mlsanityData to 14 Oct 2026

Towards Improving Adversarial Training of NLP Models

arXiv 2109.00544 ↗First posted 1 Sep 2021cs.CL cs.AI cs.LGcited by 79

Not on the map. Why?

Abstract (arXiv)

Adversarial training, a method for learning robust deep neural networks, constructs adversarial examples during training. However, recent methods for generating NLP adversarial examples involve combinatorial search and expensive sentence encoders for constraining the generated instances. As a result, it remains challenging to use vanilla adversarial training to improve NLP models' performance, and the benefits are mainly uninvestigated. This paper proposes a simple and improved vanilla adversarial training process for NLP models, which we name Attacking to Training (A2T). The core part of A2T is a new and cheaper word substitution attack optimized for vanilla adversarial training. We use A2T to train BERT and RoBERTa models on IMDB, Rotten Tomatoes, Yelp, and SNLI datasets. Our results empirically show that it is possible to train robust NLP models using a much cheaper adversary. We demonstrate that vanilla adversarial training with A2T can improve an NLP model's robustness to the attack it was originally trained with and also defend the model against other types of word substitution attacks. Furthermore, we show that A2T can improve NLP models' standard accuracy, cross-domain generalization, and interpretability. Code is available at https://github.com/QData/Textattack-A2T .

Key facts. Cited by 79 papers in the map (data through 14 Oct 2026). Builds on 35 of its 55 references that are in the map. First posted on arXiv 1 Sep 2021.

Builds on

35 of 55 references.

References · 35

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,372
  3. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,170
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  6. 2016"Why Should I Trust You?": Explaining the Predictions of Any Classifiercited by 5,070
  7. 2019DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lightercited by 4,307
  8. 2015Character-level Convolutional Networks for Text Classificationcited by 2,330
  9. 2015A large annotated corpus for learning natural language inferencecited by 1,847
  10. 2017Decoupled Weight Decay Regularizationcited by 1,831
  11. 2016Adversarial examples in the physical worldcited by 1,769
  12. 2017Adversarial Examples for Evaluating Reading Comprehension Systemscited by 571
23 more
  1. 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 491
  2. 2018Universal Sentence Encodercited by 489
  3. 2019On Evaluating Adversarial Robustnesscited by 447
  4. 2018Generating Natural Language Adversarial Examplescited by 424
  5. 2015Evaluating the visualization of what a Deep Neural Network has learnedcited by 419
  6. 2018Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifierscited by 345
  7. 2020BAE: BERT-based Adversarial Examples for Text Classificationcited by 316
  8. 2016Adversarial Training Methods for Semi-Supervised Text Classificationcited by 280
  9. 2019SMART: Robust and Efficient Fine-Tuning for Pre-trained Natural Language Models through Principled Regularized Optimizationcited by 254
  10. 2019Facebook FAIR's WMT19 News Translation Task Submissioncited by 179
  11. 2019Certified Robustness to Adversarial Word Substitutionscited by 168
  12. 2016Counter-fitting Word Vectors to Linguistic Constraintscited by 140
  13. 2020Contextualized Perturbation for Textual Adversarial Attackcited by 136
  14. 2020Adversarial Training for Large Neural Language Modelscited by 111
  15. 2020SSMBA: Self-Supervised Manifold Based Data Augmentation for Improving Out-of-Domain Robustnesscited by 96
  16. 2018Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examplescited by 94
  17. 2019Achieving Verified Robustness to Symbol Substitutions via Interval Bound Propagationcited by 88
  18. 2020Reevaluating Adversarial Examples in Natural Languagecited by 85
  19. 2021Towards Robustness Against Natural Language Word Substitutionscited by 69
  20. 2018Training verified learners with learned verifierscited by 50
  21. 2020TextAttack: A Framework for Adversarial Attacks, Data Augmentation, and Adversarial Training in NLPcited by 45
  22. 2020Learning Variational Word Masks to Improve the Interpretability of Neural Text Classifierscited by 35
  23. 2020Searching for a Search Method: Benchmarking Search Algorithms for Generating NLP Adversarial Examplescited by 23

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 13; 2023: 29; 2024: 26; 2025: 7; 2026: 4.

79 papers.

Sort:

By area:

  1. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 387
  2. 2022State-of-the-art generalisation research in NLP: A taxonomy and reviewcited by 98
  3. 2024Typos that Broke the RAG's Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbationscited by 65
  4. 2024R.A.C.E.: Robust Adversarial Concept Erasure for Secure Text-to-Image Diffusion Modelcited by 58
  5. 2023Query-Efficient Black-Box Red Teaming via Bayesian Optimizationcited by 32
  6. 2023Adversarial Illusions in Multi-Modal Embeddingscited by 29
  7. 2023Are Chatbots Ready for Privacy-Sensitive Applications? An Investigation into Input Regurgitation and Prompt-Induced Sanitizationcited by 17
  8. 2023PTP: Boosting Stability and Performance of Prompt Tuning with Perturbation-Based Regularizercited by 15
  9. 2024LLM Whisperer: An Inconspicuous Attack to Bias LLM Responsescited by 15
  10. 2023Dynamic Transformers Provide a False Sense of Efficiencycited by 14
  11. 2024Towards Building a Robust Toxicity Predictorcited by 14
  12. 2023A Review of ChatGPT Applications in Education, Marketing, Software Engineering, and Healthcare: Benefits, Drawbacks, and Research Directionscited by 12
38 more
  1. 2023Generating Valid and Natural Adversarial Examples with Large Language Modelscited by 12
  2. 2024An Unsupervised Approach to Achieve Supervised-Level Explainability in Healthcare Recordscited by 12
  3. 2023Randomized Smoothing with Masked Inference for Adversarially Robust Text Classificationscited by 11
  4. 2023Improving the Robustness of Transformer-based Large Language Models with Dynamic Attentioncited by 10
  5. 2022Impact of Adversarial Training on Robustness and Generalizability of Language Modelscited by 9
  6. 2023TextDefense: Adversarial Text Detection based on Word Importance Entropycited by 9
  7. 2023LimeAttack: Local Explainable Method for Textual Hard-Label Adversarial Attackcited by 9
  8. 2026LaS-Comp: Zero-shot 3D Completion with Latent-Spatial Consistencycited by 9
  9. 2022Residue-Based Natural Language Adversarial Attack Detectioncited by 8
  10. 2023CitySpec with Shield: A Secure Intelligent Assistant for Requirement Formalizationcited by 7
  11. 2023Modeling Adversarial Attack on Pre-trained Language Models as Sequential Decision Makingcited by 6
  12. 2023LEAP: Efficient and Automated Test Method for NLP Softwarecited by 6
  13. 2024Adversarial Training: A Surveycited by 6
  14. 2023Towards Effective Paraphrasing for Information Disguisecited by 5
  15. 2024LLM-Based Robust Product Classification in Commerce and Compliancecited by 5
  16. 2024Hijacking Vision-and-Language Navigation Agents with Adversarial Environmental Attackscited by 5
  17. 2022Identifying Adversarial Attacks on Text Classifierscited by 4
  18. 2022Are Synonym Substitution Attacks Really Synonym Substitution Attacks?cited by 4
  19. 2023Frauds Bargain Attack: Generating Adversarial Text Samples via Word Manipulation Processcited by 4
  20. 2023A Classification-Guided Approach for Adversarial Attacks against Neural Machine Translationcited by 4
  21. 2023Improving Language Models Meaning Understanding and Consistency by Learning Conceptual Roles from Dictionarycited by 4
  22. 2023BERT Lost Patience Won't Be Robust to Adversarial Slowdowncited by 4
  23. 2024Extreme Miscalibration and the Illusion of Adversarial Robustnesscited by 4
  24. 2022Don't sweat the small stuff, classify the rest: Sample Shielding to protect text classifiers against adversarial attackscited by 3
  25. 2022Balanced Adversarial Training: Balancing Tradeoffs between Fickleness and Obstinacy in NLP Modelscited by 3
  26. 2023Enhancing Robustness of AI Offensive Code Generators via Data Augmentationcited by 3
  27. 2023Toward Stronger Textual Attack Detectorscited by 3
  28. 2024Finding a Needle in the Adversarial Haystack: A Targeted Paraphrasing Approach For Uncovering Edge Cases with Minimal Distribution Distortioncited by 3
  29. 2024SemRoDe: Macro Adversarial Training to Learn Representations That are Robust to Word-Level Attackscited by 3
  30. 2024PID Control-Based Self-Healing to Improve the Robustness of Large Language Modelscited by 3
  31. 2024Achieving Domain-Independent Certified Robustness via Knowledge Continuitycited by 3
  32. 2022Adversarial Attack and Defense for Non-Parametric Two-Sample Testscited by 2
  33. 2022Detecting Textual Adversarial Examples Based on Distributional Characteristics of Data Representationscited by 2
  34. 2022Learning to Ignore Adversarial Attackscited by 2
  35. 2022TCAB: A Large-Scale Text Classification Attack Benchmarkcited by 2
  36. 2024MaskPure: Improving Defense Against Text Adversaries with Stochastic Purificationcited by 2
  37. 2024TF-Attack: Transferable and Fast Adversarial Attacks on Large Language Modelscited by 2
  38. 2024TaeBench: Improving Quality of Toxic Adversarial Examplescited by 2

50 most cited of 79 All 79 (JSON)