mlsanityData to 14 Oct 2026

Don't Retrain, Just Rewrite: Countering Adversarial Perturbations by Rewriting Text

arXiv 2305.16444 ↗First posted 25 May 2023cs.CLcited by 8

Not on the map. Why?

Abstract (arXiv)

Can language models transform inputs to protect text classifiers against adversarial attacks? In this work, we present ATINTER, a model that intercepts and learns to rewrite adversarial inputs to make them non-adversarial for a downstream text classifier. Our experiments on four datasets and five attack mechanisms reveal that ATINTER is effective at providing better adversarial robustness than existing defense approaches, without compromising task accuracy. For example, on sentiment classification using the SST-2 dataset, our method improves the adversarial accuracy over the best existing defense approach by more than 4% with a smaller decrease in task accuracy (0.5% vs 2.5%). Moreover, we show that ATINTER generalizes across multiple downstream tasks and classifiers without having to explicitly retrain it for those settings. Specifically, we find that when ATINTER is trained to remove adversarial perturbations for the sentiment classification task on the SST-2 dataset, it even transfers to a semantically different task of news classification (on AGNews) and improves the adversarial robustness by more than 10%.

Key facts. Cited by 8 papers in the map (data through 14 Oct 2026). Builds on 42 of its 54 references that are in the map. First posted on arXiv 25 May 2023.

Builds on

42 of 54 references.

References · 42

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,599
  3. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,372
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  5. 2018GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understandingcited by 4,899
  6. 2019DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lightercited by 4,307
  7. 2019ALBERT: A Lite BERT for Self-supervised Learning of Language Representationscited by 2,790
  8. 2017A Broad-Coverage Challenge Corpus for Sentence Understanding through Inferencecited by 2,682
  9. 2015Character-level Convolutional Networks for Text Classificationcited by 2,330
  10. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  11. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  12. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 722
30 more
  1. 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 671
  2. 2017Adversarial Examples for Evaluating Reading Comprehension Systemscited by 571
  3. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
  4. 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 491
  5. 2017Non-Autoregressive Neural Machine Translationcited by 463
  6. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 446
  7. 2018Generating Natural Language Adversarial Examplescited by 424
  8. 2018TextBugger: Generating Adversarial Text Against Real-world Applicationscited by 381
  9. 2018Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifierscited by 345
  10. 2020BAE: BERT-based Adversarial Examples for Text Classificationcited by 316
  11. 2017Synthetic and Natural Noise Both Break Neural Machine Translationcited by 306
  12. 2019Certified Robustness to Adversarial Word Substitutionscited by 168
  13. 2020Understanding and Mitigating the Tradeoff Between Robustness and Accuracycited by 149
  14. 2016Counter-fitting Word Vectors to Linguistic Constraintscited by 140
  15. 2018Pathologies of Neural Models Make Interpretations Difficultcited by 140
  16. 2021Measure and Improve Robustness in NLP Models: A Surveycited by 107
  17. 2018Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examplescited by 94
  18. 2019Achieving Verified Robustness to Symbol Substitutions via Interval Bound Propagationcited by 88
  19. 2020Reevaluating Adversarial Examples in Natural Languagecited by 85
  20. 2020SAFER: A Structure-free Approach for Certified Robustness to Adversarial Word Substitutionscited by 73
  21. 2020It's Morphin' Time! Combating Linguistic Discrimination with Inflectional Perturbationscited by 64
  22. 2019Learning to Discriminate Perturbations for Blocking Adversarial Attacks in Text Classificationcited by 57
  23. 2021BERT & Family Eat Word Salad: Experiments with Text Understandingcited by 44
  24. 2021Defending Pre-trained Language Models from Adversarial Word Substitutions Without Performance Sacrificecited by 30
  25. 2022Text Generation with Text-Editing Modelscited by 21
  26. 2021Textual Backdoor Attacks Can Be More Harmful via Two Simple Trickscited by 18
  27. 2020SHIELD: Defending Textual Neural Networks against Multiple Black-Box Adversarial Attacks with Stochastic Multi-Expert Patchercited by 13
  28. 2022ROSE: Robust Selective Fine-tuning for Pre-trained Language Modelscited by 6
  29. 2022Distinguishing Non-natural from Natural Adversarial Samples for More Robust Pre-trained Language Modelcited by 3
  30. 2022Don't sweat the small stuff, classify the rest: Sample Shielding to protect text classifiers against adversarial attackscited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 3; 2025: 4; 2026: 1.

8 papers.

  1. 2024Beyond Perplexity: Multi-dimensional Safety Evaluation of LLM Compressioncited by 33
  2. 2024State Space Models are Strong Text Rerankerscited by 10
  3. 2025Exploring Gradient-Guided Masked Language Model to Detect Textual Adversarial Attackscited by 4
  4. 2025SALMAN: Stability Analysis of Language Models Through the Maps Between Graph-based Manifoldscited by 2
  5. 2024DiffuseDef: Improved Robustness to Adversarial Attacks via Iterative Denoisingcited by 1
  6. 2025Reformulation is All You Need: Addressing Malicious Text Features in DNNscited by 1
  7. 2025Backdoor Samples Detection Based on Perturbation Discrepancy Consistency in Pre-trained Language Modelscited by 0
  8. 2026Agentic Adversarial Rewriting Exposes Architectural Vulnerabilities in Black-Box NLP Pipelinescited by 0