Research map / Adversarial robustness and security / Certified and empirical robustness
Robust Few-Shot Named Entity Recognition with Boundary Discrimination and Correlation Purification
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Assesses adversarial (synonym-substitution) robustness of few-shot NER and proposes BDCP, a two-stage method with entity boundary discrimination and correlation purification that improves robustness on Few-NERD and Cross-Dataset attack sets.
Problem
Few-shot NER models assume clean labeled data and their cross-domain transfer ability is vulnerable to textual adversarial attacks (synonym substitution), degrading recognition of unseen entity types.
Approach
A boundary discriminative module with multiple components per BIO-style boundary class (assignment and diversity losses) for span detection, plus correlation purification in entity typing that minimizes entity-specific interference via a KL-based information bottleneck and maximizes entity-context correlation via an InfoNCE-style loss.
Key results
- On Few-NERD INTRA 5-1 under attack, BDCP reaches 40.76 F1 versus 33.73 for Decomposed.
- Under attack, BDCP improves over Decomposed by 7.59% on Few-NERD and 6.10% on Cross-Dataset in F1, per the paper's reported averages.
- Ablation on Few-NERD shows the full BDCP (56.84 INTER 5-1 attack) exceeds each single component, e.g. +components and +purify.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use BDCP instead of Decomposed | few-shot NER · Few-NERD adversarial examples | F1: 33.73 -> 40.76 | Helped |
| Use BDCP instead of Decomposed | few-shot NER · Cross-Dataset adversarial examples | F1: 42.87 -> 51.36; 23.39 -> 27.91; 22.46 -> 27.29; 34.19 -> 40.73 | Helped |
| Add assignment loss (ablation) | Decomposed on Few-NERD · Few-NERD INTRA 5-1 Attack | F1: 33.73 -> 34.86 | Helped |
| Add diversity loss alongside assignment loss (ablation) | Decomposed on Few-NERD · Few-NERD INTRA 5-1 Attack | F1: 34.86 -> 36.25 | Helped |
| Add correlation facilitation loss (ablation) | Decomposed on Few-NERD · Few-NERD INTRA 5-1 Attack | F1: 33.73 -> 33.81 | No clear effect |
| Add interference information filtering loss (ablation) | Decomposed on Few-NERD · Few-NERD INTRA 5-1 Attack | F1: 33.73 -> 35.38 | Helped |
| Add both correlation facilitation and interference filtering losses (ablation) | Decomposed on Few-NERD · Few-NERD INTRA 5-1 Attack | F1: 33.73 -> 37.41 | Helped |
| Add boundary discrimination and correlation purification (ablation) | Decomposed on Few-NERD · Few-NERD INTRA 5-1 Attack | F1: 33.73 -> 40.76 | Helped |
| Replace the two-stage model with BDCP-Single (ablation) | BDCP on Few-NERD INTRA 1-shot · Few-NERD INTRA 1-shot clean examples | F1: 39.58; decreases by 13.05 points | Hurt |
| Replace the two-stage model with BDCP-Single (ablation) | BDCP on Few-NERD INTRA 1-shot · Few-NERD INTRA 1-shot attacked examples | F1: 24.14; decreases by 16.62 points | Hurt |
Surprising findings
- Directly applying the information bottleneck to few-shot NER does not improve adversarial robustness, per the authors' appendix.
- RanMASK random masking can hurt performance in the 10-way 5-shot INTRA setting, since random masking removes useful information when labeled data is scarce.
Limitations
- Two-stage paradigm may cause error propagation from span detection to entity typing.
- Robustness evaluated only with synonym-substitution attacks generated by BERT-Attack.
- Adversarial training is not explored.
Experimental setup
Datasets: Few-NERD Cross-Dataset (CoNLL-2003, GUM, WNUT-2017, OntoNotes)
Benchmarks: Few-NERD (INTRA, INTER) Cross-Dataset (News, Wiki, Social, Mixed)
Metrics: F1
Baselines: ProtoBERT StructShot CONTAINER Decomposed MatchingNet SimBERT L-TapNet+CDT RockNER RanMASK
Builds on: Decomposed meta-learning for few-shot NER Information Bottleneck BERT-Attack InfoNCE ProtoNet
Closest papers by meaning
- Adversity-aware Few-shot Named Entity Recognition via Augmentation Learning (AAAI 2025 · similarity 0.91)
- SENCR: A Span Enhanced Two-Stage Network with Counterfactual Rethinking for Chinese NER (AAAI 2024 · similarity 0.85)
- Span Graph Transformer for Document-Level Named Entity Recognition (AAAI 2024 · similarity 0.84)
- Small Language Model Makes an Effective Long Text Extractor (AAAI 2025 · similarity 0.83)
- Discrepancy and Uncertainty Aware Denoising Knowledge Distillation for Zero-Shot Cross-Lingual Named Entity Recognition (AAAI 2024 · similarity 0.82)
- Three Heads Are Better than One: Improving Cross-Domain NER with Progressive Decomposed Network (AAAI 2024 · similarity 0.82)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.