🏆 ACL Findings 2026

Small Data, Big Noise:
Adversarial Training for Robust
Parameter-Efficient Fine-Tuning

A unified framework that brings adversarial training to PEFT - improving robustness to word-level, character-level, and domain-shift perturbations under low-resource conditions.

Eitan Cohen · Idan Simai · Uri Shaham

Bar-Ilan University · Ramat Gan, Israel

Paper (arXiv) Code (GitHub) Cite

Abstract

Parameter-Efficient Fine-Tuning (PEFT) has become essential for adapting foundation models to downstream NLP tasks. However, current PEFT methods often struggle with robustness to noise and performance degradation on limited training data. We propose SDBN (Small Data Big Noise), a unified framework that brings adversarial training to PEFT - a combination that remains less studied in the PEFT setting despite its complementary strengths - to enhance model robustness and generalization, outperforming alternative approaches. We also introduce two variants of the method that use discrete uncertainty sets: SDBN-h, which enumerates character-level edits and selects worst-case variants using gradients, and SDBN-p, which uses LLM-generated variants for robust optimization in generative tasks. Experiments across multiple benchmarks reveal substantial improvements, particularly in low-resource settings and under both word-level and character-level corruptions. This framework addresses the less explored intersection of adversarial training and parameter-efficient adaptation, without introducing additional parameters or only modest computational overhead, making PEFT deployments more reliable in real-world scenarios where data scarcity and linguistic variability often coexist.

At a Glance

3×

SDBN Variants

Benchmarks

PEFT Methods

Baselines

LLM Backbones

Method

The SDBN Framework

SDBN integrates adversarial training into the PEFT fine-tuning loop by injecting worst-case embedding-space perturbations - forcing adapter parameters to learn locally smooth representations that generalize under noise and domain shift, even when clean training data is scarce.

Freeze backbone, initialize PEFT adapter

The pretrained backbone (BERT, DeBERTa, LLaMA, Qwen) is frozen. Only the PEFT adapter parameters - LoRA, BitFit, Adapter, or QLoRA - are trainable.

↓

Compute clean embedding & gradient

For each batch, compute embeddings e = E(X), the clean loss L_clean, and its gradient g = ∇_eL_clean.

↓

Construct worst-case perturbation δ

SDBN uses FGSM: δ = ε · sign(g) (ℓ∞ ball, ε = 10⁻⁴), maximizing loss in the direction of steepest ascent. SDBN-h selects the discrete character-variant z* that maximizes ⟨g, E(z)−E(x)⟩. SDBN-p selects the LLM-generated variant with maximum explicit loss.

↓

Update adapter on adversarial loss

Trainable PEFT parameters are updated using L_adv = L(f_θ(e + δ), Y). No extra GPU memory; per-batch overhead is ~1.4× vanilla.

SDBN (ℓ∞)

Continuous embedding-space perturbation via FGSM. Best for word-level noise and domain shift. Used as default across classification tasks.

SDBN-h

Discrete character-level uncertainty set. Gradient-guided selection over single-character edits (delete, swap, double, phonetic, insert, Cyrillic, case). Addresses tokenization-breaking corruptions that fall outside ℓ∞ ball.

SDBN-p

LLM-generated adversarial variants (GPT-5.2) as a discrete uncertainty set. Selects worst-case semantic variant by explicit forward pass. Designed for generative tasks (SQuAD, TweetQA).

Setup

PEFT methods & backbones

PEFT methods evaluated

LoRA QLoRA Adapter BitFit

Backbone models

BERT-base DeBERTa-v3 LLaMA-3.2-1B LLaMA-2-7B Qwen-2.5-7B

Baselines compared

Vanilla PEFT NEFTune EDA FreeLB SMART

Benchmarks

All evaluated datasets

Seven benchmarks spanning classification, generative QA, semantic relations, and cross-domain generalization - evaluated under clean, word-level, and character-level noise conditions across 5%-100% of training data.

Banking77

Classification

Intent classification with 77 banking-domain labels. Primary benchmark for low-resource robustness experiments. DeBERTa-v3, 1,000 samples.

TREC

Classification

Question-type classification. Evaluated with BERT-base across 5%-100% training data to measure gains as data shrinks.

20NewsGroups

Classification

20-category newsgroup topic classification. Evaluated with BERT-base across variable data regimes.

IMDB

Classification

Sentiment classification. Evaluated with BERT-base across all data scales (5%-100%).

BLESS

Semantic Relations

Word-pair semantic relation classification. Key benchmark for character-level noise evaluation (SDBN-h). DeBERTa-v3 + LoRA, 1,000 samples.

SQuAD

Generative QA

Extractive QA evaluated with LLaMA-3.2-1B (EM/F1) and Qwen-2.5-7B. 200-500 training samples. Primary benchmark for SDBN-p.

TweetQA

Generative QA

Social-media QA evaluated with LLaMA-2-7B and LLaMA-3.2-1B (F1). 200 training samples. SDBN-p vs all baselines.

ArSarcasm-v2

Domain Shift

Arabic dialect sarcasm/sentiment. Trained on Egyptian Arabic (270 samples), zero-shot transfer to Levantine, Gulf, and Modern Standard Arabic. Tests cross-domain generalization.

NLI (Fiction→Telephone)

Domain Shift

Natural Language Inference cross-genre transfer. Trained on NLI Fiction (77 samples), evaluated on NLI Telephone. DeBERTa-v3-large, 20 random seeds.

Results

Selected results

SDBN consistently outperforms all baselines across settings. Key tables from the paper are reproduced below.

Table 2 - Generative tasks (SDBN-p)

Top: SQuAD Exact Match, LLaMA-3.2-1B + LoRA, 200 samples. Bottom: TweetQA F1, LLaMA-2-7B + LoRA, 200 samples.

Method	Clean	Swap-Word	Homophone
Vanilla	58.92	32.44	47.28
NEFTune	59.72	32.72	48.08
EDA	58.88	32.44	47.96
FreeLB	57.00	31.64	44.04
SMART	52.64	28.44	40.52
SDBN-p	59.84	35.08	52.20

Method	Clean	Delete-Char	Delete-Word
Vanilla	68.09	51.56	56.06
NEFTune	69.34	55.13	54.30
EDA	70.02	53.14	55.04
FreeLB	76.57	60.59	60.79
SMART	66.71	49.54	51.13
SDBN-p	80.81	65.55	64.15

Table 1 - BLESS: character-level noise (SDBN-h)

DeBERTa-v3 + LoRA, 1,000 clean samples. SDBN-h yields best robustness on tokenization-breaking types (+4-7%).

Method	Clean	Delete-Char	Swap-Char	Double-Char
Vanilla	89.81±0.29	60.67±2.19	56.82±2.38	68.51±2.75
SDBN	89.83±0.24	60.84±1.85	57.22±2.84	68.66±2.27
NEFTune	89.08±0.54	61.19±0.89	57.22±0.82	69.42±1.29
SDBN-h	89.61±0.30	65.14±1.19	62.80±1.47	72.54±1.05

Table 3 - SDBN gains: PEFT vs. full fine-tuning (Banking77, DeBERTa-v3)

Absolute accuracy gain (pp) from adding SDBN. Low-resource subset. Adversarial training is dramatically more effective within PEFT's constrained parameter space.

Method	Clean	Replace	Delete	Swap	Avg gain
LoRA	+23.6	+18.8	+18.7	+17.1	+19.6
BitFit	+16.0	+11.2	+12.8	+11.3	+12.8
Adapter	+13.3	+9.4	+9.8	+6.2	+9.7
Full FT	+1.3	+0.9	+0.5	+0.8	+0.9

Table 7 - Clean-data accuracy across datasets (BERT-base, 10% training data)

Excerpt at the most challenging (10%) data regime. SDBN improves every PEFT method on every dataset.

Method	Banking77	TREC	20News	IMDB
Adapter	78.26	74.40	63.16	84.78
SDBN-Adapter	80.48	76.76	63.47	85.39
BitFit	67.45	65.68	56.78	84.01
SDBN-BitFit	70.08	69.24	58.92	84.56
LoRA	66.42	72.20	60.13	85.46
SDBN-LoRA	72.86	74.72	61.56	86.00

Domain shift - ArSarcasm-v2 & NLI cross-genre

Cross-domain generalization without any target-domain training data.

Setting	Vanilla	NEFTune	SDBN
ArSarcasm - Egyptian (source)	55.2	56.3	59.6
ArSarcasm - Levantine (target)	44.6	44.9	57.1
ArSarcasm - Gulf (target)	44.6	44.9	47.2
ArSarcasm - Modern Standard (target)	54.1	54.4	57.8
NLI - Fiction (source)	51.8	55.0	58.9
NLI - Telephone (target)	48.7	54.6	51.0

Evaluation Protocol

Noise types evaluated

Models are tested under 9 distinct perturbation types at inference time, spanning word-level semantic noise, character-level tokenization-breaking edits, and adversarial character substitutions.

Replace Word Delete Word Swap Words Homophone Slang Pronoun Replace Delete Char Swap Chars Double Char Keyboard Char Phonetic Replace Insert Char Cyrillic Substitution Case Change

Evaluated at both constant intensity (exactly one operation per sentence) and variable intensity (1-5 operations per sentence) to test robustness under escalating corruption.

Citation

BibTeX

If you find this work useful, please cite:

@inproceedings{cohen2026sdbn,
  title = {Small Data, Big Noise: Adversarial Training for Robust Parameter-Efficient Fine-Tuning},
  author = {Cohen, Eitan and Simai, Idan and Shaham, Uri},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  url = {https://arxiv.org/abs/2606.10610}
}

Resources

Paper & Code

Read on arXiv View Code on GitHub