# Frequency-Guided Word Substitutions for Detecting Textual Adversarial Examples

arXiv: https://arxiv.org/abs/2004.05887 · HTML: https://mlsanity.com/paper/2004.05887/

## Key facts

- Cited by 54 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Apr 2020.

## Built on by (most cited first, 30 of 54)

- [Why Should Adversarial Perturbations be Imperceptible? Rethink the Research Paradigm in Adversarial NLP](https://mlsanity.com/paper/2210.10683/) (2022)
- [Use of LLMs for Illicit Purposes: Threats, Prevention Measures, and Vulnerabilities](https://mlsanity.com/paper/2308.12833/) (2023)
- [One Perturbation is Enough: On Generating Universal Adversarial Perturbations against Vision-Language Pre-training Models](https://mlsanity.com/paper/2406.05491/) (2024)
- [Text-CRS: A Generalized Certified Robustness Framework against Textual Adversarial Attacks](https://mlsanity.com/paper/2307.16630/) (2023)
- [Detection of Word Adversarial Examples in Text Classification: Benchmark and Baseline via Robust Density Estimation](https://mlsanity.com/paper/2203.01677/) (2022)
- [Defending Pre-trained Language Models from Adversarial Word Substitutions Without Performance Sacrifice](https://mlsanity.com/paper/2105.14553/) (2021)
- [The Trickle-down Impact of Reward (In-)consistency on RLHF](https://mlsanity.com/paper/2309.16155/) (2023)
- ["That Is a Suspicious Reaction!": Interpreting Logits Variation to Detect NLP Adversarial Attacks](https://mlsanity.com/paper/2204.04636/) (2022)
- [Achieving Model Robustness through Discrete Adversarial Training](https://mlsanity.com/paper/2104.05062/) (2021)
- [A Prompting-based Approach for Adversarial Example Generation and Robustness Enhancement](https://mlsanity.com/paper/2203.10714/) (2022)
- [Adversarial Training for Improving Model Robustness? Look at Both Prediction and Interpretation](https://mlsanity.com/paper/2203.12709/) (2022)
- [Textwash -- automated open-source text anonymisation](https://mlsanity.com/paper/2208.13081/) (2022)
- [Defending Against Knowledge Poisoning Attacks During Retrieval-Augmented Generation](https://mlsanity.com/paper/2508.02835/) (2025)
- [Improving the Robustness of Transformer-based Large Language Models with Dynamic Attention](https://mlsanity.com/paper/2311.17400/) (2023)
- [Less is More: Understanding Word-level Textual Adversarial Attack via n-gram Frequency Descend](https://mlsanity.com/paper/2302.02568/) (2023)
- [TextDefense: Adversarial Text Detection based on Word Importance Entropy](https://mlsanity.com/paper/2302.05892/) (2023)
- [Detecting Textual Adversarial Examples through Randomized Substitution and Vote](https://mlsanity.com/paper/2109.05698/) (2021)
- [Residue-Based Natural Language Adversarial Attack Detection](https://mlsanity.com/paper/2204.10192/) (2022)
- [TextShield: Beyond Successfully Detecting Adversarial Sentences in Text Classification](https://mlsanity.com/paper/2302.02023/) (2023)
- [Fast Adversarial Training against Textual Adversarial Attacks](https://mlsanity.com/paper/2401.12461/) (2024)
- [Rethinking Textual Adversarial Defense for Pre-trained Language Models](https://mlsanity.com/paper/2208.10251/) (2022)
- [Masked Language Model Based Textual Adversarial Example Detection](https://mlsanity.com/paper/2304.08767/) (2023)
- [ROIC-DM: Robust Text Inference and Classification via Diffusion Model](https://mlsanity.com/paper/2401.03514/) (2024)
- [Identifying Adversarial Attacks on Text Classifiers](https://mlsanity.com/paper/2201.08555/) (2022)
- [Disentangled Text Representation Learning with Information-Theoretic Perspective for Adversarial Robustness](https://mlsanity.com/paper/2210.14957/) (2022)
- [Exploring Gradient-Guided Masked Language Model to Detect Textual Adversarial Attacks](https://mlsanity.com/paper/2504.08798/) (2025)
- [Contrasting Human- and Machine-Generated Word-Level Adversarial Examples for Text Classification](https://mlsanity.com/paper/2109.04385/) (2021)
- [TREATED:Towards Universal Defense against Textual Adversarial Attacks](https://mlsanity.com/paper/2109.06176/) (2021)
- [The Best Defense is Attack: Repairing Semantics in Textual Adversarial Examples](https://mlsanity.com/paper/2305.04067/) (2023)
- [From Adversarial Arms Race to Model-centric Evaluation: Motivating a Unified Automatic Robustness Evaluation Framework](https://mlsanity.com/paper/2305.18503/) (2023)

## Abstract (arXiv)

Recent efforts have shown that neural text processing models are vulnerable to adversarial examples, but the nature of these examples is poorly understood. In this work, we show that adversarial attacks against CNN, LSTM and Transformer-based classification models perform word substitutions that are identifiable through frequency differences between replaced words and their corresponding substitutions. Based on these findings, we propose frequency-guided word substitutions (FGWS), a simple algorithm exploiting the frequency properties of adversarial word substitutions for the detection of adversarial examples. FGWS achieves strong performance by accurately detecting adversarial examples on the SST-2 and IMDb sentiment datasets, with F1 detection scores of up to 91.4% against RoBERTa-based classification models. We compare our approach against a recently proposed perturbation discrimination framework and show that we outperform it by up to 13.0% F1.