Reasoning Robustness of LLMs to Adversarial Typographical Errors

Abstract

Large Language Models (LLMs) have demonstrated impressive capabilities in reasoning using Chain-of-Thought (CoT) prompting. However, CoT can be biased by users’ instruction. In this work, we study the reasoning robustness of LLMs to typographical errors, which can naturally occur in users’ queries. We design an Adversarial Typo Attack (ATA) algorithm that iteratively samples typos for words that are important to the query and selects the edit that is most likely to succeed in attacking. It shows that LLMs are sensitive to minimal adversarial typographical changes. Notably, with 1 character edit, Mistral-7B-Instruct’s accuracy drops from 43.7% to 38.6% on GSM8K, while with 8 character edits the performance further drops to 19.2%. To extend our evaluation to larger and closed-source LLMs, we develop the R2ATA benchmark, which assesses models’ Reasoning Robustness to ATA. It includes adversarial typographical questions derived from three widely-used reasoning datasets—GSM8K, BBH, and MMLU—by applying ATA to open-source LLMs. R2ATA demonstrates remarkable transferability and causes notable performance drops across multiple super large and closed-source LLMs.

Esther Gan

Doctoral Student (Aug ‘23)
Co-Supervised by Michael Shieh

PhD Candidate August 2023 Intake

Min-Yen Kan

Associate Professor

WING lead; interests include Digital Libraries, Information Retrieval and Natural Language Processing.