Existing works have shown that fine-tuned textual transformer models achieve state-of-the-art prediction performances but are also vulnerable to adversarial text perturbations. Traditional adversarial evaluation is often done \textit{only after} fine-tuning the models and ignoring the training data. In this paper, we want to prove that there is also a strong correlation between training data and model robustness. To this end, we extract 13 different features representing a wide range of input fine-tuning corpora properties and use them to predict the adversarial robustness of the fine-tuned models. Focusing mostly on encoder-only transformer models BERT and RoBERTa with additional results for BART, ELECTRA and GPT2, we provide diverse evidence to support our argument. First, empirical analyses show that (a) extracted features can be used with a lightweight classifier such as Random Forest to effectively predict the attack success rate and (b) features with the most influence on the model robustness have a clear correlation with the robustness. Second, our framework can be used as a fast and effective additional tool for robustness evaluation since it (a) saves 30x-193x runtime compared to the traditional technique, (b) is transferable across models, (c) can be used under adversarial training, and (d) robust to statistical randomness. Our code will be publicly available.

翻译：现有研究表明，微调后的文本Transformer模型虽在预测性能上达到最优水平，却易受对抗性文本扰动的影响。传统对抗性评估通常仅在模型微调后进行，忽视了训练数据的作用。本文旨在证明训练数据与模型鲁棒性之间存在强相关性。为此，我们提取了代表输入微调语料库属性的13种不同特征，用以预测微调后模型的对抗鲁棒性。研究主要聚焦于编码器型Transformer模型BERT和RoBERTa，并辅以BART、ELECTRA和GPT2的实验结果，多维度验证我们的论点。首先，实证分析表明：(a)提取的特征可与随机森林等轻量级分类器结合，有效预测攻击成功率；(b)对模型鲁棒性影响最大的特征与鲁棒性存在明确相关性。其次，我们的框架可作为快速有效的鲁棒性评估辅助工具，因为它具备以下优势：(a)与传统方法相比，运行速度提升30-193倍；(b)可跨模型迁移；(c)适用于对抗训练场景；(d)对统计随机性具有鲁棒性。相关代码将公开发布。