Cited by 11Topic ModelingNatural Language Processing TechniquesDomain Adaptation and Few-Shot Learning

Exploring the Robustness of In-Context Learning with Noisy Labels

Open access
Cheng, Chen, Yu, Xinzhi, Wen, Haodong, Sun, Jingsong, Yue, Guanzhang, Zhang, Yihao, Wei, Zeming·2025·ICASSP 2025 - 2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

Abstract

Recently, the mysterious In-Context Learning (ICL) ability exhibited by Transformer architectures, especially in large language models (LLMs), has sparked significant research interest. However, the resilience of Transformers’ in-context learning capabilities in the presence of noisy samples, prevalent in both training corpora and prompt demonstrations, remains underexplored. In this paper, inspired by prior research that studies ICL ability using simple function classes, we take a closer look at this problem by investigating the robustness of Transformers against noisy labels. Specifically, we first conduct a thorough evaluation and analysis of the robustness of Transformers against noisy labels during in-context learning and show that they exhibit notable resilience against diverse types of noise in demonstration labels. Furthermore, we delve deeper into this problem by exploring whether introducing noise into the training set, akin to a form of data augmentation, enhances such robustness during inference, and find that such noise can indeed improve the robustness of ICL. Overall, our fruitful analysis and findings provide a comprehensive understanding of the resilience of Transformer models against label noises during ICL and provide valuable insights into the research on Transformers in natural language processing. Our code is available at https://github.com/InezYu0928/in-context-learning.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1109/icassp49660.2025.10889281

Cites

61 of 61 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • ICA is stealthy: its prompt is in natural language form and cannot be easily detected.

    “Stealthy.While adversarial suffix attacks [61,60] may be easily detected with a simple perplexity filter [1,16], the prompt of ICA is thoroughly in a natural language form and cannot be easily detected.”

    From Jailbreak and Guard Aligned Language Models With Only Few In-Context Demonstrations (2026) · cites this paper as [61]

    The Introduction discusses safety concerns about manipulated in-context demonstrations, while Section 3 evaluates robustness to noisy labels in a linear-regression task. Neither passage addresses an ICA prompt's natural-language form or whether it is difficult to detect; searches for those claims and for perplexity-filter detection found no supporting passage. Page numbers were unavailable in our copy. (LLM, conf=0.76)

    Experimental — accuracy not yet measured
  • ICA achieved 81% Attack Success Rate (ASR) on GPT-4 evaluated by the AdvBench dataset.

    “ICA achieved 81% Attack Success Rate (ASR) on GPT-4 [33] evaluated by the AdvBench dataset [61]”

    From Jailbreak and Guard Aligned Language Models With Only Few In-Context Demonstrations (2026) · cites this paper as [61]

    Section 3 describes noisy-label experiments using GPT-2 models, not an ICA attack on GPT-4. Searches for ICA, an 81% attack success rate, and AdvBench found no passage in our copy reporting the claimed result. The indexed passages provide section labels but no page numbers. (LLM, conf=0.75)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 4

  1. Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In ICML, 2018.
  2. Zeming Wei, Jingyu Zhu, and Yihao Zhang. Sharpness-aware minimization alone can improve adversarial robustness. In ICML Workshop on New Frontiers in Adversarial Machine Learning, 2023d.
  3. Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML, 2019.
  4. Yihao Zhang, Zeming Wei, Jun Sun, and Meng Sun. Towards general conceptual model editing via adversarial representation engineering. arXiv preprint, 2024b.

Cited by

Sorted by citations

Authors
Cheng, C., Yu, X., Wen, H., Sun, J., Yue, G., Zhang, Y., & Wei, Z.
Affiliations
  • ShanghaiTech University
  • Fudan University (CN)
  • Xi'an Jiaotong University (CN)
  • Peking University (CN)
Venue
ICASSP 2025 - 2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)
Publisher
IEEE
Published
2025-04-06
Pages
1-5
ISSN
1520-6149 (ISSN-L)
OpenAlex
W4408355401
Cited by
11
References
42
Citations by year
2026: 5 · 2025: 4 · 2024: 2
FWCI
8.58
Type
conference paper
Language
en
Open access
Locations
  • IEEE International Conference on Acoustics Speech and Signal Processing (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Funders
National Natural Science Foundation of China
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Topic Modeling
  • Physical Sciences › Computer Science › Artificial Intelligence › Natural Language Processing Techniques
  • Physical Sciences › Computer Science › Artificial Intelligence › Domain Adaptation and Few-Shot Learning
Keywords
in-context learning, label noise, label noise robustness, transformer models, large language models, data augmentation, inference robustness

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review