mlsanityData to 7 Oct 2026

BERT-ATTACK: Adversarial Attack Against BERT Using BERT

arXiv 2004.09984 ↗First posted 21 Apr 2020cs.CLcited by 488

Not on the map. Why?

Cited by 41 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Adversarial attacks for discrete data (such as texts) have been proved significantly more challenging than continuous data (such as images) since it is difficult to generate adversarial samples with gradient-based methods. Current successful attack methods for texts usually adopt heuristic replacement strategies on the character or word level, which remains challenging to find the optimal solution in the massive space of possible combinations of replacements while preserving semantic consistency and language fluency. In this paper, we propose BERT-Attack, a high-quality and effective method to generate adversarial samples using pre-trained masked language models exemplified by BERT. We turn BERT against its fine-tuned models and other deep neural models in downstream tasks so that we can successfully mislead the target models to predict incorrectly. Our method outperforms state-of-the-art attack strategies in both success rate and perturb percentage, while the generated adversarial samples are fluent and semantically preserved. Also, the cost of calculation is low, thus possible for large-scale generations. The code is available at https://github.com/LinyangLee/BERT-Attack.

Key facts. Cited by 488 papers in the map (data through 7 Oct 2026). First posted on arXiv 21 Apr 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 68; 2022: 80; 2023: 116; 2024: 109; 2025: 72; 2026: 43.

488 papers.

Sort:

By area:

  1. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  2. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 619
  3. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  4. 2021Pre-Trained Models: Past, Present and Futurecited by 319
  5. 2022Prompting GPT-3 To Be Reliablecited by 258
  6. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 251
  7. 2021Gradient-based Adversarial Attacks against Text Transformerscited by 233
  8. 2021Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Modelscited by 227
  9. 2023PromptRobust: Towards Evaluating the Robustness of Large Language Models on Adversarial Promptscited by 218
  10. 2023Automatically Auditing Large Language Models via Discrete Optimizationcited by 187
  11. 2023MMA-Diffusion: MultiModal Attack on Diffusion Modelscited by 184
  12. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
38 more
  1. 2024GSM-Plus: A Comprehensive Benchmark for Evaluating the Robustness of LLMs as Mathematical Problem Solverscited by 155
  2. 2023Poisoning Retrieval Corpora by Injecting Adversarial Passagescited by 153
  3. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfercited by 147
  4. 2022Towards Adversarial Attack on Vision-Language Pre-training Modelscited by 142
  5. 2023Auditing large language models: a three-layered approachcited by 135
  6. 2024An Adversarial Perspective on Machine Unlearning for AI Safetycited by 113
  7. 2021Towards Robustness of Text-to-SQL Models against Synonym Substitutioncited by 110
  8. 2021Measure and Improve Robustness in NLP Models: A Surveycited by 107
  9. 2023Set-level Guidance Attack: Boosting Adversarial Transferability of Vision-Language Pre-training Modelscited by 106
  10. 2021On the Adversarial Robustness of Vision Transformerscited by 104
  11. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 103
  12. 2022ReCode: Robustness Evaluation of Code Generation Modelscited by 100
  13. 2023DyVal: Dynamic Evaluation of Large Language Models for Reasoning Taskscited by 100
  14. 2022Why Should Adversarial Perturbations be Imperceptible? Rethink the Research Paradigm in Adversarial NLPcited by 99
  15. 2024Coercing LLMs to do and reveal (almost) anythingcited by 88
  16. 2023Red teaming ChatGPT via Jailbreaking: Bias, Robustness, Reliability and Toxicitycited by 86
  17. 2021Towards Improving Adversarial Training of NLP Modelscited by 79
  18. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarkscited by 70
  19. 2023VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Modelscited by 66
  20. 2021Common Sense Beyond English: Evaluating and Improving Multilingual Language Models for Commonsense Reasoningcited by 64
  21. 2023Black Box Adversarial Prompting for Foundation Modelscited by 62
  22. 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labelscited by 61
  23. 2023Adversarial Demonstration Attacks on Large Language Modelscited by 58
  24. 2021Certified Robustness to Text Adversarial Attacks by Randomized [MASK]cited by 57
  25. 2021Adversarial Robustness Comparison of Vision Transformer and MLP-Mixer to CNNscited by 57
  26. 2021T-Miner: A Generative Approach to Defend Against Trojan Attacks on DNN-based Text Classificationcited by 56
  27. 2021Searching for an Effective Defender: Benchmarking Defense against Adversarial Word Substitutioncited by 55
  28. 2023Red Teaming Language Model Detectors with Language Modelscited by 55
  29. 2023SeqXGPT: Sentence-Level AI-Generated Text Detectioncited by 55
  30. 2021CLINE: Contrastive Learning with Semantic Negative Examples for Natural Language Understandingcited by 50
  31. 2022CodeAttack: Code-Based Adversarial Attacks for Pre-trained Programming Language Modelscited by 48
  32. 2022On the Blind Spots of Model-Based Evaluation Metrics for Text Generationcited by 48
  33. 2022BITE: Textual Backdoor Attacks with Iterative Trigger Injectioncited by 47
  34. 2022Bridging the Gap Between Indexing and Retrieval for Differentiable Search Index with Query Generationcited by 47
  35. 2022SemAttack: Natural Textual Attacks via Different Semantic Spacescited by 42
  36. 2023RobuT: A Systematic Study of Table QA Robustness Against Human-Annotated Adversarial Perturbationscited by 41
  37. 2023Hijacking Large Language Models via Adversarial In-Context Learningcited by 41
  38. 2023Origin Tracing and Detecting of LLMscited by 39

50 most cited of 488 All 488 (JSON)