# Adversarial Attacks on Deep Learning Models in Natural Language Processing: A Survey

arXiv: https://arxiv.org/abs/1901.06796 · HTML: https://mlsanity.com/paper/1901.06796/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 21 Jan 2019.

## Built on by (most cited first, 10 of 10)

- [NL-Augmenter: A Framework for Task-Sensitive Natural Language Augmentation](https://mlsanity.com/paper/2112.02721/) (2021)
- [Why do universal adversarial attacks work on large language models?: Geometry might be the answer](https://mlsanity.com/paper/2309.00254/) (2023)
- [Towards Building a Robust Toxicity Predictor](https://mlsanity.com/paper/2404.08690/) (2024)
- [Semantic-Preserving Adversarial Text Attacks](https://mlsanity.com/paper/2108.10015/) (2021)
- [BERTops: Studying BERT Representations under a Topological Lens](https://mlsanity.com/paper/2205.00953/) (2022)
- [Identifying Adversarially Attackable and Robust Samples](https://mlsanity.com/paper/2301.12896/) (2023)
- [Target Model Agnostic Adversarial Attacks with Query Budgets on Language Understanding Models](https://mlsanity.com/paper/2106.07047/) (2021)
- [Using calibrator to improve robustness in Machine Reading Comprehension](https://mlsanity.com/paper/2202.11865/) (2022)
- [Gender Bias and Universal Substitution Adversarial Attacks on Grammatical Error Correction Systems for Automated Assessment](https://mlsanity.com/paper/2208.09466/) (2022)
- [Taxonomy of AISecOps Threat Modeling for Cloud Based Medical Chatbots](https://mlsanity.com/paper/2305.11189/) (2023)

## Abstract (arXiv)

With the development of high computational devices, deep neural networks (DNNs), in recent years, have gained significant popularity in many Artificial Intelligence (AI) applications. However, previous efforts have shown that DNNs were vulnerable to strategically modified samples, named adversarial examples. These samples are generated with some imperceptible perturbations but can fool the DNNs to give false predictions. Inspired by the popularity of generating adversarial examples for image DNNs, research efforts on attacking DNNs for textual applications emerges in recent years. However, existing perturbation methods for images cannotbe directly applied to texts as text data is discrete. In this article, we review research works that address this difference and generatetextual adversarial examples on DNNs. We collect, select, summarize, discuss and analyze these works in a comprehensive way andcover all the related information to make the article self-contained. Finally, drawing on the reviewed literature, we provide further discussions and suggestions on this topic.