RockNER: A Simple Method to Create Adversarial Examples for Evaluating the Robustness of Named Entity Recognition Models

Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 3728–3737 November 7–11, 2021. c⃝2021 Association for Computational Linguistics 3728 RockNER: A Simple Method to Create Adversarial Examples for Evaluating the Robustness of Named Entity Recognition Models Bill Yuchen Lin Wenyang Gao Jun Yan Ryan Moreno Xiang Ren {yuchen.lin,wenyangg,yanjun,morenor,xiangren}@usc.edu Department of Computer Science and Information Sciences Institute, University of Southern California Abstract To audit the robustness of named entity recog- nition (NER) models, we propose RockNER, a simple yet effective method to create natural adversarial examples. Specifically, at the en- tity level, we replace target entities with other entities of the same semantic class in Wikidata; at the context level, we use pre-trained lan- guage models (e.g., BERT) to generate word substitutions. Together, the two levels of at- tack produce natural adversarial examples that result in a shifted distribution from the train- ing data on which our target models have been trained. We apply the proposed method to the OntoNotes dataset and create a new bench- mark named OntoRock for evaluating the ro- bustness of existing NER models via a system- atic evaluation protocol. Our experiments and analysis reveal that even the best model has a significant performance drop, and these mod- els seem to memorize in-domain entity pat- terns instead of reasoning from the context. Our work also studies the effects of a few sim- ple data augmentation methods to improve the robustness of NER models. 1 1 Introduction Recent named entity recognition (NER) models have achieved great performance on many con- ventional benchmarks such as CoNLL2003 (Tjong Kim Sang, 2002) and OntoNotes 5.0 (Weischedel et al., 2013). However, it is not clear whether they are reliable in realistic applications in which en- tities and/or context words can be out of the dis- tribution of the training data. It is thus important to audit the robustness of NER systems via nat- ural adversarial attacks. Most existing methods for generating adversarial attacks in NLP focus on sentence classification (Jin et al., 2020; Li et al., 2020; Minervini and Riedel, 2018) and question an- swering (Jia and Liang, 2017; Ribeiro et al., 2018; 1Our code and data are publicly available at the project website: https://inklab.usc.edu/rockner. Original NER Examples I thank my Beijing [GPE] friends and wish everyone a Happy New Year [EVENT] . Natural Adversarial Examples (Entity-only) I thank my Bari [GPE] friends and wish everyone a Happy Casimir Pulaski Day [EVENT] . Natural Adversarial Examples (Entity + Context) I admire my Bari [GPE] roommates and wish everyone a Happy Casimir Pulaski Day [EVENT] . Entity-level Attack Context-level Attack Figure 1: Illustration of RockNER attacking pipeline. Gan and Ng, 2019), and these methods lack spe- cial designs reflecting the underlying compositions of the NER examples — i.e., entity structures and their context words. In this paper, we focus on creating general natural adversarial examples (i.e., real-world entities and human-readable context) for evaluating the robustness of NER models. As shown in Figure 1, given a NER example, our method …

Content truncated to 500 words