Universal Evasion Attacks on Summarization Scoring

TL;DR

This paper demonstrates that current automatic summary scoring systems are vulnerable to evasion attacks, which can produce non-summaries that score highly, exposing their low robustness and raising concerns about their reliability.

Contribution

It introduces evasion attack methods on summary scoring systems, revealing their vulnerability and highlighting the need for more robust evaluation metrics.

Findings

Attack systems can generate non-summary strings that score highly on popular metrics.

Evasion attacks outperform some state-of-the-art summarization methods on certain metrics.

A simple trigger can manipulate BERTScore to favor non-summaries over true summaries.

Abstract

The automatic scoring of summaries is important as it guides the development of summarizers. Scoring is also complex, as it involves multiple aspects such as fluency, grammar, and even textual entailment with the source text. However, summary scoring has not been considered a machine learning task to study its accuracy and robustness. In this study, we place automatic scoring in the context of regression machine learning tasks and perform evasion attacks to explore its robustness. Attack systems predict a non-summary string from each input, and these non-summary strings achieve competitive scores with good summarizers on the most popular metrics: ROUGE, METEOR, and BERTScore. Attack systems also "outperform" state-of-the-art summarization methods on ROUGE-1 and ROUGE-L, and score the second-highest on METEOR. Furthermore, a BERTScore backdoor is observed: a simple trigger can score higher than any automatic summarization method. The evasion attacks in this work indicate the low robustness of current scoring systems at the system level. We hope that our highlighting of these proposed attacks will facilitate the development of summary scores.