Don’t Search for a Search Method — Simple Heuristics Suffice for Adversarial Text Attacks (2021.emnlp-main)
Copied to clipboard
| Challenge: | Recent research has focused on adversarial text attacks on neural networks for natural language processing. |
| Approach: | They implement an algorithm inspired by zeroth order optimization-based attacks and compare it with benchmark results in TextAttack. |
| Outcome: | The proposed algorithm outperforms other black-box adversarial text attacks. |
Similar Papers
Tougher Text, Smarter Models: Raising the Bar for Adversarial Defence Benchmarks (2025.coling-main)
Copied to clipboard
| Challenge: | Recent advances in natural language processing have highlighted the vulnerability of deep learning models to adversarial attacks. |
| Approach: | They propose a benchmark for textual adversarial defence that evaluates state-of-the-art defence mechanisms across diverse datasets, models, and tasks. |
| Outcome: | The proposed benchmark incorporates a wide range of datasets and evaluates state-of-the-art defence mechanisms. |
Searching for an Effective Defender: Benchmarking Defense against Adversarial Word Substitution (2021.emnlp-main)
Copied to clipboard
Zongyi Li, Jianhan Xu, Jiehang Zeng, Linyang Li, Xiaoqing Zheng, Qi Zhang, Kai-Wei Chang, Cho-Jui Hsieh
| Challenge: | Existing methods to defend against adversarial word-substitution attacks have not been evaluated or compared in a systematic manner. |
| Approach: | They propose to compare different defense methods under representative adversarial attacks . they propose a method that improves the robustness of neural text classifiers against such attacks a . |
| Outcome: | The proposed method improves robustness of neural text classifiers against such attacks by a significant margin. |
Rethinking Word-level Adversarial Attack: The Trade-off between Efficiency, Effectiveness, and Imperceptibility (2024.lrec-main)
Copied to clipboard
| Challenge: | Neural language models have demonstrated impressive performance but remain vulnerable to word-level adversarial attacks. |
| Approach: | They propose two standardized search spaces to address the problem of word-level adversarial attacks. |
| Outcome: | The proposed search spaces improve performance and trade-offs in different scenarios. |
TextAttack: A Framework for Adversarial Attacks, Data Augmentation, and Adversarial Training in NLP (2020.emnlp-demos)
Copied to clipboard
| Challenge: | TextAttack provides implementations of 16 adversarial attacks from the literature and supports a variety of models and datasets. |
| Approach: | They introduce a Python framework for adversarial attacks, data augmentation, and adversarially training in NLP. |
| Outcome: | This paper introduces a Python framework for adversarial attacks, data augmentation, and adversarially training in NLP. |
Adversarial NLI: A New Benchmark for Natural Language Understanding (2020.acl-main)
Copied to clipboard
| Challenge: | a new large-scale NLI benchmark dataset is presented to test models on a variety of popular NLIs. |
| Approach: | They propose a large-scale NLI benchmark dataset that is iteratively compared with a human-and-model-in-the-loop procedure. |
| Outcome: | The proposed method can be applied in a never-ending learning scenario, becoming a moving target for NLU, rather than a static benchmark that will quickly saturate. |
Query-Efficient Textual Adversarial Example Generation for Black-Box Attacks (2024.naacl-long)
Copied to clipboard
| Challenge: | Existing black-box attacks require thousands of queries on the target model, making them expensive in real-world applications. |
| Approach: | They propose a new approach that guides word substitutions using prior knowledge from the training set to improve the attack efficiency. |
| Outcome: | The proposed approach reduces query-free attack and guided search attacks by a factor of 10 500 . it improves transferability and generalization by the ensemble of the ABPens in NLP . |
A Strong Baseline for Query Efficient Attacks in a Black Box Setting (2021.emnlp-main)
Copied to clipboard
| Challenge: | Existing black box search methods are inefficient as they do not consider the amount of queries required to generate adversarial attacks. |
| Approach: | They propose a query efficient attack strategy to generate plausible adversarial examples on text classification and entailment tasks. |
| Outcome: | The proposed attack reduces query count by 75% across all datasets and target models compared to prior attacks in a limited query setting. |
Word-level Textual Adversarial Attacking as Combinatorial Optimization (2020.acl-main)
Copied to clipboard
| Challenge: | Existing word-level attack models are far from perfect because of unsuitable search space reduction methods and inefficient optimization algorithms. |
| Approach: | They propose a novel adversarial adversarialist model that incorporates word substitution and particle swarm optimization to solve two problems separately. |
| Outcome: | The proposed model achieves much higher success rates and crafts more high-quality adversarial examples as compared to baseline methods. |
How do humans perceive adversarial text? A reality check on the validity and naturalness of word-based adversarial attacks (2023.acl-long)
Copied to clipboard
| Challenge: | Existing text adversarial attacks are impractical in real-world scenarios where humans are involved. |
| Approach: | They have surveyed 378 human participants about the perceptibility of text adversarial examples produced by state-of-the-art methods. |
| Outcome: | The proposed methods ignore the property of imperceptibility or study it under limited conditions. |
Universal Adversarial Attacks with Natural Triggers for Text Classification (2021.naacl-main)
Copied to clipboard
| Challenge: | Recent work has demonstrated the vulnerability of modern text classifiers to universal adversarial attacks, which are input-agnostic sequences of words added to text processed by classifier. |
| Approach: | They propose a gradient-based search that aims to maximize the downstream classifier’s prediction loss by using an adversarially regularized autoencoder to generate triggers and propose heuristics to spot such attacks. |
| Outcome: | The proposed algorithms reduce model accuracy while being less identifiable than prior models as per automatic detection metrics and human-subject studies. |