mlsanityData to 14 Oct 2026

Certified Robustness to Text Adversarial Attacks by Randomized [MASK]

arXiv 2105.03743 ↗First posted 8 May 2021cs.CLcited by 57

Not on the map. Why?

Abstract (arXiv)

Recently, few certified defense methods have been developed to provably guarantee the robustness of a text classifier to adversarial synonym substitutions. However, all existing certified defense methods assume that the defenders are informed of how the adversaries generate synonyms, which is not a realistic scenario. In this paper, we propose a certifiably robust defense method by randomly masking a certain proportion of the words in an input text, in which the above unrealistic assumption is no longer necessary. The proposed method can defend against not only word substitution-based attacks, but also character-level perturbations. We can certify the classifications of over 50% texts to be robust to any perturbation of 5 words on AGNEWS, and 2 words on SST2 dataset. The experimental results show that our randomized smoothing method significantly outperforms recently proposed defense methods across multiple datasets.

Key facts. Cited by 57 papers in the map (data through 14 Oct 2026). Builds on 46 of its 68 references that are in the map. First posted on arXiv 8 May 2021.

Builds on

46 of 68 references.

References · 46

  1. 2017Attention Is All You Needcited by 60,361
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  3. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,372
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  6. 2013Intriguing properties of neural networkscited by 5,155
  7. 2016SGDR: Stochastic Gradient Descent with Warm Restartscited by 5,045
  8. 2015Character-level Convolutional Networks for Text Classificationcited by 2,330
  9. 2015A large annotated corpus for learning natural language inferencecited by 1,847
  10. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  11. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
  12. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
34 more
  1. 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 671
  2. 2017Adversarial Examples for Evaluating Reading Comprehension Systemscited by 571
  3. 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 491
  4. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 468
  5. 2018Generating Natural Language Adversarial Examplescited by 424
  6. 2018TextBugger: Generating Adversarial Text Against Real-world Applicationscited by 381
  7. 2018Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifierscited by 345
  8. 2018On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Modelscited by 328
  9. 2016Adversarial Training Methods for Semi-Supervised Text Classificationcited by 280
  10. 2019FreeLB: Enhanced Adversarial Training for Natural Language Understandingcited by 264
  11. 2019Adversarial Attacks and Defenses in Images, Graphs and Text: A Reviewcited by 237
  12. 2017Generating Natural Adversarial Examplescited by 183
  13. 2019Certified Robustness to Adversarial Word Substitutionscited by 168
  14. 2017Deep Text Classification Can be Fooledcited by 106
  15. 2019Text Processing Like Humans Do: Visually Attacking and Shielding NLP Systemscited by 101
  16. 2018Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examplescited by 94
  17. 2019Achieving Verified Robustness to Symbol Substitutions via Interval Bound Propagationcited by 88
  18. 2020Robustness Verification for Transformerscited by 76
  19. 2020SAFER: A Structure-free Approach for Certified Robustness to Adversarial Word Substitutionscited by 73
  20. 2018Interpretable Adversarial Perturbation in Input Embedding Space for Textcited by 67
  21. 2019Robustness Certificates for Sparse Adversarial Attacks by Randomized Ablationcited by 60
  22. 2017Towards Crafting Text Adversarial Samplescited by 55
  23. 2018Training verified learners with learned verifierscited by 50
  24. 2020Generating Natural Language Attacks in a Hard Label Black Box Settingcited by 50
  25. 2018Greedy Attack and Gumbel Attack: Generating Adversarial Examples for Discrete Datacited by 38
  26. 2019Word-level Textual Adversarial Attacking as Combinatorial Optimizationcited by 37
  27. 2018Discrete Adversarial Attacks and Submodular Optimization with Applications to Text Classificationcited by 35
  28. 2020Defense against Adversarial Attacks in NLP via Dirichlet Neighborhood Ensemblecited by 28
  29. 2020Adversarial Attack and Defense of Structured Prediction Modelscited by 20
  30. 2020On the Transferability of Adversarial Attacksagainst Neural Text Classifiercited by 16
  31. 2018Word Embedding Perturbation for Sentence Classificationcited by 11
  32. 2017DANCin SEQ2SEQ: Fooling Text Classifiers with Adversarial Text Example Generationcited by 9
  33. 2020Voting based ensemble improves robustness of defensive modelscited by 7
  34. 2019Interpretable Adversarial Training for Textcited by 6

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 1; 2022: 8; 2023: 10; 2024: 15; 2025: 14; 2026: 9.

57 papers.

Sort:

By area:

  1. 2023Defending Against Alignment-Breaking Attacks via Robustly Aligned LLMcited by 192
  2. 2023A Survey of Safety and Trustworthiness of Large Language Models through the Lens of Verification and Validationcited by 93
  3. 2024Defending Large Language Models against Jailbreak Attacks via Semantic Smoothingcited by 74
  4. 2021Searching for an Effective Defender: Benchmarking Defense against Adversarial Word Substitutioncited by 56
  5. 2023Text-CRS: A Generalized Certified Robustness Framework against Textual Adversarial Attackscited by 34
  6. 2025Topic-FlipRAG: Topic-Orientated Adversarial Opinion Manipulation Attacks to Retrieval-Augmented Generation Modelscited by 33
  7. 2025FlippedRAG: Black-Box Opinion Manipulation Adversarial Attacks to Retrieval-Augmented Generation Modelscited by 25
  8. 2022Certified Robustness Against Natural Language Attacks by Causal Interventioncited by 24
  9. 2022A Survey of Adversarial Defences and Robustness in NLPcited by 23
  10. 2023Certified Robustness for Large Language Models with Self-Denoisingcited by 23
  11. 2022Textual Manifold-based Defense Against Natural Language Adversarial Examplescited by 19
  12. 2023RS-Del: Edit Distance Robustness Certificates for Sequence Classifiers via Randomized Deletioncited by 17
38 more
  1. 2022Text Adversarial Purification as Defense against Adversarial Attackscited by 16
  2. 2024NLP Verification: Towards a General Methodology for Certifying Robustnesscited by 16
  3. 2024Advancing the Robustness of Large Language Models through Self-Denoised Smoothingcited by 16
  4. 2024Are AI-Generated Text Detectors Robust to Adversarial Perturbations?cited by 16
  5. 2022Robust Textual Embedding against Word-level Adversarial Attackscited by 12
  6. 2022Robust Natural Language Processing: Recent Advances, Challenges, and Future Directionscited by 11
  7. 2022Impact of Adversarial Training on Robustness and Generalizability of Language Modelscited by 9
  8. 2023Less is More: Understanding Word-level Textual Adversarial Attack via n-gram Frequency Descendcited by 9
  9. 2025Generative or Discriminative? Revisiting Text Classification in the Era of Transformerscited by 9
  10. 2024Adversarial Text Purification: A Large Language Model Approach for Defensecited by 8
  11. 2024Risks, Causes, and Mitigations of Widespread Deployments of Large Language Models (LLMs): A Surveycited by 8
  12. 2025Towards the Worst-case Robustness of Large Language Modelscited by 7
  13. 2025CluCERT: Certifying LLM Robustness via Clustering-Guided Denoising Smoothingcited by 6
  14. 2024Learn to Disguise: Avoid Refusal Responses in LLM's Defense via a Multi-agent Attacker-Disguiser Gamecited by 5
  15. 2024ProTransformer: Robustify Transformers via Plug-and-Play Paradigmcited by 5
  16. 2023Robust Few-Shot Named Entity Recognition with Boundary Discrimination and Correlation Purificationcited by 4
  17. 2024MMCert: Provable Defense against Adversarial Attacks to Multi-modal Modelscited by 4
  18. 2026SMSR: Certified Defence Against Runtime Memory Poisoning in Persistent LLM Agent Systemscited by 4
  19. 2022Don't sweat the small stuff, classify the rest: Sample Shielding to protect text classifiers against adversarial attackscited by 3
  20. 2023Benchmarking Robustness of Text-Image Composed Retrievalcited by 2
  21. 2024MaskPure: Improving Defense Against Text Adversaries with Stochastic Purificationcited by 2
  22. 2024CERT-ED: Certifiably Robust Text Classification for Edit Distancecited by 2
  23. 2025Tougher Text, Smarter Models: Raising the Bar for Adversarial Defence Benchmarkscited by 2
  24. 2025GenoArmory: A Unified Evaluation Framework for Adversarial Attacks on Genomic Foundation Modelscited by 2
  25. 2025Adversarial Defence without Adversarial Defence: Enhancing Language Model Robustness via Instance-level Principal Component Removalcited by 2
  26. 2025Guided Perturbation Sensitivity (GPS): Detecting Adversarial Text via Embedding Stability and Word Importancecited by 2
  27. 2023Improving Classifier Robustness through Active Generation of Pairwise Counterfactualscited by 1
  28. 2023Fooling the Textual Fooler via Randomizing Latent Representationscited by 1
  29. 2024CR-UTP: Certified Robustness against Universal Text Perturbations on Large Language Modelscited by 1
  30. 2024DiffuseDef: Improved Robustness to Adversarial Attacks via Iterative Denoisingcited by 1
  31. 2025Bridging Robustness and Generalization Against Word Substitution Attacks in NLP via the Growth Bound Matrix Approachcited by 1
  32. 2025RobustMask: Certified Robustness against Adversarial Neural Ranking Attack via Randomized Maskingcited by 1
  33. 2026DiscourseFlip: An Oblique Discourse-Level Opinion Manipulation Attack against Black-box Retrieval-Augmented Generationcited by 1
  34. 2024Reversible Jump Attack to Textual Classifiers with Modification Reductioncited by 0
  35. 2024GenFighter: A Generative and Evolutive Textual Attack Removalcited by 0
  36. 2025RedHerring Attack: Testing the Reliability of Attack Detectioncited by 0
  37. 2025AdaptDel: Adaptable Deletion Rate Randomized Smoothing for Certified Robustnesscited by 0
  38. 2025Adversarially Robust Detection of Harmful Online Content: A Computational Design Science Approachcited by 0

50 most cited of 57 All 57 (JSON)