# Universal Adversarial Perturbation for Text Classification

arXiv: https://arxiv.org/abs/1910.04618 · HTML: https://mlsanity.com/paper/1910.04618/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 Oct 2019.

## Built on by (most cited first, 8 of 8)

- [A Survey On Universal Adversarial Attack](https://mlsanity.com/paper/2103.01498/) (2021)
- [PRP: Propagating Universal Perturbations to Attack Large Language Model Guard-Rails](https://mlsanity.com/paper/2402.15911/) (2024)
- [Fooling Explanations in Text Classifiers](https://mlsanity.com/paper/2206.03178/) (2022)
- [ER-Test: Evaluating Explanation Regularization Methods for Language Models](https://mlsanity.com/paper/2205.12542/) (2022)
- [Cheating Automatic Short Answer Grading: On the Adversarial Usage of Adjectives and Adverbs](https://mlsanity.com/paper/2201.08318/) (2022)
- [AR-GAN: Generative Adversarial Network-Based Defense Method Against Adversarial Attacks on the Traffic Sign Classification System of Autonomous Vehicles](https://mlsanity.com/paper/2401.14232/) (2023)
- [Accountable and Explainable Methods for Complex Reasoning over Text](https://mlsanity.com/paper/2211.04946/) (2022)
- [Towards Robust Universal Perturbation Attacks: A Float-Coded, Penalty-Driven Evolutionary Approach](https://mlsanity.com/paper/2601.12624/) (2026)

## Abstract (arXiv)

Given a state-of-the-art deep neural network text classifier, we show the existence of a universal and very small perturbation vector (in the embedding space) that causes natural text to be misclassified with high probability. Unlike images on which a single fixed-size adversarial perturbation can be found, text is of variable length, so we define the "universality" as "token-agnostic", where a single perturbation is applied to each token, resulting in different perturbations of flexible sizes at the sequence level. We propose an algorithm to compute universal adversarial perturbations, and show that the state-of-the-art deep neural networks are highly vulnerable to them, even though they keep the neighborhood of tokens mostly preserved. We also show how to use these adversarial perturbations to generate adversarial text samples. The surprising existence of universal "token-agnostic" adversarial perturbations may reveal important properties of a text classifier.