mlsanityData to 7 Oct 2026

Frequency-Guided Word Substitutions for Detecting Textual Adversarial Examples

arXiv 2004.05887 ↗First posted 13 Apr 2020cs.CLcited by 54

Not on the map. Why?

Abstract (arXiv)

Recent efforts have shown that neural text processing models are vulnerable to adversarial examples, but the nature of these examples is poorly understood. In this work, we show that adversarial attacks against CNN, LSTM and Transformer-based classification models perform word substitutions that are identifiable through frequency differences between replaced words and their corresponding substitutions. Based on these findings, we propose frequency-guided word substitutions (FGWS), a simple algorithm exploiting the frequency properties of adversarial word substitutions for the detection of adversarial examples. FGWS achieves strong performance by accurately detecting adversarial examples on the SST-2 and IMDb sentiment datasets, with F1 detection scores of up to 91.4% against RoBERTa-based classification models. We compare our approach against a recently proposed perturbation discrimination framework and show that we outperform it by up to 13.0% F1.

Key facts. Cited by 54 papers in the map (data through 7 Oct 2026). First posted on arXiv 13 Apr 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 6; 2022: 16; 2023: 16; 2024: 6; 2025: 6; 2026: 4.

54 papers.

Sort:

By area:

  1. 2022Why Should Adversarial Perturbations be Imperceptible? Rethink the Research Paradigm in Adversarial NLPcited by 99
  2. 2023Use of LLMs for Illicit Purposes: Threats, Prevention Measures, and Vulnerabilitiescited by 76
  3. 2024One Perturbation is Enough: On Generating Universal Adversarial Perturbations against Vision-Language Pre-training Modelscited by 39
  4. 2022Detection of Word Adversarial Examples in Text Classification: Benchmark and Baseline via Robust Density Estimationcited by 32
  5. 2023Text-CRS: A Generalized Certified Robustness Framework against Textual Adversarial Attackscited by 32
  6. 2021Defending Pre-trained Language Models from Adversarial Word Substitutions Without Performance Sacrificecited by 30
  7. 2023The Trickle-down Impact of Reward (In-)consistency on RLHFcited by 29
  8. 2022"That Is a Suspicious Reaction!": Interpreting Logits Variation to Detect NLP Adversarial Attackscited by 24
  9. 2021Achieving Model Robustness through Discrete Adversarial Trainingcited by 23
  10. 2022A Prompting-based Approach for Adversarial Example Generation and Robustness Enhancementcited by 12
  11. 2022Adversarial Training for Improving Model Robustness? Look at Both Prediction and Interpretationcited by 12
  12. 2025Defending Against Knowledge Poisoning Attacks During Retrieval-Augmented Generationcited by 11
38 more
  1. 2022Textwash -- automated open-source text anonymisationcited by 10
  2. 2023Improving the Robustness of Transformer-based Large Language Models with Dynamic Attentioncited by 10
  3. 2023Less is More: Understanding Word-level Textual Adversarial Attack via n-gram Frequency Descendcited by 9
  4. 2023TextDefense: Adversarial Text Detection based on Word Importance Entropycited by 9
  5. 2021Detecting Textual Adversarial Examples through Randomized Substitution and Votecited by 8
  6. 2022Residue-Based Natural Language Adversarial Attack Detectioncited by 8
  7. 2023TextShield: Beyond Successfully Detecting Adversarial Sentences in Text Classificationcited by 8
  8. 2024Fast Adversarial Training against Textual Adversarial Attackscited by 7
  9. 2022Rethinking Textual Adversarial Defense for Pre-trained Language Modelscited by 5
  10. 2023Masked Language Model Based Textual Adversarial Example Detectioncited by 5
  11. 2024ROIC-DM: Robust Text Inference and Classification via Diffusion Modelcited by 5
  12. 2022Identifying Adversarial Attacks on Text Classifierscited by 4
  13. 2022Disentangled Text Representation Learning with Information-Theoretic Perspective for Adversarial Robustnesscited by 4
  14. 2025Exploring Gradient-Guided Masked Language Model to Detect Textual Adversarial Attackscited by 4
  15. 2021Contrasting Human- and Machine-Generated Word-Level Adversarial Examples for Text Classificationcited by 3
  16. 2023The Best Defense is Attack: Repairing Semantics in Textual Adversarial Examplescited by 3
  17. 2023From Adversarial Arms Race to Model-centric Evaluation: Motivating a Unified Automatic Robustness Evaluation Frameworkcited by 3
  18. 2023Toward Stronger Textual Attack Detectorscited by 3
  19. 2021Adversarial Examples Detection with Bayesian Neural Networkcited by 2
  20. 2021TREATED:Towards Universal Defense against Textual Adversarial Attackscited by 2
  21. 2022Input-specific Attention Subnetworks for Adversarial Detectioncited by 2
  22. 2022Detecting Textual Adversarial Examples Based on Distributional Characteristics of Data Representationscited by 2
  23. 2022Identifying Human Strategies for Generating Word-Level Adversarial Examplescited by 2
  24. 2022TCAB: A Large-Scale Text Classification Attack Benchmarkcited by 2
  25. 2022ADDMU: Detection of Far-Boundary Adversarial Examples with Data and Model Uncertainty Estimationcited by 2
  26. 2023On the Universal Adversarial Perturbations for Efficient Data-free Adversarial Detectioncited by 2
  27. 2024RoCoIns: Enhancing Robustness of Large Language Models through Code-Style Instructionscited by 2
  28. 2025Guided Perturbation Sensitivity (GPS): Detecting Adversarial Text via Embedding Stability and Word Importancecited by 2
  29. 2023Alert-ME: An Explainability-Driven Defense Against Adversarial Examples in Transformer-Based Text Classificationcited by 1
  30. 2023DA3: A Distribution-Aware Adversarial Attack against Language Modelscited by 1
  31. 2024Assessing biomedical knowledge robustness in large language models by query-efficient sampling attackscited by 1
  32. 2022Towards Explainability in NLP: Analyzing and Calculating Word Saliency through Word Propertiescited by 0
  33. 2023VoteTRANS: Detecting Adversarial Text without Training by Voting on Hard Labels of Transformationscited by 0
  34. 2023What Learned Representations and Influence Functions Can Tell Us About Adversarial Examplescited by 0
  35. 2024Reversible Jump Attack to Textual Classifiers with Modification Reductioncited by 0
  36. 2025Effective faking of verbal deception detection with target-aligned adversarial attackscited by 0
  37. 2025RedHerring Attack: Testing the Reliability of Attack Detectioncited by 0
  38. 2025Adversarially Robust Detection of Harmful Online Content: A Computational Design Science Approachcited by 0

50 most cited of 54 All 54 (JSON)