# Elephant in the Room: An Evaluation Framework for Assessing Adversarial Examples in NLP

arXiv: https://arxiv.org/abs/2001.07820 · HTML: https://mlsanity.com/paper/2001.07820/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 22 Jan 2020.

## Built on by (most cited first, 7 of 7)

- [Grey-box Adversarial Attack And Defence For Sentiment Classification](https://mlsanity.com/paper/2103.11576/) (2021)
- [A Survey of Adversarial Defences and Robustness in NLP](https://mlsanity.com/paper/2203.06414/) (2022)
- [The King is Naked: on the Notion of Robustness for Natural Language Processing](https://mlsanity.com/paper/2112.07605/) (2021)
- [On Robustness of Neural Semantic Parsers](https://mlsanity.com/paper/2102.01563/) (2021)
- [Contrasting Human- and Machine-Generated Word-Level Adversarial Examples for Text Classification](https://mlsanity.com/paper/2109.04385/) (2021)
- [Emergent Linguistic Structures in Neural Networks are Fragile](https://mlsanity.com/paper/2210.17406/) (2022)
- [The Ultimate Cookbook for Invisible Poison: Crafting Subtle Clean-Label Text Backdoors with Style Attributes](https://mlsanity.com/paper/2504.17300/) (2025)

## Abstract (arXiv)

An adversarial example is an input transformed by small perturbations that machine learning models consistently misclassify. While there are a number of methods proposed to generate adversarial examples for text data, it is not trivial to assess the quality of these adversarial examples, as minor perturbations (such as changing a word in a sentence) can lead to a significant shift in their meaning, readability and classification label. In this paper, we propose an evaluation framework consisting of a set of automatic evaluation metrics and human evaluation guidelines, to rigorously assess the quality of adversarial examples based on the aforementioned properties. We experiment with six benchmark attacking methods and found that some methods generate adversarial examples with poor readability and content preservation. We also learned that multiple factors could influence the attacking performance, such as the length of the text inputs and architecture of the classifiers.