# HotFlip: White-Box Adversarial Examples for Text Classification

arXiv: https://arxiv.org/abs/1712.06751 · HTML: https://mlsanity.com/paper/1712.06751/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 19 Dec 2017.

## Built on by (most cited first, 13 of 13)

- [LLMs-as-Judges: A Comprehensive Survey on LLM-based Evaluation Methods](https://mlsanity.com/paper/2412.05579/) (2024)
- [Cats Confuse Reasoning LLM: Query Agnostic Adversarial Triggers for Reasoning Models](https://mlsanity.com/paper/2503.01781/) (2025)
- [On Robustness of Neural Semantic Parsers](https://mlsanity.com/paper/2102.01563/) (2021)
- [Why do universal adversarial attacks work on large language models?: Geometry might be the answer](https://mlsanity.com/paper/2309.00254/) (2023)
- [Interpretation of Black Box NLP Models: A Survey](https://mlsanity.com/paper/2203.17081/) (2022)
- [Sample Attackability in Natural Language Adversarial Attacks](https://mlsanity.com/paper/2306.12043/) (2023)
- [Layered LLM Defenses as an Ensemble: Access Tiers, Inference Cost, and the Measured Failure Correlation Between Defense Layers](https://mlsanity.com/paper/2608.28327/) (2026)
- [TestifAI: Tomography-Based Testing for Deep Learning Systems](https://mlsanity.com/paper/2608.18900/) (2026)
- [Adversarially Robust and Explainable Model Compression with On-Device Personalization for Text Classification](https://mlsanity.com/paper/2101.05624/) (2021)
- [Probabilistic Categorical Adversarial Attack & Adversarial Training](https://mlsanity.com/paper/2210.09364/) (2022)
- [Adversarial Attacks and Defense for Conversation Entailment Task](https://mlsanity.com/paper/2405.00289/) (2024)
- [SurvAttack: Black-Box Attack On Survival Models through Ontology-Informed EHR Perturbation](https://mlsanity.com/paper/2412.18706/) (2024)
- [Automated Feature Labeling with Token-Space Gradient Descent](https://mlsanity.com/paper/2504.00754/) (2025)

## Abstract (arXiv)

We propose an efficient method to generate white-box adversarial examples to trick a character-level neural classifier. We find that only a few manipulations are needed to greatly decrease the accuracy. Our method relies on an atomic flip operation, which swaps one token for another, based on the gradients of the one-hot input vectors. Due to efficiency of our method, we can perform adversarial training which makes the model more robust to attacks at test time. With the use of a few semantics-preserving constraints, we demonstrate that HotFlip can be adapted to attack a word-level classifier as well.