# A Geometry-Inspired Attack for Generating Natural Language Adversarial Examples

arXiv: https://arxiv.org/abs/2010.01345 · HTML: https://mlsanity.com/paper/2010.01345/

## Key facts

- Cited by 20 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Oct 2020.

## Built on by (most cited first, 20 of 20)

- [On Evaluating Adversarial Robustness of Large Vision-Language Models](https://mlsanity.com/paper/2305.16934/) (2023)
- [Evaluating the Robustness of Text-to-image Diffusion Models against Real-world Attacks](https://mlsanity.com/paper/2306.13103/) (2023)
- [TextGrad: Advancing Robustness Evaluation in NLP by Gradient-Driven Optimization](https://mlsanity.com/paper/2212.09254/) (2022)
- [Assessing Adversarial Robustness of Large Language Models: An Empirical Study](https://mlsanity.com/paper/2405.02764/) (2024)
- [HQA-Attack: Toward High Quality Black-Box Hard-Label Adversarial Attack on Text](https://mlsanity.com/paper/2402.01806/) (2024)
- [Token-Modification Adversarial Attacks for Natural Language Processing: A Survey](https://mlsanity.com/paper/2103.00676/) (2021)
- [Robust Textual Embedding against Word-level Adversarial Attacks](https://mlsanity.com/paper/2202.13817/) (2022)
- [TextHacker: Learning based Hybrid Local Search Algorithm for Text Hard-label Adversarial Attack](https://mlsanity.com/paper/2201.08193/) (2022)
- [A Differentiable Language Model Adversarial Attack on Text Classifiers](https://mlsanity.com/paper/2107.11275/) (2021)
- [BERT is Robust! A Case Against Synonym-Based Adversarial Examples in Text Classification](https://mlsanity.com/paper/2109.07403/) (2021)
- [Rethinking Textual Adversarial Defense for Pre-trained Language Models](https://mlsanity.com/paper/2208.10251/) (2022)
- [Self-Supervised Contrastive Learning with Adversarial Perturbations for Defending Word Substitution-based Attacks](https://mlsanity.com/paper/2107.07610/) (2021)
- [Distinguishing Non-natural from Natural Adversarial Samples for More Robust Pre-trained Language Model](https://mlsanity.com/paper/2203.11199/) (2022)
- [A Context-Aware Approach for Textual Adversarial Attack through Probability Difference Guided Beam Search](https://mlsanity.com/paper/2208.08029/) (2022)
- [Multi-task Adversarial Attacks against Black-box Model with Few-shot Queries](https://mlsanity.com/paper/2508.10039/) (2025)
- [SEPP: Similarity Estimation of Predicted Probabilities for Defending and Detecting Adversarial Text](https://mlsanity.com/paper/2110.05748/) (2021)
- [Generating Watermarked Adversarial Texts](https://mlsanity.com/paper/2110.12948/) (2021)
- [PivotAttack: Rethinking the Search Trajectory in Hard-Label Text Attacks via Pivot Words](https://mlsanity.com/paper/2603.10842/) (2026)
- [SEP-Attack: A Simple and Effective Paradigm for Transfer-Based Textual Adversarial Attack](https://mlsanity.com/paper/2605.24958/) (2026)
- [OASIS: Optimizing Attacker Sequences for Hard-Label Black-Box Text Attacks](https://mlsanity.com/paper/2608.29568/) (2026)

## Abstract (arXiv)

Generating adversarial examples for natural language is hard, as natural language consists of discrete symbols, and examples are often of variable lengths. In this paper, we propose a geometry-inspired attack for generating natural language adversarial examples. Our attack generates adversarial examples by iteratively approximating the decision boundary of Deep Neural Networks (DNNs). Experiments on two datasets with two different models show that our attack fools natural language models with high success rates, while only replacing a few words. Human evaluation shows that adversarial examples generated by our attack are hard for humans to recognize. Further experiments show that adversarial training can improve model robustness against our attack.