---
title: "On Adversarial Examples for Character-Level Neural Machine"
description: "The authors build a white-box attacker by extending HotFlip. 37.54 BLEU. 21 references, cited by 71 papers here."
authors: ["Javid Ebrahimi", "Daniel Lowd", "Dejing Dou"]
year: 2018
venue: "Proceedings of the 27th International Conference on Computational Linguistics"
source: "https://aclanthology.org/C18-1055/"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/ebrahimi-2018-adversarial-examples-character-level-neural/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/ebrahimi-2018-adversarial-examples-character-level-neural/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2018](https://md.research.elamur.ai/free/en/papers/2018/page/3/) / On Adversarial Examples for Character-Level Neural Machine Translation

# On Adversarial Examples for Character-Level Neural Machine Translation

**Authors:** [Javid Ebrahimi](https://md.research.elamur.ai/free/en/authors/javid-ebrahimi/), [Daniel Lowd](https://md.research.elamur.ai/free/en/authors/daniel-lowd/) and [Dejing Dou](https://md.research.elamur.ai/free/en/authors/dejing-dou/) · **Year:** 2018 · **Venue:** [Proceedings of the 27th International Conference on Computational Linguistics](https://md.research.elamur.ai/free/en/venues/coling/) ([COLING 2018](https://md.research.elamur.ai/free/en/venues/coling/2018/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/C18-1055/) · [PDF](https://aclanthology.org/C18-1055.pdf) · [OpenAlex](https://openalex.org/W2811010710)

**Citations:** 152 citations (OpenAlex, 2026-10-14) · [71](https://md.research.elamur.ai/free/en/papers/ebrahimi-2018-adversarial-examples-character-level-neural/cited-by/) in our library, of the 141,840 papers whose bibliographies we read

## Summary
The paper asks how badly a character-level neural machine translation system can fail when an attacker sees its internals. Earlier robustness studies of NLP models mostly relied on black-box noise such as random typos. The authors build a white-box attacker by extending HotFlip. It scores four character edits (flip, swap, delete, insert) using gradients with respect to one-hot inputs, then applies the most damaging edits through greedy or beam search. Besides untargeted attacks that only lower BLEU, they define two goal-driven attacks specific to translation. A controlled attack makes a chosen word disappear from the output, and a targeted attack substitutes a different word for it. Experiments on CS-EN, FR-EN and DE-EN translation show that white-box edits damage translations far more than black-box noise does. Adversarial training with a fast one-shot attack makes models considerably more robust. This matters because subtle character edits can silently change a translation's meaning, which is a real risk for MT used in high-stakes settings.

## Key points
- Edit operations are represented as vectors in input space, and directional derivatives estimate how much each edit raises the loss. One forward pass and one backward pass are enough to rank all candidate flips.
- The controlled attack maximizes the loss on the target word. The targeted attack minimizes the loss on the replacement word, for example turning "therapist" into "psychopath" in DE→EN output.
- On FR-EN, the Vanilla model drops from 37.54 BLEU on clean text to 5.36 on white-box (FIDS-W) adversarial examples. The FIDS-W-trained model reaches 31.94 on the same examples.
- Adversarial training applies one FIDS edit to all words in parallel (a one-shot attack). It costs only about 3 times the time of regular training, and it needs both clean and adversarial data to keep clean BLEU high.
- An Ensemble model trained on white-box and black-box (Nat, Rand) examples performs best overall. Its average BLEU is 32.30 versus 15.95 for Vanilla on FR-EN, 27.82 versus 12.64 on DE-EN, and 19.99 versus 11.24 on CS-EN.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [University of Oregon](https://md.research.elamur.ai/free/en/universities/university-of-oregon/) — University, Eugene, United States · 14 works · 3,167 citations

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 9,085 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 8,888 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 9,296 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 9,206 works

🧭 Topics (1): [🔁 Machine translation](https://md.research.elamur.ai/free/en/topics/machine-translation/) · 958 works

## Cite

Cite as: Javid Ebrahimi, Daniel Lowd and Dejing Dou. 2018. On Adversarial Examples for Character-Level Neural Machine Translation. Proceedings of the 27th International Conference on Computational Linguistics.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{ebrahimi2018adversarial,
  title = {{On Adversarial Examples for Character-Level Neural Machine Translation}},
  author = {Javid Ebrahimi, Daniel Lowd and Dejing Dou},
  booktitle = {Proceedings of the 27th International Conference on Computational Linguistics},
  year = {2018},
  url = {https://aclanthology.org/C18-1055/}
}
```

- [← previous MTNT: A Testbed for Machine Translation of Noisy Text](https://md.research.elamur.ai/free/en/papers/michel-2018-mtnt-testbed-machine-translation-noisy/)
- [next → Few-Shot Charge Prediction with Discriminative Legal Attributes](https://md.research.elamur.ai/free/en/papers/hu-2018-few-shot-charge-prediction-discriminative/)
- [↑ back to papers of 2018](https://md.research.elamur.ai/free/en/papers/2018/page/3/)

## References

21 references, 10 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Yonatan Belinkov and Yonatan Bisk. 2018. Synthetic and natural noise both break neural machine translation. In Proceedings of ICLR. [find](https://scholar.google.com/scholar?q=Yonatan+Belinkov+and+Yonatan+Bisk%2E+2018%2E+Synthetic+and+natural+noise+both+break+neural+machine+translation%2E+In+Proceedings+of+ICLR%2E)
2. Yotam Berger. 2017. Israel arrests Palestinian because Facebook translated ’good morning’ to ’attack them’. Retrieved from [https://www.haaretz.com](https://www.haaretz.com). [↗](https://www.haaretz.com)
3. Stevie Chancellor, Jessica Annette Pater, Trustin Clear, Eric Gilbert, and Munmun De Choudhury. 2016. \# thyghgapp: Instagram content moderation and lexical variation in pro-eating disorder communities. In Proceedings of the 19th ACM Conference on Computer-Supported Cooperative Work & Social Computin… [find](https://scholar.google.com/scholar?q=Stevie+Chancellor%2C+Jessica+Annette+Pater%2C+Trustin+Clear%2C+Eric+Gilbert%2C+and+Munmun+De+Choudhury%2E+2016%2E+%5C%23+thyghgapp%3A+Instagram+content+moderation+and+lexical+variation+in+pro%2Deating+disorder+communitie)
4. Marta R Costa-Jussa and José AR Fonollosa. 2016. [Character-based neural machine translation](https://md.research.elamur.ai/free/en/papers/jussa-2016-character-based-neural-machine-translation/). In Proceedings of ACL.
5. Nilesh Dalvi, Pedro Domingos, Sumit Sanghai, Deepak Verma, et al. 2004. Adversarial classification. In Proceedings of KDD, pages 99–108. [find](https://scholar.google.com/scholar?q=Nilesh+Dalvi%2C+Pedro+Domingos%2C+Sumit+Sanghai%2C+Deepak+Verma%2C+et+al%2E+2004%2E+Adversarial+classification%2E+In+Proceedings+of+KDD%2C+pages+99%E2%80%93108%2E)
6. Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018. [Hotflip: White-box adversarial examples for text classification](https://md.research.elamur.ai/free/en/papers/ebrahimi-2018-hotflip-white-box-adversarial-examples/). In Proceedings of ACL.
7. Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. [Explaining and harnessing adversarial examples](https://md.research.elamur.ai/free/en/papers/goodfellow-2014-explaining-harnessing-adversarial-examples/). In Proceedings of ICLR.
8. Robin Jia and Percy Liang. 2017. [Adversarial examples for evaluating reading comprehension systems](https://md.research.elamur.ai/free/en/papers/jia-2017-adversarial-examples-evaluating-reading-comprehension/). In Proceedings of EMNLP.
9. Yoon Kim, Yacine Jernite, David Sontag, and Alexander M Rush. 2016. [Character-aware neural language models](https://md.research.elamur.ai/free/en/papers/kim-2015-character-aware-neural-language-models/). Proceedings of AAAI.
10. Jason Lee, Kyunghyun Cho, and Thomas Hofmann. 2017. [Fully character-level neural machine translation without explicit segmentation](https://md.research.elamur.ai/free/en/papers/lee-2017-fully-character-level-neural-machine/). TACL.
11. Daniel Lowd and Christopher Meek. 2005. Adversarial learning. In Proceedings of KDD, pages 641–647. [find](https://scholar.google.com/scholar?q=Daniel+Lowd+and+Christopher+Meek%2E+2005%2E+Adversarial+learning%2E+In+Proceedings+of+KDD%2C+pages+641%E2%80%93647%2E)
12. Minh-Thang Luong, Hieu Pham, and Christopher D Manning. 2015. [Effective approaches to attention-based neural machine translation](https://md.research.elamur.ai/free/en/papers/luong-2015-effective-approaches-attention-based-neural/). In Proceedings of EMNLP.
13. Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. [Towards deep learning models resistant to adversarial attacks](https://md.research.elamur.ai/free/en/papers/madry-2017-towards-deep-learning-models-resistant/). arXiv preprint arXiv:1706.06083.
14. Cettolo Mauro, Niehues Jan, Stüker Sebastian, Bentivogli Luisa, Cattoni Roldano, and Federico Marcello. 2016. The iwslt 2016 evaluation campaign. In International Workshop on Spoken Language Translation. [find](https://scholar.google.com/scholar?q=Cettolo+Mauro%2C+Niehues+Jan%2C+Stu%CC%88ker+Sebastian%2C+Bentivogli+Luisa%2C+Cattoni+Roldano%2C+and+Federico+Marcello%2E+2016%2E+The+iwslt+2016+evaluation+campaign%2E+In+International+Workshop+on+Spoken+Language+Translat)
15. Takeru Miyato, Andrew M Dai, and Ian Goodfellow. 2017. [Adversarial training methods for semi-supervised text classification](https://md.research.elamur.ai/free/en/papers/miyato-2016-adversarial-training-methods-semi-supervised/). In Proceedings of ICLR.
16. Rico Sennrich, Barry Haddow, and Alexandra Birch. 2016. [Neural machine translation of rare words with subword units](https://md.research.elamur.ai/free/en/papers/sennrich-2016-neural-machine-translation-rare-words/). Proceedings of ACL.
17. Uri Shaham, Yutaro Yamada, and Sahand Negahban. 2015. Understanding adversarial training: Increasing local stability of neural nets through robust optimization. arXiv preprint arXiv:1511.05432. — [arXiv:1511.05432](https://arxiv.org/abs/1511.05432) [find](https://scholar.google.com/scholar?q=Uri+Shaham%2C+Yutaro+Yamada%2C+and+Sahand+Negahban%2E+2015%2E+Understanding+adversarial+training%3A+Increasing+local+stability+of+neural+nets+through+robust+optimization%2E+arXiv+preprint+arXiv%3A1511%2E05432%2E+%E2%80%94+%5BarX)
18. Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Dan Boneh, and Patrick McDaniel. 2018. Ensemble adversarial training: Attacks and defenses. In Proceedings of ICLR. [find](https://scholar.google.com/scholar?q=Florian+Trame%CC%80r%2C+Alexey+Kurakin%2C+Nicolas+Papernot%2C+Dan+Boneh%2C+and+Patrick+McDaniel%2E+2018%2E+Ensemble+adversarial+training%3A+Attacks+and+defenses%2E+In+Proceedings+of+ICLR%2E)
19. Sam Wiseman and Alexander M Rush. 2016. Sequence-to-sequence learning as beam-search optimization. In Proceedings of EMNLP. [find](https://scholar.google.com/scholar?q=Sam+Wiseman+and+Alexander+M+Rush%2E+2016%2E+Sequence%2Dto%2Dsequence+learning+as+beam%2Dsearch+optimization%2E+In+Proceedings+of+EMNLP%2E)
20. Zhengli Zhao, Dheeru Dua, and Sameer Singh. 2018. Generating natural adversarial examples. In Proceedings of ICLR. [find](https://scholar.google.com/scholar?q=Zhengli+Zhao%2C+Dheeru+Dua%2C+and+Sameer+Singh%2E+2018%2E+Generating+natural+adversarial+examples%2E+In+Proceedings+of+ICLR%2E)
21. Arkaitz Zubiaga, Maria Liakata, Rob Procter, Geraldine Wong Sak Hoi, and Peter Tolmie. 2016. Analysing how people orient to and spread rumours in social media by looking at conversational threads. PloS one, 11(3):e0150989. [find](https://scholar.google.com/scholar?q=Arkaitz+Zubiaga%2C+Maria+Liakata%2C+Rob+Procter%2C+Geraldine+Wong+Sak+Hoi%2C+and+Peter+Tolmie%2E+2016%2E+Analysing+how+people+orient+to+and+spread+rumours+in+social+media+by+looking+at+conversational+threads%2E+Plo)

*Updated 24 October 2026*