mlsanityData to 7 Oct 2026

BAE: BERT-based Adversarial Examples for Text Classification

arXiv 2004.01970 ↗First posted 4 Apr 2020cs.CLcited by 316

Not on the map. Why?

Cited by 24 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Modern text classification models are susceptible to adversarial examples, perturbed versions of the original text indiscernible by humans which get misclassified by the model. Recent works in NLP use rule-based synonym replacement strategies to generate adversarial examples. These strategies can lead to out-of-context and unnaturally complex token replacements, which are easily identifiable by humans. We present BAE, a black box attack for generating adversarial examples using contextual perturbations from a BERT masked language model. BAE replaces and inserts tokens in the original text by masking a portion of the text and leveraging the BERT-MLM to generate alternatives for the masked tokens. Through automatic and human evaluations, we show that BAE performs a stronger attack, in addition to generating adversarial examples with improved grammaticality and semantic coherence as compared to prior work.

Key facts. Cited by 316 papers in the map (data through 7 Oct 2026). First posted on arXiv 4 Apr 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 51; 2022: 57; 2023: 75; 2024: 71; 2025: 45; 2026: 17.

316 papers.

Sort:

By area:

  1. 2023Can Large Language Models Be an Alternative to Human Evaluations?cited by 729
  2. 2023Explainability for Large Language Models: A Surveycited by 331
  3. 2021Gradient-based Adversarial Attacks against Text Transformerscited by 233
  4. 2021Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Modelscited by 227
  5. 2023To Generate or Not? Safety-Driven Unlearned Diffusion Models Are Still Easy To Generate Unsafe Images ... For Nowcited by 204
  6. 2023MMA-Diffusion: MultiModal Attack on Diffusion Modelscited by 184
  7. 2023SneakyPrompt: Jailbreaking Text-to-image Generative Modelscited by 175
  8. 2024Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Modelscited by 164
  9. 2023Auditing large language models: a three-layered approachcited by 135
  10. 2024Is LLM-as-a-Judge Robust? Investigating Universal Adversarial Attacks on Zero-shot LLM Assessmentcited by 117
  11. 2024An Adversarial Perspective on Machine Unlearning for AI Safetycited by 113
  12. 2021Robustness Gym: Unifying the NLP Evaluation Landscapecited by 107
38 more
  1. 2021Measure and Improve Robustness in NLP Models: A Surveycited by 107
  2. 2021On the Adversarial Robustness of Vision Transformerscited by 104
  3. 2021An Empirical Survey of Data Augmentation for Limited Data Learning in NLPcited by 101
  4. 2022Why Should Adversarial Perturbations be Imperceptible? Rethink the Research Paradigm in Adversarial NLPcited by 99
  5. 2021Towards Improving Adversarial Training of NLP Modelscited by 79
  6. 2023Robust Multi-bit Natural Language Watermarking through Invariant Featurescited by 76
  7. 2021AEDA: An Easier Data Augmentation Technique for Text Classificationcited by 67
  8. 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labelscited by 61
  9. 2021Adversarial Robustness Comparison of Vision Transformer and MLP-Mixer to CNNscited by 57
  10. 2021T-Miner: A Generative Approach to Defend Against Trojan Attacks on DNN-based Text Classificationcited by 56
  11. 2021Searching for an Effective Defender: Benchmarking Defense against Adversarial Word Substitutioncited by 55
  12. 2023Red Teaming Language Model Detectors with Language Modelscited by 55
  13. 2021CLINE: Contrastive Learning with Semantic Negative Examples for Natural Language Understandingcited by 50
  14. 2022CodeAttack: Code-Based Adversarial Attacks for Pre-trained Programming Language Modelscited by 48
  15. 2022BITE: Textual Backdoor Attacks with Iterative Trigger Injectioncited by 47
  16. 2022DFX: A Low-latency Multi-FPGA Appliance for Accelerating Transformer-based Text Generationcited by 46
  17. 2022SemAttack: Natural Textual Attacks via Different Semantic Spacescited by 42
  18. 2022Towards Formal XAI: Formally Approximate Minimal Explanations of Neural Networkscited by 42
  19. 2024Arondight: Red Teaming Large Vision Language Models with Auto-generated Multi-modal Jailbreak Promptscited by 39
  20. 2023Prompting Large Language Models for Counterfactual Generation: An Empirical Studycited by 36
  21. 2021FlipDA: Effective and Robust Data Augmentation for Few-Shot Learningcited by 32
  22. 2022Detection of Word Adversarial Examples in Text Classification: Benchmark and Baseline via Robust Density Estimationcited by 32
  23. 2023Text-CRS: A Generalized Certified Robustness Framework against Textual Adversarial Attackscited by 32
  24. 2023Query-Efficient Black-Box Red Teaming via Bayesian Optimizationcited by 31
  25. 2021Defending Pre-trained Language Models from Adversarial Word Substitutions Without Performance Sacrificecited by 30
  26. 2024ToxiCloakCN: Evaluating Robustness of Offensive Language Detection in Chinese with Cloaking Perturbationscited by 30
  27. 2022Character-level White-Box Adversarial Attacks against Transformers via Attachable Subwords Substitutioncited by 28
  28. 2023Assessing Hidden Risks of LLMs: An Empirical Study on Robustness, Consistency, and Credibilitycited by 28
  29. 2024Universal Prompt Optimizer for Safe Text-to-Image Generationcited by 27
  30. 2021Reliability Testing for Natural Language Processing Systemscited by 25
  31. 2021Bayesian Attention Belief Networkscited by 25
  32. 2022"That Is a Suspicious Reaction!": Interpreting Logits Variation to Detect NLP Adversarial Attackscited by 24
  33. 2025Bypassing LLM Guardrails: An Empirical Analysis of Evasion Attacks against Prompt Injection and Jailbreak Detection Systemscited by 24
  34. 2021Code-Mixing on Sesame Street: Dawn of the Adversarial Polyglotscited by 23
  35. 2021Achieving Model Robustness through Discrete Adversarial Trainingcited by 23
  36. 2022Generalized but not Robust? Comparing the Effects of Data Modification Methods on Out-of-Domain Generalization and Adversarial Robustnesscited by 23
  37. 2022Phrase-level Textual Adversarial Attack with Label Preservationcited by 23
  38. 2022A Survey of Adversarial Defences and Robustness in NLPcited by 22

50 most cited of 316 All 316 (JSON)