mlsanityData to 14 Oct 2026

Gradient-based Adversarial Attacks against Text Transformers

arXiv 2104.13733 ↗First posted 15 Apr 2021cs.CL cs.AI cs.CRcited by 234

Not on the map. Why?

Cited by 104 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

We propose the first general-purpose gradient-based attack against transformer models. Instead of searching for a single adversarial example, we search for a distribution of adversarial examples parameterized by a continuous-valued matrix, hence enabling gradient-based optimization. We empirically demonstrate that our white-box attack attains state-of-the-art attack performance on a variety of natural language tasks. Furthermore, we show that a powerful black-box transfer attack, enabled by sampling from the adversarial distribution, matches or exceeds existing methods, while only requiring hard-label outputs.

Key facts. Cited by 234 papers in the map (data through 14 Oct 2026). Builds on 33 of its 39 references that are in the map. First posted on arXiv 15 Apr 2021.

Builds on

33 of 39 references.

References · 33

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  3. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,372
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  5. 2019BERTScore: Evaluating Text Generation with BERTcited by 5,512
  6. 2013Intriguing properties of neural networkscited by 5,155
  7. 2013Distributed Representations of Words and Phrases and their Compositionalitycited by 3,474
  8. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  9. 2019XLNet: Generalized Autoregressive Pretraining for Language Understandingcited by 2,811
  10. 2019ALBERT: A Lite BERT for Self-supervised Learning of Language Representationscited by 2,790
  11. 2016Categorical Reparameterization with Gumbel-Softmaxcited by 2,739
  12. 2017A Broad-Coverage Challenge Corpus for Sentence Understanding through Inferencecited by 2,682
21 more
  1. 2015Character-level Convolutional Networks for Text Classificationcited by 2,330
  2. 2019Cross-lingual Language Model Pretrainingcited by 1,090
  3. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 722
  4. 2017Evasion Attacks against Machine Learning at Test Timecited by 689
  5. 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 671
  6. 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 491
  7. 2018Universal Sentence Encodercited by 489
  8. 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 460
  9. 2018Generating Natural Language Adversarial Examplescited by 424
  10. 2018Adversarial Attacks on Neural Networks for Graph Datacited by 397
  11. 2018TextBugger: Generating Adversarial Text Against Real-world Applicationscited by 381
  12. 2018Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifierscited by 345
  13. 2020BAE: BERT-based Adversarial Examples for Text Classificationcited by 316
  14. 2018Adversarial Attack on Graph Structured Datacited by 301
  15. 2018Audio Adversarial Examples: Targeted Attacks on Speech-to-Textcited by 274
  16. 2020Contextualized Perturbation for Textual Adversarial Attackcited by 136
  17. 2020Reevaluating Adversarial Examples in Natural Languagecited by 85
  18. 2017Towards Crafting Text Adversarial Samplescited by 55
  19. 2020Universal Adversarial Attacks with Natural Triggers for Text Classificationcited by 51
  20. 2020Generating Natural Language Attacks in a Hard Label Black Box Settingcited by 50
  21. 2020TextAttack: A Framework for Adversarial Attacks, Data Augmentation, and Adversarial Training in NLPcited by 45

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 4; 2022: 14; 2023: 45; 2024: 93; 2025: 53; 2026: 25.

234 papers.

Sort:

By area:

  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  2. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  3. 2022Scaling Laws for Reward Model Overoptimizationcited by 1,095
  4. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 672
  5. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  6. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 573
  7. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 536
  8. 2024The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearningcited by 509
  9. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 451
  10. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrationscited by 431
  11. 2023Hard Prompts Made Easy: Gradient-Based Discrete Optimization for Prompt Tuning and Discoverycited by 336
  12. 2023Are aligned neural networks adversarially aligned?cited by 315
38 more
  1. 2023In-context Vectors: Making In Context Learning More Effective and Controllable Through Latent Space Steeringcited by 245
  2. 2023Automatically Auditing Large Language Models via Discrete Optimizationcited by 191
  3. 2024Security and Privacy Challenges of Large Language Models: A Surveycited by 186
  4. 2024COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllabilitycited by 175
  5. 2024AdvPrompter: Fast Adaptive Adversarial Prompting for LLMscited by 156
  6. 2023Understanding Catastrophic Forgetting in Language Models via Implicit Inferencecited by 144
  7. 2024Jailbreaking Attack against Multimodal Large Language Modelcited by 135
  8. 2023Open Sesame! Universal Black Box Jailbreaking of Large Language Modelscited by 134
  9. 2024Attacks, Defenses and Evaluations for LLM Conversation Safety: A Surveycited by 130
  10. 2024Black-Box Access is Insufficient for Rigorous AI Auditscited by 126
  11. 2023Explore, Establish, Exploit: Red Teaming Language Models from Scratchcited by 114
  12. 2023AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Modelscited by 111
  13. 2024Improved Techniques for Optimization-Based Jailbreaking on Large Language Modelscited by 110
  14. 2024Attacking Large Language Models with Projected Gradient Descentcited by 94
  15. 2024Soft Prompt Threats: Attacking Safety Alignment and Unlearning in Open-Source LLMs through the Embedding Spacecited by 91
  16. 2024Coercing LLMs to do and reveal (almost) anythingcited by 89
  17. 2024Fast Adversarial Attacks on Language Models In One GPU Minutecited by 88
  18. 2024Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplificationcited by 81
  19. 2024Safeguarding Large Language Models: A Surveycited by 78
  20. 2024CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completioncited by 76
  21. 2024Jailbreaking Prompt Attack: A Controllable Adversarial Attack against Diffusion Modelscited by 72
  22. 2024Inducing High Energy-Latency of Large Vision-Language Models with Verbose Imagescited by 69
  23. 2021Prompt Waywardness: The Curious Case of Discretized Interpretation of Continuous Promptscited by 64
  24. 2024Query-Based Adversarial Prompt Generationcited by 62
  25. 2022Adversarial Training for High-Stakes Reliabilitycited by 60
  26. 2023On the Design Fundamentals of Diffusion Models: A Surveycited by 60
  27. 2024"Glue pizza and eat rocks" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Modelscited by 60
  28. 2021Adversarial Robustness Comparison of Vision Transformer and MLP-Mixer to CNNscited by 57
  29. 2024ImgTrojan: Jailbreaking Vision-Language Models with ONE Imagecited by 57
  30. 2023Generative Pre-trained Transformer: A Comprehensive Review on Enabling Technologies, Potential Applications, Emerging Challenges, and Future Directionscited by 55
  31. 2022LAMP: Extracting Text from Gradients with Language Model Priorscited by 54
  32. 2023Privacy in Large Language Models: Attacks, Defenses and Future Directionscited by 51
  33. 2024Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMscited by 51
  34. 2024Automated Red Teaming with GOAT: the Generative Offensive Agent Testercited by 45
  35. 2022SemAttack: Natural Textual Attacks via Different Semantic Spacescited by 42
  36. 2023On Robustness of Prompt-based Semantic Parsing with Large Pre-trained Language Model: An Empirical Study on Codexcited by 41
  37. 2023What's the Magic Word? A Control Theory of LLM Promptingcited by 41
  38. 2024Boosting Jailbreak Attack with Momentumcited by 40

50 most cited of 234 All 234 (JSON)