# Generating Black-Box Adversarial Examples for Text Classifiers Using a Deep Reinforced Model

arXiv: https://arxiv.org/abs/1909.07873 · HTML: https://mlsanity.com/paper/1909.07873/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 Sep 2019.

## Built on by (most cited first, 10 of 10)

- [R&R: Metric-guided Adversarial Sentence Generation](https://mlsanity.com/paper/2104.08453/) (2021)
- [Semantic-Preserving Adversarial Text Attacks](https://mlsanity.com/paper/2108.10015/) (2021)
- [Data-Driven Mitigation of Adversarial Text Perturbation](https://mlsanity.com/paper/2202.09483/) (2022)
- [TREATED:Towards Universal Defense against Textual Adversarial Attacks](https://mlsanity.com/paper/2109.06176/) (2021)
- [Trust Me, I Know This Function: Hijacking LLM Static Analysis using Bias](https://mlsanity.com/paper/2508.17361/) (2025)
- [A Constraint-Enforcing Reward for Adversarial Attacks on Text Classifiers](https://mlsanity.com/paper/2405.11904/) (2024)
- [A Mutation-based Text Generation for Adversarial Machine Learning Applications](https://mlsanity.com/paper/2212.11808/) (2022)
- [Augmenting Text to Increase Translation Difficulty](https://mlsanity.com/paper/2608.15932/) (2026)
- [A Simple Yet Efficient Method for Adversarial Word-Substitute Attack](https://mlsanity.com/paper/2206.05015/) (2022)
- [RTD-Guard: A Black-Box Textual Adversarial Detection Framework via Replacement Token Detection](https://mlsanity.com/paper/2603.12582/) (2026)

## Abstract (arXiv)

Recently, generating adversarial examples has become an important means of measuring robustness of a deep learning model. Adversarial examples help us identify the susceptibilities of the model and further counter those vulnerabilities by applying adversarial training techniques. In natural language domain, small perturbations in the form of misspellings or paraphrases can drastically change the semantics of the text. We propose a reinforcement learning based approach towards generating adversarial examples in black-box settings. We demonstrate that our method is able to fool well-trained models for (a) IMDB sentiment classification task and (b) AG's news corpus news categorization task with significantly high success rates. We find that the adversarial examples generated are semantics-preserving perturbations to the original text.