{"id":"caf2b99a-4926-49e3-b039-5ce57edf7856","arxiv_id":"2504.17723","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"RoMA, a statistical robustness estimator, is adapted to black-box language models and is shown to approximate exact verification within 1% on small networks while scaling to BERT sentiment analysis.","lead":"This paper adapts RoMA, a black-box statistical robustness estimator, to monitor language models by sampling semantic and typographical perturbations and analyzing confidence scores. The authors report that RoMA matches exact formal verification within 1% on small networks while cutting runtimes from hours to minutes, and demonstrate the approach on BERT sentiment classifiers.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"LLM robustness scores in §5.2–5.4 are empirical percentages, not RoMA's distribution-derived plr; no confidence intervals are reported, and the Word2Vec sampler is not uniform over the plr epsilon-ball, so 'statistically validated bounds' is unsupported.","rationale":"The reader's weakest assumption correctly identifies the gap between the empirical robustness percentage in §5.2 and the distribution-based plr estimate from §4. This is the most load-bearing concern because the paper's contribution, as stated in the abstract and title, is statistical runtime verification with validated bounds for LLMs. If the reported LLM scores are merely empirical frequencies, the 'statistically validated bounds' claim is unsupported, and the paper reduces to a case study of perturbation-based accuracy measurement. The issue is addressable: report the actual estimator, provide confidence intervals, and either justify the sampling measure or restate the claims. The Exact Count validation on small networks is a useful external check, but it does not transfer to the transformer setting. The reader's conditional verdict is appropriate; the concern does not require rejection if the authors can supply the missing estimator analysis and rephrase the claims accordingly.","tokens_in":13867,"tokens_out":4399,"duration_ms":43594,"concrete_test":"Take 100 random SST-2 sentences. For each, enumerate all single-word substitutions within the Word2Vec cosine threshold used in §4 (or a large stratified sample), compute the exact empirical misclassification rate, and bootstrap a 95% confidence interval. Independently compute the RoMA distribution-based plr estimate from the fitted runner-up distribution as described in §4. If the distribution-based estimate lies outside the bootstrap interval for more than a few sentences, the §5.2 percentage is not a statistically validated plr estimate and the central claim fails; if it lies inside, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The abstract's central claim is that RoMA 'provides quantitative robustness assessments with statistically validated bounds' for LLMs, and Section 4 describes a plr estimate obtained by fitting runner-up confidence distributions (Anderson-Darling, Box-Cox) over perturbations. The LLM evaluation in Section 5.2, however, defines robustness as 'the percentage of semantically perturbed inputs maintaining classification confidence scores above the 0.50 threshold.' This is an empirical accuracy rate, not the distribution-derived plr estimate from Section 4, and no confidence interval or statistical bound is reported for any LLM score. The paper never shows the two quantities coincide. Furthermore, Definition 2 defines plr with respect to a uniform measure on a continuous ℓ∞ ball, whereas the perturbation generator samples discrete synonym substitutions whose selection probability is induced by Word2Vec cosine thresholds and sentence structure; there is no argument that this sampler is uniform over the set where plr is measured. The Section 5.1 Exact Count validation covers only six small feedforward networks (ACAS Xu rows timed out and thus have no ground-truth comparison), so it does not validate the transformer-based LLM setting. This gap directly undermines the 'statistically validated bounds' portion of the central claim.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper adapts the RoMA statistical robustness-verification framework to black-box LLM classification. It replaces pixel noise with semantic perturbations obtained by Word2Vec-based synonym substitution, and evaluates BERT-base sentiment classifiers on SST-2 across embedding, categorial, and orthographic perturbation domains. The authors claim that RoMA estimates robustness within 1% of the Exact Count formal verification baseline on small networks and ACAS Xu, while reducing verification time from hours to minutes, and they report LLM robustness scores of 97.18%/96.60% for the embedding domain and 94.44%/93.94% for the orthographic domain. The paper concludes that RoMA is a scalable candidate for runtime robustness monitoring of LLMs in black-box deployment settings.","tokens_in":14144,"tokens_out":3703,"duration_ms":38029,"significance":"If the central claims held, the paper would offer a useful black-box runtime monitoring approach for LLMs, with a concrete external validation against the Exact Count formal baseline and a public implementation. The orthographic experiment includes an exhaustive ground-truth comparison that is a genuine strength, and the Exact Count reproduction provides an independent check for small feedforward networks. However, the LLM experiments do not actually implement the distribution-derived plr estimator described in Section 4, and the empirical 1% accuracy claim is established only on six small synthetic networks, not on transformers. As presented, the abstract's claim of 'statistically validated bounds' for LLM robustness is not supported by the evidence, though it is plausibly fixable by re-scoping the claims and adding the missing statistical analysis.","major_comments":[{"comment":"The LLM robustness metric is defined as 'the percentage of semantically perturbed inputs maintaining classification confidence scores above the 0.50 threshold' (Section 5.2, Results). This is an empirical accuracy rate, not the plr estimate described in Section 4, which fits runner-up confidence distributions with the Anderson-Darling test and Box-Cox transformation and then derives a probability from the fitted distribution. No confidence intervals are reported for any LLM score, and the paper never shows that the empirical percentage equals or bounds the distribution-derived plr. Consequently, the abstract's 'statistically validated bounds' claim is unsupported for the LLM experiments.","section":"§5.2 Results"},{"comment":"Definition 2 defines plr with respect to a uniform measure on a continuous ℓ∞ ball around x0, while the perturbation generator in Section 4 selects discrete synonym substitutions using a Word2Vec cosine-similarity threshold of 1−ϵ. The sampling distribution is induced by the embedding vocabulary, sentence structure, and the random choice of word positions, and no argument is given that this distribution approximates the uniform measure on the ℓ∞ ball. Thus the reported scores cannot be directly interpreted as estimates of plr as defined, and the paper should either state explicitly that the target quantity is robustness under the specific semantic perturbation distribution or provide a uniformity argument.","section":"§4 vs. Definition 2"},{"comment":"The 'within 1% deviation' claim is established only on the six synthetic models for which Exact Count terminates (Model_2_20 through Model_5_95). For Model_10_76 and the five ACAS Xu properties, Exact Count times out after 24 hours, so no ground-truth comparison exists. These networks are also small feedforward ReLU networks, not transformer-based LLMs. The authors acknowledge the architectural gap in the text accompanying Table 1, but the abstract and Section 5.1's 'Implications for Runtime Verification' still present the sub-1% accuracy as applying to the LLM setting. This extrapolation needs to be explicitly qualified or supported by LLM-specific validation.","section":"§5.1, Table 1"},{"comment":"In the orthographic experiment, the paper reports that runner-up confidence scores fail Anderson-Darling normality tests even after Box-Cox transformation, yet the framework still produces robustness estimates that match exhaustive ground truth within 0.17%. This agreement is a useful empirical sanity check, but it directly undercuts the premise that distributional normality is required for 'statistically validated bounds'. The paper should either present the orthographic results as an empirical validation of a non-parametric estimator, or restrict the 'statistically validated' wording to the settings where the distributional assumptions are actually satisfied.","section":"§5.4"}],"minor_comments":[{"comment":"The phrase 'with 50% of SST-2 sentences were processed within 15 minutes' is grammatically awkward and the percentage refers to instances, so please revise for clarity.","section":"Abstract and §1"},{"comment":"Several reference entries contain encoding artifacts, for example reference [1] ('Anderson, T.: Anderson-Darling Tests...') and reference [3] ('B¯ erzin,š, J.'); these should be cleaned up.","section":"References"},{"comment":"The text refers to 'T able 1' with an extra space, and the table column alignment could be improved for readability.","section":"Table 1"},{"comment":"The vertical axis label reads 'Frequency (percentage)' while the caption describes a cumulative distribution function; please correct the axis label to reflect the CDF.","section":"Figure 3"},{"comment":"Please clarify whether the reported processing times include the time for generating up to 1,000 perturbations per sentence or only the model inference time.","section":"§5.2"}],"recommendation":"major_revision","confidential_remarks":"The core idea is salvageable and there is a genuine external validation component in the Exact Count comparison and the orthographic ground-truth check. The main problem is that the abstract and conclusions overclaim: the LLM evaluation uses an empirical accuracy metric rather than the distributional plr estimator, and the 1% figure is not established for transformers. I recommend the authors re-scope the claims, add confidence intervals or explicitly characterize the empirical metric, and either provide a uniformity argument for the perturbation sampler or redefine plr for the discrete semantic-perturbation setting. This is fixable within the manuscript's scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this is a genuine but modest contribution — the first adaptation of the RoMA statistical verification framework to black-box LLM monitoring, with an external check against an exact counter. The paper deserves a serious referee, but the central 'statistically validated bounds' claim is not supported by the LLM experiments as reported.\n\nWhat is good: the adaptation is concrete. Word2Vec-based semantic perturbations, runner-up confidence distributions, Anderson-Darling and Box-Cox where needed, and the code is public. The validation against Exact Count on six small synthetic networks shows RoMA within roughly 1% of ground truth, and Section 5.4 does a genuinely nice thing: it compares RoMA estimates for orthographic perturbations against a full exhaustive pass over all 1,821 test sentences and lands within 0.17%. That is real evidence.\n\nThe soft spots are serious but addressable. The biggest one: the 'robustness scores' in Sections 5.2–5.4 are empirical frequencies — the percentage of perturbed inputs whose confidence stays above 0.50 — not the distribution-derived plr that Section 4 says RoMA computes. No confidence interval is reported for any LLM score, so 'statistically validated bounds' is doing a lot of work without a visible estimate or variance. The paper never shows the two quantities coincide.\n\nSecond, the perturbation sampler does not match Definition 2's uniform measure over an ℓ∞ ball. Word2Vec cosine thresholds define a discrete, sentence-structure-dependent set of substitutions, not a uniform draw from a continuous ball. Without an argument that this sampler yields unbiased plr estimates, the numbers should be called empirical robustness under a particular perturbation model, not estimates of the formal definition.\n\nThird, the 1% accuracy claim rests on six small feedforward networks. ACAS Xu runs timed out and have no ground truth, so the transfer to transformer-based LLMs is untested. The authors acknowledge this in Section 5.1, which is fair — but the abstract states the claim without that qualifier.\n\nWho this is for: people working on runtime verification for LLMs, or anyone who wants a black-box robustness monitor that runs in minutes rather than hours. It is a useful case study, not a paradigm shift. It deserves peer review — the method is clearly described, the limitations are mostly stated, and the code is available — but the final version should either report the actual plr estimates with intervals or tone down the 'statistically validated' language.","headline":"A real but modest case study: the first RoMA-style statistical robustness monitor for black-box LLMs, with an honest external check against an exact verifier, but the headline 'statistically validated bounds' claim outruns the reported experiments.","tokens_in":14626,"tokens_out":1924,"would_cite":true,"duration_ms":18124,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that adapting RoMA to black-box LLM monitoring estimates adversarial robustness within about 1% of formal verification while cutting runtime from hours to minutes.","keywords":["LLM safety","neural network verification","LLM verification","robustness","runtime monitoring","statistical verification","semantic perturbation","BERT"],"falsifier":"Enumerate, for a small enough vocabulary or a tiny BERT-like model, every single-word substitution that passes the Word2Vec cosine threshold on a set of sentences, compute the exact misclassification rate over that full substitution set, run RoMA on the same sentences, and compare: if the two differ by more than the claimed 1% on a non-trivial share of inputs, the transfer claim is refuted.","tokens_in":13655,"feed_emoji":"🛡️","tokens_out":10161,"duration_ms":92041,"temperature":0.7,"pith_summary":"The paper is a case study asking whether a statistical, black-box verification method can fill in where formal verification of LLMs hits its exponential wall. It adapts RoMA, a framework that estimates robustness from the distribution of a network's runner-up confidence scores under perturbations, to language inputs via Word2Vec-based word substitution. Against the Exact Count formal algorithm on six small networks, RoMA's robustness estimates land within about 1 percentage point while reducing runtime from hours to minutes, and on ACAS Xu it finishes in under 16 minutes where exact counting times out after 24 hours. On BERT sentiment classifiers over SST-2, the same method produces quantitative robustness scores under semantic, categorial, and orthographic perturbations, pointing toward online monitoring of deployed LLMs without white-box access. The paper's upshot is that statistical robustness estimation may be a scalable complement to formal verification in runtime-critical LLM deployments.","feed_headline":"Statistical checks match formal LLM robustness in minutes","feed_subtitle":"RoMA-based monitoring estimates BERT robustness within about 1% of exact counting, in minutes rather than hours","key_machinery":"The load-bearing object is the probabilistic-local-robustness (plr) score, the probability that the predicted label is preserved when the input is sampled uniformly from an $\\epsilon$-ball around the original input. RoMA never enumerates that ball; instead it records the runner-up confidence score (the highest class probability other than the predicted label) across thousands of perturbations, checks the collected scores for normality with the Anderson-Darling test, applies the Box-Cox transformation when normality is rejected, and uses the resulting distribution to estimate the probability of misclassification. In the LLM adaptation, the perturbation step replaces words with Word2Vec neighbors whose cosine similarity to the original word exceeds $1-\\epsilon$, making the finite set of synonym substitutions the practical stand-in for the continuous epsilon-ball. This runner-up-score-to-distribution pipeline is what converts a black-box confidence histogram into a quantitative robustness estimate.","core_discovery":"The paper's central claim is that RoMA, a black-box statistical robustness estimator, can be adapted to serve as a runtime monitor for LLMs when formal verification is infeasible. For text input it replaces pixel noise with Word2Vec-based synonym substitution, collecting up to 1,000 perturbed variants per sentence and analyzing the distribution of the runner-up confidence score. On the Exact Count formal baseline, RoMA matches probabilistic-local-robustness values to within about 1 percentage point on the six small synthetic networks where exact counting terminates, and estimates ACAS Xu instances in under 16 minutes where Exact Count times out after 24 hours. On BERT-base sentiment classifiers over SST-2, the method reports 97.18% semantic robustness for the best checkpoint, per-class robustness differences up to 1.5%, and orthographic robustness of 94.44% that agrees with an exhaustive ground-truth evaluation to within 0.17 percentage points. These results are offered as evidence that statistical estimation can narrow the gap between theoretical verification guarantees and operational deployment constraints for LLMs.","pith_inferences":["Editorial extension: the 1% validation is carried out on small feedforward networks and ACAS Xu, not on transformers; a true transfer claim would require an exact-count comparison on a small transformer, where exhaustive counting is still feasible.","Editorial extension: the LLM experiments define robustness as the empirical fraction of perturbed inputs that keep confidence above 0.50, while the formal baseline measures plr over a continuous epsilon-ball; checking whether these two quantities converge on the same sentences would directly test the measure being used.","Editorial extension: the orthographic experiment already performs exhaustive character-level enumeration, so the same exhaustive logic could be applied to the semantic substitution set on a small vocabulary, giving a cheap falsification test of RoMA's estimate on the exact distribution it samples from.","Editorial extension: if non-normal confidence distributions still yield accurate estimates, a targeted stress test using deliberately bimodal or heavy-tailed runner-up score distributions would map where the estimator breaks."],"forward_implications":["On the six synthetic models with exact counts, RoMA's estimates land within about 1 percentage point of exact PLR while running in 444-487 seconds versus 211-3,696 seconds for Exact Count.","RoMA processes half of the SST-2 test set in under 15 minutes and the full set in under 36 minutes, which the paper takes as evidence that the framework is fast enough for online monitoring of BERT-scale classifiers.","The best checkpoint scores 97.18% semantic robustness versus 96.60% for the final checkpoint, indicating that optimizing for classification performance may also improve resilience to semantic perturbations.","Per-class robustness varies by up to 1.5%, so a runtime monitor that reports only an aggregate score can miss class-specific weaknesses.","Orthographic robustness estimates of 94.44% and 93.94% remain within 0.17% of exhaustive ground truth even when the confidence distributions fail normality tests, suggesting the estimator is not critically dependent on its normality assumption."],"supporting_citations":[{"why":"Supplies the RoMA statistical framework being adapted: runner-up confidence distributions, Anderson-Darling validation, and Box-Cox transformation for robustness estimation.","marker":"[29]"},{"why":"Supplies the Exact Count formal verification algorithm used as ground-truth plr baseline for the sub-1% comparison.","marker":"[32]"},{"why":"Supplies the BERT architecture used for the LLM robustness case study on sentiment classification.","marker":"[9]"},{"why":"Supplies the Word2Vec embeddings whose cosine-similarity threshold defines the semantic perturbation neighborhood.","marker":"[33]"},{"why":"Supplies the SST-2 sentiment dataset on which the LLM embedding, categorial, and orthographic evaluations are run.","marker":"[46]"},{"why":"Supplies the Anderson-Darling goodness-of-fit test used to validate normality of runner-up confidence distributions.","marker":"[1]"},{"why":"Supplies the Box-Cox power transformation applied when runner-up scores fail the normality test.","marker":"[4]"}],"fun_headline_variants":["LLM robustness in minutes, not hours","Statistical check matches formal LLM verification","Black-box LLM robustness estimated in minutes","RoMA: LLM robustness within 1% in minutes"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole method assumes that a few hundred to a thousand synonym-substituted sentence variants, with the model's second-highest confidence scores treated as a normal (or normalizable) distribution, estimate the same probability of misclassification that formal verification defines over all small input changes—an equivalence the paper never checks on the language models themselves.","fun_headline_variants_meta":{"raw":{"variants":["LLM robustness in minutes, not hours","Statistical check matches formal LLM verification","Black-box LLM robustness estimated in minutes","RoMA: LLM robustness within 1% in minutes"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000609,"raw_usage":{"total_tokens":2828,"prompt_tokens":927,"completion_tokens":1901,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":543,"completion_tokens_details":{"reasoning_tokens":1843}},"tokens_in":543,"tokens_out":1901,"duration_ms":14698,"temperature":1.0,"reasoning_tokens":1843,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T10:32:19.182469+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Enumerate, for a small enough vocabulary or a tiny BERT-like model, every single-word substitution that passes the Word2Vec cosine threshold on a set of sentences, compute the exact misclassification rate over that full substitution set, run RoMA on the same sentences, and compare: if the two differ by more than the claimed 1% on a non-trivial share of inputs, the transfer claim is refuted.","supporting_citations":[{"cited_title":"In: Proc","cited_arxiv_id":null,"evidence_quote":"Supplies the RoMA statistical framework being adapted: runner-up confidence distributions, Anderson-Darling validation, and Box-Cox transformation for robustness estimation."},{"cited_title":"The #DNN-Verification Problem: Counting Unsafe Inputs for Deep Neural Networks","cited_arxiv_id":"2301.07068","evidence_quote":"Supplies the Exact Count formal verification algorithm used as ground-truth plr baseline for the sub-1% comparison."},{"cited_title":"and Ng, Andrew and Potts, Christopher: Recursive Deep Models for Semantic Compositionality Over a Sentiment Treebank","cited_arxiv_id":null,"evidence_quote":"Supplies the SST-2 sentiment dataset on which the LLM embedding, categorial, and orthographic evaluations are run."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the Anderson-Darling goodness-of-fit test used to validate normality of runner-up confidence distributions."},{"cited_title":"Journal of the American Statistical Association77(377), 209–210 (1982)","cited_arxiv_id":null,"evidence_quote":"Supplies the Box-Cox power transformation applied when runner-up scores fail the normality test."}],"review_version":1}