mlsanityData to 7 Oct 2026

SAFER: A Structure-free Approach for Certified Robustness to Adversarial Word Substitutions

arXiv 2005.14424 ↗First posted 29 May 2020cs.LG cs.CL cs.CRcited by 72

Not on the map. Why?

Abstract (arXiv)

State-of-the-art NLP models can often be fooled by human-unaware transformations such as synonymous word substitution. For security reasons, it is of critical importance to develop models with certified robustness that can provably guarantee that the prediction is can not be altered by any possible synonymous word substitution. In this work, we propose a certified robust method based on a new randomized smoothing technique, which constructs a stochastic ensemble by applying random word substitutions on the input sentences, and leverage the statistical properties of the ensemble to provably certify the robustness. Our method is simple and structure-free in that it only requires the black-box queries of the model outputs, and hence can be applied to any pre-trained models (such as BERT) and any types of models (world-level or subword-level). Our method significantly outperforms recent state-of-the-art methods for certified robustness on both IMDB and Amazon text classification tasks. To the best of our knowledge, we are the first work to achieve certified robustness on large systems such as BERT with practically meaningful certified accuracy.

Key facts. Cited by 72 papers in the map (data through 7 Oct 2026). First posted on arXiv 29 May 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 11; 2022: 17; 2023: 12; 2024: 15; 2025: 10; 2026: 7.

72 papers.

Sort:

By area:

  1. 2023Certifying LLM Safety against Adversarial Promptingcited by 248
  2. 2021Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Modelscited by 227
  3. 2021On the Adversarial Robustness of Vision Transformerscited by 104
  4. 2022Why Should Adversarial Perturbations be Imperceptible? Rethink the Research Paradigm in Adversarial NLPcited by 99
  5. 2023A Survey of Safety and Trustworthiness of Large Language Models through the Lens of Verification and Validationcited by 91
  6. 2024Defending Large Language Models against Jailbreak Attacks via Semantic Smoothingcited by 68
  7. 2021Certified Robustness to Text Adversarial Attacks by Randomized [MASK]cited by 57
  8. 2021Searching for an Effective Defender: Benchmarking Defense against Adversarial Word Substitutioncited by 55
  9. 2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)cited by 44
  10. 2023Text-CRS: A Generalized Certified Robustness Framework against Textual Adversarial Attackscited by 32
  11. 2021Defending Pre-trained Language Models from Adversarial Word Substitutions Without Performance Sacrificecited by 30
  12. 2022Certified Robustness Against Natural Language Attacks by Causal Interventioncited by 23
38 more
  1. 2023Certified Robustness for Large Language Models with Self-Denoisingcited by 23
  2. 2022A Survey of Adversarial Defences and Robustness in NLPcited by 22
  3. 2021Improving Zero-Shot Cross-Lingual Transfer Learning via Robust Trainingcited by 21
  4. 2021Does Robustness Improve Fairness? Approaching Fairness with Word Substitution Robustness Methods for Text Classificationcited by 20
  5. 2022Textual Manifold-based Defense Against Natural Language Adversarial Examplescited by 19
  6. 2021Certified Robustness to Programmable Transformations in LSTMscited by 18
  7. 2021On the Robustness of Reading Comprehension Models to Entity Renamingcited by 17
  8. 2023RS-Del: Edit Distance Robustness Certificates for Sequence Classifiers via Randomized Deletioncited by 17
  9. 2022On Robust Prefix-Tuning for Text Classificationcited by 15
  10. 2024Advancing the Robustness of Large Language Models through Self-Denoised Smoothingcited by 15
  11. 2024NLP Verification: Towards a General Methodology for Certifying Robustnesscited by 14
  12. 2022Adversarial Training for Improving Model Robustness? Look at Both Prediction and Interpretationcited by 12
  13. 2023Randomized Smoothing with Masked Inference for Adversarially Robust Text Classificationscited by 11
  14. 2022Robust Natural Language Processing: Recent Advances, Challenges, and Future Directionscited by 9
  15. 2022Impact of Adversarial Training on Robustness and Generalizability of Language Modelscited by 9
  16. 2023Less is More: Understanding Word-level Textual Adversarial Attack via n-gram Frequency Descendcited by 9
  17. 2023Don't Retrain, Just Rewrite: Countering Adversarial Perturbations by Rewriting Textcited by 8
  18. 2021Integer-arithmetic-only Certified Robustness for Quantized Neural Networkscited by 7
  19. 2023Perturbation-Invariant Adversarial Training for Neural Ranking Models: Improving the Effectiveness-Robustness Trade-Offcited by 7
  20. 2024Fast Adversarial Training against Textual Adversarial Attackscited by 7
  21. 2025Towards the Worst-case Robustness of Large Language Modelscited by 7
  22. 2023ANTONIO: Towards a Systematic Method of Generating NLP Benchmarks for Verificationcited by 6
  23. 2025CluCERT: Certifying LLM Robustness via Clustering-Guided Denoising Smoothingcited by 6
  24. 2022Rethinking Textual Adversarial Defense for Pre-trained Language Modelscited by 5
  25. 2023Masked Language Model Based Textual Adversarial Example Detectioncited by 5
  26. 2024ProTransformer: Robustify Transformers via Plug-and-Play Paradigmcited by 5
  27. 2022Identifying Adversarial Attacks on Text Classifierscited by 4
  28. 2022Improving robustness of language models from a geometry-aware perspectivecited by 4
  29. 2024MMCert: Provable Defense against Adversarial Attacks to Multi-modal Modelscited by 4
  30. 2022Distinguishing Non-natural from Natural Adversarial Samples for More Robust Pre-trained Language Modelcited by 3
  31. 2022Balanced Adversarial Training: Balancing Tradeoffs between Fickleness and Obstinacy in NLP Modelscited by 3
  32. 2024SemRoDe: Macro Adversarial Training to Learn Representations That are Robust to Word-Level Attackscited by 3
  33. 2022Quantifying Robustness to Adversarial Word Substitutionscited by 2
  34. 2022Sibylvariant Transformations for Robust Text Classificationcited by 2
  35. 2022ADDMU: Detection of Far-Boundary Adversarial Examples with Data and Model Uncertainty Estimationcited by 2
  36. 2024The Impact of Quantization on the Robustness of Transformer-based Text Classifierscited by 2
  37. 2024Explaining the role of Intrinsic Dimensionality in Adversarial Trainingcited by 2
  38. 2024MaskPure: Improving Defense Against Text Adversaries with Stochastic Purificationcited by 2

50 most cited of 72 All 72 (JSON)