mlsanityData to 7 Oct 2026

Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifiers

arXiv 1801.04354 ↗First posted 13 Jan 2018cs.CL cs.CR cs.IRcited by 341

Not on the map. Why?

Cited by 24 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Although various techniques have been proposed to generate adversarial samples for white-box attacks on text, little attention has been paid to black-box attacks, which are more realistic scenarios. In this paper, we present a novel algorithm, DeepWordBug, to effectively generate small text perturbations in a black-box setting that forces a deep-learning classifier to misclassify a text input. We employ novel scoring strategies to identify the critical tokens that, if modified, cause the classifier to make an incorrect prediction. Simple character-level transformations are applied to the highest-ranked tokens in order to minimize the edit distance of the perturbation, yet change the original classification. We evaluated DeepWordBug on eight real-world text datasets, including text classification, sentiment analysis, and spam detection. We compare the result of DeepWordBug with two baselines: Random (Black-box) and Gradient (White-box). Our experimental results indicate that DeepWordBug reduces the prediction accuracy of current state-of-the-art deep-learning models, including a decrease of 68% on average for a Word-LSTM model and 48% on average for a Char-CNN model.

Key facts. Cited by 341 papers in the map (data through 7 Oct 2026). First posted on arXiv 13 Jan 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 62; 2022: 55; 2023: 71; 2024: 73; 2025: 57; 2026: 23.

341 papers.

Sort:

By area:

  1. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 619
  2. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  3. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 251
  4. 2021Gradient-based Adversarial Attacks against Text Transformerscited by 233
  5. 2023PromptRobust: Towards Evaluating the Robustness of Large Language Models on Adversarial Promptscited by 218
  6. 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attackscited by 189
  7. 2023Defending Against Alignment-Breaking Attacks via Robustly Aligned LLMcited by 173
  8. 2024RAID: A Shared Benchmark for Robust Evaluation of Machine-Generated Text Detectorscited by 157
  9. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfercited by 147
  10. 2024Is LLM-as-a-Judge Robust? Investigating Universal Adversarial Attacks on Zero-shot LLM Assessmentcited by 117
  11. 2021Measure and Improve Robustness in NLP Models: A Surveycited by 107
  12. 2023Set-level Guidance Attack: Boosting Adversarial Transferability of Vision-Language Pre-training Modelscited by 106
38 more
  1. 2023A Survey on LLM-Generated Text Detection: Necessity, Methods, and Future Directionscited by 101
  2. 2023DyVal: Dynamic Evaluation of Large Language Models for Reasoning Taskscited by 100
  3. 2022Why Should Adversarial Perturbations be Imperceptible? Rethink the Research Paradigm in Adversarial NLPcited by 99
  4. 2023A Survey of Safety and Trustworthiness of Large Language Models through the Lens of Verification and Validationcited by 91
  5. 2021Towards Improving Adversarial Training of NLP Modelscited by 79
  6. 2022Machine Generated Text: A Comprehensive Survey of Threat Models and Detection Methodscited by 75
  7. 2021Bad Characters: Imperceptible NLP Attackscited by 69
  8. 2021Towards Robustness Against Natural Language Word Substitutionscited by 68
  9. 2024Typos that Broke the RAG's Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbationscited by 64
  10. 2023Adversarial Demonstration Attacks on Large Language Modelscited by 58
  11. 2021Certified Robustness to Text Adversarial Attacks by Randomized [MASK]cited by 57
  12. 2021T-Miner: A Generative Approach to Defend Against Trojan Attacks on DNN-based Text Classificationcited by 56
  13. 2021Searching for an Effective Defender: Benchmarking Defense against Adversarial Word Substitutioncited by 55
  14. 2021Model Extraction and Adversarial Transferability, Your BERT is Vulnerable!cited by 51
  15. 2021How Should Pre-Trained Language Models Be Fine-Tuned Towards Adversarial Robustness?cited by 49
  16. 2022CodeAttack: Code-Based Adversarial Attacks for Pre-trained Programming Language Modelscited by 48
  17. 2023On Robustness of Prompt-based Semantic Parsing with Large Pre-trained Language Model: An Empirical Study on Codexcited by 41
  18. 2023Hijacking Large Language Models via Adversarial In-Context Learningcited by 41
  19. 2022Attribution and Obfuscation of Neural Text Authorship: A Data Mining Perspectivecited by 40
  20. 2024One Perturbation is Enough: On Generating Universal Adversarial Perturbations against Vision-Language Pre-training Modelscited by 39
  21. 2021The Threat of Offensive AI to Organizationscited by 37
  22. 2024DetectRL: Benchmarking LLM-Generated Text Detection in Real-World Scenarioscited by 37
  23. 2023Text-CRS: A Generalized Certified Robustness Framework against Textual Adversarial Attackscited by 32
  24. 2021Defending Pre-trained Language Models from Adversarial Word Substitutions Without Performance Sacrificecited by 30
  25. 2021Perturbing Inputs for Fragile Interpretations in Deep Natural Language Processingcited by 30
  26. 2021A Review of Adversarial Attack and Defense for Classification Methodscited by 29
  27. 2022Exploiting Cultural Biases via Homoglyphs in Text-to-Image Synthesiscited by 29
  28. 2023The Trickle-down Impact of Reward (In-)consistency on RLHFcited by 29
  29. 2022Character-level White-Box Adversarial Attacks against Transformers via Attachable Subwords Substitutioncited by 28
  30. 2022Towards Robustness of Text-to-SQL Models Against Natural and Realistic Adversarial Table Perturbationcited by 28
  31. 2023Assessing Hidden Risks of LLMs: An Empirical Study on Robustness, Consistency, and Credibilitycited by 28
  32. 2024Who Wrote This? The Key to Zero-Shot LLM-Generated Text Detection Is GECScorecited by 27
  33. 2024B-AVIBench: Towards Evaluating the Robustness of Large Vision-Language Model on Black-box Adversarial Visual-Instructionscited by 26
  34. 2022Adversarial Robustness of Neural-Statistical Features in Detection of Generative Transformerscited by 25
  35. 2021Adversarial Attacks on Deep Models for Financial Transaction Recordscited by 24
  36. 2022"That Is a Suspicious Reaction!": Interpreting Logits Variation to Detect NLP Adversarial Attackscited by 24
  37. 2025Bypassing LLM Guardrails: An Empirical Analysis of Evasion Attacks against Prompt Injection and Jailbreak Detection Systemscited by 24
  38. 2021Framing RNN as a kernel method: A neural ODE approachcited by 23

50 most cited of 341 All 341 (JSON)