mlsanityData to 7 Oct 2026

Universal Adversarial Attacks with Natural Triggers for Text Classification

arXiv 2005.00174 ↗First posted 1 May 2020cs.CL cs.CRcited by 50

Not on the map. Why?

Abstract (arXiv)

Recent work has demonstrated the vulnerability of modern text classifiers to universal adversarial attacks, which are input-agnostic sequences of words added to text processed by classifiers. Despite being successful, the word sequences produced in such attacks are often ungrammatical and can be easily distinguished from natural text. We develop adversarial attacks that appear closer to natural English phrases and yet confuse classification systems when added to benign inputs. We leverage an adversarially regularized autoencoder (ARAE) to generate triggers and propose a gradient-based search that aims to maximize the downstream classifier's prediction loss. Our attacks effectively reduce model accuracy on classification tasks while being less identifiable than prior models as per automatic detection metrics and human-subject studies. Our aim is to demonstrate that adversarial attacks can be made harder to detect than previously thought and to enable the development of appropriate defenses.

Key facts. Cited by 50 papers in the map (data through 7 Oct 2026). First posted on arXiv 1 May 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 10; 2022: 11; 2023: 10; 2024: 11; 2025: 3; 2026: 5.

50 papers.

Sort:

By area:

  1. 2022Red Teaming Language Models with Language Modelscited by 983
  2. 2023Toxicity in ChatGPT: Analyzing Persona-assigned Language Modelscited by 356
  3. 2023Low-Resource Languages Jailbreak GPT-4cited by 290
  4. 2021Gradient-based Adversarial Attacks against Text Transformerscited by 233
  5. 2023Poisoning Retrieval Corpora by Injecting Adversarial Passagescited by 153
  6. 2024Black-Box Access is Insufficient for Rigorous AI Auditscited by 123
  7. 2023Explore, Establish, Exploit: Red Teaming Language Models from Scratchcited by 111
  8. 2021Measure and Improve Robustness in NLP Models: A Surveycited by 107
  9. 2023AdvCLIP: Downstream-agnostic Adversarial Examples in Multimodal Contrastive Learningcited by 101
  10. 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Modelscited by 97
  11. 2021A Survey On Universal Adversarial Attackcited by 59
  12. 2021Embodied BERT: A Transformer Model for Embodied, Language-guided Visual Task Completioncited by 57
38 more
  1. 2022A Study of the Attention Abnormality in Trojaned BERTscited by 47
  2. 2022Order-Disorder: Imitation Adversarial Attacks for Black-box Neural Ranking Modelscited by 37
  3. 2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 35
  4. 2021Robust Feature-Level Adversaries are Interpretability Toolscited by 27
  5. 2024Corpus Poisoning via Approximate Greedy Gradient Descentcited by 21
  6. 2023A Survey on Out-of-Distribution Evaluation of Neural NLP Modelscited by 20
  7. 2021The King is Naked: on the Notion of Robustness for Natural Language Processingcited by 16
  8. 2022A Word is Worth A Thousand Dollars: Adversarial Attack on Tweets Fools Stock Predictionscited by 15
  9. 2021Jujutsu: A Two-stage Defense against Adversarial Patch Attacks on Deep Neural Networkscited by 13
  10. 2023Why do universal adversarial attacks work on large language models?: Geometry might be the answercited by 13
  11. 2024Towards a Framework for Evaluating Explanations in Automated Fact Verificationcited by 7
  12. 2022Attention Hijacking in Trojan Transformerscited by 6
  13. 2022Analyzing Semantic Faithfulness of Language Models via Input Intervention on Question Answeringcited by 6
  14. 2021Automatically Exposing Problems with Neural Dialog Modelscited by 5
  15. 2022Cheating Automatic Short Answer Grading: On the Adversarial Usage of Adjectives and Adverbscited by 5
  16. 2021MINIMAL: Mining Models for Data Free Universal Adversarial Triggerscited by 4
  17. 2024SSCAE -- Semantic, Syntactic, and Context-aware natural language Adversarial Examples generatorcited by 3
  18. 2024textitLinkPrompt: Natural and Universal Adversarial Attacks on Prompt-based Language Modelscited by 3
  19. 2022Universal Evasion Attacks on Summarization Scoringcited by 2
  20. 2022Attack on Unfair ToS Clause Detection: A Case Study using Universal Adversarial Triggerscited by 2
  21. 2023On the Universal Adversarial Perturbations for Efficient Data-free Adversarial Detectioncited by 2
  22. 2025NLP Security and Ethics, in the Wildcited by 2
  23. 2022A Universal Adversarial Policy for Text Classifierscited by 1
  24. 2023DA3: A Distribution-Aware Adversarial Attack against Language Modelscited by 1
  25. 2024Can Reinforcement Learning Unlock the Hidden Dangers in Aligned Large Language Models?cited by 1
  26. 2024Proactive Adversarial Defense: Harnessing Prompt Tuning in Vision-Language Models to Detect Unseen Backdoored Imagescited by 1
  27. 2025Bridging Robustness and Generalization Against Word Substitution Attacks in NLP via the Growth Bound Matrix Approachcited by 1
  28. 2022A sentiment analysis model for car review texts based on adversarial training and whole word mask BERTcited by 0
  29. 2023SenTest: Evaluating Robustness of Sentence Encoderscited by 0
  30. 2024A Generative Adversarial Attack for Multilingual Text Classifierscited by 0
  31. 2024Analyzing Multi-Head Attention on Trojan BERT Modelscited by 0
  32. 2024Unpacking the Resilience of SNLI Contradiction Examples to Attackscited by 0
  33. 2025For Those Who May Find Themselves on the Red Teamcited by 0
  34. 2026Can We Trust LLM Detectors?cited by 0
  35. 2026RTD-Guard: A Black-Box Textual Adversarial Detection Framework via Replacement Token Detectioncited by 0
  36. 2026Universal Adversarial Triggerscited by 0
  37. 2026S-GBT: Smooth Growth Bound Tensor for Certified Robustness Against Word Substitution Attacks in NLPcited by 0
  38. 2026Eliciting Intrinsic Hallucinations in LLMs via Semantically Equivalent Adversarial Attackscited by 0