--- title: "Trick Me If You Can — paper by Wallace et al. (2019)" description: "Automatic adversarial attacks in NLP usually apply narrow, meaning-preserving tweaks such as typos… 1 reference, cited by 53 papers here." authors: ["Eric Wallace", "Pedro Rodriguez", "Shi Feng", "Ikuya Yamada", "Jordan Boyd-Graber"] year: 2019 venue: "Transactions of the Association for Computational Linguistics" source: "https://aclanthology.org/Q19-1029/" doi: "10.1162/tacl_a_00279" licence: "CC BY 4.0 (ACL Anthology)" licence_url: "https://creativecommons.org/licenses/by/4.0/" summary_licence: "Elamur Cosmic License" canonical: "https://research.elamur.ai/free/en/papers/wallace-2019-trick-me-if-you-can/" --- [Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/wallace-2019-trick-me-if-you-can/) [home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2019](https://md.research.elamur.ai/free/en/papers/2019/page/4/) / Trick Me If You Can: Human-in-the-Loop Generation of Adversarial Examples for Question Answering # Trick Me If You Can: Human-in-the-Loop Generation of Adversarial Examples for Question Answering **Authors:** [Eric Wallace](https://md.research.elamur.ai/free/en/authors/eric-wallace/), [Pedro Rodriguez](https://md.research.elamur.ai/free/en/authors/pedro-rodriguez/), [Shi Feng](https://md.research.elamur.ai/free/en/authors/shi-feng/), [Ikuya Yamada](https://md.research.elamur.ai/free/en/authors/ikuya-yamada/) and [Jordan Boyd-Graber](https://md.research.elamur.ai/free/en/authors/jordan-boyd-graber/) · **Year:** 2019 · **Venue:** [Transactions of the Association for Computational Linguistics](https://md.research.elamur.ai/free/en/venues/tacl/) ([Transactions of the Association for Computational Linguistics (TACL) 2019](https://md.research.elamur.ai/free/en/venues/tacl/2019/)) · **Publisher:** [The MIT Press](https://md.research.elamur.ai/free/en/publishers/the-mit-press/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/) **Links:** [Publisher's page](https://aclanthology.org/Q19-1029/) · [PDF](https://aclanthology.org/Q19-1029.pdf) · [DOI 10.1162/tacl\_a\_00279](https://doi.org/10.1162/tacl_a_00279) · [OpenAlex](https://openalex.org/W2946140580) **Citations:** 129 citations (OpenAlex, 2026-10-14) · [53](https://md.research.elamur.ai/free/en/papers/wallace-2019-trick-me-if-you-can/cited-by/) in our library, of the 141,840 papers whose bibliographies we read ## Summary Automatic adversarial attacks in NLP usually apply narrow, meaning-preserving tweaks such as typos, word swaps, or distractor sentences. These reveal only shallow weaknesses and scale poorly to paragraph-length inputs. Wallace et al. instead put people in charge of breaking models. Experienced Quizbowl question writers drafted trivia questions in an interactive interface. The interface displayed the model's top guesses, the point in the question where it first answered correctly, and word-level saliency highlights showing which words drove its prediction. Writers kept editing until the system failed while the question stayed fair for human players. The work ran in two rounds, targeting an ElasticSearch-based IR baseline and a GRU-based neural classifier. The resulting adversarial questions were no harder for humans than ordinary ones. Strong QA systems, however, lost up to 40% relative accuracy on them and failed badly in live human–computer matches they normally win. The edits exposed phenomena such as multi-hop reasoning and misleading entity types. The work shows that guided human creativity can produce diverse, semantically grounded challenge data that rule-based or generative attacks cannot easily reach. ## Key points - **Testbed:** Quizbowl, whose pyramid-shaped questions move from obscure clues to easier ones. Models were trained on roughly 110,000 questions, and the answer space grew from 11,000 entities in round one to 25,000 in round two. - **Models attacked:** the IR baseline from the NIPS 2017 Quizbowl shared task, and a bidirectional GRU RNN using 300-dimensional GloVe embeddings. - **Interpretations:** - For the RNN, a gradient-based, first-order Taylor approximation estimates the effect of removing each word. - For the IR model, the ElasticSearch Highlight API provides the word scores. - Writers found that spotting overused "stock" clues was the most valuable feature. - **Main result:** relative accuracy of strong QA systems dropped by as much as 40%, while human difficulty was unchanged. - **Motivation:** an automatic syntactic paraphrase network produced valid Quizbowl paraphrases only about 3% of the time, which illustrates the limits of model-generated attacks on long texts. *Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.* ## Institutions - [University of Maryland, College Park](https://md.research.elamur.ai/free/en/universities/university-of-maryland-college-park/) — University, College Park, United States · 83 works · 23,784 citations 📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 9,085 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 8,888 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 9,296 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 9,206 works 🧭 Topics (1): [❓ Question answering](https://md.research.elamur.ai/free/en/topics/question-answering/) · 243 works ## Cite Cite as: Eric Wallace, Pedro Rodriguez, Shi Feng, Ikuya Yamada and Jordan Boyd-Graber. 2019. Trick Me If You Can: Human-in-the-Loop Generation of Adversarial Examples for Question Answering. Transactions of the Association for Computational Linguistics. The paper itself, not this page. BibTeX from the library's record of the work. ```bibtex @article{wallace2019trick, title = {{Trick Me If You Can: Human-in-the-Loop Generation of Adversarial Examples for Question Answering}}, author = {Eric Wallace, Pedro Rodriguez, Shi Feng, Ikuya Yamada and Jordan Boyd-Graber}, journal = {Transactions of the Association for Computational Linguistics}, year = {2019}, doi = {10.1162/tacl\_a\_00279}, url = {https://doi.org/10.1162/tacl_a_00279} } ``` - [← previous Overcoming Catastrophic Forgetting During Domain Adaptation of Neural Machine Translation](https://md.research.elamur.ai/free/en/papers/thompson-2019-overcoming-catastrophic-forgetting-during-domain/) - [next → AllenNLP Interpret: A Framework for Explaining Predictions of NLP Models](https://md.research.elamur.ai/free/en/papers/wallace-2019-allennlp-interpret-framework-explaining-predictions/) - [↑ back to papers of 2019](https://md.research.elamur.ai/free/en/papers/2019/page/4/) ## References 1 references, 1 of them with a card of ours. ↗ leads to the work. 1. Yonatan Belinkov and Yonatan Bisk. 2018. Synthetic and natural noise both break neural machine translation. In Proceedings of the International Conference on Learning Representations. \#\# Conclusion Yonatan Belinkov and James Glass. 2019. [Analysis methods in neural language processing: A survey](https://md.research.elamur.ai/free/en/papers/belinkov-2019-analysis-methods-neural-language-processing/). In T… *Updated 24 October 2026*