# Generating Natural Language Adversarial Examples on a Large Scale with Generative Models

arXiv: https://arxiv.org/abs/2003.10388 · HTML: https://mlsanity.com/paper/2003.10388/

## Key facts

- Cited by 15 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 Mar 2020.

## Built on by (most cited first, 15 of 15)

- [On Evaluating Adversarial Robustness of Large Vision-Language Models](https://mlsanity.com/paper/2305.16934/) (2023)
- [A Survey of Adversarial Defences and Robustness in NLP](https://mlsanity.com/paper/2203.06414/) (2022)
- [A Differentiable Language Model Adversarial Attack on Text Classifiers](https://mlsanity.com/paper/2107.11275/) (2021)
- [GE-AdvGAN: Improving the transferability of adversarial samples by gradient editing-based adversarial generative model](https://mlsanity.com/paper/2401.06031/) (2024)
- [Towards the Worst-case Robustness of Large Language Models](https://mlsanity.com/paper/2501.19040/) (2025)
- [Cheating Automatic Short Answer Grading: On the Adversarial Usage of Adjectives and Adverbs](https://mlsanity.com/paper/2201.08318/) (2022)
- [Synthetic data generation for a longitudinal cohort study -- Evaluation, method extension and reproduction of published data analysis results](https://mlsanity.com/paper/2305.07685/) (2023)
- [textitLinkPrompt: Natural and Universal Adversarial Attacks on Prompt-based Language Models](https://mlsanity.com/paper/2403.16432/) (2024)
- [Logically Consistent Adversarial Attacks for Soft Theorem Provers](https://mlsanity.com/paper/2205.00047/) (2022)
- [A Constraint-Enforcing Reward for Adversarial Attacks on Text Classifiers](https://mlsanity.com/paper/2405.11904/) (2024)
- [False Alarms, Real Damage: Adversarial Attacks Using LLM-based Models on Text-based Cyber Threat Intelligence Systems](https://mlsanity.com/paper/2507.06252/) (2025)
- [Interactionless Inverse Reinforcement Learning: A Data-Centric Framework for Durable Alignment](https://mlsanity.com/paper/2602.14844/) (2026)
- [Augmenting Text to Increase Translation Difficulty](https://mlsanity.com/paper/2608.15932/) (2026)
- [SEPP: Similarity Estimation of Predicted Probabilities for Defending and Detecting Adversarial Text](https://mlsanity.com/paper/2110.05748/) (2021)
- [Hallucinations in LLMs: A Lifecycle-Based Survey of Causes, Detection, Mitigation, and Prevention](https://mlsanity.com/paper/2608.26168/) (2026)

## Abstract (arXiv)

Today text classification models have been widely used. However, these classifiers are found to be easily fooled by adversarial examples. Fortunately, standard attacking methods generate adversarial texts in a pair-wise way, that is, an adversarial text can only be created from a real-world text by replacing a few words. In many applications, these texts are limited in numbers, therefore their corresponding adversarial examples are often not diverse enough and sometimes hard to read, thus can be easily detected by humans and cannot create chaos at a large scale. In this paper, we propose an end to end solution to efficiently generate adversarial texts from scratch using generative models, which are not restricted to perturbing the given texts. We call it unrestricted adversarial text generation. Specifically, we train a conditional variational autoencoder (VAE) with an additional adversarial loss to guide the generation of adversarial examples. Moreover, to improve the validity of adversarial texts, we utilize discrimators and the training framework of generative adversarial networks (GANs) to make adversarial texts consistent with real data. Experimental results on sentiment analysis demonstrate the scalability and efficiency of our method. It can attack text classification models with a higher success rate than existing methods, and provide acceptable quality for humans in the meantime.