# Adversarial Texts with Gradient Methods

arXiv: https://arxiv.org/abs/1801.07175 · HTML: https://mlsanity.com/paper/1801.07175/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 22 Jan 2018.

## Built on by (most cited first, 14 of 14)

- [Towards Robustness Against Natural Language Word Substitutions](https://mlsanity.com/paper/2107.13541/) (2021)
- [Grey-box Adversarial Attack And Defence For Sentiment Classification](https://mlsanity.com/paper/2103.11576/) (2021)
- [A Survey on Out-of-Distribution Evaluation of Neural NLP Models](https://mlsanity.com/paper/2306.15261/) (2023)
- [Fall of Giants: How popular text-based MLaaS fall against a simple evasion attack](https://mlsanity.com/paper/2104.05996/) (2021)
- [Robust Natural Language Processing: Recent Advances, Challenges, and Future Directions](https://mlsanity.com/paper/2201.00768/) (2022)
- [Verifying the Robustness of Automatic Credibility Assessment](https://mlsanity.com/paper/2303.08032/) (2023)
- [Adversarial Attacks and Defenses for Social Network Text Processing Applications: Techniques, Challenges and Future Research Directions](https://mlsanity.com/paper/2110.13980/) (2021)
- [EDoG: Adversarial Edge Detection For Graph Neural Networks](https://mlsanity.com/paper/2212.13607/) (2022)
- [Adversary for Social Good: Leveraging Adversarial Attacks to Protect Personal Attribute Privacy](https://mlsanity.com/paper/2306.02488/) (2023)
- [Adversarial Machine Learning in Text Analysis and Generation](https://mlsanity.com/paper/2101.08675/) (2021)
- [Attacks against Ranking Algorithms with Text Embeddings: a Case Study on Recruitment Algorithms](https://mlsanity.com/paper/2108.05490/) (2021)
- [HAT4RD: Hierarchical Adversarial Training for Rumor Detection on Social Media](https://mlsanity.com/paper/2110.00425/) (2021)
- [A Grey-box Text Attack Framework using Explainable AI](https://mlsanity.com/paper/2503.08226/) (2025)
- [A Robust and Explainable Transformer-Based Framework for Phishing Email Detection](https://mlsanity.com/paper/2511.12085/) (2025)

## Abstract (arXiv)

Adversarial samples for images have been extensively studied in the literature. Among many of the attacking methods, gradient-based methods are both effective and easy to compute. In this work, we propose a framework to adapt the gradient attacking methods on images to text domain. The main difficulties for generating adversarial texts with gradient methods are i) the input space is discrete, which makes it difficult to accumulate small noise directly in the inputs, and ii) the measurement of the quality of the adversarial texts is difficult. We tackle the first problem by searching for adversarials in the embedding space and then reconstruct the adversarial texts via nearest neighbor search. For the latter problem, we employ the Word Mover's Distance (WMD) to quantify the quality of adversarial texts. Through extensive experiments on three datasets, IMDB movie reviews, Reuters-2 and Reuters-5 newswires, we show that our framework can leverage gradient attacking methods to generate very high-quality adversarial texts that are only a few words different from the original texts. There are many cases where we can change one word to alter the label of the whole piece of text. We successfully incorporate FGM and DeepFool into our framework. In addition, we empirically show that WMD is closely related to the quality of adversarial texts.