robustness evaluation

This study investigates the robustness of NLP models under systematic, minimal linguistic perturbations—spanning orthography, syntax, dialect, and style. We propose the first language-driven, task-agnostic framework for controllable perturbation generation, integrating LLM-based prompt engineering with human-in-the-loop validation to construct high-quality, multi-granularity perturbed datasets. A cross-task benchmarking protocol is designed and evaluated across four mainstream NLP tasks. Key findings are: (1) negation-based modifications induce widespread vulnerability, revealing a shared weakness; (2) LLMs exhibit greater robustness than traditional models but still suffer from significant language-level deficiencies; (3) perturbation effects are strongly task-dependent. Our work establishes a novel systematic robustness evaluation paradigm and provides both theoretical foundations and practical tools for modeling linguistic robustness.

Deep learning models exhibit insufficient robustness against adversarial perturbations and common image corruptions, undermining their reliability in real-world deployment. To address this, we propose an active robustness verification strategy that leverages the training set itself: by performing local robustness analysis, our method automatically identifies “weakly robust” samples—serving as early, interpretable indicators of model vulnerability—and enables targeted robustness enhancement. Unlike conventional passive paradigms that rely solely on perturbed test sets for robustness evaluation, ours is the first to repurpose training data for robustness diagnostics. We integrate adversarial perturbation injection with diverse natural corruption tests. Extensive experiments on CIFAR-10, CIFAR-100, and ImageNet demonstrate that our strategy significantly improves model robustness against both attacks and corruptions (average gain of +8.2%) while enhancing the sensitivity and interpretability of reliability assessment.

This work addresses the challenge of generating high-coverage, diverse robustness test cases for microservice APIs, where anomalous inputs can trigger cascading failures. The authors propose an automated test generation approach leveraging large language models (LLMs), integrating existing mutation taxonomies into prompt design and introducing two novel strategies: Guided and GuidedFewShot. Evaluations across three open-source LLMs (14B–70B parameters) and seven prompting strategies produced 663 test cases on mono- and multilingual microservice systems. Results demonstrate that prompting strategy exerts a greater influence on test diversity than model size; GuidedFewShot achieves the highest single-run fault coverage—detecting 5 out of 9 and 8 out of 14 failure modes in the two systems, respectively—with low cross-model similarity. Moreover, combining multiple prompting strategies with a single LLM surpasses the effectiveness of multi-model ensembles.

To address unexpected behavioral shifts in language models (LMs) following fine-tuning or deployment, this paper introduces Behavioral Shift Auditing (BSA), a continuous monitoring framework. BSA operates without access to model parameters or gradients, and—uniquely—establishes the first unsupervised, statistical hypothesis testing framework for text generation comparison, leveraging the Kolmogorov–Smirnov test and bootstrap resampling to reliably detect distributional shifts in critical capabilities such as toxicity and translation. The method provides theoretically grounded false positive control and supports configurable tolerance thresholds to accommodate diverse application scenarios. Experiments demonstrate that BSA achieves stable detection of significant behavioral shifts using only hundreds of samples, attaining high sensitivity and low false positive rates on both toxicity and machine translation tasks. Overall, BSA establishes a lightweight, robust, and interpretable paradigm for continuous auditing of LM behavioral evolution.

Current evaluation datasets struggle to accurately estimate the risk of rare failures that machine learning models may encounter in deployment. This work proposes an extrapolation method for failure rates grounded in extreme value theory, leveraging the top-k largest failure scores observed in the evaluation set to predict failure rates at deployment scale. To address the inherent safety bias and the tendency of existing extrapolation estimators to overlook high-risk failure modes, the approach incorporates a predictability-aware loss function during fine-tuning. Experiments on the Password Game and GridWorld benchmarks demonstrate that the proposed method substantially reduces prediction error while preserving primary task performance, achieving safety levels comparable to those of supervised baselines.

This work addresses the lack of traceability in existing domain-specific fine-tuning approaches, which often leads to blind and inefficient data augmentation. The authors propose a “programming with data” paradigm that treats structured knowledge representations as a unified foundation for both training and evaluation, drawing an analogy to software development: training data serve as source code, model training as compilation, evaluation as unit testing, and data refinement as debugging. This framework enables precise, concept- and reasoning-chain–oriented model repair through structured knowledge extraction, test-driven data engineering, concept-level gap analysis, and diagnosis of broken reasoning chains. Validated across 16 disciplines, the approach significantly enhances model performance without compromising general capabilities, and the authors release an open-source knowledge base, evaluation suite, and training corpora to support reproducibility and further research.

Current large language model (LLM) protocols rely solely on end-to-end accuracy for evaluation, which fails to reveal when errors are corrected or introduced during reasoning—particularly under distribution shifts or in modular compositions where behavior becomes opaque. This work proposes a dual-outcome measurement interface that records correctness states before and after each protocol step, enabling fine-grained auditing through reusable metrics: correction rate (c) and corruption rate (γ). By integrating paired outcome measurements, difficulty-proxied conditioning, and Markov factorization tests, the method identifies three failure mechanisms—mixed shifts, presentation contamination, and state insufficiency—and supports compositional prediction and dynamic control in multi-step protocols. Experiments on synthetic mathematical tasks and GSM8K demonstrate that the interface accurately predicts optimal activation or suppression of protocol modules, substantially enhancing system predictability and robustness.

Current large language model evaluation benchmarks report only aggregate accuracy, offering limited insight into fine-grained capability deficiencies. This work proposes the first unified behavioral diagnostic framework that employs leave-one-model-out (LOMO) cross-validation to cluster failure modes across probe tasks in single-turn and multi-turn dialogues as well as adversarial settings, thereby constructing an interpretable taxonomy of model failures. The approach uncovers common structural patterns underlying model errors and identifies a meta-failure mode characterized by a significant gap between a model’s self-assessment and its actual performance. Experiments demonstrate that with just 50 samples across 2,664 single-turn tasks, the method achieves a Kendall’s tau of 0.81 for ranking consistency and an AUC of 0.88 for cross-model failure prediction, while yielding highly cohesive and interpretable clusters in multi-turn and adversarial scenarios.

This work addresses the “fragile safety” of language models, which mechanically adhere to original safety rules even when contextual shifts invert the safety implications of their actions. To systematically evaluate robustness in dynamic scenarios, we introduce a context-flipping assessment framework that constructs paired examples with reversed safety outcomes. Our analysis reveals, for the first time, a substantial gap—averaging 17.4 percentage points—between models’ safety reasoning and commonsense understanding, demonstrating that this fragility stems from insufficient policy coverage rather than misinterpretation. To mitigate this, we propose a state-aware verification mechanism that replaces conventional action-level safeguards. Evaluated on the PacifAIst benchmark and catastrophic consequence probes, our approach achieves 100% risk detection with zero false positives, whereas existing safeguards completely fail.

This work addresses the challenge of reliably verifying whether machine unlearning models genuinely eliminate dependence on sensitive data under real-world deployment constraints and imperfect evaluation conditions. It introduces, for the first time, a causal-path perspective to construct an unlearning verification framework, proposing a causal fuzz testing method that systematically identifies both direct and indirect information leakage pathways—such as those mediated by proxy variables, effect cancellation, or subgroup masking—through budget-constrained interventions. The approach generates actionable “leakage reports” for debugging. Experimental results demonstrate that conventional attribution methods often overlook such residual dependencies, whereas the proposed technique effectively uncovers latent sensitivities even in black-box API models, offering a reliable and operationally viable solution for practical unlearning validation.