mlsanityData to 7 Oct 2026

TextBugger: Generating Adversarial Text Against Real-world Applications

arXiv 1812.05271 ↗First posted 13 Dec 2018cs.CR cs.CL cs.LGcited by 376

Not on the map. Why?

Cited by 40 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Deep Learning-based Text Understanding (DLTU) is the backbone technique behind various applications, including question answering, machine translation, and text classification. Despite its tremendous popularity, the security vulnerabilities of DLTU are still largely unknown, which is highly concerning given its increasing use in security-sensitive applications such as sentiment analysis and toxic content detection. In this paper, we show that DLTU is inherently vulnerable to adversarial text attacks, in which maliciously crafted texts trigger target DLTU systems and services to misbehave. Specifically, we present TextBugger, a general attack framework for generating adversarial texts. In contrast to prior works, TextBugger differs in significant ways: (i) effective -- it outperforms state-of-the-art attacks in terms of attack success rate; (ii) evasive -- it preserves the utility of benign text, with 94.9% of the adversarial text correctly recognized by human readers; and (iii) efficient -- it generates adversarial text with computational complexity sub-linear to the text length. We empirically evaluate TextBugger on a set of real-world DLTU systems and services used for sentiment analysis and toxic content detection, demonstrating its effectiveness, evasiveness, and efficiency. For instance, TextBugger achieves 100% success rate on the IMDB dataset based on Amazon AWS Comprehend within 4.61 seconds and preserves 97% semantic similarity. We further discuss possible defense mechanisms to mitigate such attack and the adversary's potential countermeasures, which leads to promising directions for further research.

Key facts. Cited by 376 papers in the map (data through 7 Oct 2026). First posted on arXiv 13 Dec 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 61; 2022: 63; 2023: 89; 2024: 84; 2025: 61; 2026: 18.

376 papers.

Sort:

By area:

  1. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  2. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 619
  3. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  4. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 434
  5. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 251
  6. 2021Gradient-based Adversarial Attacks against Text Transformerscited by 233
  7. 2021Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Modelscited by 227
  8. 2023PromptRobust: Towards Evaluating the Robustness of Large Language Models on Adversarial Promptscited by 218
  9. 2023To Generate or Not? Safety-Driven Unlearned Diffusion Models Are Still Easy To Generate Unsafe Images ... For Nowcited by 204
  10. 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attackscited by 189
  11. 2023SneakyPrompt: Jailbreaking Text-to-image Generative Modelscited by 175
  12. 2023Defending Against Alignment-Breaking Attacks via Robustly Aligned LLMcited by 173
38 more
  1. 2024Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Modelscited by 164
  2. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfercited by 147
  3. 2024Black-Box Access is Insufficient for Rigorous AI Auditscited by 123
  4. 2023Explore, Establish, Exploit: Red Teaming Language Models from Scratchcited by 111
  5. 2021BERT: A Review of Applications in Natural Language Processing and Understandingcited by 109
  6. 2021Measure and Improve Robustness in NLP Models: A Surveycited by 107
  7. 2023DyVal: Dynamic Evaluation of Large Language Models for Reasoning Taskscited by 100
  8. 2023Revisiting Out-of-distribution Robustness in NLP: Benchmark, Analysis, and LLMs Evaluationscited by 96
  9. 2023A Survey of Safety and Trustworthiness of Large Language Models through the Lens of Verification and Validationcited by 91
  10. 2021Hidden Backdoors in Human-Centric Language Modelscited by 83
  11. 2024Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplificationcited by 80
  12. 2023Use of LLMs for Illicit Purposes: Threats, Prevention Measures, and Vulnerabilitiescited by 76
  13. 2021Bad Characters: Imperceptible NLP Attackscited by 69
  14. 2021TDGIA:Effective Injection Attacks on Graph Neural Networkscited by 67
  15. 2023VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Modelscited by 66
  16. 2024Building Guardrails for Large Language Modelscited by 61
  17. 2023Adversarial Demonstration Attacks on Large Language Modelscited by 58
  18. 2021Certified Robustness to Text Adversarial Attacks by Randomized [MASK]cited by 57
  19. 2021T-Miner: A Generative Approach to Defend Against Trojan Attacks on DNN-based Text Classificationcited by 56
  20. 2022Exploring the Universal Vulnerability of Prompt-based Learning Paradigmcited by 56
  21. 2021Searching for an Effective Defender: Benchmarking Defense against Adversarial Word Substitutioncited by 55
  22. 2022"Real Attackers Don't Compute Gradients": Bridging the Gap Between Adversarial ML Research and Practicecited by 55
  23. 2024Query-Based Adversarial Prompt Generationcited by 55
  24. 2021Model Extraction and Adversarial Transferability, Your BERT is Vulnerable!cited by 51
  25. 2024MultiTrust: A Comprehensive Benchmark Towards Trustworthy Multimodal Large Language Modelscited by 51
  26. 2022CodeAttack: Code-Based Adversarial Attacks for Pre-trained Programming Language Modelscited by 48
  27. 2024Phantom: General Backdoor Attacks on Retrieval Augmented Language Generationcited by 46
  28. 2021NeuronFair: Interpretable White-Box Fairness Testing through Biased Neuron Identificationcited by 42
  29. 2022SemAttack: Natural Textual Attacks via Different Semantic Spacescited by 42
  30. 2023On Robustness of Prompt-based Semantic Parsing with Large Pre-trained Language Model: An Empirical Study on Codexcited by 41
  31. 2023Hijacking Large Language Models via Adversarial In-Context Learningcited by 41
  32. 2023In ChatGPT We Trust? Measuring and Characterizing the Reliability of ChatGPTcited by 35
  33. 2023Text-CRS: A Generalized Certified Robustness Framework against Textual Adversarial Attackscited by 32
  34. 2023MathAttack: Attacking Large Language Models Towards Math Solving Abilitycited by 31
  35. 2021Perturbing Inputs for Fragile Interpretations in Deep Natural Language Processingcited by 30
  36. 2023Assessing Hidden Risks of LLMs: An Empirical Study on Robustness, Consistency, and Credibilitycited by 28
  37. 2024Revisiting the Adversarial Robustness of Vision Language Models: a Multimodal Perspectivecited by 28
  38. 2021Bridge the Gap Between CV and NLP! A Gradient-based Textual Adversarial Attack Frameworkcited by 27

50 most cited of 376 All 376 (JSON)