB would be a practically valuable black-box sensitivity estimator that scales beyond the exponential cost of Hahn et al. (2021), with downstream benefits for model diagnosis, interpretability, and adversarial auditing. The paper contains several constructive elements: a public code repository, a diverse multilingual evaluation setup, human evaluation for paraphrase attacks, and a sanity check on templated CheckList data. However, the significance is conditional on resolving definitional and algorithmic gaps: the estimator as specified does not provably track the sensitivity quantity it claims to scale, the bandit machinery is not fully specified, and one advertised application (paraphrase attack) does not actually use the SMAB estimator. These issues must be addressed before the empirical results can be taken as evidence for the central claim.","major_comments":[{"comment":"The local sensitivity L_w is computed from a randomly sampled sentence s1 and the highest-reward sentence s2 from the perturbed set P_w, and is then binarized ('We assign L_w to 1 if L_w > 0') before the global update in Eq. (3). Since rewards are label-flip indicators, this binarized value is 1 exactly when either s1 or s2 flips the label, so the running average G_w^t converges to the probability that at least one of two (partly cherry-picked) perturbed instances flips the label, not to the mean flip probability that defines singleton sensitivity in Hahn et al. (2021). This quantity is increasing in the number of MLM replacements N and in the number of sentences containing the word, so frequent words are systematically inflated and the resulting ranking is not comparable across words. The paper provides no convergence proof, no regret analysis, and no comparison against exact singleton or block sensitivity on a small dataset, leaving the fidelity of SMAB to the quantity it claims to scale unverified.","section":"Section 2.3, Eqs. (2)-(3) and Algorithm 1"},{"comment":"The described sampling procedure is not a valid UCB or Thompson Sampling implementation. Eq. (1) writes w*_{t+1} = argmax_w Beta(α, β), which is not a well-defined operation, and the Beta parameters α, β are initialized randomly and never updated with observed rewards. Consequently there is no exploration-exploitation tradeoff, no posterior learning, and no mechanism for the global sensitivity estimates to influence future word selection. The statement 'We minimize the total regret R_t' is not supported by any step of the algorithm or by any experimental measurement of regret. As written, SMAB is a random-sampling heuristic with a running-average accumulator, not a multi-armed bandit method.","section":"Section 2.3 and Algorithm 1"},{"comment":"The paraphrase-attack experiment does not use the SMAB framework. The sensitivity reward in Eq. (9) is computed by Algorithm 2, which extracts keyphrases with TopicRank, masks each word, generates 10 perturbed sentences, and computes the flip fraction; this is a separate estimator with no MAB component and no connection to the local/global sensitivities defined in Section 2.3. Therefore the claimed application of SMAB to paraphrase attacks is not supported by the reported experiments, and the '12.00% improvement over SOTA' attributed to sensitivity-guided paraphrase generation must be re-associated with a different estimator.","section":"Section 5.4 and Appendix D"},{"comment":"The accuracy-proxy claim rests on only 9 data points for mHate and 5 for XNLI, with no error bars or cross-validation. The p-values treat languages as independent samples, yet languages in the same dataset share model, tokenizer, and task characteristics and are not independent observations. Moreover, Section 4 states that KLD is compared with the 'relative drop in accuracy', but the figures plot KLD against absolute accuracy, which is a different quantity. Given the small sample size and this specification mismatch, the evidence for an unsupervised accuracy proxy is thin.","section":"Section 4.3, Figures 3-4"},{"comment":"The headline attack improvements are reported for the best configuration among several choices of SMAB LLM (six models) and perturbation type (W4, W5, W6), with no standard deviation, confidence interval, or significance test. No comparison is made against a random-word selection baseline or against an alternative attribution method such as LIME or SHAP, so it is unclear whether the observed ASR gains are due to the sensitivity values themselves or to the specific prompt phrasing and the general instruction to modify a minimal subset of words.","section":"Section 5.3, Table 3"}],"minor_comments":[{"comment":"Step 7 of Algorithm 1 says 'Select two sentences s1, s2 ∈ S_w' while the text says s1 ∈ P_w and s2 ∈ P_w; the notation should be unified to avoid ambiguity about whether the two sentences are drawn from the original sentence set or from the set of perturbed instances.","section":"Section 2.3 vs Algorithm 1"},{"comment":"The sentence 'We assign L_w to 1 if L_w > 0' appears in the Global Sensitivity paragraph after Eq. (3), but this binarization is a core part of the estimator and should be defined earlier, with its effect on the statistical interpretation of G_w^t made explicit.","section":"Section 2.3"},{"comment":"The abstract reports an improvement of 13.61% while Section 5.3 and Table 3 report 15.58%; these numbers should be reconciled.","section":"Abstract vs Section 5.3 and Table 3"},{"comment":"The phrase 'improvement over the baselines by a margin of 15.58%' should clarify whether this is an absolute percentage-point difference or a relative improvement, as the two readings give different substantive claims.","section":"Section 5.3"},{"comment":"UCB is mentioned in the text and in Figure 2, but only a Beta-based sampling rule is described, which is not UCB; the paper should either define the UCB rule actually used or state that only Thompson-style sampling was implemented.","section":"Section 2.3"},{"comment":"The symbol N is overloaded: it denotes the number of MLM replacements (N=10), the count N^w in Eq. (3), and the number of sensitivity bins in Section 4; using distinct symbols would prevent confusion.","section":"Various"},{"comment":"The time-complexity expression for SMAB in Eq. (8) omits the inner-loop cost of perturbing all sentences in S_w and generating N replacements per selected word; a precise cost model and empirical runtime would be needed to support the scalability claim.","section":"Appendix A"},{"comment":"The SASR curve for UCB is constant because the UCB estimates fall into only two bins, which suggests the UCB variant is not operating as intended; this observation should be discussed rather than used solely as evidence for the superiority of Thompson Sampling.","section":"Figure 2"},{"comment":"The sensitivity threshold used in the SASR evaluation is introduced without a principled method for selecting it; the SASR-versus-threshold curves are informative, but the metric requires a clear decision rule for practical use.","section":"Section 3"}],"recommendation":"major_revision","confidential_remarks":"The paper bundles two distinct sensitivity estimators under the SMAB umbrella: the MAB-based estimator of Section 2.3 and the keyphrase-masking estimator of Algorithm 2 in Appendix D. The paraphrase-attack section should either be re-run with actual SMAB sensitivities or be presented as a separate contribution. The abstract/body inconsistency in the reported improvement (13.61 vs 15.58) suggests insufficient final proofreading. The public code repository is a positive element, but no license or reproducibility checklist is provided. The fit with the journal's scope is reasonable for a broad NLP/ML venue, though the theoretical and empirical gaps currently make acceptance premature."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core idea here is genuinely useful: a label-free, black-box word-sensitivity estimator that needs no gold labels and no model weights, then applied to three practical problems. The CHECKLIST case study, the KLD-as-accuracy-proxy idea, and the sensitivity-guided attacks are all worth a look. The code is public and the writing is clear. This is not a paper to desk-reject.\n\nBut there is a load-bearing definitional problem. The local sensitivity in Eq. 2 combines a randomly drawn flip indicator with the best-case flip indicator, then binarizes the sum to 1 if positive. Since the rewards are 0/1, that binarization makes the local sensitivity an OR of the two flip events, not the singleton flip probability. The global sensitivity in Eq. 3 is a running average of these OR events. As the stress-test note correctly points out, even with infinite pulls this converges to E[r1 OR r2], which is strictly larger than the singleton flip probability and grows with the number of occurrences or replacements. So SMAB does not actually estimate the Hahn et al. sensitivity it claims to scale up. The paper never compares SMAB to exact singleton or block sensitivity on a small dataset, so we do not know whether the biased statistic even correlates with the intended target. That is the main gap.\n\nThere are also smaller issues. The bandit specification is internally inconsistent: it calls UCB but samples from Beta distributions, and the regret formula in Eq. 6 is never used. The accuracy-proxy claim rests on 5 to 9 correlation points, which is thin even with a p-value. The attack results are reported as best configurations without error bars or significance testing, and the abstract and introduction disagree on whether the PromptAttack improvement is 15.58% or 13.61%. These are fixable but need attention.\n\nWhat the paper does well is to show that a cheap, label-free sensitivity-like signal can separate template types and improve two attack families. That empirical finding might survive even if the estimator is not exactly Hahn sensitivity, but the paper needs to either fix the estimator or reframe the claims to match what is actually computed. A small-scale exact-sensitivity comparison would settle this quickly.\n\nI would send this to peer review. The idea is novel enough to deserve a serious referee, but the revision must address the estimator mismatch head-on and add the missing validation.","headline":"The sensitivity estimator is a running average of an OR of two flip events, not Hahn-style sensitivity; the paper's applications are interesting but rest on that mismatch.","tokens_in":743,"tokens_out":886,"would_cite":false,"duration_ms":36444,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"SMAB claims word-level sensitivity can be estimated cheaply and without labels, and shows it predicts accuracy drops and sharpens attacks.","keywords":["word sensitivity","multi-armed bandit","text classification","adversarial text generation","unsupervised accuracy proxy","masked language modeling","model interpretability"],"falsifier":"Take a small dataset, enumerate all MLM substitutions for each word (or compute Hahn et al.'s exact singleton sensitivity on a subset), and compare SMAB's final word rankings to the exact flip rates: if the rank correlation is near zero, or if words above a 0.9 sensitivity threshold flip labels no more often than randomly chosen words, the estimator is not tracking sensitivity.","tokens_in":18610,"feed_emoji":"🎯","tokens_out":7555,"duration_ms":62767,"temperature":0.7,"pith_summary":"SMAB (Sensitivity-based Multi-Armed Bandit) claims that word-level sensitivity of a text classifier—how likely replacing a word is to change the predicted label—can be estimated cheaply and without gold labels, using a two-level bandit that samples sentences, replaces target words with masked-language-model alternatives, and counts label flips. The paper argues this estimate is good enough to separate words that matter from words that do not in template-generated tests, to serve as an unsupervised proxy for accuracy when gold labels are missing, and to sharpen adversarial text attacks. In the paper's experiments, sensitivity-guided prompts raise attack success rate by 15.58 percentage points over the perturbation-prompt baseline (the introduction states 13.61), and adding a sensitivity reward improves paraphrase attack quality by 12.00 percentage points over the best baseline. If true, sensitivity—previously requiring exponential enumeration—becomes a practical black-box diagnostic for sequence classifiers.","feed_headline":"Bandit sampler finds words that flip a classifier","feed_subtitle":"SMAB estimates word sensitivity without gold labels, then uses it to predict accuracy drops and sharpen attacks.","key_machinery":"Key machinery is the two-level bandit with sample-replace-predict updates. The outer arm is a word w with global sensitivity G_w^t; the inner arm is the set S_w of sentences containing w, each with a local sensitivity. Selection uses Thompson Sampling (or UCB) over Beta(α, β) priors, so words believed more sensitive are explored more. Local sensitivity is L_w = ε r1 + (1−ε) r2, where r1 and r2 come from a random and the best sampled perturbed sentence and any positive flip is binarized to 1; global sensitivity is updated as G_w^t = (N^w $G_w^{{t−1}}$ + L_w)/(1 + N^w). The machinery's job is to make the exponential enumeration of Hahn et al.'s subset sensitivity unnecessary: SMAB's quoted time complexity is O(T(|X| + |D||V| cost(f))) rather than O(|D| |V|^{|P|} cost(f)).","core_discovery":"The paper's central claim is that for any sequence classifier and dataset, the sensitivity of individual words can be estimated as the expected frequency with which replacing that word with a contextually plausible substitute flips the classifier's output, and that this can be done at scale by a two-level multi-armed bandit. The outer arms are the dataset's words; each word points to the sentences containing it as inner arms. At each step the bandit selects a word, samples two of its sentences, replaces the word in each using a masked language model (ten draws per sentence), and labels the perturbed sentences with the target classifier. A positive reward is any label flip, binarized to 1, and the local sensitivity is a convex combination of a randomly chosen sentence's reward and the highest-reward sentence's reward; global sensitivity is a running average over visits. The paper reports that on CHECKLIST-style sentiment tests, words marked high-sensitivity by Thompson Sampling lie in DIR templates and flip labels with high success rate, while INV-template words stay in low-sensitivity bins. It further reports that the KL divergence between sensitivity distributions of two models or languages correlates negatively with their accuracy difference (Pearson r = −0.75 on multilingual hate speech, −0.91 on XNLI), and that sensitivity-guided perturbation instructions outperform the perturbation-prompt baselines by 15.58 percentage points on SST-2, while a sensitivity reward improves the paraphrase attack by 12.00 percentage points on human-judged adversarial quality.","pith_inferences":["Beyond the paper: because SMAB consumes only predictions, the same estimator could audit any API-only classifier; the transferability of sensitivity rankings across different target models is an open question the paper does not test.","Beyond the paper: the KLD-accuracy correlation is established on two tasks and a handful of models; a natural test is whether it survives across more diverse model families and domains, and whether it can be used to detect distribution shift.","Beyond the paper: the binarization of local rewards to 1 discards confidence information; a variant that keeps the original reward might yield finer-grained sensitivity and could be compared against the current version."],"forward_implications":["Word-level sensitivity can be computed for large datasets without ever seeing model weights or gold labels, using only an MLM and classifier predictions.","Template-generated behavioral tests can be audited automatically: words from DIR templates should score high and INV words low, giving a cheap sanity check on a classifier's sensitivities.","In the absence of gold labels, the KL divergence between sensitivity distributions can rank models or languages by expected accuracy, which would ease low-resource evaluation.","Adversarial attacks can be steered by sensitivity: telling an LLM which words are globally sensitive improves perturbation prompts, and rewarding paraphrase generation for changing sensitivity improves attack quality."],"supporting_citations":[{"why":"Defines sensitivity as the number of disjoint changeable subsets; SMAB scales this notion.","marker":"Hahn et al. (2021)"},{"why":"Provides the CHECKLIST templates and dataset used in the case study separating INV and DIR words.","marker":"Ribeiro et al. (2020)"},{"why":"Supplies the UCB selection strategy used as one outer-arm sampler.","marker":"Auer et al. (2002)"},{"why":"Supplies Thompson Sampling, the main outer-arm selection strategy used by SMAB.","marker":"Thompson (1933)"},{"why":"Provides the masked language model that generates replacement words in sample-replace-predict.","marker":"Devlin et al. (2019)"},{"why":"Provides the perturbation-prompt attack baseline that sensitivity-guided prompts extend.","marker":"Xu et al. (2023)"},{"why":"Provides the paraphrase attack baseline whose reward function is augmented with the sensitivity reward.","marker":"Roth et al. (2024)"},{"why":"Provides the XNLI dataset used in the KLD-accuracy proxy experiments.","marker":"Conneau et al. (2018)"},{"why":"Provides the SST-2 dataset used for adversarial example generation.","marker":"Socher et al. (2013)"}],"fun_headline_variants":["Bandit-based sensitivity predicts word flips and sharpens attacks","MAB word sensitivity: a proxy for accuracy and a boost for attacks","Sensitivity-guided bandit boosts attacks by 15.58%","Bandit sampler: word sensitivity without gold labels","SMAB: scalable sensitivity for adversarial text generation"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that replacing a word in only ten MLM-drawn samples and binarizing every label flip to 1 produces a reward whose average tracks the true probability that perturbing that word changes the classifier's output, so that the bandit's final sensitivity rankings are faithful to the sensitivity it claims to scale up.","fun_headline_variants_meta":{"raw":{"variants":["Bandit-based sensitivity predicts word flips and sharpens attacks","MAB word sensitivity: a proxy for accuracy and a boost for attacks","Sensitivity-guided bandit boosts attacks by 15.58%","Bandit sampler: word sensitivity without gold labels","SMAB: scalable sensitivity for adversarial text generation"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000801,"raw_usage":{"total_tokens":3573,"prompt_tokens":1045,"completion_tokens":2528,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":661,"completion_tokens_details":{"reasoning_tokens":2445}},"tokens_in":661,"tokens_out":2528,"duration_ms":19155,"temperature":1.0,"reasoning_tokens":2445,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-08T13:47:41.192535+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a small dataset, enumerate all MLM substitutions for each word (or compute Hahn et al.'s exact singleton sensitivity on a subset), and compare SMAB's final word rankings to the exact flip rates: if the rank correlation is near zero, or if words above a 0.9 sensitivity threshold flip labels no more often than randomly chosen words, the estimator is not tracking sensitivity.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines sensitivity as the number of disjoint changeable subsets; SMAB scales this notion."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies Thompson Sampling, the main outer-arm selection strategy used by SMAB."}],"review_version":1}