mlsanityData to 14 Oct 2026

Deep Text Classification Can be Fooled

arXiv 1704.08006 ↗First posted 26 Apr 2017cs.CR cs.LGcited by 106

Not on the map. Why?

Abstract (arXiv)

In this paper, we present an effective method to craft text adversarial samples, revealing one important yet underestimated fact that DNN-based text classifiers are also prone to adversarial sample attack. Specifically, confronted with different adversarial scenarios, the text items that are important for classification are identified by computing the cost gradients of the input (white-box attack) or generating a series of occluded test samples (black-box attack). Based on these items, we design three perturbation strategies, namely insertion, modification, and removal, to generate adversarial samples. The experiment results show that the adversarial samples generated by our method can successfully fool both state-of-the-art character-level and word-level DNN-based text classifiers. The adversarial samples can be perturbed to any desirable classes without compromising their utilities. At the same time, the introduced perturbation is difficult to be perceived.

Key facts. Cited by 106 papers in the map (data through 14 Oct 2026). First posted on arXiv 26 Apr 2017.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 38; 2022: 22; 2023: 23; 2024: 16; 2025: 4; 2026: 3.

106 papers.

Sort:

By area:

  1. 2023Poisoning Retrieval Corpora by Injecting Adversarial Passagescited by 159
  2. 2021BERT: A Review of Applications in Natural Language Processing and Understandingcited by 109
  3. 2023A Survey of Safety and Trustworthiness of Large Language Models through the Lens of Verification and Validationcited by 93
  4. 2021Evaluating the Robustness of Neural Language Models to Input Perturbationscited by 87
  5. 2021Towards Robustness Against Natural Language Word Substitutionscited by 69
  6. 2021Certified Robustness to Text Adversarial Attacks by Randomized [MASK]cited by 57
  7. 2021How Should Pre-Trained Language Models Be Fine-Tuned Towards Adversarial Robustness?cited by 49
  8. 2023On Robustness of Prompt-based Semantic Parsing with Large Pre-trained Language Model: An Empirical Study on Codexcited by 41
  9. 2021Defending Against Backdoor Attacks in Natural Language Generationcited by 33
  10. 2021Defending Pre-trained Language Models from Adversarial Word Substitutions Without Performance Sacrificecited by 30
  11. 2021Perturbing Inputs for Fragile Interpretations in Deep Natural Language Processingcited by 30
  12. 2021The Role of Explainability in Assuring Safety of Machine Learning in Healthcarecited by 26
38 more
  1. 2021Adversarial Attacks on Deep Models for Financial Transaction Recordscited by 24
  2. 2022Certified Robustness Against Natural Language Attacks by Causal Interventioncited by 24
  3. 2022A Survey of Adversarial Defences and Robustness in NLPcited by 23
  4. 2022Phrase-level Textual Adversarial Attack with Label Preservationcited by 23
  5. 2021Multi-granularity Textual Adversarial Attack with Behavior Cloningcited by 21
  6. 2023A Survey on Out-of-Distribution Evaluation of Neural NLP Modelscited by 20
  7. 2021Certified Robustness to Programmable Transformations in LSTMscited by 18
  8. 2021Efficient Combinatorial Optimization for Word-level Adversarial Textual Attackcited by 17
  9. 2021A Strong Baseline for Query Efficient Attacks in a Black Box Settingcited by 16
  10. 2021The King is Naked: on the Notion of Robustness for Natural Language Processingcited by 16
  11. 2022AEON: A Method for Automatic Evaluation of NLP Test Casescited by 15
  12. 2022Adversarial Robustness for Tabular Data through Cost and Utility Awarenesscited by 15
  13. 2022TASA: Deceiving Question Answering Models by Twin Answer Sentences Attackcited by 15
  14. 2024Robust Neural Information Retrieval: An Adversarial and Out-of-distribution Perspectivecited by 15
  15. 2024Trustworthy Distributed AI Systems: Robustness, Privacy, and Governancecited by 14
  16. 2021Adversarial Stylometry in the Wild: Transferable Lexical Substitution Attacks on Author Profilingcited by 13
  17. 2021Token-Modification Adversarial Attacks for Natural Language Processing: A Surveycited by 12
  18. 2022Robust Textual Embedding against Word-level Adversarial Attackscited by 12
  19. 2022Adversarial Training for Improving Model Robustness? Look at Both Prediction and Interpretationcited by 12
  20. 2022Robust Natural Language Processing: Recent Advances, Challenges, and Future Directionscited by 11
  21. 2022TAPE: Assessing Few-shot Russian Language Understandingcited by 11
  22. 2025Explainability in Practice: A Survey of Explainable NLP Across Various Domainscited by 11
  23. 2022TextHacker: Learning based Hybrid Local Search Algorithm for Text Hard-label Adversarial Attackcited by 10
  24. 2024Spiking Convolutional Neural Networks for Text Classificationcited by 10
  25. 2021A Differentiable Language Model Adversarial Attack on Text Classifierscited by 9
  26. 2022Defending Black-box Skeleton-based Human Activity Classifierscited by 9
  27. 2022Imputing Out-of-Vocabulary Embeddings with LOVE Makes Language Models Robust with Little Costcited by 9
  28. 2023Less is More: Understanding Word-level Textual Adversarial Attack via n-gram Frequency Descendcited by 9
  29. 2024A Modified Word Saliency-Based Adversarial Attack on Text Classification Modelscited by 9
  30. 2021Evaluating Document Coherence Modellingcited by 8
  31. 2021PDPGD: Primal-Dual Proximal Gradient Descent Adversarial Attackcited by 8
  32. 2021Detecting Textual Adversarial Examples through Randomized Substitution and Votecited by 8
  33. 2021Improving the robustness and accuracy of biomedical language models through adversarial trainingcited by 7
  34. 2022Testing the limits of natural language models for predicting human language judgmentscited by 7
  35. 2023Robustness Over Time: Understanding Adversarial Examples' Effectiveness on Longitudinal Versions of Large Language Modelscited by 7
  36. 2021R&R: Metric-guided Adversarial Sentence Generationcited by 6
  37. 2021We Can Always Catch You: Detecting Adversarial Patched Objects WITH or WITHOUT Signaturecited by 6
  38. 2022ROSE: Robust Selective Fine-tuning for Pre-trained Language Modelscited by 6

50 most cited of 106 All 106 (JSON)