# Searching for a Search Method: Benchmarking Search Algorithms for Generating NLP Adversarial Examples

arXiv: https://arxiv.org/abs/2009.06368 · HTML: https://mlsanity.com/paper/2009.06368/

## Key facts

- Cited by 23 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 9 Sep 2020.

## Built on by (most cited first, 23 of 23)

- [Data-centric Artificial Intelligence: A Survey](https://mlsanity.com/paper/2303.10158/) (2023)
- [Towards Improving Adversarial Training of NLP Models](https://mlsanity.com/paper/2109.00544/) (2021)
- [Searching for an Effective Defender: Benchmarking Defense against Adversarial Word Substitution](https://mlsanity.com/paper/2108.12777/) (2021)
- [Query-Efficient and Scalable Black-Box Adversarial Attacks on Discrete Sequential Data via Bayesian Optimization](https://mlsanity.com/paper/2206.08575/) (2022)
- [A Strong Baseline for Query Efficient Attacks in a Black Box Setting](https://mlsanity.com/paper/2109.04775/) (2021)
- [Text Adversarial Purification as Defense against Adversarial Attacks](https://mlsanity.com/paper/2203.14207/) (2022)
- [PTP: Boosting Stability and Performance of Prompt Tuning with Perturbation-Based Regularizer](https://mlsanity.com/paper/2305.02423/) (2023)
- [Token-Modification Adversarial Attacks for Natural Language Processing: A Survey](https://mlsanity.com/paper/2103.00676/) (2021)
- [Robust Natural Language Processing: Recent Advances, Challenges, and Future Directions](https://mlsanity.com/paper/2201.00768/) (2022)
- [Less is More: Understanding Word-level Textual Adversarial Attack via n-gram Frequency Descend](https://mlsanity.com/paper/2302.02568/) (2023)
- [LimeAttack: Local Explainable Method for Textual Hard-Label Adversarial Attack](https://mlsanity.com/paper/2308.00319/) (2023)
- [Don't Search for a Search Method -- Simple Heuristics Suffice for Adversarial Text Attacks](https://mlsanity.com/paper/2109.07926/) (2021)
- [Generating Natural Language Adversarial Examples through An Improved Beam Search Algorithm](https://mlsanity.com/paper/2110.08036/) (2021)
- [Step by Step Loss Goes Very Far: Multi-Step Quantization for Adversarial Text Attacks](https://mlsanity.com/paper/2302.05120/) (2023)
- [From Adversarial Arms Race to Model-centric Evaluation: Motivating a Unified Automatic Robustness Evaluation Framework](https://mlsanity.com/paper/2305.18503/) (2023)
- [Robust Text Classification: Analyzing Prototype-Based Networks](https://mlsanity.com/paper/2311.06647/) (2023)
- [A Constraint-Enforcing Reward for Adversarial Attacks on Text Classifiers](https://mlsanity.com/paper/2405.11904/) (2024)
- [Adversarially Robust Neural Legal Judgement Systems](https://mlsanity.com/paper/2308.00165/) (2023)
- [Pointing out the Shortcomings of Relation Extraction Models with Semantically Motivated Adversarials](https://mlsanity.com/paper/2402.19076/) (2024)
- [Simpler becomes Harder: Do LLMs Exhibit a Coherent Behavior on Simplified Corpora?](https://mlsanity.com/paper/2404.06838/) (2024)
- [SCAT: Robust Self-supervised Contrastive Learning via Adversarial Training for Text Classification](https://mlsanity.com/paper/2307.01488/) (2023)
- [A Generative Adversarial Attack for Multilingual Text Classifiers](https://mlsanity.com/paper/2401.08255/) (2024)
- [Towards Robust Domain Generation Algorithm Classification](https://mlsanity.com/paper/2404.06236/) (2024)

## Abstract (arXiv)

We study the behavior of several black-box search algorithms used for generating adversarial examples for natural language processing (NLP) tasks. We perform a fine-grained analysis of three elements relevant to search: search algorithm, search space, and search budget. When new search algorithms are proposed in past work, the attack search space is often modified alongside the search algorithm. Without ablation studies benchmarking the search algorithm change with the search space held constant, one cannot tell if an increase in attack success rate is a result of an improved search algorithm or a less restrictive search space. Additionally, many previous studies fail to properly consider the search algorithms' run-time cost, which is essential for downstream tasks like adversarial training. Our experiments provide a reproducible benchmark of search algorithms across a variety of search spaces and query budgets to guide future research in adversarial NLP. Based on our experiments, we recommend greedy attacks with word importance ranking when under a time constraint or attacking long inputs, and either beam search or particle swarm optimization otherwise. Code implementation shared via https://github.com/QData/TextAttack-Search-Benchmark