mlsanityData to 7 Oct 2026

Semantic-Preserving Adversarial Text Attacks

arXiv 2108.10015 ↗First posted 23 Aug 2021cs.CL stat.MLcited by 5

Not on the map. Why?

Abstract (arXiv)

Deep neural networks (DNNs) are known to be vulnerable to adversarial images, while their robustness in text classification is rarely studied. Several lines of text attack methods have been proposed in the literature, including character-level, word-level, and sentence-level attacks. However, it is still a challenge to minimize the number of word changes necessary to induce misclassification, while simultaneously ensuring lexical correctness, syntactic soundness, and semantic similarity. In this paper, we propose a Bigram and Unigram based adaptive Semantic Preservation Optimization (BU-SPO) method to examine the vulnerability of deep models. Our method has four major merits. Firstly, we propose to attack text documents not only at the unigram word level but also at the bigram level which better keeps semantics and avoids producing meaningless outputs. Secondly, we propose a hybrid method to replace the input words with options among both their synonyms candidates and sememe candidates, which greatly enriches the potential substitutions compared to only using synonyms. Thirdly, we design an optimization algorithm, i.e., Semantic Preservation Optimization (SPO), to determine the priority of word replacements, aiming to reduce the modification cost. Finally, we further improve the SPO with a semantic Filter (named SPOF) to find the adversarial example with the highest semantic similarity. We evaluate the effectiveness of our BU-SPO and BU-SPOF on IMDB, AG's News, and Yahoo! Answers text datasets by attacking four popular DNNs models. Results show that our methods achieve the highest attack success rates and semantics rates by changing the smallest number of words compared with existing methods.

Key facts. Cited by 5 papers in the map (data through 7 Oct 2026). Builds on 24 of its 49 references that are in the map. First posted on arXiv 23 Aug 2021.

Builds on

24 of 49 references.

References · 24

  1. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2013Intriguing properties of neural networkscited by 5,114
  4. 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
  5. 2014Convolutional Neural Networks for Sentence Classificationcited by 1,124
  6. 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 663
  7. 2017Adversarial Examples for Evaluating Reading Comprehension Systemscited by 568
  8. 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 488
  9. 2018Universal Sentence Encodercited by 485
  10. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  11. 2018Generating Natural Language Adversarial Examplescited by 422
  12. 2018Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifierscited by 341
12 more
  1. 2020BAE: BERT-based Adversarial Examples for Text Classificationcited by 316
  2. 2017Synthetic and Natural Noise Both Break Neural Machine Translationcited by 304
  3. 2018Audio Adversarial Examples: Targeted Attacks on Speech-to-Textcited by 268
  4. 2016Understanding Neural Networks through Representation Erasurecited by 223
  5. 2016Counter-fitting Word Vectors to Linguistic Constraintscited by 138
  6. 2016Crafting Adversarial Input Sequences for Recurrent Neural Networkscited by 102
  7. 2014word2vec Parameter Learning Explainedcited by 53
  8. 2020TextAttack: A Framework for Adversarial Attacks, Data Augmentation, and Adversarial Training in NLPcited by 45
  9. 2018Comparing Attention-based Convolutional and Recurrent Neural Networks: Success and Limitations in Machine Reading Comprehensioncited by 19
  10. 2020Point Adversarial Self Mining: A Simple Method for Facial Expression Recognitioncited by 11
  11. 2019Adversarial Attacks on Deep Learning Models in Natural Language Processing: A Surveycited by 10
  12. 2019Generating Black-Box Adversarial Examples for Text Classifiers Using a Deep Reinforced Modelcited by 10

Built on by

Cited by year

Citing papers per year: 2023: 1; 2024: 2; 2025: 2.

5 papers.

  1. 2025Emoti-Attack: Zero-Perturbation Adversarial Attacks on NLP Systems via Emoji Sequencescited by 5
  2. 2024Saliency Attention and Semantic Similarity-Driven Adversarial Perturbationcited by 4
  3. 2024Enhancing Adversarial Text Attacks on BERT Models with Projected Gradient Descentcited by 3
  4. 2023Towards Unsupervised Graph Completion Learning on Graphs with Features and Structure Missingcited by 1
  5. 2025Improving Adversarial Robustness via Phase and Amplitude-aware Promptingcited by 0