| Challenge: | Existing techniques for generating adversarial examples are driven by local heuristic rules that are agnostic to the context, resulting in unnatural and ungrammatical outputs. |
| Approach: | They propose a ContextuaLized AdversaRial Example generation model that generates fluent and grammatical outputs through a mask-then-infill procedure. |
| Outcome: | The proposed model outperforms baseline models in terms of attack success rate, textual similarity, fluency and grammaticality. |
Similar Papers
BAE: BERT-based Adversarial Examples for Text Classification (2020.emnlp-main)
Copied to clipboard
| Challenge: | Recent studies have exposed the vulnerability of text classification models to adversarial examples . perturbed versions of the original text are indiscernible by humans and misclassified by the model . |
| Approach: | They propose a black box attack for generating adversarial examples using contextual perturbations from a BERT-masked language model. |
| Outcome: | The proposed attack produces examples with improved grammaticality and semantic coherence compared to previous work. |
Attacking Misinformation Detection Using Adversarial Examples Generated by Language Models (2025.emnlp-main)
Copied to clipboard
| Challenge: | Large language models can be used to attack content filtering algorithms in social media platforms. |
| Approach: | They propose to generate adversarial examples to test the robustness of social media content filtering algorithms. |
| Outcome: | The proposed model outperforms existing models in the case of propaganda, false claims, rumours and hyperpartisan news. |
Reevaluating Adversarial Examples in Natural Language (2020.findings-emnlp)
Copied to clipboard
| Challenge: | State-of-the-art adversarial examples lack a common definition of what constitutes success . human surveys show that to preserve semantics, we need to increase the minimum cosine similarities between the embeddings of swapped words and between the sentence encodings of original and perturbed sentences. |
| Approach: | They propose a unified definition of what constitutes a successful adversarial example . they propose four categories of constraints that are used to define adversarials . |
| Outcome: | The proposed framework is based on the outputs of two state-of-the-art synonym substitution attacks. |
Towards Robustness of Text-to-SQL Models Against Natural and Realistic Adversarial Table Perturbation (2022.acl-long)
Copied to clipboard
| Challenge: | Existing Text-to-SQL parsers are vulnerable to perturbations in NL questions . we propose the Adversarial Table Perturbation (ATP) as a new attacking paradigm . |
| Approach: | They propose to use the Adversarial Table Perturbation to measure robustness of Text-to-SQL parsers against adversarial perturbations. |
| Outcome: | The proposed approach outperforms baseline methods in robustness evaluations on ADVETA and can be used in future projects. |
Phrase-level Textual Adversarial Attack with Label Preservation (2022.findings-naacl)
Copied to clipboard
| Challenge: | Existing adversarial attacks are usually realized through word-level or sentence-level perturbations, which either limit the perturbation space or sacrifice fluency and textual quality. |
| Approach: | They propose a phrase-level perturbation-based adversarial ATtack that generates adversarials through phrase- level perturbations. |
| Outcome: | The proposed approach improves the performance of natural language processing models by reducing the need for word-level perturbations and preserving the fluency and grammaticality of the samples. |
Perturbations in the Wild: Leveraging Human-Written Text Perturbations for Realistic Adversarial Attack and Defense (2022.findings-acl)
Copied to clipboard
| Challenge: | ANTHRO extracts over 600K human-written text perturbations and leverages them for realistic adversarial attacks. |
| Approach: | They propose an adversarial text manipulation algorithm that inductively extracts over 600K human-written text perturbations and leverages them for realistic adversarials. |
| Outcome: | The proposed algorithm outperforms the TextBugger baseline with an increase of 50% and 40% in terms of semantic preservation and stealthiness when evaluated by layperson and professional human workers. |
Universal Adversarial Attacks with Natural Triggers for Text Classification (2021.naacl-main)
Copied to clipboard
| Challenge: | Recent work has demonstrated the vulnerability of modern text classifiers to universal adversarial attacks, which are input-agnostic sequences of words added to text processed by classifier. |
| Approach: | They propose a gradient-based search that aims to maximize the downstream classifier’s prediction loss by using an adversarially regularized autoencoder to generate triggers and propose heuristics to spot such attacks. |
| Outcome: | The proposed algorithms reduce model accuracy while being less identifiable than prior models as per automatic detection metrics and human-subject studies. |
SemAttack: Natural Textual Attacks via Different Semantic Spaces (2022.findings-naacl)
Copied to clipboard
| Challenge: | Existing approaches to attack pre-trained language models suffer from low success rates or fail to search efficiently in the exponentially large perturbation space. |
| Approach: | They propose an efficient framework to generate natural adversarial text by constructing different semantic perturbation functions. |
| Outcome: | The proposed framework generates natural adversarial texts for different languages with high success rates. |
Generating Textual Adversaries with Minimal Perturbation (2022.findings-emnlp)
Copied to clipboard
| Challenge: | Existing word-level adversarial approaches for textual data have various limitations due to the large search space consisting of combinations of candidate words. |
| Approach: | They propose a novel attack strategy to find adversarial texts with high similarity to original texts without perturbation. |
| Outcome: | The proposed approach achieves higher success rates and lower perturbation rates in four benchmark datasets compared with state-of-the-art approaches. |
Close or Cloze? Assessing the Robustness of Large Language Models to Adversarial Perturbations via Word Recovery (2025.coling-main)
Copied to clipboard
| Challenge: | Existing models implicitly recover the original text, but it is unclear when they rely on context and when they implicitly do so. |
| Approach: | They propose to use a dictionary to recover adversarial words by using a phonetic, typo, and visual attack to study word recovery performance. |
| Outcome: | The proposed model outperforms open-source models on hateful, offensive, and toxic classification tasks. |