Understanding and executing natural language instructions in a grounded domain is one of the hallmarks of artificial intelligence. In this paper, we focus on instruction understanding in the blocks world domain and investigate the language understanding abilities of two top-performing systems for the task. We aim to understand if the test performance of these models indicates an understanding of the spatial domain and of the natural language instructions relative to it, or whether they merely over-fit spurious signals in the dataset. We formulate a set of expectations one might have from an instruction following model and concretely characterize the different dimensions of robustness such a model should possess. Despite decent test performance, we find that state-of-the-art models fall short of these expectations and are extremely brittle. We then propose a learning strategy that involves data augmentation and show through extensive experiments that the proposed learning strategy yields models that are competitive on the original test set while satisfying our expectations much better. 1 . Building agents that can understand and execute natural language instructions in a grounded environment is a hallmark of artificial intelligence (Winograd, 1972). There is wide applicability of this technology in navigation (Chen et al., 2019; Tellex et al., 2011; Chen and Mooney, 2011), collaborative building (Narayan-Chen et al., 2019), and several others areas (Li et al., 2020b; Brana-van et al., 2009). The key challenge underlying these and many other applications is the need to understand the natural language instruction (to the extent that it is possible) and ground relevant parts of it in the environment. While the use of deep networks has led to significant progress on several 1 Our code is publicly available at: http://cogcomp.org/page/publication_view/936 Figure 1: Task: Given a configuration of blocks and an instruction, predict the source and target location. benchmarks (Abiodun et al., 2018) an investigation into the instruction understanding capabilities of such systems remains lacking. We do not know the extent to which these models truly understand the spatial relations in the environment, nor their robustness to variability in the environment or in the instructions. This understanding is also important from the viewpoint of safety critical applications , where robustness to variability is essential. While robustness to input perturbations at test-time has been studied in computer vision (Goodfellow et al., 2014) and in certain natural language tasks (Alzantot et al., 2018; Wallace et al., 2019; Shah et al., 2020), it remains relatively elusive in the instruction following task in a grounded environment. This can be attributed to the difficulty in characterizing the different expectations of robustness in this setting, due to the multiple channels of input involved, which semantically constrain each other. The Blocks World domain is an ideal platform to study the abilities of a system to understand instructions (Winograd, 1972; Bisk et al., 2016; Narayan-Chen et al., 2019; Misra et al., 2017; Bisk et al., 2018; Mehta and Goldwasser, 2019; Tan and Bansal, 2018). Despite being seemingly simple, it presents key reasoning challenges, including compositional language understanding and spatial understanding, that need to be addressed in any instructional domain. In Bisk et al. (2016), the en-(a) vironment consists of a number of blocks placed on a flat board. The model is provided with the current configuration of blocks in the environment along with an instruction, and is tasked with executing the instruction by manipulating appropriate blocks. In this work, we follow the more challenging setting in Bisk et al. (2016) where the blocks are unlabeled, necessitating the use of involved referential expressions in the instructions. Fig.1 shows that the instruction and block configuration are semantically dependent, jointly determining the outcome. Despite the success of top performing models (Tan and Bansal, 2018; Bisk et al., 2016) on the test set for this task, we question if the models are able to reason about the complex language and spatial concepts of this task and generalize or are merely over fitting the test set. To investigate these questions we formulate the following expectations one should have from an instruction following model: (1) Identity Invariance Expectation : The performance of the model on an input should not degrade on slightly perturbing the input. (2) Symmetry Equivariance Expectation : A symmetric transformation of an input should cause an equivalent transformation of model prediction and performance should not degrade. (3) Length Invariance Expectation : The performance of a model should not depend on the length of the input, as long as the semantics is unchanged. Our expectations complement existing work in three dimensions: (1) is related to adversarial perturbations (Goodfellow et al., 2014) and (2) is related to equivariance of CNNs explored in computer vision (Cohen and Welling, 2016). It is also related to contrast sets (Gardner et al., 2020; Li et al., 2020a) and counterfactual data augmentation (Kaushik et al., 2019). Here, we extend the investigation to this new task of instruction following involving both natural language and an environment, discrete and continuous perturbations and both regression and classification tasks. Contrast (3) is related to Lake and Baroni (2018) where vulnerability to length in a toy sequence-sequence task was demonstrated. Here we show that length-based vulnerability exists in another modalitythe number of blocks present on the board, for this much more complicated task. While these form only a subset of the expectations one might have from an instruction following model, it already allows us to formally characterize some of the dimensions of robustness an instruction following agent must have. As an example, a tiny shift in the location of each block should not affect the model prediction (identity invariance). In Sec. 2, we formulate concrete perturbations to test whether a given model satisfies these expectations. The space of perturbations that we consider have the following attributes: (a) Semantic Preserving or Semantic Altering. (b) Linguistic or Geometric. (c) Discrete or Continuous. We find that both models studied suffer a large performance drop under each of the perturbations, and fall short of satisfying our expectations. We then present a data augmentation scheme designed to better address our expectations from such models. Our extensive experiments in Sec. 2.3 indicate that our learning strategy results in more robust models that perform much better on the perturbed test set while maintaining similar performance on the original test set. Given the block configuration W  R 20  3 (three-dimensional coordinate locations of a maximum of 20 unlabeled blocks B = b 1 , ..., b 20 and an instruction I , the model has to move the appropriate block. There are two sub-tasks: (i) predicting the source block to be moved and (ii) predicting the Figure 3: Relative Performance Degradation for the source (classification and regression) and target (regression) sub-tasks. While the target output is always a location y  R 3 , for the source task the model can either predict a particular block y  { 1 , 2 , ..., 20 } (Tan and Bansal, 2018) or a particular source location y  R 3 (Bisk et al., 2016). Let P denote a perturbation space and ( I (cid:48) , W (cid:48) ) be the perturbed version of ( I, W ) under P . Note that ( I (cid:48) , W (cid:48) ) can be chosen randomly or adversarially as the perturbation which maximizes the loss : ( I (cid:48) , W (cid:48) ) = arg max ( I (cid:48) ,W (cid:48) ) P (cid:96) ( f ( I (cid:48) , W (cid:48) ) , O ) . Here (cid:96) denotes a loss function and O denotes the gold source/target location. If the perturbation space is discrete and finite we can simple search over all candidate ( I (cid:48) , W (cid:48) ) to find the one with the maximum loss. If it is continuous and infinite, we can use a first order method (eg: First Order Gradient Signed Method FGSM (Goodfellow et al., 2014)) to find the adversarial ( I (cid:48) , W (cid:48) ) . Now we characterize P . Broadly, we have the following two types of perturbations: (i) Semantics Preserving (SP) : Perturbations when applied to either I or W , do not change the meaning of either. Since the modified instruction I (cid:48) or world state W (cid:48) is semantically unchanged, the model should perform similarly on the perturbed input. Informally, we want f ( I, W )  f ( I (cid:48) , W (cid:48) ) since I  I (cid:48) and W  W (cid:48) . SP perturbations can be of the following types:  Linguistic (SPL) : Perturbations that do not change the overall meaning of the instruction. Consider Lexical Substitutions: We identify a list of synonyms for each of the shapes and spatial concepts ( C ) in this domain. 2 For each test example which contains at least one of these 2 Examples of synonym sets for shapes in C are { tower ( s ) , stack ( s ) } , { block ( s ) , brick ( s ) , box ( es ) } . concepts we adversarially pick the one with the highest loss over all combinations of substitutions from the synonyms in C . Since the size of these synonym sets are small, an explicit search over all candidate substitutions is possible, although the search space grows combinatorially with the number of elements of C in I . Geometric (SPG) : These perturbations do not change the semantics of the board. Tiny changes in the block locations which preserve the overall semantics of W should not affect model predictions. We perturb each block location slightly in an adversarial direction 3 w.r.t W . Count (SPC) : We identify distractor blocks which do not affect the meaning of the instruction (Fig. 2(b)). Large distance from the source and target location acts as a proxy for this. P comprises of deleting k blocks where k  { 0 , 1 , 2 , ..., N } is chosen adversarially to generate W (cid:48) . We set N = 3 . 4  Permutation (SPP) : These are perturbations where the order in which the block locations are fed to the model, are permuted: ( B ) = { b (1) , ..., b (20) } . While semantically nothing changes in the input ( ( I (cid:48) , W (cid:48) )  ( I, ( W )) , where  denotes semantic equivalence), we see models still suffer a large performance drop, even for a random permutation  . (ii) Semantic Altering (SA) : These perturbations create a new ( I (cid:48) , W (cid:48) ) pair with different semantics, using a simple transformation that we want the model to be equivariant to. A horizontal mirroring of W with a corresponding change in I (flipping all the left concept words to right and vice versa) 3 according to a FGSM attack with (cid:15) = 0 . 05 4 Addition of such distractor blocks at locations far from the source and target locations, form a similar perturbation set that also leads to a significant performance drop for existing models (Appendix A). 2.1 Model Performance vs Our Expectations The dataset from Bisk et al. (2016) 5 has 2493 training examples and 720 test examples. We evaluate the performance of our implementation of two models: from Bisk et al. (2016) and from Tan and Bansal (2018). One important difference between the two models is that while both models treat the target subtask T as a regression task (trained and evaluated using a normalized mean squared error called block distance BD), Tan and Bansal (2018) treats the source subtask as a classification task S cls (trained using cross entropy loss as (cid:96) and evaluated using classification accuracy Acc.) while Bisk et al. (2016) treats it as a regression task S reg (trained and evaluated using BD). We use both models for the source and the Bisk et al. (2016) model for the target subtask. We compare model performance on the original test set using standard evaluation and on the perturbed test set using a robust evaluation measure. The robust evaluation measure for S reg and T is max( BD ( f ( I, W ) , O ) , BD ( f ( I (cid:48) , W (cid:48) ) , O )) and min( Acc ( f ( I, W ) , O ) , Acc ( f ( I (cid:48) , W (cid:48) ) , O )) for S cls . This robust evaluation formulation is motivated by the requirement that models perform well on both the original and the perturbed examples. From Fig. 3 we see that models suffer a large performance drop of upto 87 . 48% , 42 . 86% and 5 https://groundedlanguage.github.io 30 . 03% for the source-classification,-regression and target subtasks respectively, over different P . In this section we show that a simple data augmentation strategy improves model performance under robust evaluation on the perturbed test set. For each input ( I, W ) in the training data we add another example which is adversarial: ( I (cid:48) , W (cid:48) ) = arg max ( I (cid:48) ,W (cid:48) ) P (cid:96) ( f ( I (cid:48) , W (cid:48) ) , O ) . This perturbation set P used in training is the same one that is used for robust test evaluation. When P is continuous (eg: SPG), we use the FGSM attack to solve this maximization and obtain ( I (cid:48) , W (cid:48) ) . When P is discrete (eg: SPL, SPC) we search over the perturbation space to find the perturbation with the highest loss. We train the model on a combined dataset consisting of both the original train-set and the adversarially augmented data. This is an extension of Adversarial Training (Madry et al., 2017) to the instruction following task for (i) both discrete and continuous perturbations (ii) both regression and classification tasks. In this section we show the benefits of adversarially augmented robust training. Consider the models M std from Bisk et al. (2016) and Tan and Bansal (2018) which were shown to perform poorly under robust evaluation in Sec. 2.1. Here we compare their performance with their robustly trained variants M rob . For all models we perform standard evaluation and robust evaluations for each perturbation type. This is done for the source (classification and regression) and target sub-tasks. In Table 1 we show the results under the different settings, averaged over 5 runs. For every perturbation category and for all sub-tasks, we see that the robust models (i) outperform their standard counterparts in terms of robust evaluation metric and (ii) in some cases even on standard evaluation. Thus, knowledge-free robust training framework can produce models which are less brittle to perturbations with competitive standard performance on the original test set. In this paper we formulated the performance expectations for an instruction following system. Based on these expectations, we created several categories of perturbations and showed that existing models fail spectacularly on them. We then demonstrated the benefits of adversarial data augmentation on each perturbation category. This work was supported by Contracts W911NF-15-1-0461 and FA8750-19-2-0201 with the US Defense Advanced Research Projects Agency (DARPA), the Army Research Office under Grant Number W911NF-20-1-0080, and by ONR Contract N00014-19-1-2620. The views and conclusions contained in this document are those of the authors and should not be interpreted as representing the official policies, either expressed or implied, of the Department of Defense or the U.S. Government.
abstain objective objective method result objective abstain abstain abstain abstain other abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain method abstain abstain objective abstain abstain abstain abstain objective abstain result method abstain method method abstain abstain abstain result method result abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain method abstain abstain abstain abstain method abstain abstain abstain abstain abstain abstain method abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain method abstain abstain method method abstain abstain abstain abstain other abstain abstain method abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain result result abstain abstain abstain method result objective other other