| Challenge: | Text-based adversarial attacks are becoming more commonplace and accessible to general internet users. |
| Approach: | They propose a method that restores baseline performance on attacked content with low computational overhead. |
| Outcome: | The proposed method restores baseline performance on attacked content with low computational overhead. |
Similar Papers
Tougher Text, Smarter Models: Raising the Bar for Adversarial Defence Benchmarks (2025.coling-main)
Copied to clipboard
| Challenge: | Recent advances in natural language processing have highlighted the vulnerability of deep learning models to adversarial attacks. |
| Approach: | They propose a benchmark for textual adversarial defence that evaluates state-of-the-art defence mechanisms across diverse datasets, models, and tasks. |
| Outcome: | The proposed benchmark incorporates a wide range of datasets and evaluates state-of-the-art defence mechanisms. |
Don’t Retrain, Just Rewrite: Countering Adversarial Perturbations by Rewriting Text (2023.acl-long)
Copied to clipboard
| Challenge: | ATINTER model can be used to rewrite adversarial inputs to make them non-adversarial . if undefended, model should maintain good task performance and effectively mitigate adversarials . |
| Approach: | They propose a model that intercepts adversarial inputs and learns to rewrite them . they show that it provides better adversarial robustness than existing defense approaches . |
| Outcome: | The proposed model improves adversarial robustness without compromising task accuracy on a sentiment classification dataset. |
Searching for an Effective Defender: Benchmarking Defense against Adversarial Word Substitution (2021.emnlp-main)
Copied to clipboard
Zongyi Li, Jianhan Xu, Jiehang Zeng, Linyang Li, Xiaoqing Zheng, Qi Zhang, Kai-Wei Chang, Cho-Jui Hsieh
| Challenge: | Existing methods to defend against adversarial word-substitution attacks have not been evaluated or compared in a systematic manner. |
| Approach: | They propose to compare different defense methods under representative adversarial attacks . they propose a method that improves the robustness of neural text classifiers against such attacks a . |
| Outcome: | The proposed method improves robustness of neural text classifiers against such attacks by a significant margin. |
Towards Adversarially Robust Text Classifiers by Learning to Reweight Clean Examples (2022.findings-acl)
Copied to clipboard
| Challenge: | Existing defense methods improve the adversarial robustness by making models adapt to training set augmented with some adversarials. |
| Approach: | They propose to introduce a reweighting mechanism to calibrate the training distribution to obtain robust models. |
| Outcome: | The proposed method minimizes the loss of validation set mixed with clean examples and adversarial ones in an online learning manner. |
Synonym-unaware Fast Adversarial Training against Textual Adversarial Attacks (2025.findings-naacl)
Copied to clipboard
| Challenge: | Existing adversarial defense methods rely on predetermined linguistic knowledge and assume that attackers’ synonym candidates are known, which is often unrealistic. |
| Approach: | They propose a Fast Adversarial Training method that leverages single-step perturbation generation and effective perturbation initialization to improve model robustness without requiring synonym awareness. |
| Outcome: | Experiments show that the proposed method outperforms existing models under character-level and word-level attacks while still maintaining the correct syntax. |
Text Processing Like Humans Do: Visually Attacking and Shielding NLP Systems (N19-1)
Copied to clipboard
Steffen Eger, Gözde Gül Şahin, Andreas Rücklé, Ji-Ung Lee, Claudia Schulz, Mohsen Mesgar, Krishnkant Swarnkar, Edwin Simpson, Iryna Gurevych
| Challenge: | Recent studies show that visual similarity can play a decisive role in assessing the meaning of characters. |
| Approach: | They investigate the impact of visual adversarial attacks on current NLP systems . they explore three shielding methods that significantly improve the robustness of the models . |
| Outcome: | The proposed methods improve performance but still fall behind non-attack scenarios. |
Generating Textual Adversaries with Minimal Perturbation (2022.findings-emnlp)
Copied to clipboard
| Challenge: | Existing word-level adversarial approaches for textual data have various limitations due to the large search space consisting of combinations of candidate words. |
| Approach: | They propose a novel attack strategy to find adversarial texts with high similarity to original texts without perturbation. |
| Outcome: | The proposed approach achieves higher success rates and lower perturbation rates in four benchmark datasets compared with state-of-the-art approaches. |
Detection of Adversarial Examples in Text Classification: Benchmark and Baseline via Robust Density Estimation (2022.findings-acl)
Copied to clipboard
| Challenge: | Word-level adversarial attacks have shown success in NLP, decreasing performance of transformer-based models with smaller perturbation rate. |
| Approach: | They propose a dataset for four popular attack methods on four datasets and four models to encourage further research in this field. |
| Outcome: | The proposed baseline has the highest auc on 29 out of 30 dataset-attack-model combinations. |
From Hero to Zéroe: A Benchmark of Low-Level Adversarial Attacks (2020.aacl-main)
Copied to clipboard
| Challenge: | Adversarial attacks are label-preserving modifications to inputs of machine learning classifiers designed to fool machines but not humans. |
| Approach: | They propose to use a dataset to test the robustness of future NLP models to identify low-level adversarial attacks that are less realistic in typical applications such as social media. |
| Outcome: | The proposed dataset provides a benchmark for testing robustness of future more human-like NLP models. |
Universal Adversarial Attacks with Natural Triggers for Text Classification (2021.naacl-main)
Copied to clipboard
| Challenge: | Recent work has demonstrated the vulnerability of modern text classifiers to universal adversarial attacks, which are input-agnostic sequences of words added to text processed by classifier. |
| Approach: | They propose a gradient-based search that aims to maximize the downstream classifier’s prediction loss by using an adversarially regularized autoencoder to generate triggers and propose heuristics to spot such attacks. |
| Outcome: | The proposed algorithms reduce model accuracy while being less identifiable than prior models as per automatic detection metrics and human-subject studies. |