mlsanityData to 7 Oct 2026

Token-Modification Adversarial Attacks for Natural Language Processing: A Survey

arXiv 2103.00676 ↗First posted 1 Mar 2021cs.CL cs.CR cs.LGcited by 12

Not on the map. Why?

Abstract (arXiv)

Many adversarial attacks target natural language processing systems, most of which succeed through modifying the individual tokens of a document. Despite the apparent uniqueness of each of these attacks, fundamentally they are simply a distinct configuration of four components: a goal function, allowable transformations, a search method, and constraints. In this survey, we systematically present the different components used throughout the literature, using an attack-independent framework which allows for easy comparison and categorisation of components. Our work aims to serve as a comprehensive guide for newcomers to the field and to spark targeted research into refining the individual attack components.

Key facts. Cited by 12 papers in the map (data through 7 Oct 2026). Builds on 52 of its 117 references that are in the map. First posted on arXiv 1 Mar 2021.

Builds on

52 of 117 references.

References · 52

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,491
  3. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,049
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2017A Unified Approach to Interpreting Model Predictionscited by 6,488
  6. 2019BERTScore: Evaluating Text Generation with BERTcited by 5,462
  7. 2016"Why Should I Trust You?": Explaining the Predictions of Any Classifiercited by 5,040
  8. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  9. 2018Neural Network Acceptability Judgmentscited by 952
  10. 2016Adversarial Machine Learning at Scalecited by 934
  11. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  12. 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 663
38 more
  1. 2017Adversarial Examples for Evaluating Reading Comprehension Systemscited by 568
  2. 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 488
  3. 2018Generating Natural Language Adversarial Examplescited by 422
  4. 2018TextBugger: Generating Adversarial Text Against Real-world Applicationscited by 376
  5. 2018Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifierscited by 341
  6. 2020BAE: BERT-based Adversarial Examples for Text Classificationcited by 316
  7. 2017Synthetic and Natural Noise Both Break Neural Machine Translationcited by 304
  8. 2019Automatic Detection of Generated Text is Easiest when Humans are Fooledcited by 260
  9. 2017Generating Natural Adversarial Examplescited by 182
  10. 2016Counter-fitting Word Vectors to Linguistic Constraintscited by 138
  11. 2020Contextualized Perturbation for Textual Adversarial Attackcited by 136
  12. 2017Deep Text Classification Can be Fooledcited by 105
  13. 2016Crafting Adversarial Input Sequences for Recurrent Neural Networkscited by 102
  14. 2019Text Processing Like Humans Do: Visually Attacking and Shielding NLP Systemscited by 99
  15. 2018Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examplescited by 93
  16. 2018On Adversarial Examples for Character-Level Neural Machine Translationcited by 85
  17. 2020Reevaluating Adversarial Examples in Natural Languagecited by 83
  18. 2020Imitation Attacks and Defenses for Black-box Machine Translation Systemscited by 78
  19. 2019AllenNLP Interpret: A Framework for Explaining Predictions of NLP Modelscited by 74
  20. 2019Make Up Your Mind! Adversarial Generation of Inconsistent Natural Language Explanationscited by 71
  21. 2020It's Morphin' Time! Combating Linguistic Discrimination with Inflectional Perturbationscited by 64
  22. 2018Motivating the Rules of the Game for Adversarial Example Researchcited by 57
  23. 2019On Evaluation of Adversarial Perturbations for Sequence-to-Sequence Modelscited by 56
  24. 2017Towards Crafting Text Adversarial Samplescited by 55
  25. 2020Generating Natural Language Attacks in a Hard Label Black Box Settingcited by 50
  26. 2020Generating Fluent Adversarial Examples for Natural Languagescited by 49
  27. 2020TextAttack: A Framework for Adversarial Attacks, Data Augmentation, and Adversarial Training in NLPcited by 45
  28. 2019Natural Language Adversarial Defense through Synonym Encodingcited by 39
  29. 2020From Hero to Z'eroe: A Benchmark of Low-Level Adversarial Attackscited by 36
  30. 2020Searching for a Search Method: Benchmarking Search Algorithms for Generating NLP Adversarial Examplescited by 23
  31. 2019Understanding Impacts of High-Order Loss Approximations and Features in Deep Learning Interpretationcited by 22
  32. 2020A Geometry-Inspired Attack for Generating Natural Language Adversarial Examplescited by 20
  33. 2020Adversarial Attack and Defense of Structured Prediction Modelscited by 20
  34. 2020On the Transferability of Adversarial Attacksagainst Neural Text Classifiercited by 16
  35. 2021Adversarial Stylometry in the Wild: Transferable Lexical Substitution Attacks on Author Profilingcited by 12
  36. 2020Considering Likelihood in NLP Classification Explanations with Occlusion and Language Modelingcited by 11
  37. 2020Unsupervised Text Style Transfer with Padded Masked Language Modelscited by 4
  38. 2020Detecting Word Sense Disambiguation Biases in Machine Translation for Model-Agnostic Adversarial Attackscited by 2

50 most cited of 52 All 52 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 1; 2022: 2; 2023: 0; 2024: 4; 2025: 2; 2026: 3.

12 papers.

  1. 2024Black-Box Access is Insufficient for Rigorous AI Auditscited by 123
  2. 2021BERT-Defense: A Probabilistic Model Based on BERT to Combat Cognitively Inspired Orthographic Adversarial Attackscited by 17
  3. 2022Robust Natural Language Processing: Recent Advances, Challenges, and Future Directionscited by 9
  4. 2022Cyberbullying Classifiers are Sensitive to Model-Agnostic Perturbationscited by 5
  5. 2024Hijacking Vision-and-Language Navigation Agents with Adversarial Environmental Attackscited by 5
  6. 2024A Constraint-Enforcing Reward for Adversarial Attacks on Text Classifierscited by 2
  7. 2025Demystifying Network Foundation Modelscited by 2
  8. 2024Assessing biomedical knowledge robustness in large language models by query-efficient sampling attackscited by 1
  9. 2025Towards Inclusive Toxic Content Moderation: Addressing Vulnerabilities to Adversarial Attacks in Toxicity Classifiers Tackling LLM-generated Contentcited by 0
  10. 2026Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluationcited by 0
  11. 2026LFQA-HP-1M: A Large-Scale Human Preference Dataset for Long-Form Question Answeringcited by 0
  12. 2026Vulnerability of Natural Language Classifiers to Evolutionary Generated Adversarial Textcited by 0