Beat the AI: Investigating Adversarial Human Annotation for Reading Comprehension

Data collection is a fundamental prerequisite for Machine Learning-based approaches to Natural Language Processing (NLP). Innovations in data acquisition methodology, such as crowdsourcing, have led to major breakthroughs in scalability and preceded the “deep learning revolution”, for which they can arguably be seen as co-responsible (Deng et al., 2009; Bowman et al., 2015; Rajpurkar et al., 2016). Annotation approaches include expert annotation, for example, relying on trained linguists (Marcus et al., 1993), crowd-sourcing by non-experts (Snow et al., 2008), distant supervision (Mintz et al., 2009; Joshi et al., 2017), and leveraging document structure (Hermann et al., 2015). The concrete data collection paradigm chosen dictates the degree of scalability, annotation cost, precise task structure (often arising as a compromise of the above) and difficulty, domain coverage, as well as resulting dataset biases and model blind spots (Jia and Liang, 2017; Schwartz et al., 2017; Gururangan et al., 2018).

A recently emerging trend in NLP dataset creation is the use of a model-in-the-loop when composing samples: A contemporary model is used either as a filter or directly during annotation, to identify samples wrongly predicted by the model. Examples of this method are realized in Build It Break It, The Language Edition (Ettinger et al., 2017), HotpotQA (Yang et al., 2018a), SWAG (Zellers et al., 2018), Mechanical Turker Descent (Yang et al., 2018b), DROP (Dua et al., 2019), CODAH (Chen et al., 2019), Quoref (Dasigi et al., 2019), and AdversarialNLI (Nie et al., 2019).¹ This approach probes model robustness and ensures that the resulting datasets pose a challenge to current models, which drives research to tackle new sets of problems.

We study this approach in the context of Reading Comprehension (RC), and investigate its robustness in the face of continuously progressing models—do adversarially constructed datasets quickly become outdated in their usefulness as models grow stronger?

Based on models trained on the widely used SQuAD dataset, and following the same annotation protocol, we investigate the annotation setup where an annotator has to compose questions for which the model predicts the wrong answer. As a result, only samples that the model fails to predict correctly are retained in the dataset—see Figure 1 for an example.

We apply this annotation strategy with three distinct models in the loop, resulting in datasets with 12,000 samples each. We then study the reproducibility of the adversarial effect when retraining the models with the same data, as well as the generalization ability of models trained using datasets produced with and without a model adversary. Models can, to a considerable degree, learn to generalize to more challenging questions, based on training sets collected with both stronger and also weaker models in the loop. Compared to training on SQuAD, training on adversarially composed questions leads to a similar degree of generalization to non-adversarially written questions, both for SQuAD and NaturalQuestions (Kwiatkowski et al., 2019). It furthermore leads to general improvements across the model-in-the-loop datasets we collect, as well as improvements of more than 20.0F₁ for both BERT and RoBERTa on an extractive subset of DROP (Dua et al., 2019), another adversarially composed dataset. When conducting a systematic analysis of the concrete questions different models fail to answer correctly, as well as non-adversarially composed questions, we see that the nature of the resulting questions changes: Questions composed with a model in the loop are overall more diverse, use more paraphrasing, multi-hop inference, comparisons, and background knowledge, and are generally less easily answered by matching an explicit statement that states the required information literally. Given our observations, we believe a model-in-the-loop approach to annotation shows promise and should be considered when creating future RC datasets.

To summarize, our contributions are as follows: First, an investigation into the model-in-the-loop approach to RC data collection based on three progressively stronger models, together with an empirical performance comparison when trained on datasets constructed with adversaries of different strength. Second, a comparative investigation into the nature of questions composed to be unsolvable by a sequence of progressively stronger models. Third, a study of the reproducibility of the adversarial effect and the generalization ability of models trained in various settings.

Recent efforts in dataset construction have driven considerable progress in RC, yet datasets are structurally diverse and annotation methodologies vary. With its large size and combination of free-form questions with answers as extracted spans, SQuAD1.1 (Rajpurkar et al., 2016) has become an established benchmark that has inspired the construction of a series of similarly structured datasets. However, mounting evidence suggests that models can achieve strong generalization performance merely by relying on superficial cues—such as lexical overlap, term frequencies, or entity type matching (Chen et al., 2016; Weissenborn et al., 2017; Sugawara et al., 2018). It has thus become an increasingly important consideration to construct datasets that RC models find challenging, and for which natural language understanding is a requisite for generalization. Attempts to achieve this non-trivial aim have typically revolved around extensions to the SQuAD dataset annotation methodology. They include unanswerable questions (Trischler et al., 2017; Rajpurkar et al., 2018; Reddy et al., 2019; Choi et al., 2018), adding the option of “Yes” or “No” answers (Dua et al., 2019; Kwiatkowski et al., 2019), questions requiring reasoning over multiple sentences or documents (Welbl et al., 2018; Yang et al., 2018a), questions requiring rule interpretation or context awareness (Saeidi et al., 2018; Choi et al., 2018; Reddy et al., 2019), limiting annotator passage exposure by sourcing questions first (Kwiatkowski et al., 2019), controlling answer types by including options for dates, numbers, or spans from the question (Dua et al., 2019), as well as questions with free-form answers (Nguyen et al., 2016; Kočiský et al., 2018; Reddy et al., 2019).

One recently adopted approach to constructing challenging datasets involves the use of an adversarial model to select examples that it does not perform well on, an approach which superficially is akin to active learning (Lewis and Gale, 1994). Here, we make a distinction between two sub-categories of adversarial annotation: i) adversarial filtering, where the adversarial model is applied offline in a separate stage of the process, usually after data generation; examples include SWAG (Zellers et al., 2018), ReCoRD (Zhang et al., 2018), HotpotQA (Yang et al., 2018a), and HellaSWAG (Zellers et al., 2019); ii) model-in-the-loop adversarial annotation, where the annotator can directly interact with the adversary during the annotation process and uses the feedback to further inform the generation process; examples include CODAH (Chen et al., 2019), Quoref (Dasigi et al., 2019), DROP Dua et al. (2019), FEVER2.0 (Thorne et al., 2019), AdversarialNLI Nie et al. (2019), as well as work by Dinan et al. (2019), Kaushik et al. (2020), and Wallace et al. (2019) for the Quizbowl task.

We are primarily interested in the latter category, as this feedback loop creates an environment where the annotator can probe the model directly to explore its weaknesses and formulate targeted adversarial attacks. Although Dua et al. (2019) and Dasigi et al. (2019) make use of adversarial annotations for RC, both annotation setups limit the reach of the model-in-the-loop: In DROP, primarily due to the imposition of specific answer types, and in Quoref by focusing on co-reference, which is already a known RC model weakness.

In contrast, we investigate a scenario where annotators interact with a model in its original task setting—annotators must thus explore a range of natural adversarial attacks, as opposed to filtering out “easy” samples during the annotation process.

The data annotation protocol is based on SQuAD1.1, with a model in the loop, and the additional instruction that questions should only have one answer in the passage, which directly mirrors the setting in which these models were trained.

Formally, provided with a passage p, a human annotator generates a question q and selects a (human) answer a_h by highlighting the corresponding span in the passage. The input (p,q) is then given to the model, which returns a predicted (model) answer a_m. To compare the two, a word-overlap F₁ score between a_h and a_m is computed; a score above a threshold of 40% is considered a “win” for the model.² This process is repeated until the human “wins”; Figure 2 gives a schematic overview of the process. All successful (p,q,a_h) triples, that is, those which the model is unable to answer correctly, are then retained for further validation.

We begin by training three different models, which are used as adversaries during data annotation. As a seed dataset for training the models we select the widely used SQuAD1.1 (Rajpurkar et al., 2016) dataset, a large-scale resource for which a variety of mature and well-performing models are readily available. Furthermore, unlike cloze-based datasets, SQuAD is robust to passage/question-only adversarial attacks (Kaushik and Lipton, 2018). We will compare dataset annotation with a series of three progressively stronger models as adversary in the loop, namely, BiDAF (Seo et al., 2017), BERT_LARGE (Devlin et al., 2019), and RoBERTa_LARGE (Liu et al., 2019b). Each of these will serve as a model adversary in a separate annotation experiment and result in three distinct datasets; we will refer to these as $DBiDAF$⁠, $DBERT$⁠, and $DRoBERTa$ respectively. Examples from the validation set of each are shown in Table 1. We rely on the AllenNLP (Gardner et al., 2018) and Transformers (Wolf et al., 2019) model implementations, and our models achieve EM/F₁ scores of 65.5%/77.5%, 82.7%/90.3% and 86.9%/93.6% for BiDAF, BERT, and RoBERTa, respectively, on the SQuAD1.1 validation set, consistent with results reported in other work.

Our choice of models reflects both the transition from LSTM-based to pre-trained transformer-based models, as well as a graduation among the latter; we investigate how this is reflected in datasets collected with each of these different models in the annotation loop. For each of the models we collect 10,000 training, 1,000 validation, and 1,000 test examples. Dataset sizes are motivated by the data efficiency of transformer-based pretrained models (Devlin et al., 2019; Liu et al., 2019b), which has improved the viability of smaller-scale data collection efforts for investigative and analysis purposes.

To ensure the experimental integrity provided by reporting all results on a held-out test set, we split the existing SQuAD1.1 validation set in half (stratified by document title) as the official test set is not publicly available. We maintain passage consistency across the training, validation and test sets of all datasets to enable like-for-like comparisons. Lastly, we use the majority vote answer as ground truth for SQuAD1.1 to ensure that all our datasets have one valid answer per question, enabling us to fairly draw direct comparisons. For clarity, we will hereafter refer to this modified version of SQuAD1.1 as $DSQuAD$⁠.

We use custom-designed Human Intelligence Tasks (HITs) served through Amazon Mechanical Turk (AMT) for all annotation efforts. Workers are required to be based in Canada, the UK, or the US, have a HIT Approval Rate greater than 98%, and have previously completed at least 1,000 HITs successfully. We experiment with and without the AMT Master requirement and find no substantial difference in quality, but observe a throughput reduction of nearly 90%. We pay USD 2.00 for every question generation HIT, during which workers are required to compose up to five questions that “beat” the model in the loop (cf. Figure 3). The mean HIT completion times for BiDAF, BERT, and RoBERTa are 551.8s, 722.4s, and 686.4s. Furthermore, we find that human workers are able to generate questions that successfully “beat” the model in the loop 59.4% of the time for BiDAF, 47.1% for BERT, and 44.0% for RoBERTa. These metrics broadly reflect the relative strength of the models.

We provide a two- part worker training interface in order to i) familiarize workers with the process, and ii) conduct a first screening based on worker outputs. The interface familiarizes workers with formulating questions, and answering them through span selection. Workers are asked to generate questions for two given answers, to highlight answers for two given questions, to generate one full question-answer pair, and finally to complete a question generation HIT with BiDAF as the model in the loop. Each worker’s output is then reviewed manually (by the authors); those who pass the screening are added to the pool of qualified annotators.

In the second annotation stage, qualified workers produce data for the “Beat the AI” question generation task. A sample of every worker’s HITs is manually reviewed based on their total number of completed tasks n, determined by $⌊5⋅log10(n)+1⌋$⁠, chosen for convenience. This is done after every annotation batch; if workers fall below an 80% success threshold at any point, their qualification is revoked and their work is discarded in its entirety.

As the models used in the annotation task become stronger, the resulting questions tend to become more complex. However, this also means that it becomes more challenging to disentangle measures of dataset quality from inherent question difficulty. As such, we use the condition of human answerability for an annotated question-answer pair as follows: It is answerable if at least one of three additional non-expert human validators can provide an answer matching the original. We conduct answerability checks on both the validation and test sets, and achieve answerability scores of 87.95%, 85.41%, and 82.63% for $DBiDAF$⁠, $DBERT$⁠, and $DRoBERTa$⁠. We discard all questions deemed unanswerable from the validation and test sets, and further discard all data from any workers with less than half of their questions considered answerable. It should be emphasized that the main purpose of this process is to create a level playing field for comparison across datasets constructed for different model adversaries, and can inevitably result in valid questions being discarded. The total cost for training and qualification, dataset construction, and validation is approximately USD 27,000.

We select a randomly chosen validator’s answer to each question and compute Exact Match (EM) and word overlap F₁ scores with the original to calculate non-expert human performance; Table 2 shows the result. We observe a clear trend: The stronger the model in the loop used to construct the dataset, the harder the resulting questions become for humans.

Table 3 provides general details on the number of passages and question-answer pairs used in the different dataset splits. The average number of words in questions and answers, as well as the average longest n-gram overlap between passage and question are given in Table 4.

We can again observe two clear trends: From weaker towards stronger models used in the annotation loop, the average length of answers increases, and the largest n-gram overlap drops from 3 to 2 tokens. That is, on average there is a trigram overlap between the passage and question for $DSQuAD$⁠, but only a bigram overlap for $DRoBERTa$ (Figure 4).³ This is in line with prior observations on lexical overlap as a predictive cue in SQuAD (Weissenborn et al., 2017; Min et al., 2018); questions with less overlap are harder to answer for any of the three models.

We furthermore analyze question types based on the question wh-word. We find that—in contrast to $DSQuAD$—the datasets collected with a model in the annotation loop have fewer when, how, and in questions, and more which, where, and why questions, as well as questions in the other category, which indicates increased question diversity. In terms of answer types, we observe more common noun and verb phrase clauses than in $DSQuAD$⁠, as well as fewer dates, names, and numeric answers. This reflects on the strong answer-type matching capabilities of contemporary RC models. The training and validation sets used in this analysis (⁠$DBiDAF$⁠, $DBERT$⁠, and $DRoBERTa$⁠) will be publicly released.

We begin with an experiment regarding the consistency of the adversarial nature of the models in the annotation loop. Our annotation pipeline is designed to reject all samples where the model correctly predicts the answer. How reproducible is this when retraining the model with the same training data? To measure this, we evaluate the performance of instances of BiDAF, BERT, and RoBERTa, which only differ from the model used during annotation in their random initialization and order of mini-batch samples during training. These results are shown in Table 5.

First, we observe—as expected given our annotation constraints—that model performance is 0.0EM on datasets created with the same respective model in the annotation loop. We observe, however, that retrained models do not reliably perform as poorly on those samples. For example, BERT reaches 19.7EM, whereas the original model used during annotation provides no correct answer with 0.0EM. This demonstrates that random model components can substantially affect the adversarial annotation process. The evaluation furthermore serves as a baseline for subsequent model evaluations: This much of the performance range can be learned merely by retraining the same model. A possible takeaway for using the model-in-the-loop annotation strategy in the future is to rely on ensembles of adversaries and reduce the dependency on one particular model instantiation, as investigated by Grefenstette et al. (2018).

A potential problem with the focus on challenging questions is that they might be very distinct from one another, leading to difficulties in learning to generalize to and from them. We conduct a series of experiments in which we train on $DBiDAF$⁠, $DBERT$⁠, and $DRoBERTa$⁠, and observe how well models can learn to generalize to the respective test portions of these datasets. Table 6 shows the results, and there is a multitude of observations.

First, one clear trend we observe across all training data setups is a negative performance progression when evaluated against datasets constructed with a stronger model in the loop. This trend holds true for all but the BiDAF model, in each of the training configurations, and for each of the evaluation datasets. For example, RoBERTa trained on $DRoBERTa$ achieves 72.1, 57.1, 49.5, and 41.0F₁ when evaluated on $DSQuAD$⁠, $DBiDAF$⁠, $DBERT$⁠, and $DRoBERTa$ respectively.

Second, we observe that the BiDAF model is not able to generalize well to datasets constructed with a model in the loop, independent of its training setup. In particular, it is unable to learn from $DBiDAF$⁠, thus failing to overcome some of its own blind spots through adversarial training. Irrespective of the training dataset, BiDAF consistently performs poorly on the adversarially collected evaluation datasets, and we also note a substantial performance drop when trained on $DBiDAF$⁠, $DBERT$⁠, or $DRoBERTa$ and evaluated on $DSQuAD$⁠.

In contrast, BERT and RoBERTa are able to partially overcome their blind spots through training on data collected with a model in the loop, and to a degree that far exceeds what would be expected from random retraining (cf. Table 5). For example, BERT reaches 47.9F₁ when trained and evaluated on $DBERT$⁠, while RoBERTa trained on $DRoBERTa$ reaches 41.0F₁ on $DRoBERTa$⁠, both considerably better than random retraining or when training on the non-adversarially collected $DSQuAD(10K)$⁠, showing gains of 20.6F₁ for BERT and 18.9F₁ for RoBERTa. These observations suggest that there exists learnable structure among harder questions that can be picked up by some of the models, yet not all, as BiDAF fails to achieve this. The fact that even BERT can learn to generalize to $DRoBERTa$⁠, but not BiDAF to $DBERT$ suggests the existence of an inherent limitation to what BiDAF can learn from these new samples, compared with BERT and RoBERTa.

More generally, we observe that training on $DS$⁠, where S is a stronger RC model, helps generalize to $DW$⁠, where W is a weaker model—for example, training on $DRoBERTa$ and testing on $DBERT$⁠. On the other hand, training on $DW$ also leads to generalization towards $DS$⁠. For example, RoBERTa trained on 10,000 SQuAD samples reaches 22.1F₁ on $DRoBERTa$ (⁠$DS$⁠), whereas training RoBERTa on $DBiDAF$ and $DBERT$ (⁠$DW$⁠) bumps this number to 39.9F₁ and 38.8F₁, respectively.

Third, we observe similar performance degradation patterns for both BERT and RoBERTa on $DSQuAD$ when trained on data collected with increasingly stronger models in the loop. For example, RoBERTa evaluated on $DSQuAD$ achieves 82.8, 80.0, 75.1, and 72.1F₁ when trained on $DSQuAD(10K)$⁠, $DBiDAF$⁠, $DBERT$⁠, and $DRoBERTa$⁠, respectively. This may indicate a gradual shift in the distributions of composed questions as the model in the loop gets stronger.

These observations suggest an encouraging takeaway for the model-in-the-loop annotation paradigm: Even though a particular model might be chosen as an adversary in the annotation loop, which at some point falls behind more recent state-of-the-art models, these future models can still benefit from data collected with the weaker model, and also generalize better to samples composed with the stronger model in the loop.

We further show experimental results for the same models and training datasets, but now including SQuAD as additional training data, in Table 7. In this training setup we generally see improved generalization to $DBiDAF$⁠, $DBERT$⁠, and $DRoBERTa$⁠. Interestingly, the relative differences between $DBiDAF$⁠, $DBERT$⁠, and $DRoBERTa$ as training sets used in conjunction with SQuAD are much diminished, and especially $DRoBERTa$ as (part of) the training set now generalizes substantially better. We see that BERT and RoBERTa both show consistent performance gains with the addition of the original SQuAD1.1 training data, but unlike in Table 6, this comes without any noticeable decline in performance on $DSQuAD$⁠, suggesting that the adversarially constructed datasets expose inherent model weaknesses, as investigated by Liu et al. (2019a).

Furthermore, RoBERTa achieves the strongest results on the adversarially collected evaluation sets, in particular when trained on $DSQuAD+DRoBERTa$⁠. This stands in contrast to the results in Table 6, where training on $DBiDAF$ in several cases led to better generalization than training on $DRoBERTa$⁠. A possible explanation is that training on $DRoBERTa$ leads to a larger degree of overfitting to specific adversarial examples in $DRoBERTa$ than training on $DBiDAF$⁠, and that the inclusion of a large number of standard SQuAD training samples can mitigate this effect.

Results for the models trained on all the datasets combined (⁠$DSQuAD$⁠, $DBiDAF$⁠, $DBERT$⁠, and $DRoBERTa$⁠) are shown in Table 8. These further support the previous observations and provide additional performance gains where, for example, RoBERTa achieves F₁ scores of 86.9 on $DSQuAD$⁠, 74.1 on $DBiDAF$⁠, 65.1 on $DBERT$⁠, and 52.7 on $DRoBERTa$⁠, surpassing the best previous performance on all adversarial datasets.

Finally, we identify a risk of datasets constructed with weaker models in the loop becoming outdated. For example, RoBERTa achieves 58.2EM/73.2F₁ on $DBiDAF$⁠, in contrast to 0.0EM/ 5.5F₁ for BiDAF—which is not far from the non-expert human performance of 62.6EM/78.5F₁ (cf. Table 2).

It is also interesting to note that, even when training on all the combined data (cf. Table 8), BERT outperforms RoBERTa on $DRoBERTa$ and vice versa, suggesting that there may exist weaknesses inherent to each model class.

Compared with standard annotation, the model- in-the-loop approach generally results in new question distributions. Consequently, models trained on adversarially composed questions might not be able to generalize to standard (“easy”) questions, thus limiting the practical usefulness of the resulting data. To what extent do models trained on model-in-the-loop questions generalize differently to standard (“easy”) questions, compared with models trained on standard (“easy”) questions?

To measure this we further train each of our three models on either $DBiDAF$⁠, $DBERT$⁠, or $DRoBERTa$ and test on $DSQuAD$⁠, with results in the $DSQuAD$ columns of Table 6. For comparison, the models are also trained on 10,000 SQuAD1.1 samples (referred to as $DSQuAD(10K)$⁠) chosen from the same passages as the adversarial datasets, thus eliminating size and paragraph choice as potential confounding factors. The models are tuned for EM on the held-out $DSQuAD$ validation set. Note that, although performance values on the majority vote $DSQuAD$ dataset are lower than on the original, for the reasons described earlier, this enables direct comparisons across all datasets.

Remarkably, neither BERT nor RoBERTa show substantial drops when trained on $DBiDAF$ compared to training on SQuAD data (−2.1F₁, and −2.8F₁): Training these models on a dataset with a weaker model in the loop still leads to strong generalization even to data from the original SQuAD distribution, which all models in the loop are trained on. BiDAF, on the other hand, fails to learn such information from the adversarially collected data, and drops ¿30F₁ for each of the new training sets, compared to training on SQuAD.

We also observe a gradual decrease in generalization to SQuAD when training on $DBiDAF$ towards training on $DRoBERTa$⁠. This suggests that the stronger the model, the more dissimilar the resulting data distribution becomes from the original SQuAD distribution. We later find further support for this explanation in a qualitative analysis (Section 5). It may, however, also be due to a limitation of BERT and RoBERTa—similar to BiDAF—in learning from a data distribution designed to beat these models; an even stronger model might learn more from, for example, $DRoBERTa$⁠.

Finally, we investigate to what extent models can transfer skills learned on the datasets created with a model in the loop to two recently introduced datasets: DROP (Dua et al., 2019), and NaturalQuestions (Kwiatkowski et al., 2019). In this experiment we select the subsets of DROP and NaturalQuestions that align with the structural constraints of SQuAD to ensure a like-for-like analysis. Specifically, we only consider questions in DROP where the answer is a span in the passage and where there is only one candidate answer. For NaturalQuestions, we consider all non-tabular long answers as passages, remove HTML tags and use the short answer as the extracted span. We apply this filtering on the validation sets for both datasets. Next we split them, stratifying by document (as we did for $DSQuAD$⁠), which results in 1409/1418 validation and test set examples for DROP, and 964/982 for NaturalQuestions, respectively. We denote these datasets as $DDROP$ and $DNQ$ for clarity and distinction from their unfiltered versions. We consider the same models and training datasets as before, but tune on the respective validation sets of $DDROP$ and $DNQ$⁠. Table 6 shows the results of these experiments in the respective $DDROP$ and $DNQ$ columns.

First, we observe clear generalization improvements towards $DDROP$ across all models compared to training on $DSQuAD(10K)$ when training on any of $DBiDAF$⁠, $DBERT$⁠, or $DRoBERTa$⁠. That is, including a model in the loop for the training dataset leads to improved transfer towards $DDROP$⁠. Note that DROP also makes use of a BiDAF model in the loop during annotation; these results are in line with our prior observations when testing the same setups on $DBiDAF$⁠, $DBERT$⁠, and $DRoBERTa$⁠, compared to training on $DSQuAD(10K)$⁠.

Second, we observe overall strong transfer results towards $DNQ$⁠, with up to 69.8F₁ for a BERT model trained on $DBiDAF$⁠. Note that this result is similar to, and even slightly improves over, model training with SQuAD data of the same size. That is, relative to training on SQuAD data, training on adversarially collected data $DBiDAF$ does not impede generalization to the $DNQ$ dataset, which was created without a model in the annotation loop. We then, however, see a similar negative performance progression as observed before when testing on $DSQuAD$⁠: The stronger the model in the annotation loop of the training dataset, the lower the test accuracy on test data from a data distribution composed without a model in the loop.

Having applied the general model-in-the-loop methodology on models of varying strength, we next perform a qualitative comparison of the nature of the resulting questions. As reference points we also include the original SQuAD questions, as well as DROP and NaturalQuestions, in this comparison: these datasets are both constructed to overcome limitations in SQuAD and have subsets sufficiently similar to SQuAD to make an analysis possible. Specifically, we seek to understand the qualitative differences in terms of reading comprehension challenges posed by the questions in each of these datasets.

There exists a variety of prior work that seeks to understand the types of knowledge, comprehension skills, or types of reasoning required to answer questions based on text (Rajpurkar et al., 2016; Clark et al., 2018; Sugawara et al., 2019; Dua et al., 2019; Dasigi et al., 2019); we are, however, unaware of any commonly accepted formalism. We take inspiration from these but develop our own taxonomy of comprehension requirements which suits the datasets analyzed. Our taxonomy contains 13 labels, most of which are commonly used in other work. However, the following three deserve additional clarification: i) explicit–for which the answer is stated nearly word-for-word in the passage as it is in the question, ii) filtering–a set of answers is narrowed down to select one by some particular distinguishing feature, and iii) implicit–the answer builds on information implied by the passage and does not otherwise require any of the other types of reasoning.

We annotate questions with labels from this catalogue in a manner that is not mutually exclusive, and neither fully comprehensive; the development of such a catalogue is itself very challenging. Instead, we focus on capturing the most salient characteristics of each given question, and assign it up to three of the labels in our catalogue. In total, we analyze 100 samples from the validation set of each of the datasets; Figure 5 shows the results.

An initial observation is that the majority (57%) of answers to SQuAD questions are stated explicitly, without comprehension requirements beyond the literal level. This number decreases substantially for any of the model-in-the-loop datasets derived from SQuAD (e.g., 8% for $DBiDAF$⁠) and also $DDROP$⁠, yet 42% of questions in $DNQ$ share this property. In contrast to SQuAD, the model-in-the-loop questions generally tend to involve more paraphrasing. They also require more external knowledge, and multi-hop inference (beyond co-reference resolution) with an increasing trend for stronger models used in the annotation loop. Model-in-the-loop questions further fan out into a variety of small, but non-negligible proportions of more specific types of inference required for comprehension, for example, spatial or temporal inference (both going beyond explicitly stated spatial or temporal information)—SQuAD questions rarely require these at all. Some of these more particular inference types are common features of the other two datasets, in particular comparative questions for DROP (60%) and to a small extent also NaturalQuestions. Interestingly, $DBiDAF$ possesses the largest number of comparison questions (11%) among our model-in-the-loop datasets, whereas $DBERT$ and $DRoBERTa$ only possess 1% and 3%, respectively. This offers an explanation for our previous observation in Table 6, where BERT and RoBERTa perform better on $DDROP$ when trained on $DBiDAF$ rather than on $DBERT$ or $DRoBERTa$⁠. It is likely that BiDAF as a model in the loop is worse than BERT and RoBERTa at comparative questions, as evidenced by the results in Table 6 with BiDAF reaching 8.6F₁, BERT reaching 28.9F₁, and RoBERTa reaching 39.4F₁ on $DDROP$ (when trained on $DSQuAD(10K)$⁠).

The distribution of NaturalQuestions contains elements of both the SQuAD and $DBiDAF$ distributions, which offers a potential explanation for the strong performance on $DNQ$ of models trained on $DSQuAD(10K)$ and $DBiDAF$⁠. Finally, the gradually shifting distribution away from both SQuAD and NaturalQuestions as the model-in-the-loop strength increases reflects our prior observations on the decreasing performance on SQuAD and NaturalQuestions of models trained on datasets with progressively stronger models in the loop.

We have investigated an RC annotation paradigm that requires a model in the loop to be “beaten” by an annotator. Applying this approach with progressively stronger models in the loop (BiDAF, BERT, and RoBERTa), we produced three separate datasets. Using these datasets, we investigated several questions regarding the annotation paradigm, in particular, whether such datasets grow outdated as stronger models emerge, and their generalization to standard (non-adversarially collected) questions. We found that stronger models can still learn from data collected with a weak adversary in the loop, and their generalization improves even on datasets collected with a stronger adversary. Models trained on data collected with a model in the loop further generalize well to non-adversarially collected data, both on SQuAD and on NaturalQuestions, yet we observe a gradual deterioration in performance with progressively stronger adversaries.

We see our work as a contribution towards the emerging paradigm of model-in-the-loop annotation. Although this paper has focused on RC, with SQuAD as the original dataset used to train model adversaries, we see no reason in principle why findings would not be similar for other tasks using the same annotation paradigm, when crowdsourcing challenging samples with a model in the loop. We would expect the insights and benefits conveyed by model-in-the-loop annotation to be the greatest on mature datasets where models exceed human performance: Here the resulting data provides a magnifying glass on model performance, focused in particular on samples which models struggle on. On the other hand, applying the method to datasets where performance has not yet plateaued would likely result in a more similar distribution to the original data, which is challenging to models a priori. We hope that the series of experiments on replicability, observations on transfer between datasets collected using models of different strength, as well as our findings regarding generalization to non-adversarially collected data, can support and inform future research and annotation efforts using this paradigm.

The authors would like to thank Christopher Potts for his detailed and constructive feedback, and our reviewers. This work was supported by the European Union’s Horizon 2020 Research and Innovation Programme under grant agreement no. 875160 and the UK Defence Science and Technology Laboratory (Dstl) and Engineering and Physical Research Council (EPSRC) under grant EP/R018693/1 as a part of the collaboration between US DOD, UK MOD, and UK EPSRC under the Multidisciplinary University Research Initiative (MURI).