<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Adversarial Examples | Language Technologies Lab</title><link>https://nlp.unibo.it/tag/adversarial-examples/</link><atom:link href="https://nlp.unibo.it/tag/adversarial-examples/index.xml" rel="self" type="application/rss+xml"/><description>Adversarial Examples</description><generator>Hugo Blox Builder (https://hugoblox.com)</generator><language>en-us</language><lastBuildDate>Mon, 01 Jan 2024 00:00:00 +0000</lastBuildDate><image><url>https://nlp.unibo.it/media/logo.svg</url><title>Adversarial Examples</title><link>https://nlp.unibo.it/tag/adversarial-examples/</link></image><item><title>Overview of the CLEF-2024 CheckThat! lab: check-worthiness, subjectivity, persuasion, roles, authorities, and adversarial robustness</title><link>https://nlp.unibo.it/publication/barron-etal-20240-overview/</link><pubDate>Mon, 01 Jan 2024 00:00:00 +0000</pubDate><guid>https://nlp.unibo.it/publication/barron-etal-20240-overview/</guid><description>&lt;h2 id="research-setting"&gt;Research setting&lt;/h2&gt;
&lt;p&gt;Fact-checkers decide whether a claim is true, and language technology can support many steps of their work.
CheckThat! is an evaluation lab at CLEF, the Conference and Labs of the Evaluation Forum.
Each year it runs shared tasks: the organizers release a dataset, teams build systems for it, and every system is scored on the same test data.
The tasks follow the verification pipeline below, plus auxiliary tasks that support its stages.&lt;/p&gt;
&lt;figure class="lt-viz lt-pipeline"&gt;
&lt;ol&gt;
&lt;li class="lt-pipeline-step"&gt;
&lt;span class="lt-pipeline-index"&gt;&lt;i class="fas fa-filter" aria-hidden="true"&gt;&lt;/i&gt;&lt;/span&gt;
&lt;strong&gt;Check-worthiness estimation&lt;/strong&gt;
&lt;span&gt;Decide whether a statement deserves to be checked.&lt;/span&gt;
&lt;/li&gt;
&lt;li class="lt-pipeline-step"&gt;
&lt;span class="lt-pipeline-index"&gt;&lt;i class="fas fa-history" aria-hidden="true"&gt;&lt;/i&gt;&lt;/span&gt;
&lt;strong&gt;Verified claim retrieval&lt;/strong&gt;
&lt;span&gt;Find claims that fact-checkers have already verified.&lt;/span&gt;
&lt;/li&gt;
&lt;li class="lt-pipeline-step"&gt;
&lt;span class="lt-pipeline-index"&gt;&lt;i class="fas fa-search" aria-hidden="true"&gt;&lt;/i&gt;&lt;/span&gt;
&lt;strong&gt;Supporting evidence retrieval&lt;/strong&gt;
&lt;span&gt;Collect evidence about the claim from the Web.&lt;/span&gt;
&lt;/li&gt;
&lt;li class="lt-pipeline-step"&gt;
&lt;span class="lt-pipeline-index"&gt;&lt;i class="fas fa-balance-scale" aria-hidden="true"&gt;&lt;/i&gt;&lt;/span&gt;
&lt;strong&gt;Claim verification&lt;/strong&gt;
&lt;span&gt;Decide whether the claim is true or false.&lt;/span&gt;
&lt;/li&gt;
&lt;/ol&gt;
&lt;figcaption&gt;The four core stages of the verification pipeline, as described in Section 1 and Figure 1 of the paper.&lt;/figcaption&gt;
&lt;/figure&gt;
&lt;h2 id="motivation"&gt;Motivation&lt;/h2&gt;
&lt;p&gt;The first five editions of the lab focused on the core stages of the pipeline.
From 2023, the lab also opened to auxiliary tasks that help each stage.
Claims also hide in subjective sentences, in persuasive news, and in memes.
A classifier that flags misinformation can itself be fooled.
The 2024 edition adds tasks for these cases, and three of its six tasks ran for the first time.&lt;/p&gt;
&lt;figure class="lt-viz lt-gap"&gt;
&lt;div class="lt-viz-scroll"&gt;
&lt;table&gt;
&lt;thead&gt;&lt;tr&gt;&lt;th scope="col"&gt;Edition&lt;/th&gt;&lt;th scope="col"&gt;Check-worthiness&lt;/th&gt;&lt;th scope="col"&gt;Subjectivity&lt;/th&gt;&lt;th scope="col"&gt;Persuasion&lt;/th&gt;&lt;th scope="col"&gt;Meme roles&lt;/th&gt;&lt;th scope="col"&gt;Authority evidence&lt;/th&gt;&lt;th scope="col"&gt;Adversarial attacks&lt;/th&gt;&lt;/tr&gt;&lt;/thead&gt;
&lt;tbody&gt;
&lt;tr&gt;
&lt;th scope="row"&gt;2018 to 2020&lt;/th&gt;
&lt;td&gt;&lt;i class="fas fa-check-circle lt-yes" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;yes&lt;/span&gt;&lt;/td&gt;
&lt;td&gt;&lt;i class="fas fa-times-circle lt-no" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;no&lt;/span&gt;&lt;/td&gt;
&lt;td&gt;&lt;i class="fas fa-times-circle lt-no" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;no&lt;/span&gt;&lt;/td&gt;
&lt;td&gt;&lt;i class="fas fa-times-circle lt-no" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;no&lt;/span&gt;&lt;/td&gt;
&lt;td&gt;&lt;i class="fas fa-times-circle lt-no" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;no&lt;/span&gt;&lt;/td&gt;
&lt;td&gt;&lt;i class="fas fa-times-circle lt-no" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;no&lt;/span&gt;&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;th scope="row"&gt;2021 and 2022&lt;/th&gt;
&lt;td&gt;&lt;i class="fas fa-check-circle lt-yes" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;yes&lt;/span&gt;&lt;/td&gt;
&lt;td&gt;&lt;i class="fas fa-times-circle lt-no" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;no&lt;/span&gt;&lt;/td&gt;
&lt;td&gt;&lt;i class="fas fa-times-circle lt-no" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;no&lt;/span&gt;&lt;/td&gt;
&lt;td&gt;&lt;i class="fas fa-times-circle lt-no" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;no&lt;/span&gt;&lt;/td&gt;
&lt;td&gt;&lt;i class="fas fa-times-circle lt-no" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;no&lt;/span&gt;&lt;/td&gt;
&lt;td&gt;&lt;i class="fas fa-times-circle lt-no" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;no&lt;/span&gt;&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;th scope="row"&gt;2023&lt;/th&gt;
&lt;td&gt;&lt;i class="fas fa-check-circle lt-yes" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;yes&lt;/span&gt;&lt;/td&gt;
&lt;td&gt;&lt;i class="fas fa-check-circle lt-yes" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;yes&lt;/span&gt;&lt;/td&gt;
&lt;td&gt;&lt;i class="fas fa-times-circle lt-no" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;no&lt;/span&gt;&lt;/td&gt;
&lt;td&gt;&lt;i class="fas fa-times-circle lt-no" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;no&lt;/span&gt;&lt;/td&gt;
&lt;td&gt;&lt;i class="fas fa-adjust lt-partial" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;partially&lt;/span&gt;&lt;/td&gt;
&lt;td&gt;&lt;i class="fas fa-times-circle lt-no" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;no&lt;/span&gt;&lt;/td&gt;
&lt;/tr&gt;
&lt;tr class="is-ours"&gt;
&lt;th scope="row"&gt;This paper (2024) &lt;span class="lt-ours"&gt;This work&lt;/span&gt;&lt;/th&gt;
&lt;td&gt;&lt;i class="fas fa-check-circle lt-yes" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;yes&lt;/span&gt;&lt;/td&gt;
&lt;td&gt;&lt;i class="fas fa-check-circle lt-yes" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;yes&lt;/span&gt;&lt;/td&gt;
&lt;td&gt;&lt;i class="fas fa-check-circle lt-yes" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;yes&lt;/span&gt;&lt;/td&gt;
&lt;td&gt;&lt;i class="fas fa-check-circle lt-yes" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;yes&lt;/span&gt;&lt;/td&gt;
&lt;td&gt;&lt;i class="fas fa-check-circle lt-yes" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;yes&lt;/span&gt;&lt;/td&gt;
&lt;td&gt;&lt;i class="fas fa-check-circle lt-yes" aria-hidden="true"&gt;&lt;/i&gt;&lt;span class="sr-only"&gt;yes&lt;/span&gt;&lt;/td&gt;
&lt;/tr&gt;
&lt;/tbody&gt;
&lt;/table&gt;
&lt;/div&gt;
&lt;figcaption&gt;How the 2024 edition relates to the earlier editions of the lab (Sections 1 to 3 and Table 1 of the paper). Partial: the 2023 edition asked to find authorities. It did not ask to retrieve evidence from them.&lt;/figcaption&gt;
&lt;/figure&gt;
&lt;blockquote&gt;
&lt;p&gt;&lt;strong&gt;Objective.&lt;/strong&gt; Offer six tasks that support different steps of the verification pipeline, in mono-, multi-, and cross-lingual settings over fifteen languages. Then compare the systems of the participating teams.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;h2 id="approach"&gt;Approach&lt;/h2&gt;
&lt;p&gt;Each task has its own dataset, mostly with training, development, and test splits.
Teams submit runs, which are sets of predictions on the test data.
Each task scores the runs with its own metric and compares them with a baseline, a simple reference system built by the organizers.
In Task 6 the roles change: teams attack victim models, which are classifiers that detect misinformation.
An adversarial example is a text changed slightly so that the victim model changes its decision while the meaning stays the same.&lt;/p&gt;
&lt;figure class="lt-viz lt-pipeline"&gt;
&lt;ol&gt;
&lt;li class="lt-pipeline-step is-highlight"&gt;
&lt;span class="lt-pipeline-index"&gt;&lt;i class="fas fa-tasks" aria-hidden="true"&gt;&lt;/i&gt;&lt;/span&gt;
&lt;strong&gt;Six tasks&lt;/strong&gt;
&lt;span&gt;Each task supports one step of the pipeline.&lt;/span&gt;
&lt;/li&gt;
&lt;li class="lt-pipeline-step"&gt;
&lt;span class="lt-pipeline-index"&gt;&lt;i class="fas fa-database" aria-hidden="true"&gt;&lt;/i&gt;&lt;/span&gt;
&lt;strong&gt;Datasets&lt;/strong&gt;
&lt;span&gt;Training, development, and test data per language.&lt;/span&gt;
&lt;/li&gt;
&lt;li class="lt-pipeline-step"&gt;
&lt;span class="lt-pipeline-index"&gt;&lt;i class="fas fa-users" aria-hidden="true"&gt;&lt;/i&gt;&lt;/span&gt;
&lt;strong&gt;Runs&lt;/strong&gt;
&lt;span&gt;Teams submit predictions on the test data.&lt;/span&gt;
&lt;/li&gt;
&lt;li class="lt-pipeline-step"&gt;
&lt;span class="lt-pipeline-index"&gt;&lt;i class="fas fa-sort-amount-down" aria-hidden="true"&gt;&lt;/i&gt;&lt;/span&gt;
&lt;strong&gt;Scoring&lt;/strong&gt;
&lt;span&gt;Each task scores the runs against a baseline.&lt;/span&gt;
&lt;/li&gt;
&lt;/ol&gt;
&lt;figcaption&gt;How the 2024 lab ran (Sections 3 to 5 of the paper).&lt;/figcaption&gt;
&lt;/figure&gt;
&lt;table&gt;
&lt;thead&gt;
&lt;tr&gt;
&lt;th&gt;Task&lt;/th&gt;
&lt;th&gt;Input&lt;/th&gt;
&lt;th&gt;Output&lt;/th&gt;
&lt;th&gt;Test languages&lt;/th&gt;
&lt;th&gt;Metric&lt;/th&gt;
&lt;/tr&gt;
&lt;/thead&gt;
&lt;tbody&gt;
&lt;tr&gt;
&lt;td&gt;T1 Check-worthiness&lt;/td&gt;
&lt;td&gt;A statement from a tweet, a transcript, or a political debate&lt;/td&gt;
&lt;td&gt;Whether it needs fact-checking&lt;/td&gt;
&lt;td&gt;Arabic, Dutch, English&lt;/td&gt;
&lt;td&gt;F1 of the check-worthy class&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;T2 Subjectivity&lt;/td&gt;
&lt;td&gt;A sentence from a news article&lt;/td&gt;
&lt;td&gt;Subjective or objective&lt;/td&gt;
&lt;td&gt;Arabic, Bulgarian, English, German, Italian, multilingual&lt;/td&gt;
&lt;td&gt;Macro F1&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;T3 Persuasion techniques&lt;/td&gt;
&lt;td&gt;A news article&lt;/td&gt;
&lt;td&gt;Text spans that use one of 23 persuasion techniques&lt;/td&gt;
&lt;td&gt;Arabic, Bulgarian, English, Portuguese, Slovene&lt;/td&gt;
&lt;td&gt;Micro F1 with partial span matching&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;T4 Roles in memes&lt;/td&gt;
&lt;td&gt;A meme and an entity in it&lt;/td&gt;
&lt;td&gt;Hero, villain, victim, or other&lt;/td&gt;
&lt;td&gt;Bulgarian, English, code-mixed Hindi-English&lt;/td&gt;
&lt;td&gt;F1&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;T5 Evidence from authorities&lt;/td&gt;
&lt;td&gt;A rumor in a tweet and the timelines of authorities, the sources that know the matter&lt;/td&gt;
&lt;td&gt;Evidence tweets, then supported, refuted, or unverifiable&lt;/td&gt;
&lt;td&gt;Arabic, English&lt;/td&gt;
&lt;td&gt;MAP, macro F1&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;T6 Adversarial robustness&lt;/td&gt;
&lt;td&gt;A text and a victim model&lt;/td&gt;
&lt;td&gt;An adversarial example&lt;/td&gt;
&lt;td&gt;Not stated&lt;/td&gt;
&lt;td&gt;BODEGA score&lt;/td&gt;
&lt;/tr&gt;
&lt;/tbody&gt;
&lt;/table&gt;
&lt;p&gt;&lt;em&gt;The 2024 tasks. Source: Sections 3, 4, and 5 of the paper.&lt;/em&gt;&lt;/p&gt;
&lt;h2 id="results"&gt;Results&lt;/h2&gt;
&lt;p&gt;Each task was scored on its own test data, against its own baseline.
F1 combines precision and recall, from 0 to 1, and macro F1 averages it over the classes.
MAP (mean average precision), from 0 to 1, rewards a system that ranks the evidence tweets high in its list.
The BODEGA score, from the framework of the same name, rates adversarial examples automatically, and Task 6 also checked a sample by hand.&lt;/p&gt;
&lt;ul class="lt-viz lt-proj-numbers"&gt;&lt;li&gt;&lt;span class="lt-proj-number"&gt;46&lt;/span&gt;&lt;span class="lt-proj-number-label"&gt;teams took part, out of 130 registered&lt;/span&gt;&lt;/li&gt;&lt;li&gt;&lt;span class="lt-proj-number"&gt;15&lt;/span&gt;&lt;span class="lt-proj-number-label"&gt;languages across the six tasks&lt;/span&gt;&lt;/li&gt;&lt;li&gt;&lt;span class="lt-proj-number"&gt;0.879&lt;/span&gt;&lt;span class="lt-proj-number-label"&gt;best macro F1 in English rumor verification, against 0.495 for the baseline&lt;/span&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;table&gt;
&lt;thead&gt;
&lt;tr&gt;
&lt;th&gt;Task&lt;/th&gt;
&lt;th&gt;Teams&lt;/th&gt;
&lt;th&gt;Metric&lt;/th&gt;
&lt;th&gt;Best score&lt;/th&gt;
&lt;th&gt;Baseline&lt;/th&gt;
&lt;/tr&gt;
&lt;/thead&gt;
&lt;tbody&gt;
&lt;tr&gt;
&lt;td&gt;T1 Check-worthiness, English&lt;/td&gt;
&lt;td&gt;26&lt;/td&gt;
&lt;td&gt;F1 of the check-worthy class&lt;/td&gt;
&lt;td&gt;0.802&lt;/td&gt;
&lt;td&gt;Not reported&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;T2 Subjectivity, English&lt;/td&gt;
&lt;td&gt;15 (all languages)&lt;/td&gt;
&lt;td&gt;Macro F1&lt;/td&gt;
&lt;td&gt;0.744&lt;/td&gt;
&lt;td&gt;Not reported&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;T3 Persuasion techniques, English&lt;/td&gt;
&lt;td&gt;2 (all languages)&lt;/td&gt;
&lt;td&gt;Micro F1&lt;/td&gt;
&lt;td&gt;0.092&lt;/td&gt;
&lt;td&gt;0.009&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;T4 Roles in memes&lt;/td&gt;
&lt;td&gt;0&lt;/td&gt;
&lt;td&gt;F1&lt;/td&gt;
&lt;td&gt;No runs&lt;/td&gt;
&lt;td&gt;0.58&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;T5 Evidence retrieval, English&lt;/td&gt;
&lt;td&gt;5&lt;/td&gt;
&lt;td&gt;MAP&lt;/td&gt;
&lt;td&gt;0.604&lt;/td&gt;
&lt;td&gt;0.335&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;T5 Rumor verification, English&lt;/td&gt;
&lt;td&gt;5&lt;/td&gt;
&lt;td&gt;Macro F1&lt;/td&gt;
&lt;td&gt;0.879&lt;/td&gt;
&lt;td&gt;0.495&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;T6 Adversarial robustness&lt;/td&gt;
&lt;td&gt;6&lt;/td&gt;
&lt;td&gt;BODEGA score&lt;/td&gt;
&lt;td&gt;0.7458&lt;/td&gt;
&lt;td&gt;0.4261 (BERT-ATTACK, an earlier attack method)&lt;/td&gt;
&lt;/tr&gt;
&lt;/tbody&gt;
&lt;/table&gt;
&lt;p&gt;&lt;em&gt;Participating teams and best official score per task. Source: Sections 5.1 to 5.6 and Tables 5, 7, 10, 12, 14, and 15 of the paper. The best Task 5 retrieval run came from a team of the task organizers.&lt;/em&gt;&lt;/p&gt;
&lt;p&gt;Most teams fine-tuned pretrained transformer models, and many also used large language models (LLMs).
In Task 5, systems fine-tuned on the task data retrieved evidence best, but only the two LLM-based systems beat the baseline in English rumor verification.
Task 4 attracted no participants, so only its baseline is available.
Task 6 shows a gap between automatic and manual evaluation, as the chart below shows.&lt;/p&gt;
&lt;figure class="lt-viz lt-bars"&gt;
&lt;figcaption class="lt-viz-title"&gt;Adversarial examples with preserved meaning (manual check) &lt;span&gt;(higher is better)&lt;/span&gt;&lt;/figcaption&gt;
&lt;ul&gt;&lt;li class="lt-bar" tabindex="0"&gt;
&lt;span class="lt-bar-label"&gt;SINAI&lt;/span&gt;
&lt;span class="lt-bar-track"&gt;&lt;span class="lt-bar-fill" style="--w: 99%"&gt;&lt;/span&gt;&lt;/span&gt;
&lt;span class="lt-bar-value"&gt;99%&lt;/span&gt;
&lt;/li&gt;&lt;li class="lt-bar" tabindex="0"&gt;
&lt;span class="lt-bar-label"&gt;MMU_NLP&lt;/span&gt;
&lt;span class="lt-bar-track"&gt;&lt;span class="lt-bar-fill" style="--w: 96%"&gt;&lt;/span&gt;&lt;/span&gt;
&lt;span class="lt-bar-value"&gt;96%&lt;/span&gt;
&lt;/li&gt;&lt;li class="lt-bar" tabindex="0"&gt;
&lt;span class="lt-bar-label"&gt;TurQUaz&lt;/span&gt;
&lt;span class="lt-bar-track"&gt;&lt;span class="lt-bar-fill" style="--w: 62%"&gt;&lt;/span&gt;&lt;/span&gt;
&lt;span class="lt-bar-value"&gt;62%&lt;/span&gt;
&lt;/li&gt;&lt;li class="lt-bar" tabindex="0"&gt;
&lt;span class="lt-bar-label"&gt;Palöri&lt;/span&gt;
&lt;span class="lt-bar-track"&gt;&lt;span class="lt-bar-fill" style="--w: 14.000000000000002%"&gt;&lt;/span&gt;&lt;/span&gt;
&lt;span class="lt-bar-value"&gt;14%&lt;/span&gt;
&lt;/li&gt;&lt;li class="lt-bar" tabindex="0"&gt;
&lt;span class="lt-bar-label"&gt;OpenFact&lt;/span&gt;
&lt;span class="lt-bar-track"&gt;&lt;span class="lt-bar-fill" style="--w: 11%"&gt;&lt;/span&gt;&lt;/span&gt;
&lt;span class="lt-bar-value"&gt;11%&lt;/span&gt;
&lt;/li&gt;&lt;li class="lt-bar" tabindex="0"&gt;
&lt;span class="lt-bar-label"&gt;TextTrojaners&lt;/span&gt;
&lt;span class="lt-bar-track"&gt;&lt;span class="lt-bar-fill" style="--w: 7.000000000000001%"&gt;&lt;/span&gt;&lt;/span&gt;
&lt;span class="lt-bar-value"&gt;7%&lt;/span&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;p class="lt-viz-note"&gt;Share of adversarial examples whose meaning annotators judged preserved. Each team had 100 successful examples from the fact-checking domain of Task 6. The two top teams of the automatic BODEGA ranking (OpenFact, TextTrojaners) score lowest here. Source: Section 5.6 of the paper.&lt;/p&gt;
&lt;details class="lt-viz-table"&gt;
&lt;summary&gt;Show as table&lt;/summary&gt;
&lt;table&gt;&lt;thead&gt;&lt;tr&gt;&lt;th scope="col"&gt;System&lt;/th&gt;&lt;th scope="col"&gt;Adversarial examples with preserved meaning (manual check)&lt;/th&gt;&lt;/tr&gt;&lt;/thead&gt;
&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;SINAI&lt;/td&gt;&lt;td&gt;99%&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;MMU_NLP&lt;/td&gt;&lt;td&gt;96%&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;TurQUaz&lt;/td&gt;&lt;td&gt;62%&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;Palöri&lt;/td&gt;&lt;td&gt;14%&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;OpenFact&lt;/td&gt;&lt;td&gt;11%&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;TextTrojaners&lt;/td&gt;&lt;td&gt;7%&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/details&gt;
&lt;/figure&gt;
&lt;h2 id="takeaways"&gt;Takeaways&lt;/h2&gt;
&lt;ol class="lt-viz lt-takeaways"&gt;
&lt;li&gt;&lt;strong&gt;The lab grew beyond the core pipeline.&lt;/strong&gt;&lt;span&gt;Six tasks in fifteen languages cover subjectivity, persuasion, memes, authorities, and adversarial attacks next to check-worthiness.&lt;/span&gt;&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;LLMs helped most in rumor verification.&lt;/strong&gt;&lt;span&gt;In English, the two LLM-based systems were the only ones above the baseline, with a best macro F1 of 0.879 against 0.495.&lt;/span&gt;&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Automatic scores can mislead.&lt;/strong&gt;&lt;span&gt;In Task 6, annotators preferred attacks based on homoglyphs, characters that look alike, while the automatic score ranked other methods first.&lt;/span&gt;&lt;/li&gt;
&lt;/ol&gt;</description></item></channel></rss>