mlsanityData to 14 Oct 2026

Generating Natural Language Adversarial Examples

arXiv 1804.07998 ↗First posted 21 Apr 2018cs.CLcited by 424

Not on the map. Why?

Cited by 44 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Deep neural networks (DNNs) are vulnerable to adversarial examples, perturbations to correctly classified examples which can cause the model to misclassify. In the image domain, these perturbations are often virtually indistinguishable to human perception, causing humans and state-of-the-art models to disagree. However, in the natural language domain, small perturbations are clearly perceptible, and the replacement of a single word can drastically alter the semantics of the document. Given these challenges, we use a black-box population-based optimization algorithm to generate semantically and syntactically similar adversarial examples that fool well-trained sentiment analysis and textual entailment models with success rates of 97% and 70%, respectively. We additionally demonstrate that 92.3% of the successful sentiment analysis adversarial examples are classified to their original label by 20 human annotators, and that the examples are perceptibly quite similar. Finally, we discuss an attempt to use adversarial training as a defense, but fail to yield improvement, demonstrating the strength and diversity of our adversarial examples. We hope our findings encourage researchers to pursue improving the robustness of DNNs in the natural language domain.

Key facts. Cited by 424 papers in the map (data through 14 Oct 2026). First posted on arXiv 21 Apr 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 105; 2022: 86; 2023: 99; 2024: 72; 2025: 39; 2026: 23.

424 papers.

Sort:

By area:

  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  2. 2023Can Large Language Models Be an Alternative to Human Evaluations?cited by 734
  3. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 469
  4. 2022A Holistic Approach to Undesired Content Detection in the Real Worldcited by 356
  5. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Modelscited by 328
  6. 2023Are aligned neural networks adversarially aligned?cited by 315
  7. 2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 284
  8. 2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 279
  9. 2021Gradient-based Adversarial Attacks against Text Transformerscited by 234
  10. 2023To Generate or Not? Safety-Driven Unlearned Diffusion Models Are Still Easy To Generate Unsafe Images ... For Nowcited by 210
  11. 2023Defending Against Alignment-Breaking Attacks via Robustly Aligned LLMcited by 192
  12. 2023Automatically Auditing Large Language Models via Discrete Optimizationcited by 191
38 more
  1. 2023SneakyPrompt: Jailbreaking Text-to-image Generative Modelscited by 189
  2. 2024Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Modelscited by 168
  3. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfercited by 158
  4. 2024Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attackscited by 156
  5. 2023Open Sesame! Universal Black Box Jailbreaking of Large Language Modelscited by 134
  6. 2023AugGPT: Leveraging ChatGPT for Text Data Augmentationcited by 130
  7. 2021A Survey on Data Augmentation for Text Classificationcited by 111
  8. 2021Towards Robustness of Text-to-SQL Models against Synonym Substitutioncited by 110
  9. 2021Measure and Improve Robustness in NLP Models: A Surveycited by 107
  10. 2024Weak-to-Strong Jailbreaking on Large Language Modelscited by 107
  11. 2022Why Should Adversarial Perturbations be Imperceptible? Rethink the Research Paradigm in Adversarial NLPcited by 102
  12. 2021An Empirical Survey of Data Augmentation for Limited Data Learning in NLPcited by 101
  13. 2023A Survey of Safety and Trustworthiness of Large Language Models through the Lens of Verification and Validationcited by 93
  14. 2023On the Robustness of Large Multimodal Models Against Image Adversarial Attackscited by 92
  15. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitutioncited by 89
  16. 2023Red teaming ChatGPT via Jailbreaking: Bias, Robustness, Reliability and Toxicitycited by 89
  17. 2024Fast Adversarial Attacks on Language Models In One GPU Minutecited by 88
  18. 2023Use of LLMs for Illicit Purposes: Threats, Prevention Measures, and Vulnerabilitiescited by 82
  19. 2021Towards Improving Adversarial Training of NLP Modelscited by 79
  20. 2021Identifying and Mitigating Spurious Correlations for Improving Robustness in NLP Modelscited by 76
  21. 2021Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasurescited by 73
  22. 2023Unleashing the potential of prompt engineering for large language modelscited by 72
  23. 2021Bad Characters: Imperceptible NLP Attackscited by 71
  24. 2023A Survey on Detection of LLMs-Generated Contentcited by 71
  25. 2021Towards Robustness Against Natural Language Word Substitutionscited by 69
  26. 2022Evaluating the Susceptibility of Pre-Trained Language Models via Handcrafted Adversarial Examplescited by 69
  27. 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labelscited by 66
  28. 2024Typos that Broke the RAG's Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbationscited by 65
  29. 2023Adversarial Demonstration Attacks on Large Language Modelscited by 63
  30. 2023Black Box Adversarial Prompting for Foundation Modelscited by 62
  31. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 62
  32. 2021T-Miner: A Generative Approach to Defend Against Trojan Attacks on DNN-based Text Classificationcited by 60
  33. 2021Certified Robustness to Text Adversarial Attacks by Randomized [MASK]cited by 57
  34. 2021Searching for an Effective Defender: Benchmarking Defense against Adversarial Word Substitutioncited by 56
  35. 2023Red Teaming Language Model Detectors with Language Modelscited by 55
  36. 2021On Guaranteed Optimal Robust Explanations for NLP Modelscited by 54
  37. 2022CodeAttack: Code-Based Adversarial Attacks for Pre-trained Programming Language Modelscited by 53
  38. 2022Incorporating Hierarchy into Text Encoder: a Contrastive Learning Approach for Hierarchical Text Classificationcited by 52

50 most cited of 424 All 424 (JSON)