mlsanityData to 7 Oct 2026

Reevaluating Adversarial Examples in Natural Language

arXiv 2004.14174 ↗First posted 25 Apr 2020cs.CL cs.AI cs.CRcited by 83

Not on the map. Why?

Abstract (arXiv)

State-of-the-art attacks on NLP models lack a shared definition of a what constitutes a successful attack. We distill ideas from past work into a unified framework: a successful natural language adversarial example is a perturbation that fools the model and follows some linguistic constraints. We then analyze the outputs of two state-of-the-art synonym substitution attacks. We find that their perturbations often do not preserve semantics, and 38% introduce grammatical errors. Human surveys reveal that to successfully preserve semantics, we need to significantly increase the minimum cosine similarities between the embeddings of swapped words and between the sentence encodings of original and perturbed sentences.With constraints adjusted to better preserve semantics and grammaticality, the attack success rate drops by over 70 percentage points.

Key facts. Cited by 83 papers in the map (data through 7 Oct 2026). First posted on arXiv 25 Apr 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 13; 2022: 22; 2023: 20; 2024: 12; 2025: 9; 2026: 7.

83 papers.

Sort:

By area:

  1. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 738
  2. 2023Can Large Language Models Be an Alternative to Human Evaluations?cited by 729
  3. 2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 281
  4. 2021Gradient-based Adversarial Attacks against Text Transformerscited by 233
  5. 2021Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Modelscited by 227
  6. 2021Measure and Improve Robustness in NLP Models: A Surveycited by 107
  7. 2021Towards Improving Adversarial Training of NLP Modelscited by 79
  8. 2023Robust Multi-bit Natural Language Watermarking through Invariant Featurescited by 76
  9. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarkscited by 70
  10. 2021Searching for an Effective Defender: Benchmarking Defense against Adversarial Word Substitutioncited by 55
  11. 2021The Dangers of Underclaiming: Reasons for Caution When Reporting How NLP Systems Failcited by 38
  12. 2022Detection of Word Adversarial Examples in Text Classification: Benchmark and Baseline via Robust Density Estimationcited by 32
38 more
  1. 2021Grey-box Adversarial Attack And Defence For Sentiment Classificationcited by 28
  2. 2022Robust Conversational Agents against Imperceptible Toxicity Triggerscited by 23
  3. 2022Phrase-level Textual Adversarial Attack with Label Preservationcited by 23
  4. 2023MTTM: Metamorphic Testing for Textual Content Moderation Softwarecited by 20
  5. 2024PAPILLON: Efficient and Stealthy Fuzz Testing-Powered Jailbreaks for LLMscited by 20
  6. 2023How do humans perceive adversarial text? A reality check on the validity and naturalness of word-based adversarial attackscited by 18
  7. 2021The King is Naked: on the Notion of Robustness for Natural Language Processingcited by 16
  8. 2024Adversarial Decoding: Generating Readable Documents for Adversarial Objectivescited by 16
  9. 2022On The Empirical Effectiveness of Unrealistic Adversarial Hardening Against Realistic Adversarial Attackscited by 15
  10. 2022Towards Explainable Evaluation Metrics for Natural Language Generationcited by 15
  11. 2022Text Adversarial Purification as Defense against Adversarial Attackscited by 15
  12. 2022AEON: A Method for Automatic Evaluation of NLP Test Casescited by 15
  13. 2024Towards Building a Robust Toxicity Predictorcited by 14
  14. 2022Less Learn Shortcut: Analyzing and Mitigating Learning of Spurious Feature-Label Correlationcited by 13
  15. 2021Token-Modification Adversarial Attacks for Natural Language Processing: A Surveycited by 12
  16. 2023TransFool: An Adversarial Attack against Neural Machine Translation Modelscited by 12
  17. 2025Building Safe GenAI Applications: An End-to-End Overview of Red Teaming for Large Language Modelscited by 11
  18. 2021BERT is Robust! A Case Against Synonym-Based Adversarial Examples in Text Classificationcited by 9
  19. 2026LaS-Comp: Zero-shot 3D Completion with Latent-Spatial Consistencycited by 9
  20. 2023Don't Retrain, Just Rewrite: Countering Adversarial Perturbations by Rewriting Textcited by 8
  21. 2022Testing the limits of natural language models for predicting human language judgmentscited by 7
  22. 2024Self-interpreting Adversarial Imagescited by 7
  23. 2021Towards Variable-Length Textual Adversarial Attackscited by 5
  24. 2023Break it, Imitate it, Fix it: Robustness by Generating Human-Like Attackscited by 5
  25. 2023Whispers of Doubt Amidst Echoes of Triumph in NLP Robustnesscited by 5
  26. 2024Impeding LLM-assisted Cheating in Introductory Programming Assignments via Adversarial Perturbationcited by 5
  27. 2021DuQM: A Chinese Dataset of Linguistically Perturbed Natural Questions for Evaluating the Robustness of Question Matching Modelscited by 4
  28. 2022A Survey on Measuring and Mitigating Reasoning Shortcuts in Machine Reading Comprehensioncited by 4
  29. 2022Are Synonym Substitution Attacks Really Synonym Substitution Attacks?cited by 4
  30. 2022Preserving Semantics in Textual Adversarial Attackscited by 4
  31. 2024Addressing Both Statistical and Causal Gender Fairness in NLP Modelscited by 4
  32. 2024Revisiting Character-level Adversarial Attacks for Language Modelscited by 4
  33. 2021Contrasting Human- and Machine-Generated Word-Level Adversarial Examples for Text Classificationcited by 3
  34. 2022Balanced Adversarial Training: Balancing Tradeoffs between Fickleness and Obstinacy in NLP Modelscited by 3
  35. 2023Step by Step Loss Goes Very Far: Multi-Step Quantization for Adversarial Text Attackscited by 3
  36. 2023From Adversarial Arms Race to Model-centric Evaluation: Motivating a Unified Automatic Robustness Evaluation Frameworkcited by 3
  37. 2023Expanding Scope: Adapting English Adversarial Attacks to Chinesecited by 3
  38. 2023Enhancing Robustness of AI Offensive Code Generators via Data Augmentationcited by 3

50 most cited of 83 All 83 (JSON)