Research map / Adversarial robustness and security / Attacks on text and graphs

Adversarial Cooperative Rationalization: The Risk of Spurious Correlations in Even Clean Datasets

ICML 2025 · Adversarial robustness and security › Attacks on text and graphs · approach: Attacks and defenses in sequential settings · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Shows that cooperative rationalization (RNP) can create generator-induced spurious correlations even in clean datasets, and proposes A2I, an adversarial attacker that inspects these correlations and instructs the predictor to ignore them.

Problem

Cooperative generator-predictor rationalization can introduce spurious correlations between selected rationale candidates and labels via biased sampling, even when the original dataset is clean, leading to unfaithful rationales.

Approach

An attacker generator selects rationale candidates that the predictor is pushed to classify as the opposite class, exposing trivial patterns; the predictor is then trained with a uniform-label instruction loss on attacker-selected rationales so it stops relying on them, providing corrected feedback to the generator.

Key results

• RNP+A2I improves rationale F1 over standard RNP across all nine beer-dataset sparsity settings, with up to 9.0 F1 gain on Beer-Appearance at S≈10% (57.8 vs 48.8).
• FR+A2I achieves best F1 among compared methods in most settings, e.g., 82.7 F1 on Beer-Appearance at S≈20% and 66.9 on Beer-Aroma at S≈10%.
• With BERT, FR+A2I reaches 33.6 F1 on Beer-Appearance at S≈10%, versus 28.0 for CR (reported from CR paper).

Measured effects reported in the paper

Surprising findings

• Predictors trained on randomly selected 10% text patterns reach about 95% accuracy, close to full-text training, even though the random patterns carry little sentiment information (about 58% when fed to the full-text predictor).
• Prediction accuracy is a poor metric for rationalization quality since the predictor can still be accurate on spurious rationales.

Limitations

• Attacker's effectiveness relies on the assumption that trivial patterns are symmetric across classes; theoretical analysis assumes arbitrary expressiveness of the generator.
• Results on text datasets use a single random seed; GNN results are averaged over five seeds with notable variance.
• Evaluation relies on rationale overlap with human annotations rather than direct measures of spurious correlation; prediction accuracy is not used as a metric.

Experimental setup

Datasets: BeerAdvocate (Beer-Appearance, Beer-Aroma, Beer-Palate) HotelReview (Hotel-Location, Hotel-Service, Hotel-Cleanliness) BA2Motifs GOODMotif

Benchmarks: BeerAdvocate HotelReview BA2Motifs GOODMotif

Metrics: accuracy precision recall F1 (rationale overlap with human annotations) sparsity attack success rate

Baselines: RNP Inter_RAT NIR FR CR llama-3.1-8b-instruct

Builds on: RNP FR Inter_RAT CR NIR

Closest papers by meaning

• Towards Faithful Explanations: Boosting Rationalization with Shortcuts Discovery (ICLR 2024 · similarity 0.84)
• Breaking Free from MMI: A New Frontier in Rationalization by Probing Input Utilization (ICLR 2025 · similarity 0.84)
• Adversarial Machine Unlearning (ICLR 2025 · similarity 0.84)
• Federated Self-Explaining GNNs with Anti-shortcut Augmentations (ICML 2024 · similarity 0.84)
• Adversaries With Incentives: A Strategic Alternative to Adversarial Robustness (ICLR 2025 · similarity 0.83)
• RashomonGB: Analyzing the Rashomon Effect and Mitigating Predictive Multiplicity in Gradient Boosting (NeurIPS 2024 · similarity 0.83)