UNMASK: Discovering and Causally Verifying Spurious Shortcuts in Text Classifiers

The paper introduces UNMASK, a fully automated pipeline that discovers, causally verifies, and mitigates spurious correlations in text classifiers without additional human annotation. The pipeline addresses the fundamental question: how can we identify which surface features are spurious without knowing them in advance, and once identified, how can we verify that a trained model actually exploits them?

The authors note that "Neural language models trained on large crowdsourced corpora frequently exploit spurious surface patterns tied to target labels without true linguistic or causal relevance, boosting benchmark performance while failing on adversarial or out-of-distribution inputs. Existing approaches either require manual specification of the feature vocabulary or automate discovery only partially, leaving the gap between dataset-level correlation and model-level exploitation unaddressed."

An LLM proposes candidate surface patterns as deterministic boolean functions over the input text. The SCGenLLM (GPT-4o) generates candidates that include: "(i) a natural-language pattern description, (ii) a category tag (lexical, structural, or relational), (iii) a brief justification, and (iv) an executable boolean expression b(x) that deterministically evaluates to TRUE/FALSE on any input x. The boolean expression is the key design choice here, enabling fully deterministic evaluation in all downstream stages."

Candidates undergo a two-phase replication protocol with:

• Initial deduplication by description

• Boolean logic validation and repair via an Evaluator LLM (Qwen3-32B)

• Coverage-based deduplication using Jaccard similarity

• Spurious Feature Validation (SFV) with Fisher's exact test under Benjamini–Hochberg control on label-stratified discovery and validation splits

The pipeline first screens features via Spurious Reliance Screening comparing prediction rates on counter-evidence groups. Then, a Generator LLM produces a minimal edit xcfj such that bi(xj) = 0 while the semantic relationship of the NLI pair is preserved. Causal classification requires three conditions: "(i) Δp̄ < −ε (removing the feature decreases fθ's predicted probability for yk) (ii) the effect is statistically significant at level αcausal and (iii) the direction is correct."

The same boolean expressions that drive causal verification serve a final role in programmatically constructing balanced groups for debiasing, without any human annotation. This enables annotation-free Deep Feature Reweighting, eliminating the group labels that standard DFR requires.

The SFV stage selects 10 features from MNLI including three lexical-overlap variants for entailment, negation-in-hypothesis and contradictory absolutes for contradiction, and a hypothesis-length pattern for neutral. The pipeline recovers the established lexical-overlap and negation biases.

Causal verification confirms 9 of the 10 on BERT and 6 on RoBERTa, consistent across all 3 seeds. The paper reveals a cross-architecture divergence invisible to correlation-only analysis, in which RoBERTa is immune to contradiction-class features that BERT exploits. Specifically, RoBERTa is immune to three contradiction-class features that BERT reliably exploits, with effect sizes below ε=0.03 and 95% confidence intervals crossing zero on all three seeds.

On BERT, PoE-IPW-Group gives the strongest HANS improvement (64.99±4.44, +12.58 pp over ERM), with PoE close behind, both preserving MNLI-m within 1.2 pp of ERM. On RoBERTa, ERM already reaches 74.48±1.44 on HANS, leaving less headroom, though PoE-IPW-Group still gains +4.08 pp.

"DFR wins on CivilComments for both architectures: BERT reaches 71.84±1.94 WGA with Tier A and RoBERTa 72.12±0.26 with Tier C, matching Kirichenko et al. (2023)'s 70.1% for hand-labeled DFR and showing that programmatic groups substitute for manual annotation."

On SST-2 and IMDB with BERT-base-uncased (seed 42), SFV identifies ten high-confidence lexical features per corpus by conventional criteria... verification returns 0 of 5 and 0 of 8 exploited respectively. The paper states: We expect this outcome. Sentiment words are the surface realization of the gold label, so they correlate with the class because they are what the task measures.

The pipeline recovers known reward-model biases without being told to look for them. For example, Safety recovers a refusal-language hierarchy peaking at OR = 161 (precision = 1.00) for apologetic refusals and Ties, despite its label-neutral construction, remains length-sensitive (OR = 2.0).

1. Statistical correlation ≠ model exploitation: "One feature (always/every in premise & never/no in hypothesis, OR = 10.01) fails on both architectures, so a high dataset-level odds ratio does not guarantee model-level exploitation."

2. Method ranking reversal: No single method dominates both tasks. PoE-IPW-Group leads on NLI HANS yet trails DFR on CivilComments WGA, and DFR wins on CivilComments yet is no better than ERM on NLI.

3. Discovery baseline comparison: UNMASK exceeds the strongest baseline (PMI+SFV) by 3.65 pp WGA with non-overlapping mean ± std intervals on CivilComments, isolating the value of compositional LLM-generated candidates over single-token statistics.

4. Causal verification as a gate: On sentiment it correctly returns zero exploited features, and debiasing on those non-causal features does not help, confirming its role as a decision gate rather than a refinement.

The paper acknowledges: "Requiring every feature to be an executable boolean expression bounds what UNMASK can discover. Latent and semantic shortcuts, topic and style bias, and distributional artifacts such as class imbalance cannot be written as a deterministic predicate over the input. Additionally, the causal stage is bounded by its generator, since a counterfactual edit removes the target pattern but cannot hold every other property of the input fixed."

Improvement 1: Annotation-Free Spurious Correlation Auditing

• What: Integrate UNMASK's pipeline (LLM candidate generation → statistical validation → causal verification) as a built-in audit module for any text classifier before deployment.

• What the improved AI system can do: Automatically generate a report of spurious features (e.g., negation-in-hypothesis or lexical overlap) that the model actually exploits, with causal effect sizes and confidence intervals—without requiring any human-labeled feature lists or group annotations. This enables continuous monitoring of model behavior on new corpora, flagging when a model shifts from relying on task-relevant semantics to surface patterns.

Improvement 2: Cross-Architecture Robustness Profiling

• What: Use the causal verification stage to compare feature exploitation across different model architectures (e.g., BERT vs. RoBERTa) on the same dataset.

• What the improved AI system can do: Automatically identify which architectures are vulnerable to which specific spurious patterns (e.g., RoBERTa's immunity to contradiction-class features that BERT exploits). This allows model selection and ensemble design that maximizes robustness by combining architectures with complementary spurious-feature immunities, rather than relying solely on aggregate accuracy metrics.

Improvement 3: Programmatic Group Construction for Debiasing

• What: Replace human-annotated group labels (e.g., in Deep Feature Reweighting) with the boolean expressions discovered by UNMASK, enabling automatic construction of balanced training groups.

• What the improved AI system can do: Train debiased classifiers on any new dataset without manual annotation effort. The system can automatically generate counterfactual examples (removing spurious features while preserving semantics) and construct balanced minibatches, achieving performance comparable to hand-labeled DFR (e.g., 71.84 WGA on CivilComments) while scaling to new domains and tasks with zero human labeling cost.

Improvement 4: Causal Verification as a Decision Gate for Feature-Based Interventions

• What: Use the causal verification stage (requiring Δp̄ < −ε, statistical significance, and correct direction) as a hard gate before applying any debiasing or feature-removal intervention.

• What the improved AI system can do: Avoid harmful or useless interventions. For example, on sentiment tasks, the system correctly identifies that sentiment words are not spurious (they are the gold-label surface realization) and therefore refuses to debias them, preventing performance degradation. This makes the system safer for deployment where naive feature removal could destroy task-relevant information.

Improvement 5: Compositional Candidate Generation for Hidden Shortcut Discovery

• What: Use LLM-generated boolean expressions (lexical, structural, relational) instead of single-token statistics (e.g., PMI) for spurious feature discovery.

• What the improved AI system can do: Discover complex, multi-token, or relational shortcuts that single-token methods miss—e.g., "always/every in premise & never/no in hypothesis" for NLI. This yields a 3.65 pp WGA improvement over PMI-based baselines on CivilComments, enabling the system to find and mitigate more subtle and realistic spurious correlations in production text classifiers.

Improvement 6: Automated Reward-Model Bias Detection

• What: Apply UNMASK's pipeline to reward models (as demonstrated on RewardBench2) to discover hidden biases like refusal-language hierarchies or length sensitivity.

• What the improved AI system can do: Automatically audit RLHF reward models before deployment, detecting if they over-reward apologetic refusals (OR=161) or are length-sensitive (OR=2.0) even when labels are neutral. This allows pre-deployment correction of reward models, preventing biased alignment in downstream chatbots or agents, and enabling safer human-AI interaction.

Neural language models trained on large crowdsourced corpora frequently exploit spurious surface patterns tied to target labels without true linguistic or causal relevance, boosting benchmark performance while failing on adversarial or out-of-distribution inputs. Existing approaches either require manual specification of the feature vocabulary or automate discovery only partially, leaving the gap between dataset-level correlation and model-level exploitation unaddressed. We present U N M ASK, a fully automated pipeline that discovers, causally verifies, and mitigates spurious correlations in text classifiers without additional human annotation. Given unlabeled training examples, U N M ASK generates candidate surface patterns as executable boolean expressions, filters them through a statistical validation protocol with independent replication, and establishes causal model dependence via verified counterfactual interventions. Causally confirmed features then serve as annotation-free group definitions for Deep Feature Reweighting, eliminating the group labels that standard DFR requires. Applied to BERT and RoBERTa trained on MNLI, our pipeline independently rediscovers established lexical-overlap and negation biases, verifying 9 of 10 features on BERT and 6 on RoBERTa, and improving HANS accuracy by up to 12.58 pp. On CivilComments-WILDS, programmatic groups match the 70.1% worst- group accuracy of hand-labeled DFR (Kirichenko et al., 2023) without demographic annotation. We further demonstrate that the discovery and validation stages generalize to reward model preference data, surfacing interpretable spurious correlations in RewardBench2.