Pith. sign in

REVIEW 3 major objections 5 minor 78 references

Assessing the Robustness of LLM-based NLP Software via Automated Testing

T0 review · 3 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that a new automated testing method, Adaptive Beam Search (ABS), can find adversarial inputs for LLM-based text classification software far more effectively than existing methods designed for older neural networks.

desk verdict Solid empirical study with a sloppy headline number: ABS beats the baselines, but the abstract's 86.138% average doesn't match Table I. read the letter →

arxiv 2412.21016 v2 pith:WQC5Y74I submitted 2024-12-30 cs.SE

Mingxuan Xiao , Yan Xiao , Shunhui Ji , Hanbo Cai , Lei Xue , Pengcheng Zhang This is my paper · ORCID
classification cs.SE
keywords robustnesstestingLLM-basedNLPsoftwareadaptivebeamsearchadversarialtestcasestextclassificationblack-box
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a new automated testing method, Adaptive Beam Search (ABS), can find adversarial inputs for LLM-based text classification software far more effectively than existing methods designed for older neural networks. The method treats the entire input—the prompt and the example together—as a single object to be perturbed, rather than testing prompts and examples separately. Across three datasets and five LLMs, ABS reports an average test success rate of 86.138% at inducing misclassification, compared with 68.177% for the best existing baseline (PWWS). It also claims to generate more natural and more transferable test cases while using fewer queries and less time per successful test case. If correct, this gives developers a practical way to probe LLM-based software for robustness defects before deployment.

What carries the argument

The central object is Adaptive Beam Search (ABS), a search over the perturbation space of the combined prompt-plus-example text. Standard beam search keeps a fixed-width set of the most promising candidate texts at each step; ABS makes the beam width $b$ adaptive through Eq. (5), which expands the beam when the indicator function $I(s_i, s'_i)$ in Eq. (6) shows that many candidates have lowered the model's confidence on the ground-truth label, and contracts it otherwise. Backtracking is implemented by maintaining a historical best candidate, updated via Eq. (7), and after each iteration replacing the beam's worst-scoring member with that historical best if the historical best has lower confidence. The word importance ranking in Eq. (4), which measures the confidence drop when each word is masked, sets the order in which words are perturbed. These mechanisms turn beam search from a fixed greedy heuristic into a search that widens when exploration pays off and rescues promising candidates that would otherwise be discarded.

What would settle it

A direct test would be to run ABS on the same datasets and threat models but replace the confidence-based word importance ranking and beam-width indicator with a random or fixed ordering of words; if the success rate stays near 86%, the confidence signal is not doing the work, and the reported efficiency gains would need a different explanation. Alternatively, testing ABS on families of LLMs known to produce miscalibrated or unstable confidence scores (e.g., small instruction-tuned models) and observing a drop toward the 68% baseline would confirm the dependency on confidence reliability.

Watch

Extended reading notes

Core claim

The central claim is that robustness testing of LLM-based NLP software should be reformulated as a combinatorial optimization problem over the full input (prompt plus example), and that an adaptive beam search is the right search algorithm for that problem. The paper introduces AORTA, a framework that supplies the goal function, perturbation space, linguistic constraints, and search method needed to run such tests in a black-box setting, and uses it to adapt 17 existing DNN-era testing methods to LLMs. Within this framework, ABS ranks words by how much masking them lowers the model's confidence in the ground-truth label, then performs synonym replacement guided by a beam search whose width grows when perturbations are successfully lowering confidence and shrinks otherwise, with a backtracking mechanism that preserves the historically best candidate. The reported result is an average success rate of 86.138%, about 18 points above the best baseline, together with lower query counts, lower time overhead, fewer grammatical errors, and better transferability of test cases across different LLMs.

Load-bearing premise

The load-bearing premise is that the confidence score an LLM returns for the ground-truth label is a stable and meaningful measure of the model's uncertainty under perturbation, so that lowering that confidence reliably guides the search; the paper itself notes that hallucination effects in smaller LLMs produce unstable or incorrect confidence outputs, which could undermine the search guidance.

Editorial extensions

If this is right

  • If ABS works as reported, LLM-based text classification software can be stress-tested automatically before deployment, with success rates near 86% on standard benchmarks, giving a quantitative robustness score rather than a manual audit.
  • Because ABS test cases are more natural (fewer grammatical errors, lower perplexity) and more transferable across models, the same test suite can be reused on different LLM backends, reducing the cost of repeated robustness assessment.
  • The AORTA framework shows that existing DNN-era testing methods can be ported to LLM-based software, but the ported methods have limited effectiveness (e.g., CheckList reaches only 12.097% on AG's News), implying that a search strategy specialized for LLMs is needed, not just a software wrapper.
  • Ablation results indicate that adaptive beam width and backtracking each contribute independently to the gains, so the two enhancements can be tuned separately for different datasets and model scales.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The method's reliance on confidence scores suggests it may work better for large models with well-calibrated confidence; for small or hallucination-prone models, a calibration step or an alternative uncertainty signal would be a natural extension, since the paper itself notes unstable confidence outputs in smaller LLMs.
  • The same adaptive beam search with backtracking could be extended beyond classification to other safety-critical LLM tasks such as toxic content moderation or log generation, wherever a scalar confidence or likelihood score is available to guide the search.
  • The high transferability of ABS test cases across model sizes hints that the method may be surfacing input-level vulnerabilities that are intrinsic to the data distribution rather than to a particular model, which could support cross-model robustness certification.
  • A testable extension would be to compare ABS against a version that uses a random word-order ranking instead of confidence-based ranking; if success rates remain similar, the confidence signal is not the source of the advantage, and the method could be simplified.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The manuscript proposes AORTA, a modular black-box robustness testing framework for LLM-based NLP software that reformulates testing as a combinatorial optimization problem over the combined prompt and example input. The framework embeds 17 existing DNN-era test methods plus a new method, ABS, which uses beam search with an adaptive beam width and a backtracking/refill mechanism. The authors evaluate ABS against five baselines on three datasets and five open-source LLMs, reporting that ABS achieves a higher success rate, lower time and query overhead, and better naturalness and transferability than the strongest baseline, PWWS.

Significance. If the reported results hold, the paper makes a useful contribution to software testing for LLM-based systems: it provides a unified framework for adapting existing NLP test methods to the black-box LLM setting, and it proposes a plausible search strategy that outperforms the best DNN-era baseline in all 15 settings of Table I. The open-source repository and the modular design are concrete strengths that support reproduction and extension. However, the paper's headline quantitative claim—an average success rate of 86.138%—is not derivable from the paper's own Table I, and the hyperparameter tuning procedure described in Section V is applied on the same test data used for evaluation. These issues bear directly on the central claims and must be resolved before the paper can be recommended for acceptance.

major comments (3)
  1. [Abstract and Conclusion vs. Table I] The abstract and the conclusion state that ABS achieves an average test success rate of 86.138%, compared with 68.177% for PWWS. Table I reports 15 ABS S-rate values: their sum is 1221.780, giving a plain mean of 81.452%; the mean of the three dataset-wise means is also 81.452%. No standard aggregation (plain mean, dataset-wise mean, model-wise mean, or any subset) reproduces 86.138%. The delivered PWWS figure of 68.177% is exactly the mean of the three PWWS dataset means (79.395%, 54.868%, 70.270%), so the inconsistency is specific to the ABS claim. Because this number is presented as the headline evidence of ABS's superiority, please correct the aggregate statistic and recompute all dependent statements (including the query-reduction factor of 218.762 times).
  2. [Section V, Experiment Setup] The paper states that the maximum beam width bmax is set based on 'the datasets' text lengths and the threat models' performance' and that bmax is kept within [6, 10] across experiments. If this tuning is performed on the same 1000-example test sets that are later used to compute S-rate, T-O, and Q-N, the evaluation is optimistically biased: the method is effectively selected on the test data. The paper's own internal-validity discussion in Section VII-B acknowledges hyperparameter sensitivity but does not address this circularity. Please either tune bmax on a held-out validation set, report a sensitivity analysis varying bmax over its range for each dataset/model, or provide variance and per-configuration results so readers can assess the stability of the reported advantages.
  3. [Section VI-A, Table I] All S-rate, C-rate, and PPL entries in Table I are point estimates, even though the text says each experiment was repeated three times and averaged. No standard deviations, confidence intervals, or significance tests are reported. Consequently, assertions such as 'In 10 out of 15 experiments in RQ1, ABS outperformed the best-performing method by more than 5%' and the general claim that ABS 'consistently surpasses all baselines' cannot be distinguished from noise. Please report per-setting variance across the three repeats and, if feasible, a paired test over the 1000 examples or the three repeats to support the qualitative comparison.
minor comments (5)
  1. [Section IV, Eq. (4)] In Eq. (4), the word importance score multiplies a softmax term by the same confidence difference; please clarify what the softmax is computed over and what this multiplication adds beyond the raw difference, since the current formulation is easy to misread as a squared difference with a normalization factor.
  2. [Section IV, Algorithm 1 and Eq. (5)] The symbol 'n' is used both for the number of candidates in the current beam and for the number of words in the input text; using distinct symbols (e.g., b for beam size and m for text length) would improve clarity and avoid confusion in the adaptive beam-width formula.
  3. [Figure 4] The subcaptions in Figure 4 contain evident typos, including 'G rammatical error' and '(want ↓)'; these should be corrected and the y-axis labels made consistent across all panels.
  4. [Section V, Threat Models] The five selected LLMs differ not only in parameter count but also in architecture, tokenizer, and training data; the paper attributes performance differences mainly to parameter scale, so please acknowledge this confound explicitly in the discussion of generalizability.
  5. [Section VI-A, confidence oracle] The authors note in Section VI-A that smaller LLMs exhibit hallucination effects leading to unstable confidence outputs. Since Eq. (4), (6), and (7) all rely on confidence values, it would be helpful to add a brief discussion of how this limitation affects ABS's search guidance relative to the baselines, which use the same soft-label oracle.

Circularity Check

1 steps flagged · score 3.0 of 10

Mild tuning-evaluation overlap on beam width; otherwise the empirical comparison is self-contained and not definitionally circular.

  1. fitted input called prediction [Section V (Experiment Setup, hyperparameter tuning); Abstract and RQ1 results]
    "Through parameter tuning, we set the minimum beam width bmin to 1 and the maximum beam width bmax to 6 in most experiments, and bmax in all experiments are kept in [6, 10]. The criteria for adjusting bmax include the datasets’ text lengths and the threat models’ performance. ... ABS facilitates a more comprehensive and accurate robustness assessment before software deployment, with an average test success rate of 86.138%."

    The beam-width hyperparameter bmax is explicitly adjusted using the performance of the same threat models and datasets on which the reported success rate is then measured. In Eq. (5), b = ((bmax-bmin)/n) * sum(I) + bmin, so bmax directly controls how many perturbation candidates are retained during search; a larger beam can only add candidates and therefore can only increase the chance of finding a label-flipping case. Selecting bmax on the basis of the target models' performance and then presenting the resulting S-rate as evidence of ABS's effectiveness means the headline success figure is partly a fitted maximum rather than an independent prediction.

full rationale

ABS is an empirical search method: word importance ranking (Eq. 4), adaptive beam width (Eqs. 5-6), and backtracking (Eq. 7) are heuristics whose quality is measured by label-flip success on held-out examples; success is not defined in terms of the heuristic quantities, so there is no by-construction reduction of output to input. The comparison against PWWS, TextFooler, TextBugger, CheckList, and StressTest is against external, open-source baselines, and the central claim that ABS outperforms the best baseline is independently supported by the per-setting entries in Table I. The one mild circular step is the tuning of bmax on the same threat models and datasets used for evaluation, which makes the reported average slightly self-selected. Separately, the abstract's 86.138% average is not recoverable from Table I (the 15 ABS S-rate entries average about 81.45%), but that is an internal-consistency/correctness issue rather than a circular-derivation issue. The Section VI-A hallucination caveat about unstable confidence outputs in smaller LLMs is a genuine limitation for confidence-guided search, yet it is shared by the soft-label baselines and does not make the derivation circular. Overall, the paper's core empirical result has independent content; the circularity concern is confined to hyperparameter tuning overlap.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The paper introduces software artifacts (AORTA and ABS) rather than new physical entities. These artifacts carry falsifiable empirical claims through the reported experiments, so the invented-entities ledger is empty. The main contributed 'things' are algorithmic and already covered in the free parameters and axioms.

free parameters (2)
  • b_min (minimum beam width) = 1
    Set by hand in Section V and kept at 1 for all experiments.
  • b_max (maximum beam width) = 6, kept in [6,10]
    Tuned per dataset and threat model based on text length and model performance (Section V), then used to compute reported success rates on the same test examples.
assumptions (4)
  • domain assumption The confidence scores generated by the threat model in response to the prompt are reliable proxies for the model's uncertainty.
    Used in Eq. (4), Eq. (6), and Eq. (7) to rank words, adjust beam width, and select historical best. The authors note in Section VI-A that hallucination can make these scores unstable for smaller models.
  • domain assumption WordNet synonym replacement with stop-word filtering preserves semantics and naturalness sufficiently for testing.
    AORTA's perturbation and constraint modules rely on this to avoid false positives, as described in Sections III-B, III-C, and IV.
  • domain assumption The three datasets, five open-source LLMs, and 1000 randomly sampled examples are representative of LLM-based NLP software.
    External validity threats are acknowledged in Section VII-B; the generalization beyond these datasets and models is not demonstrated.
  • ad hoc to paper bmax can be tuned based on dataset and model performance without invalidating the evaluation.
    Section V sets bmax in [6,10] based on text length and threat model performance, then uses the same test examples for reported S-rate, creating a tuning-evaluation overlap.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Assessing the Robustness of LLM-based NLP Software via Automated Testing." pith.science (2026). https://pith.science/paper/WQC5Y74I

@misc{pith2026241221016,
  author       = {Pith},
  title        = {Pith review of: Assessing the Robustness of LLM-based NLP Software via Automated Testing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WQC5Y74I}},
  note         = {Machine review of arXiv:2412.21016}
}
read the original abstract

Benefiting from the advancements in LLMs, NLP software has undergone rapid development. Such software is widely employed in various safety-critical tasks, such as financial sentiment analysis, toxic content moderation, and log generation. Unlike traditional software, LLM-based NLP software relies on prompts and examples as inputs. Given the complexity of LLMs and the unpredictability of real-world inputs, quantitatively assessing the robustness of such software is crucial. However, to the best of our knowledge, no automated robustness testing methods have been specifically designed to evaluate the overall inputs of LLM-based NLP software. To this end, this paper introduces the first AutOmated Robustness Testing frAmework, AORTA, which reconceptualizes the testing process into a combinatorial optimization problem. Existing testing methods designed for DNN-based software can be applied to LLM-based software by AORTA, but their effectiveness is limited. To address this, we propose a novel testing method for LLM-based software within AORTA called Adaptive Beam Search. ABS is tailored for the expansive feature space of LLMs and improves testing effectiveness through an adaptive beam width and the capability for backtracking. We successfully embed 18 test methods in the designed framework AORTA and compared the test validity of ABS with three datasets and five threat models. ABS facilitates a more comprehensive and accurate robustness assessment before software deployment, with an average test success rate of 86.138%. Compared to the currently best-performing baseline PWWS, ABS significantly reduces the computational overhead by up to 3441.895 seconds per successful test case and decreases the number of queries by 218.762 times on average. Furthermore, test cases generated by ABS exhibit greater naturalness and transferability.

Figures

Figures reproduced from arXiv: 2412.21016 by the authors.

Figure 1
Figure 1. Slightly perturbed text (green) can mislead ChatGPT into judging [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overview of AORTA framework. III. THE AORTA FRAMEWORK [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Bipolar adjective structure of WordNet. at each step in the search process. A narrower beam width can speed up the search by reducing the number of candidate solutions processed, thereby decreasing computational load. However, this acceleration comes at the cost of reduced result quality, as a narrower beam width may lead to discarding potentially high-quality solutions. Conversely, a wider beam width allows for a m… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Comparison of the average number of grammatical errors per test [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: Results of test time overhead on different datasets and threat models (want [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: Results of test query number for different datasets and threat models (want [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

78 extracted references · 60 canonical work pages

  1. [1]

    Llm-based multi-agent systems for software engineering: Literature review, vision and the road ahead,

    J. He, C. Treude, and D. Lo, “Llm-based multi-agent systems for software engineering: Literature review, vision and the road ahead,” ACM Trans. Softw. Eng. Methodol. , Jan. 2025, just Accepted. [Online]. Available: https://doi.org/10.1145/3712003

    doi:10.1145/3712003 2025

  2. [2]

    Fuzz4all: Universal fuzzing with large language models,

    C. S. Xia, M. Paltenghi, J. Le Tian, M. Pradel, and L. Zhang, “Fuzz4all: Universal fuzzing with large language models,” in Proceedings of the IEEE/ACM 46th International Conference on Software Engineering , 2024, pp. 1–13. 14

    work page 2024

  3. [3]

    Promptrobust: Towards evaluating the robustness of large language models on adversarial prompts,

    K. Zhu, J. Wang, J. Zhou, Z. Wang, H. Chen, Y . Wang, L. Yang, W. Ye, Y . Zhang, N. Gong, and X. Xie, “Promptrobust: Towards evaluating the robustness of large language models on adversarial prompts,” in Proceedings of the 1st ACM Workshop on Large AI Systems and Models with Privacy and Safety Analysis , ser. LAMPS ’24. New York, NY , USA: Association for...

    arXiv 2024

  4. [4]

    Sentiment analysis for software engineering: How far can we go?

    B. Lin, F. Zampetti, G. Bavota, M. Di Penta, M. Lanza, and R. Oliveto, “Sentiment analysis for software engineering: How far can we go?” in Proceedings of the 40th international conference on software engineer- ing, 2018, pp. 94–104

    2018

  5. [5]

    Mttm: Metamorphic testing for textual content modera- tion software,

    W. Wang, J.-t. Huang, W. Wu, J. Zhang, Y . Huang, S. Li, P. He, and M. R. Lyu, “Mttm: Metamorphic testing for textual content modera- tion software,” in 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE) . IEEE, 2023, pp. 2387–2399

    work page 2023

  6. [6]

    Unilog: Automatic logging via llm and in- context learning,

    J. Xu, Z. Cui, Y . Zhao, X. Zhang, S. He, P. He, L. Li, Y . Kang, Q. Lin, Y . Dang et al. , “Unilog: Automatic logging via llm and in- context learning,” in Proceedings of the 46th IEEE/ACM International Conference on Software Engineering , 2024, pp. 1–12

    work page 2024

  7. [7]

    Managing extreme ai risks amid rapid progress,

    Y . Bengio, G. Hinton, A. Yao, D. Song, P. Abbeel, T. Darrell, Y . N. Harari, Y .-Q. Zhang, L. Xue, S. Shalev-Shwartz, G. Hadfield, J. Clune, T. Maharaj, F. Hutter, A. G. Baydin, S. McIlraith, Q. Gao, A. Acharya, D. Krueger, A. Dragan, P. Torr, S. Russell, D. Kahneman, J. Brauner, and S. Mindermann, “Managing extreme ai risks amid rapid progress,” Science...

    doi:10.1126/science.adn0117 2024

  8. [8]

    Chatgpt incorrectness detection in software reviews,

    M. H. Tanzil, J. Y . Khan, and G. Uddin, “Chatgpt incorrectness detection in software reviews,” in Proceedings of the IEEE/ACM 46th International Conference on Software Engineering , 2024, pp. 1–12

    work page 2024

Show all 78 references
  1. [9]

    Development in times of hype: How freelancers explore generative ai?

    M. Dolata, N. Lange, and G. Schwabe, “Development in times of hype: How freelancers explore generative ai?” in Proceedings of the IEEE/ACM 46th International Conference on Software Engineering , 2024, pp. 1–13

    2024

  2. [10]

    How far are we? the triumphs and trials of generative ai in learning soft- ware engineering,

    R. Choudhuri, D. Liu, I. Steinmacher, M. Gerosa, and A. Sarma, “How far are we? the triumphs and trials of generative ai in learning soft- ware engineering,” in Proceedings of the IEEE/ACM 46th International Conference on Software Engineering , 2024, pp. 1–13

    2024

  3. [11]

    Text classification via large language models,

    X. Sun, X. Li, J. Li, F. Wu, S. Guo, T. Zhang, and G. Wang, “Text classification via large language models,” in The 2023 Conference on Empirical Methods in Natural Language Processing , 2023

    2023

  4. [12]

    Chatgpt outperforms crowd workers for text-annotation tasks,

    F. Gilardi, M. Alizadeh, and M. Kubli, “Chatgpt outperforms crowd workers for text-annotation tasks,” Proceedings of the National Academy of Sciences, vol. 120, no. 30, p. e2305016120, 2023

    2023

  5. [13]

    Can llms replace manual annotation of software engineering artifacts?

    T. Ahmed, P. Devanbu, C. Treude, and M. Pradel, “Can llms replace manual annotation of software engineering artifacts?” in IEEE/ACM International Conference on Mining Software Repositories , 2025

    2025

  6. [14]

    Assessing the robustness of llm-based nlp software via automated testing,

    X. et al., “Assessing the robustness of llm-based nlp software via automated testing,” https://github.com/lumos-xiao/ABS, 2025

    2025

  7. [15]

    Nanofuzz: A usable tool for automatic test generation,

    M. Davis, S. Choi, S. Estep, B. Myers, and J. Sunshine, “Nanofuzz: A usable tool for automatic test generation,” in Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering , 2023, pp. 1114–1126

    2023

  8. [16]

    Toward stealthy backdoor attacks against speech recognition via elements of sound,

    H. Cai, P. Zhang, H. Dong, Y . Xiao, S. Koffas, and Y . Li, “Toward stealthy backdoor attacks against speech recognition via elements of sound,” IEEE Transactions on Information Forensics and Security , vol. 19, pp. 5852–5866, 2024

    2024

  9. [17]

    Multitest: Physical-aware object insertion for testing multi-sensor fusion perception systems,

    X. Gao, Z. Wang, Y . Feng, L. Ma, Z. Chen, and B. Xu, “Multitest: Physical-aware object insertion for testing multi-sensor fusion perception systems,” in Proceedings of the IEEE/ACM 46th International Confer- ence on Software Engineering , 2024, pp. 1–13

    2024

  10. [18]

    Glue-x: Evaluating natural language understanding models from an out-of-distribution generalization perspective,

    L. Yang, S. Zhang, L. Qin, Y . Li, Y . Wang, H. Liu, J. Wang, X. Xie, and Y . Zhang, “Glue-x: Evaluating natural language understanding models from an out-of-distribution generalization perspective,” in Findings of the Association for Computational Linguistics: ACL 2023 , 2023...

    2023

  11. [19]

    Black box adversarial prompting for foundation models,

    N. Maus, P. Chao, E. Wong, and J. R. Gardner, “Black box adversarial prompting for foundation models,” in The Second Workshop on New Frontiers in Adversarial Machine Learning , 2023

    2023

  12. [20]

    On the robustness of chatgpt: An adversarial and out-of-distribution perspective,

    J. Wang, H. Xixu, W. Hou, H. Chen, R. Zheng, Y . Wang, L. Yang, W. Ye, H. Huang, X. Geng et al. , “On the robustness of chatgpt: An adversarial and out-of-distribution perspective,” in ICLR 2023 Workshop on Trustworthy and Reliable Large-Scale Machine Learning Models , 2023

    2023

  13. [21]

    Software testing with large language models: Survey, landscape, and vision,

    J. Wang, Y . Huang, C. Chen, Z. Liu, S. Wang, and Q. Wang, “Software testing with large language models: Survey, landscape, and vision,”IEEE Transactions on Software Engineering, vol. 50, no. 4, pp. 911–936, 2024

    2024

  14. [22]

    Llmeffichecker:understanding and testing efficiency degradation of large language models,

    X. Feng, X. Han, S. Chen, and W. Yang, “Llmeffichecker:understanding and testing efficiency degradation of large language models,” ACM Trans. Softw. Eng. Methodol. , may 2024, just Accepted. [Online]. Available: https://doi.org/10.1145/3664812

    2024 doi

  15. [23]

    Deepatash: Focused test generation for deep learning systems,

    T. Zohdinasab, V . Riccio, and P. Tonella, “Deepatash: Focused test generation for deep learning systems,” in Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis , 2023, pp. 954–966

    2023

  16. [24]

    Atom: Automated black-box testing of multi-label image classification systems,

    S. Hu, H. Wu, P. Wang, J. Chang, Y . Tu, X. Jiang, X. Niu, and C. Nie, “Atom: Automated black-box testing of multi-label image classification systems,” in 2023 38th IEEE/ACM International Conference on Auto- mated Software Engineering (ASE) . IEEE, 2023, pp. 230–242

    2023

  17. [25]

    Repairing failure-inducing inputs with input reflection,

    Y . Xiao, Y . Lin, I. Beschastnikh, C. Sun, D. Rosenblum, and J. S. Dong, “Repairing failure-inducing inputs with input reflection,” in Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering, 2022, pp. 1–13

    2022

  18. [26]

    Generating natural language adversarial examples through probability weighted word saliency,

    S. Ren, Y . Deng, K. He, and W. Che, “Generating natural language adversarial examples through probability weighted word saliency,” in Proceedings of the 57th annual meeting of the association for compu- tational linguistics, 2019, pp. 1085–1097

    2019

  19. [27]

    Good debt or bad debt: Detecting semantic orientations in economic texts,

    P. Malo, A. Sinha, P. Korhonen, J. Wallenius, and P. Takala, “Good debt or bad debt: Detecting semantic orientations in economic texts,” Journal of the Association for Information Science and Technology , vol. 65, no. 4, pp. 782–796, 2014

    2014

  20. [28]

    Character-level convolutional networks for text classification,

    X. Zhang, J. Zhao, and Y . LeCun, “Character-level convolutional networks for text classification,” in Advances in Neural Information Processing Systems , C. Cortes, N. Lawrence, D. Lee, M. Sugiyama, and R. Garnett, Eds., vol. 28. Curran Associates, Inc., 2015. [Online]. Avail...

    2015

  21. [29]

    Seeing stars: exploiting class relationships for sentiment categorization with respect to rating scales,

    B. Pang and L. Lee, “Seeing stars: exploiting class relationships for sentiment categorization with respect to rating scales,” in Proceedings of the 43rd Annual Meeting on Association for Computational Linguistics , 2005, pp. 115–124

    2005

  22. [30]

    Beam search: faster and monotonic,

    S. Lemons, C. L. L ´opez, R. C. Holte, and W. Ruml, “Beam search: faster and monotonic,” in Proceedings of the International Conference on Automated Planning and Scheduling , vol. 32, 2022, pp. 222–230

    2022

  23. [31]

    Chatgpt- resistant screening instrument for identifying non-programmers,

    R. Serafini, C. Otto, S. A. Horstmann, and A. Naiakshina, “Chatgpt- resistant screening instrument for identifying non-programmers,” in Pro- ceedings of the IEEE/ACM 46th International Conference on Software Engineering, 2024, pp. 1–13

    2024

  24. [32]

    Uncovering the causes of emotions in software developer communication using zero-shot llms,

    M. M. Imran, P. Chatterjee, and K. Damevski, “Uncovering the causes of emotions in software developer communication using zero-shot llms,” in Proceedings of the IEEE/ACM 46th International Conference on Software Engineering, 2024, pp. 1–13

    2024

  25. [33]

    Can automated text classification improve content analysis of software project data?

    J. Noll, D. Seichter, and S. Beecham, “Can automated text classification improve content analysis of software project data?” in 2013 ACM/IEEE International Symposium on Empirical Software Engineering and Mea- surement. IEEE, 2013, pp. 300–303

    2013

  26. [34]

    Hqa-attack: toward high quality black-box hard-label adversarial attack on text,

    H. Liu, Z. Xu, X. Zhang, F. Zhang, F. Ma, H. Chen, H. Yu, and X. Zhang, “Hqa-attack: toward high quality black-box hard-label adversarial attack on text,” Advances in Neural Information Processing Systems , vol. 36, 2024

    2024

  27. [35]

    Limeattack: Local explainable method for textual hard-label adversarial attack,

    H. Zhu, Q. Zhao, W. Shang, Y . Wu, and K. Liu, “Limeattack: Local explainable method for textual hard-label adversarial attack,” in Pro- ceedings of the AAAI Conference on Artificial Intelligence, vol. 38, 2024, pp. 19 759–19 767

    2024

  28. [36]

    Texthacker: Learning based hybrid local search algorithm for text hard-label adversarial attack,

    Z. Yu, X. Wang, W. Che, and K. He, “Texthacker: Learning based hybrid local search algorithm for text hard-label adversarial attack,” in Findings of the Association for Computational Linguistics: EMNLP 2022 , 2022, pp. 622–637

    2022

  29. [37]

    Natural language adversarial defense through synonym encoding,

    X. Wang, J. Hao, Y . Yang, and K. He, “Natural language adversarial defense through synonym encoding,” in Uncertainty in Artificial Intel- ligence. PMLR, 2021, pp. 823–833

    2021

  30. [38]

    Leap: Efficient and automated test method for nlp software,

    M. Xiao, Y . Xiao, H. Dong, S. Ji, and P. Zhang, “Leap: Efficient and automated test method for nlp software,” in 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE) . IEEE, 2023, pp. 1136–1148

    2023

  31. [39]

    Beyond accuracy: Behavioral testing of nlp models with checklist (extended abstract),

    M. T. Ribeiro, T. Wu, C. Guestrin, and S. Singh, “Beyond accuracy: Behavioral testing of nlp models with checklist (extended abstract),” in Thirtieth International Joint Conference on Artificial Intelligence IJCAI- 21, 2021

    2021

  32. [40]

    Understanding the value of software engineering technologies,

    P. Green, T. Menzies, S. Williams, and O. El-Rawas, “Understanding the value of software engineering technologies,” in 2009 IEEE/ACM International Conference on Automated Software Engineering . IEEE, 2009, pp. 52–61. 15

    2009

  33. [41]

    Enhancing speaker diarization with large language models: A contextual beam search approach,

    T. J. Park, K. Dhawan, N. Koluguri, and J. Balam, “Enhancing speaker diarization with large language models: A contextual beam search approach,” in ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . IEEE, 2024, pp. 10 861–10 865

    2024

  34. [42]

    Conformal au- toregressive generation: Beam search with coverage guarantees,

    N. Deutschmann, M. Alberts, and M. R. Mart ´ınez, “Conformal au- toregressive generation: Beam search with coverage guarantees,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 38, 2024, pp. 11 775–11 783

    2024

  35. [43]

    Hybrid filtered beam search algorithm for the optimization of monitoring patrols,

    M. Gam, A. J. Telmoudi, and D. Lefebvre, “Hybrid filtered beam search algorithm for the optimization of monitoring patrols,” Journal of Intelligent & Robotic Systems , vol. 107, no. 2, p. 26, 2023

    2023

  36. [44]

    Large- scale language model rescoring on long-form data,

    T. Chen, C. Allauzen, Y . Huang, D. Park, D. Rybach, W. R. Huang, R. Cabrera, K. Audhkhasi, B. Ramabhadran, P. J. Moreno et al., “Large- scale language model rescoring on long-form data,” in ICASSP 2023- 2023 IEEE International Conference on Acoustics, Speech and Signal Proces...

    2023

  37. [45]

    Beamqa: Multi-hop knowledge graph question answering with sequence-to-sequence prediction and beam search,

    F. Atif, O. El Khatib, and D. Difallah, “Beamqa: Multi-hop knowledge graph question answering with sequence-to-sequence prediction and beam search,” in Proceedings of the 46th International ACM SIGIR Conference on Research and Development in Information Retrieval , 2023, pp. 781–790

    2023

  38. [46]

    Iso/iec,

    I. ISO and N. IEC, “Iso/iec,” IEEE International Standard-Systems and software engineering–Vocabulary, pp. 1–541, 2017

    2017

  39. [47]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Good- fellow, and R. Fergus, “Intriguing properties of neural networks,” in 2nd International Conference on Learning Representations, ICLR 2014 , 2014

    2014

  40. [48]

    Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp,

    J. Morris, E. Lifland, J. Y . Yoo, J. Grigsby, D. Jin, and Y . Qi, “Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp,” in Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstra...

    2020

  41. [49]

    Fast adversarial attacks on language models in one GPU minute,

    V . S. Sadasivan, S. Saha, G. Sriramanan, P. Kattakinda, A. Chegini, and S. Feizi, “Fast adversarial attacks on language models in one GPU minute,” in Forty-first International Conference on Machine Learning, 2024. [Online]. Available: https://openreview.net/forum?id= wCMNbdshcY

    2024

  42. [50]

    Hotflip: White-box adversarial examples for text classification,

    J. Ebrahimi, A. Rao, D. Lowd, and D. Dou, “Hotflip: White-box adversarial examples for text classification,” in Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), 2018, pp. 31–36

    2018

  43. [51]

    Towards improving adversarial training of nlp models,

    J. Y . Yoo and Y . Qi, “Towards improving adversarial training of nlp models,” in Findings of the Association for Computational Linguistics: EMNLP 2021, 2021, pp. 945–956

    2021

  44. [52]

    A recovering beam search algorithm for the one-machine dynamic total completion time scheduling problem,

    F. Della Croce and V . T’kindt, “A recovering beam search algorithm for the one-machine dynamic total completion time scheduling problem,” Journal of the Operational Research Society , vol. 53, no. 11, pp. 1275– 1280, 2002

    2002

  45. [53]

    Backtrack beam search for multiobjective scheduling problem,

    T. Tanino, T. Tanaka, M. Inuiguchi, and N. Honda, “Backtrack beam search for multiobjective scheduling problem,” in Multi-Objective Pro- gramming and Goal Programming: Theory and Applications. Springer, 2003, pp. 147–152

    2003

  46. [54]

    Is bert really robust? a strong baseline for natural language attack on text classification and entailment,

    D. Jin, Z. Jin, J. T. Zhou, and P. Szolovits, “Is bert really robust? a strong baseline for natural language attack on text classification and entailment,” Proceedings of the AAAI Conference on Artificial Intelligence, vol. 34, no. 05, pp. 8018–8025, Apr. 2020. [Online]. Avail...

    2020

  47. [55]

    Understanding neural networks through representation erasure

    J. Li, W. Monroe, and D. Jurafsky, “Understanding neural networks through representation erasure.” CoRR, vol. abs/1612.08220, 2016. [Online]. Available: http://dblp.uni-trier.de/db/journals/corr/corr1612. html#LiMJ16a

    2016 arXiv

  48. [56]

    Wordnet: A lexical database for english,

    G. A. Miller, “Wordnet: A lexical database for english,” Commun. ACM, vol. 38, no. 11, p. 39–41, nov 1995. [Online]. Available: https://doi.org/10.1145/219717.219748

    1995

  49. [57]

    Word-level textual adversarial attacking as combinatorial optimization,

    Y . Zang, F. Qi, C. Yang, Z. Liu, M. Zhang, Q. Liu, and M. Sun, “Word-level textual adversarial attacking as combinatorial optimization,” in Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics . Online: Association for Computational Linguist...

    2020

  50. [58]

    Mistral 7b,

    A. Q. Jiang, A. Sablayrolles, A. Mensch, C. Bamford, D. S. Chaplot, D. d. l. Casas, F. Bressand, G. Lengyel, G. Lample, L. Saulnier et al., “Mistral 7b,” arXiv preprint arXiv:2310.06825 , 2023

    2023 arXiv

  51. [59]

    Llama 2: Open foundation and fine-tuned chat models,

    H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y . Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosale et al. , “Llama 2: Open foundation and fine-tuned chat models,” arXiv preprint arXiv:2307.09288, 2023

    2023 arXiv

  52. [60]

    Internlm2 technical report,

    Z. Cai, M. Cao, H. Chen, K. Chen, K. Chen, X. Chen, X. Chen, Z. Chen, Z. Chen, P. Chu et al., “Internlm2 technical report,” CoRR, 2024

    2024

  53. [61]

    Yi: Open foundation models by 01. ai,

    A. Young, B. Chen, C. Li, C. Huang, G. Zhang, G. Zhang, H. Li, J. Zhu, J. Chen, J. Chang et al., “Yi: Open foundation models by 01. ai,” arXiv preprint arXiv:2403.04652, 2024

    2024 arXiv

  54. [62]

    Stress test evaluation for natural language inference,

    A. Naik, A. Ravichander, N. Sadeh, C. Rose, and G. Neubig, “Stress test evaluation for natural language inference,” in Proceedings of the 27th International Conference on Computational Linguistics , 2018, pp. 2340–2353

    2018

  55. [63]

    Testing the limits: Unusual text inputs generation for mobile app crash detection with large language model,

    Z. Liu, C. Chen, J. Wang, M. Chen, B. Wu, Z. Tian, Y . Huang, J. Hu, and Q. Wang, “Testing the limits: Unusual text inputs generation for mobile app crash detection with large language model,” in Proceedings of the IEEE/ACM 46th International Conference on Software Engineering...

    2024

  56. [64]

    Textbugger: Generating adversarial text against real-world applications,

    J. Li, S. Ji, T. Du, B. Li, and T. Wang, “Textbugger: Generating adversarial text against real-world applications,” in Proceedings 2019 Network and Distributed System Security Symposium . Internet Society, 2019

    2019

  57. [65]

    Hallucination is inevitable: An innate limitation of large language models,

    Z. Xu, S. Jain, and M. Kankanhalli, “Hallucination is inevitable: An innate limitation of large language models,” arXiv preprint arXiv:2401.11817, 2024

    2024 arXiv

  58. [66]

    Augmenting llms with knowledge: A survey on hallucination prevention,

    K. Andriopoulos and J. Pouwelse, “Augmenting llms with knowledge: A survey on hallucination prevention,” arXiv preprint arXiv:2309.16459 , 2023

    2023 arXiv

  59. [67]

    Coophance: Cooperative enhancement for robustness of deep learning systems,

    Q. Zhang, Y . Tian, Y . Ding, S. Li, C. Sun, Y . Jiang, and J. Sun, “Coophance: Cooperative enhancement for robustness of deep learning systems,” in Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis , 2023, pp. 753–765

    2023

  60. [68]

    Black-box testing of deep neural networks through test case diversity,

    Z. Aghababaeyan, M. Abdellatif, L. Briand, R. S, and M. Bagherzadeh, “Black-box testing of deep neural networks through test case diversity,” IEEE Transactions on Software Engineering , vol. 49, no. 5, pp. 3182– 3204, 2023

    2023

  61. [69]

    Dialtest: automated testing for recurrent- neural-network-driven dialogue systems,

    Z. Liu, Y . Feng, and Z. Chen, “Dialtest: automated testing for recurrent- neural-network-driven dialogue systems,” in Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis, 2021, pp. 115–126

    2021

  62. [70]

    Keeper: Automated testing and fixing of machine learning software,

    C. Wan, S. Liu, S. Xie, Y . Liu, H. Hoffmann, M. Maire, and S. Lu, “Keeper: Automated testing and fixing of machine learning software,” ACM Trans. Softw. Eng. Methodol. , jun 2024, just Accepted. [Online]. Available: https://doi.org/10.1145/3672451

    2024 doi

  63. [71]

    Automated testing and improvement of named entity recognition systems,

    B. Yu, Y . Hu, Q. Mang, W. Hu, and P. He, “Automated testing and improvement of named entity recognition systems,” in Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, 2023, pp. 883– 894

    2023

  64. [72]

    Keeping llms aligned after fine-tuning: The crucial role of prompt templates,

    K. Lyu, H. Zhao, X. Gu, D. Yu, A. Goyal, and S. Arora, “Keeping llms aligned after fine-tuning: The crucial role of prompt templates,” in ICLR 2024 Workshop on Reliable and Responsible Foundation Models , 2024

    2024

  65. [73]

    Look before you leap: An exploratory study of uncertainty analysis for large language models,

    Y . Huang, J. Song, Z. Wang, S. Zhao, H. Chen, F. Juefei-Xu, and L. Ma, “Look before you leap: An exploratory study of uncertainty analysis for large language models,” IEEE Transactions on Software Engineering , vol. 51, no. 2, pp. 413–429, 2025

    2025

  66. [75]

    Imperceptible content poisoning in llm-powered applications,

    Q. Zhang, C. Zhou, G. Go, B. Zeng, H. Shi, Z. Xu, and Y . Jiang, “Imperceptible content poisoning in llm-powered applications,” in Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering, ser. ASE ’24. New York, NY , USA: Association for Com...

    2024

  67. [76]

    Revisiting out-of-distribution robustness in nlp: Bench- marks, analysis, and llms evaluations,

    L. Yuan, Y . Chen, G. Cui, H. Gao, F. Zou, X. Cheng, H. Ji, Z. Liu, and M. Sun, “Revisiting out-of-distribution robustness in nlp: Bench- marks, analysis, and llms evaluations,” Advances in Neural Information Processing Systems, vol. 36, 2024

    2024

  68. [77]

    Revisit input perturbation problems for llms: A unified robustness evaluation framework for noisy slot filling task,

    G. Dong, J. Zhao, T. Hui, D. Guo, W. Wang, B. Feng, Y . Qiu, Z. Gongque, K. He, Z. Wang et al., “Revisit input perturbation problems for llms: A unified robustness evaluation framework for noisy slot filling task,” in CCF International Conference on Natural Language Processing...

    2023

  69. [78]

    Ro- bustness over time: Understanding adversarial examples’ effectiveness 16 on longitudinal versions of large language models,

    Y . Liu, T. Cong, Z. Zhao, M. Backes, Y . Shen, and Y . Zhang, “Ro- bustness over time: Understanding adversarial examples’ effectiveness 16 on longitudinal versions of large language models,” arXiv preprint arXiv:2308.07847, 2023. Mingxuan Xiao is a computer science and techn...

    2023

  70. [2021]

    degree in computer science and technology with the College of Computer Science and Software Engineering, Hohai University

    He is currently pursuing the Ph.D. degree in computer science and technology with the College of Computer Science and Software Engineering, Hohai University. His research interests include the domain of trustworthy ML and responsible AI, especially backdoor learning and advers...

    2010

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.