---
title: "Generating Natural Language Adversarial — Alzantot 2018"
description: "Adversarial attacks are well studied for images, but text is harder."
authors: ["Moustafa Alzantot", "Yash Sharma", "Ahmed Elgohary", "Bo-Jhang Ho", "Mani Srivastava", "Kai-Wei Chang"]
year: 2018
venue: "arXiv:1804.07998"
source: "https://arxiv.org/abs/1804.07998"
doi: "10.48550/arxiv.1804.07998"
arxiv: "1804.07998"
licence: "arXiv — non-exclusive license to distribute"
licence_url: "http://arxiv.org/licenses/nonexclusive-distrib/1.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/alzantot-2018-generating-natural-language-adversarial-examples/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/alzantot-2018-generating-natural-language-adversarial-examples/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2018](https://md.research.elamur.ai/free/en/papers/2018/page/2/) / Generating Natural Language Adversarial Examples

# Generating Natural Language Adversarial Examples

**Authors:** Moustafa Alzantot, Yash Sharma, [Ahmed Elgohary](https://md.research.elamur.ai/free/en/authors/ahmed-elgohary/), Bo-Jhang Ho, Mani Srivastava, [Kai-Wei Chang](https://md.research.elamur.ai/free/en/authors/kai-wei-chang/) · **Year:** 2018 · **Venue:** arXiv:1804.07998 · **Licence:** [arXiv — non-exclusive license to distribute](http://arxiv.org/licenses/nonexclusive-distrib/1.0/)

**Links:** [Publisher's page](https://arxiv.org/abs/1804.07998) · [PDF](https://arxiv.org/pdf/1804.07998) · [DOI 10.48550/arxiv.1804.07998](https://doi.org/10.48550/arxiv.1804.07998) · [arXiv 1804.07998](https://arxiv.org/abs/1804.07998) · [OpenAlex](https://openalex.org/W2962718684)

**Citations:** 787 citations (openalex-snapshot · 2026-10-14) · [315](#cited-by) in our library, of the 140884 papers whose bibliographies we read

## Summary
Adversarial attacks are well studied for images, but text is harder. Words are discrete, so input gradients are unavailable, and every edit is visible to a reader. Alzantot et al. propose a black-box attack that needs only the victim model's output probabilities. It replaces individual words with synonyms, guided by a genetic algorithm. Candidate substitutes come from counter-fitted GloVe neighbours. The Google 1 billion words language model then filters them for fit with the surrounding context. From the survivors, the attack keeps the word that most increases the target class probability. A population of perturbed texts evolves through fitness-weighted selection, crossover and further mutation. The authors tested the attack on an LSTM sentiment classifier trained on IMDB and an entailment model trained on SNLI, where only the hypothesis could be edited. It flipped 97% and 70% of correctly classified inputs, respectively, and outperformed a greedy baseline. Human raters mostly still assigned the original sentiment. Retraining with adversarial examples gave no protection, which shows that NLP models need stronger defences.

## Key points
- **Search settings:** population S = 60, at most G = 20 generations, N = 8 embedding neighbours within δ = 0.5, and the top K = 4 by language-model score. Edits were capped at 20% of words for IMDB and 25% for SNLI. Articles and prepositions were never replaced.
- **Success rates and runtime:** 97% on IMDB and 70% on SNLI. The authors attribute the lower SNLI rate to short hypotheses, which average about 9 words, versus 229 words for IMDB reviews (truncated to 100). The greedy Perturb baseline did worse on IMDB and achieved no successes on SNLI under the change cap. On a single TitanX, a successful attack took 43.5 s on average for IMDB and 5 s for SNLI.
- **User study (20 volunteers):** for 100 adversarial reviews, 92.3% of sentiment labels matched the original. Raters gave original/adversarial pairs a mean similarity score of 2.23 ± 0.25, where 1 indicated very similar and 4 indicated very different.
- **Adversarial training:** 1000 attack examples from the IMDB training set were added and the model was retrained from scratch. Test-set robustness did not improve, even though the model classified the injected examples almost perfectly.
- **Code:** the attack is released at github.com/nesl/nlp_adversarial_examples.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

Fields: [Other](https://md.research.elamur.ai/free/en/shelves/other/)

## Cited by

Cited by

315 papers of our library cite it (of the 140884 whose bibliographies we read); 31 of them have a page here, 284 not yet.

- [Analysis Methods in Neural Language Processing: A Survey](https://md.research.elamur.ai/free/en/papers/belinkov-2019-analysis-methods-neural-language-processing/)
- [Robust Neural Machine Translation with Doubly Adversarial Inputs](https://md.research.elamur.ai/free/en/papers/cheng-2019-robust-neural-machine-translation-doubly/)
- [AugGPT: Leveraging ChatGPT for Text Data Augmentation](https://md.research.elamur.ai/free/en/papers/dai-2023-auggpt-leveraging-chatgpt-text-data/)
- [A Closer Look into the Robustness of Neural Dependency Parsers Using Better Adversarial Examples](https://md.research.elamur.ai/free/en/papers/findings-2021-wang-closer-look-into-robustness-neural/)
- [Results of WMT22 Metrics Shared Task: Stop Using BLEU – Neural Metrics Are Better and More Robust](https://md.research.elamur.ai/free/en/papers/freitag-2022-results-wmt22-metrics-shared-task/)
- [BAE: BERT-based Adversarial Examples for Text Classification](https://md.research.elamur.ai/free/en/papers/garg-2020-bae-bert-based-adversarial-examples/)
- [Gradient-based Adversarial Attacks against Text Transformers](https://md.research.elamur.ai/free/en/papers/guo-2021-gradient-based-adversarial-attacks-against/)
- [An Analysis of Natural Language Inference Benchmarks through the Lens of Negation](https://md.research.elamur.ai/free/en/papers/hossain-2020-analysis-natural-language-inference-benchmarks/)
- [Improved Lexically Constrained Decoding for Translation and Monolingual Rewriting](https://md.research.elamur.ai/free/en/papers/hu-2019-improved-lexically-constrained-decoding-translation/)
- [Certified Robustness to Adversarial Word Substitutions](https://md.research.elamur.ai/free/en/papers/jia-2019-certified-robustness-adversarial-word-substitutions/)
- [Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailment](https://md.research.elamur.ai/free/en/papers/jin-2019-bert-really-robust-strong-baseline/)
- [TextBugger: Generating Adversarial Text Against Real-world Applications](https://md.research.elamur.ai/free/en/papers/li-2018-textbugger-generating-adversarial-text-against/)
- [BERT-ATTACK: Adversarial Attack Against BERT Using BERT](https://md.research.elamur.ai/free/en/papers/li-2020-bert-attack-adversarial-attack-against/)
- [Contextualized Perturbation for Textual Adversarial Attack](https://md.research.elamur.ai/free/en/papers/li-2021-contextualized-perturbation-textual-adversarial-attack/)
- [Facilitating Contrastive Learning of Discourse Relational Senses by Exploiting the Hierarchy of Sense Relations](https://md.research.elamur.ai/free/en/papers/long-2022-facilitating-contrastive-learning-discourse-relational/)
- [A Holistic Approach to Undesired Content Detection in the Real World](https://md.research.elamur.ai/free/en/papers/markov-2022-holistic-approach-undesired-content-detection/)
- [TextAttack: A Framework for Adversarial Attacks, Data Augmentation, and Adversarial Training in NLP](https://md.research.elamur.ai/free/en/papers/morris-2020-textattack-framework-adversarial-attacks-data/)
- [Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer](https://md.research.elamur.ai/free/en/papers/qi-2021-mind-style-text-adversarial-backdoor/)
- [Generating Natural Language Adversarial Examples through Probability Weighted Word Saliency](https://md.research.elamur.ai/free/en/papers/ren-2019-generating-natural-language-adversarial-examples/)
- [SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks](https://md.research.elamur.ai/free/en/papers/robey-2023-smoothllm-defending-large-language-models/)
- [SherLIiC: A Typed Event-Focused Lexical Inference Benchmark for Evaluating Natural Language Inference](https://md.research.elamur.ai/free/en/papers/schmitt-2019-sherliic-typed-event-focused-lexical/)
- [Improving Generalization in Coreference Resolution via Adversarial Training](https://md.research.elamur.ai/free/en/papers/subramanian-2019-improving-generalization-coreference-resolution-adversarial/)
- [PAWS-X: A Cross-lingual Adversarial Dataset for Paraphrase Identification](https://md.research.elamur.ai/free/en/papers/yang-2019-paws-x-cross-lingual-adversarial/)
- [Generative Data Augmentation for Commonsense Reasoning](https://md.research.elamur.ai/free/en/papers/yang-2020-generative-data-augmentation-commonsense-reasoning/)
- [Word-level Textual Adversarial Attacking as Combinatorial Optimization](https://md.research.elamur.ai/free/en/papers/zang-2020-word-level-textual-adversarial-attacking/)
- [PAWS: Paraphrase Adversaries from Word Scrambling](https://md.research.elamur.ai/free/en/papers/zhang-2019-paws-paraphrase-adversaries-word-scrambling/)
- [中文对抗攻击下的ChatGPT鲁棒性评估](https://md.research.elamur.ai/free/en/papers/zhang-2025-robustness-evaluation-chatgpt/)
- [Evaluating and Enhancing the Robustness of Neural Network-based Dependency Parsing Models with Adversarial Examples](https://md.research.elamur.ai/free/en/papers/zheng-2020-evaluating-enhancing-robustness-neural-network/)
- [Red teaming ChatGPT via Jailbreaking: Bias, Robustness, Reliability and Toxicity](https://md.research.elamur.ai/free/en/papers/zhuo-2023-red-teaming-chatgpt-jailbreaking-bias/)
- [VALUE: Understanding Dialect Disparity in NLU](https://md.research.elamur.ai/free/en/papers/ziems-2022-value-understanding-dialect-disparity-nlu/)
- [Universal and Transferable Adversarial Attacks on Aligned Language Models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/)

## Cite

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@misc{alzantot2018generating,
  title = {{Generating Natural Language Adversarial Examples}},
  author = {Alzantot, Moustafa and Sharma, Yash and Elgohary, Ahmed and Ho, Bo-Jhang and Srivastava, Mani and Chang, Kai-Wei},
  year = {2018},
  doi = {10.48550/arxiv.1804.07998},
  eprint = {1804.07998},
  archivePrefix = {arXiv},
  url = {https://doi.org/10.48550/arxiv.1804.07998}
}
```

- [← previous GenDR: A Generic Deep Realizer with Complex Lexicalization](https://md.research.elamur.ai/free/en/papers/lareau-2018-gendr-generic-deep-realizer-complex/)
- [next → Generating Wikipedia by Summarizing Long Sequences](https://md.research.elamur.ai/free/en/papers/liu-2018-generating-wikipedia-summarizing-long-sequences/)
- [↑ back to papers of 2018](https://md.research.elamur.ai/free/en/papers/2018/page/2/)

## References

26 references, 8 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. M. Alzantot, Y. Sharma, S. Chakraborty, and M. Srivastava. 2018. Genattack: Practical black-box attacks with gradient-free optimization. arXiv preprint arXiv:1805.11090. — [arXiv:1805.11090](https://arxiv.org/abs/1805.11090) [find](https://scholar.google.com/scholar?q=M%2E+Alzantot%2C+Y%2E+Sharma%2C+S%2E+Chakraborty%2C+and+M%2E+Srivastava%2E+2018%2E+Genattack%3A+Practical+black%2Dbox+attacks+with+gradient%2Dfree+optimization%2E+arXiv+preprint+arXiv%3A1805%2E11090%2E+%E2%80%94+%5BarXiv%3A1805%2E11090%5D%28https%3A%2F%2Fa)
2. Edward J Anderson and Michael C Ferris. 1994. Genetic algorithms for combinatorial optimization: the assemble line balancing problem. ORSA Journal on Computing, 6(2):161–173. [find](https://scholar.google.com/scholar?q=Edward+J+Anderson+and+Michael+C+Ferris%2E+1994%2E+Genetic+algorithms+for+combinatorial+optimization%3A+the+assemble+line+balancing+problem%2E+ORSA+Journal+on+Computing%2C+6%282%29%3A161%E2%80%93173%2E)
3. Samuel R Bowman, Gabor Angeli, Christopher Potts, and Christopher D Manning. 2015. A large annotated corpus for learning natural language inference. arXiv preprint arXiv:1508.05326. [find](https://scholar.google.com/scholar?q=Samuel+R+Bowman%2C+Gabor+Angeli%2C+Christopher+Potts%2C+and+Christopher+D+Manning%2E+2015%2E+A+large+annotated+corpus+for+learning+natural+language+inference%2E+arXiv+preprint+arXiv%3A1508%2E05326%2E)
4. N. Carlini and D. Wagner. 2017. Towards evaluating the robustness of neural networks. arXiv preprint arXiv:1608.04644. — [arXiv:1608.04644](https://arxiv.org/abs/1608.04644) [find](https://scholar.google.com/scholar?q=N%2E+Carlini+and+D%2E+Wagner%2E+2017%2E+Towards+evaluating+the+robustness+of+neural+networks%2E+arXiv+preprint+arXiv%3A1608%2E04644%2E+%E2%80%94+%5BarXiv%3A1608%2E04644%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F1608%2E04644%29)
5. Nicholas Carlini and David Wagner. 2018. Audio adversarial examples: Targeted attacks on speech-to-text. arXiv preprint arXiv:1801.01944. — [arXiv:1801.01944](https://arxiv.org/abs/1801.01944) [find](https://scholar.google.com/scholar?q=Nicholas+Carlini+and+David+Wagner%2E+2018%2E+Audio+adversarial+examples%3A+Targeted+attacks+on+speech%2Dto%2Dtext%2E+arXiv+preprint+arXiv%3A1801%2E01944%2E+%E2%80%94+%5BarXiv%3A1801%2E01944%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F1801%2E01944%29)
6. Ciprian Chelba, Tomas Mikolov, Mike Schuster, Qi Ge, Thorsten Brants, Phillipp Koehn, and Tony Robinson. 2013. One billion word benchmark for measuring progress in statistical language modeling. arXiv preprint arXiv:1312.3005. [find](https://scholar.google.com/scholar?q=Ciprian+Chelba%2C+Tomas+Mikolov%2C+Mike+Schuster%2C+Qi+Ge%2C+Thorsten+Brants%2C+Phillipp+Koehn%2C+and+Tony+Robinson%2E+2013%2E+One+billion+word+benchmark+for+measuring+progress+in+statistical+language+modeling%2E+arXiv) [our card](https://md.research.elamur.ai/free/en/papers/chelba-2013-one-billion-word-benchmark-measuring/)
7. P. Chen, H Zhang, Y. Sharma, J. Yi, and C. Hseih. 2017a. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. arXiv preprint arXiv:1708.03999. — [arXiv:1708.03999](https://arxiv.org/abs/1708.03999) [find](https://scholar.google.com/scholar?q=P%2E+Chen%2C+H+Zhang%2C+Y%2E+Sharma%2C+J%2E+Yi%2C+and+C%2E+Hseih%2E+2017a%2E+Zoo%3A+Zeroth+order+optimization+based+black%2Dbox+attacks+to+deep+neural+networks+without+training+substitute+models%2E+arXiv+preprint+arXiv%3A1708%2E03)
8. P. Y. Chen, Y. Sharma, H. Zhang, J. Yi, and C. Hsieh. 2017b. Ead: Elastic-net attacks to deep neural networks via adversarial examples. arXiv preprint arXiv:1709.0414. — [arXiv:1709.0414](https://arxiv.org/abs/1709.0414) [find](https://scholar.google.com/scholar?q=P%2E+Y%2E+Chen%2C+Y%2E+Sharma%2C+H%2E+Zhang%2C+J%2E+Yi%2C+and+C%2E+Hsieh%2E+2017b%2E+Ead%3A+Elastic%2Dnet+attacks+to+deep+neural+networks+via+adversarial+examples%2E+arXiv+preprint+arXiv%3A1709%2E0414%2E+%E2%80%94+%5BarXiv%3A1709%2E0414%5D%28https%3A%2F%2Farxi)
9. Qian Chen, Xiaodan Zhu, Zhen-Hua Ling, Si Wei, Hui Jiang, and Diana Inkpen. 2017c. Enhanced lstm for natural language inference. In Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), volume 1, pages 1657–1668. [find](https://scholar.google.com/scholar?q=Qian+Chen%2C+Xiaodan+Zhu%2C+Zhen%2DHua+Ling%2C+Si+Wei%2C+Hui+Jiang%2C+and+Diana+Inkpen%2E+2017c%2E+Enhanced+lstm+for+natural+language+inference%2E+In+Proceedings+of+the+55th+Annual+Meeting+of+the+Association+for+Comput)
10. J. Ebrahimi, A. Rao, D. Lowd, and D. Dou. 2018. Hotflip: White-box adversarial examples for text classification. ACL’18; arXiv preprint arXiv:1712.06751. [find](https://scholar.google.com/scholar?q=J%2E+Ebrahimi%2C+A%2E+Rao%2C+D%2E+Lowd%2C+and+D%2E+Dou%2E+2018%2E+Hotflip%3A+White%2Dbox+adversarial+examples+for+text+classification%2E+ACL%E2%80%9918%3B+arXiv+preprint+arXiv%3A1712%2E06751%2E) [our card](https://md.research.elamur.ai/free/en/papers/ebrahimi-2018-hotflip-white-box-adversarial-examples/)
11. Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572. [find](https://scholar.google.com/scholar?q=Ian+J+Goodfellow%2C+Jonathon+Shlens%2C+and+Christian+Szegedy%2E+2014%2E+Explaining+and+harnessing+adversarial+examples%2E+arXiv+preprint+arXiv%3A1412%2E6572%2E) [our card](https://md.research.elamur.ai/free/en/papers/goodfellow-2014-explaining-harnessing-adversarial-examples/)
12. Mohit Iyyer, John Wieting, Kevin Gimpel, and Luke Zettlemoyer. 2018. Adversarial example generation with syntactically controlled paraphrase networks. In Proceedings of NAACL. [find](https://scholar.google.com/scholar?q=Mohit+Iyyer%2C+John+Wieting%2C+Kevin+Gimpel%2C+and+Luke+Zettlemoyer%2E+2018%2E+Adversarial+example+generation+with+syntactically+controlled+paraphrase+networks%2E+In+Proceedings+of+NAACL%2E) [our card](https://md.research.elamur.ai/free/en/papers/iyyer-2018-adversarial-example-generation-syntactically-controlled/)
13. Robin Jia and Percy Liang. 2017. Adversarial examples for evaluating reading comprehension systems. arXiv preprint arXiv:1707.07328. [find](https://scholar.google.com/scholar?q=Robin+Jia+and+Percy+Liang%2E+2017%2E+Adversarial+examples+for+evaluating+reading+comprehension+systems%2E+arXiv+preprint+arXiv%3A1707%2E07328%2E) [our card](https://md.research.elamur.ai/free/en/papers/jia-2017-adversarial-examples-evaluating-reading-comprehension/)
14. V. Kuleshov, S. Thakoor, T. Lau, and S. Ermon. 2018. Adversarial examples for natural language classification problems. OpenReview submission OpenReview:r1QZ3zbAZ. [find](https://scholar.google.com/scholar?q=V%2E+Kuleshov%2C+S%2E+Thakoor%2C+T%2E+Lau%2C+and+S%2E+Ermon%2E+2018%2E+Adversarial+examples+for+natural+language+classification+problems%2E+OpenReview+submission+OpenReview%3Ar1QZ3zbAZ%2E)
15. A. Kurakin, I. Goodfellow, and S. Bengio. 2016. Adversarial machine learning at scale. ICLR’17; arXiv preprint arXiv:1611.01236. — [arXiv:1611.01236](https://arxiv.org/abs/1611.01236) [find](https://scholar.google.com/scholar?q=A%2E+Kurakin%2C+I%2E+Goodfellow%2C+and+S%2E+Bengio%2E+2016%2E+Adversarial+machine+learning+at+scale%2E+ICLR%E2%80%9917%3B+arXiv+preprint+arXiv%3A1611%2E01236%2E+%E2%80%94+%5BarXiv%3A1611%2E01236%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F1611%2E01236%29)
16. Andrew L. Maas, Raymond E. Daly, Peter T. Pham, Dan Huang, Andrew Y. Ng, and Christopher Potts. 2011. Learning word vectors for sentiment analysis. In Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics: Human Language Technologies, pages 142–150, Portland, Oregon… [find](https://scholar.google.com/scholar?q=Andrew+L%2E+Maas%2C+Raymond+E%2E+Daly%2C+Peter+T%2E+Pham%2C+Dan+Huang%2C+Andrew+Y%2E+Ng%2C+and+Christopher+Potts%2E+2011%2E+Learning+word+vectors+for+sentiment+analysis%2E+In+Proceedings+of+the+49th+Annual+Meeting+of+the+Ass) [our card](https://md.research.elamur.ai/free/en/papers/maas-2011-learning-word-vectors-sentiment-analysis/)
17. A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083. [find](https://scholar.google.com/scholar?q=A%2E+Madry%2C+A%2E+Makelov%2C+L%2E+Schmidt%2C+D%2E+Tsipras%2C+and+A%2E+Vladu%2E+2017%2E+Towards+deep+learning+models+resistant+to+adversarial+attacks%2E+arXiv+preprint+arXiv%3A1706%2E06083%2E) [our card](https://md.research.elamur.ai/free/en/papers/madry-2017-towards-deep-learning-models-resistant/)
18. Nikola Mrkšić, Diarmuid O Séaghdha, Blaise Thomson, Milica Gašić, Lina Rojas-Barahona, Pei-Hao Su, David Vandyke, Tsung-Hsien Wen, and Steve Young. 2016. Counter-fitting word vectors to linguistic constraints. arXiv preprint arXiv:1603.00892. [find](https://scholar.google.com/scholar?q=Nikola+Mrks%CC%8Cic%CC%81%2C+Diarmuid+O+Se%CC%81aghdha%2C+Blaise+Thomson%2C+Milica+Gas%CC%8Cic%CC%81%2C+Lina+Rojas%2DBarahona%2C+Pei%2DHao+Su%2C+David+Vandyke%2C+Tsung%2DHsien+Wen%2C+and+Steve+Young%2E+2016%2E+Counter%2Dfitting+word+vectors+to+linguisti)
19. Heinz Mühlenbein. 1989. Parallel genetic algorithms, population genetics and combinatorial optimization. In Workshop on Parallel Processing: Logic, Organization, and Technology, pages 398–406. Springer. [find](https://scholar.google.com/scholar?q=Heinz+Mu%CC%88hlenbein%2E+1989%2E+Parallel+genetic+algorithms%2C+population+genetics+and+combinatorial+optimization%2E+In+Workshop+on+Parallel+Processing%3A+Logic%2C+Organization%2C+and+Technology%2C+pages+398%E2%80%93406%2E+Spring)
20. N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. Celik, and A. Swami. 2016a. Practical black-box attacks against machine learning. arXiv preprint arXiv:1602.02697. — [arXiv:1602.02697](https://arxiv.org/abs/1602.02697) [find](https://scholar.google.com/scholar?q=N%2E+Papernot%2C+P%2E+McDaniel%2C+I%2E+Goodfellow%2C+S%2E+Jha%2C+Z%2E+Celik%2C+and+A%2E+Swami%2E+2016a%2E+Practical+black%2Dbox+attacks+against+machine+learning%2E+arXiv+preprint+arXiv%3A1602%2E02697%2E+%E2%80%94+%5BarXiv%3A1602%2E02697%5D%28https%3A%2F%2Farxi)
21. N. Papernot, P. McDaniel, A. Swami, and R. Harang. 2016b. Crafting adversarial input sequences for recurrent neural networks. arXiv preprint arXiv:1604.08275. — [arXiv:1604.08275](https://arxiv.org/abs/1604.08275) [find](https://scholar.google.com/scholar?q=N%2E+Papernot%2C+P%2E+McDaniel%2C+A%2E+Swami%2C+and+R%2E+Harang%2E+2016b%2E+Crafting+adversarial+input+sequences+for+recurrent+neural+networks%2E+arXiv+preprint+arXiv%3A1604%2E08275%2E+%E2%80%94+%5BarXiv%3A1604%2E08275%5D%28https%3A%2F%2Farxiv%2Eorg%2Fab)
22. Jeffrey Pennington, Richard Socher, and Christopher Manning. 2014. Glove: Global vectors for word representation. In Proceedings of the 2014 conference on empirical methods in natural language processing (EMNLP), pages 1532–1543. [find](https://scholar.google.com/scholar?q=Jeffrey+Pennington%2C+Richard+Socher%2C+and+Christopher+Manning%2E+2014%2E+Glove%3A+Global+vectors+for+word+representation%2E+In+Proceedings+of+the+2014+conference+on+empirical+methods+in+natural+language+process)
23. Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. 2018. Semantically equivalent adversarial rules for debugging nlp models. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), volume 1, pages 856–865. [find](https://scholar.google.com/scholar?q=Marco+Tulio+Ribeiro%2C+Sameer+Singh%2C+and+Carlos+Guestrin%2E+2018%2E+Semantically+equivalent+adversarial+rules+for+debugging+nlp+models%2E+In+Proceedings+of+the+56th+Annual+Meeting+of+the+Association+for+Compu)
24. Y. Sharma and P. Y. Chen. 2017. Attacking the madry defense model with l1-based adversarial examples. arXiv preprint arXiv:1710.10733. — [arXiv:1710.10733](https://arxiv.org/abs/1710.10733) [find](https://scholar.google.com/scholar?q=Y%2E+Sharma+and+P%2E+Y%2E+Chen%2E+2017%2E+Attacking+the+madry+defense+model+with+l1%2Dbased+adversarial+examples%2E+arXiv+preprint+arXiv%3A1710%2E10733%2E+%E2%80%94+%5BarXiv%3A1710%2E10733%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F1710%2E10733%29)
25. Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199. [find](https://scholar.google.com/scholar?q=Christian+Szegedy%2C+Wojciech+Zaremba%2C+Ilya+Sutskever%2C+Joan+Bruna%2C+Dumitru+Erhan%2C+Ian+Goodfellow%2C+and+Rob+Fergus%2E+2013%2E+Intriguing+properties+of+neural+networks%2E+arXiv+preprint+arXiv%3A1312%2E6199%2E) [our card](https://md.research.elamur.ai/free/en/papers/szegedy-2013-intriguing-properties-neural-networks/)
26. Zhengli Zhao, Dheeru Dua, and Sameer Singh. 2018. Generating natural adversarial examples. arXiv preprint arXiv:1710.11342. — [arXiv:1710.11342](https://arxiv.org/abs/1710.11342) [find](https://scholar.google.com/scholar?q=Zhengli+Zhao%2C+Dheeru+Dua%2C+and+Sameer+Singh%2E+2018%2E+Generating+natural+adversarial+examples%2E+arXiv+preprint+arXiv%3A1710%2E11342%2E+%E2%80%94+%5BarXiv%3A1710%2E11342%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F1710%2E11342%29)