--- title: "Is BERT Really Robust? A Strong Baseline for — Jin 2019" description: "NLP classifiers, including pre-trained BERT, can be fooled by small edits to their input." authors: ["Di Jin", "Zhijing Jin", "Joey Tianyi Zhou", "Peter Szolovits"] year: 2019 venue: "arXiv:1907.11932" source: "https://arxiv.org/abs/1907.11932" doi: "10.48550/arxiv.1907.11932" arxiv: "1907.11932" licence: "CC BY 4.0 (arXiv)" licence_url: "http://creativecommons.org/licenses/by/4.0/" summary_licence: "Elamur Cosmic License" canonical: "https://research.elamur.ai/free/en/papers/jin-2019-bert-really-robust-strong-baseline/" --- [Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/jin-2019-bert-really-robust-strong-baseline/) [home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2019](https://md.research.elamur.ai/free/en/papers/2019/page/2/) / Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailment # Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailment **Authors:** [Di Jin](https://md.research.elamur.ai/free/en/authors/di-jin/), Zhijing Jin, Joey Tianyi Zhou, [Peter Szolovits](https://md.research.elamur.ai/free/en/authors/peter-szolovits/) · **Year:** 2019 · **Venue:** arXiv:1907.11932 · **Licence:** [CC BY 4.0 (arXiv)](http://creativecommons.org/licenses/by/4.0/) **Links:** [Publisher's page](https://arxiv.org/abs/1907.11932) · [PDF](https://arxiv.org/pdf/1907.11932) · [DOI 10.48550/arxiv.1907.11932](https://doi.org/10.48550/arxiv.1907.11932) · [arXiv 1907.11932](https://arxiv.org/abs/1907.11932) · [OpenAlex](https://openalex.org/W2996851481) **Citations:** 918 citations (openalex-snapshot · 2026-10-14) · [400](#cited-by) in our library, of the 140673 papers whose bibliographies we read ## Summary NLP classifiers, including pre-trained BERT, can be fooled by small edits to their input. Building such adversarial text is harder than for images because language is discrete, and the edits must keep the meaning, the grammar and the label a human would assign. The authors introduce TextFooler, a black-box attack that needs only the target model's output scores. It first ranks words by how much deleting each one lowers confidence in the true label, and it skips stop words. It then swaps the most influential words for synonyms from counter-fitted word embeddings (Mrkšić et al. 2016). A candidate is kept only if it has the same part of speech and the new sentence stays close to the original under Universal Sentence Encoder. Swaps continue until the prediction flips. The attack was tested on five classification and two entailment datasets against WordCNN, WordLSTM, BERT, InferSent and ESIM. It cut almost every model's accuracy below 10% while changing under a fifth of the words, and human judges found the outputs meaningful and grammatical. This gives a cheap, reproducible baseline for stress-testing models and for adversarial training. ## Key points - Target models: WordCNN, WordLSTM and BERT for classification (e.g., MR, IMDB); InferSent, ESIM and BERT for entailment (SNLI, MNLI). Each test used 1,000 randomly sampled examples. - Synonym search keeps the top N=50 neighbours with cosine similarity of at least δ=0.7. POS tags come from spaCy, and stop words are filtered with NLTK and spaCy lists. Cost grows linearly with text length. - Against BERT-Base, after-attack accuracy fell to 11.5% on MR, 13.6% on IMDB, 4.0% on SNLI and 9.6% on MNLI(m). Only 6.1% of words were changed on IMDB and 18.5% on SNLI. - Retraining BERT with the generated adversarial examples made it harder to attack. After-attack accuracy rose from 11.5% to 18.7% on MR and from 4.0% to 8.3% on SNLI, and more words had to be changed. - The main error types were wrong word senses, grammatical slips and label-changing content shifts (especially in entailment). Code, target models and test samples are released at github.com/jind11/TextFooler. *Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.* Fields: [Other](https://md.research.elamur.ai/free/en/shelves/other/) Topics: [Part-of-speech tagging](https://md.research.elamur.ai/free/en/topics/part-of-speech-tagging/) ## Cited by Cited by 400 papers of our library cite it (of the 140673 whose bibliographies we read); 22 of them have a page here, 378 not yet. - [DiscoFlan: Instruction Fine-tuning and Refined Text Generation for Discourse Relation Label Classification](https://md.research.elamur.ai/free/en/papers/anuranjana-2023-discoflan-instruction-fine-tuning-refined/) - [On the Opportunities and Risks of Foundation Models](https://md.research.elamur.ai/free/en/papers/bommasani-2021-opportunities-risks-foundation-models/) - [A Closer Look into the Robustness of Neural Dependency Parsers Using Better Adversarial Examples](https://md.research.elamur.ai/free/en/papers/findings-2021-wang-closer-look-into-robustness-neural/) - [BAE: BERT-based Adversarial Examples for Text Classification](https://md.research.elamur.ai/free/en/papers/garg-2020-bae-bert-based-adversarial-examples/) - [ID10M-JAM: Stress-Testing Idiom Identification Under Challenging Context](https://md.research.elamur.ai/free/en/papers/hashiloni-2026-id10m-jam-stress-testing-idiom/) - [A Survey on Recent Approaches for Natural Language Processing in Low-Resource Scenarios](https://md.research.elamur.ai/free/en/papers/hedderich-2021-survey-recent-approaches-natural-language/) - [BERT-ATTACK: Adversarial Attack Against BERT Using BERT](https://md.research.elamur.ai/free/en/papers/li-2020-bert-attack-adversarial-attack-against/) - [GSM-Plus: A Comprehensive Benchmark for Evaluating the Robustness of LLMs as Mathematical Problem Solvers](https://md.research.elamur.ai/free/en/papers/li-2024-gsm-plus-comprehensive-benchmark-evaluating/) - [HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal](https://md.research.elamur.ai/free/en/papers/mazeika-2024-harmbench-standardized-evaluation-framework-automated/) - [Breaking the Benchmark: Revealing LLM Bias via Minimal Contextual Augmentation](https://md.research.elamur.ai/free/en/papers/miandoab-2026-breaking-benchmark-revealing-llm-bias/) - [TextAttack: A Framework for Adversarial Attacks, Data Augmentation, and Adversarial Training in NLP](https://md.research.elamur.ai/free/en/papers/morris-2020-textattack-framework-adversarial-attacks-data/) - [Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer](https://md.research.elamur.ai/free/en/papers/qi-2021-mind-style-text-adversarial-backdoor/) - [Tool Learning with Foundation Models](https://md.research.elamur.ai/free/en/papers/qin-2023-tool-learning-foundation-models/) - ["Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models](https://md.research.elamur.ai/free/en/papers/shen-2023-anything-now-characterizing-evaluating-wild/) - [Prompting GPT-3 To Be Reliable](https://md.research.elamur.ai/free/en/papers/si-2022-prompting-gpt-3-reliable/) - [DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Models](https://md.research.elamur.ai/free/en/papers/wang-2023-decodingtrust-comprehensive-assessment-trustworthiness-gpt/) - [The Rise and Potential of Large Language Model Based Agents: A Survey](https://md.research.elamur.ai/free/en/papers/xi-2023-rise-potential-large-language/) - [Word-level Textual Adversarial Attacking as Combinatorial Optimization](https://md.research.elamur.ai/free/en/papers/zang-2020-word-level-textual-adversarial-attacking/) - [中文对抗攻击下的ChatGPT鲁棒性评估](https://md.research.elamur.ai/free/en/papers/zhang-2025-robustness-evaluation-chatgpt/) - [Evaluating and Enhancing the Robustness of Neural Network-based Dependency Parsing Models with Adversarial Examples](https://md.research.elamur.ai/free/en/papers/zheng-2020-evaluating-enhancing-robustness-neural-network/) - [PromptRobust: Towards Evaluating the Robustness of Large Language Models on Adversarial Prompts](https://md.research.elamur.ai/free/en/papers/zhu-2023-promptrobust-towards-evaluating-robustness-large/) - [SPARTA: Evaluating Reasoning Segmentation Robustness through Black-Box Adversarial Paraphrasing in Text Autoencoder Latent Space](https://md.research.elamur.ai/free/en/papers/zinkovich-2026-sparta-evaluating-reasoning-segmentation-robustness/) ## Cite The paper itself, not this page. BibTeX from the library's record of the work. ```bibtex @misc{jin2019is, title = {{Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailment}}, author = {Jin, Di and Jin, Zhijing and Zhou, Joey Tianyi and Szolovits, Peter}, year = {2019}, doi = {10.48550/arxiv.1907.11932}, eprint = {1907.11932}, archivePrefix = {arXiv}, url = {https://doi.org/10.48550/arxiv.1907.11932} } ``` - [← previous Is Attention Interpretable?](https://md.research.elamur.ai/free/en/papers/serrano-2019-is-attention-interpretable/) - [next → Is Biblical Hebrew a non-configurational language? Reconsidering the evidence from discontinuous phrases](https://md.research.elamur.ai/free/en/papers/hbo-2019-kaajan-biblical-hebrew-non-configurational-language/) - [↑ back to papers of 2019](https://md.research.elamur.ai/free/en/papers/2019/page/2/) ## References 4 references, 3 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet. 1. [2018] Alzantot, M.; Sharma, Y.; Elgohary, A.; Ho, B.-J.; Srivastava, M.; and Chang, K.-W. 2018. Generating natural language adversarial examples. arXiv preprint arXiv:1804.07998. [2015] Bowman, S. R.; Angeli, G.; Potts, C.; and Manning, C. D. 2015. A large annotated corpus for learning natural lang… [find](https://scholar.google.com/scholar?q=%5B2018%5D+Alzantot%2C+M%2E%3B+Sharma%2C+Y%2E%3B+Elgohary%2C+A%2E%3B+Ho%2C+B%2E%2DJ%2E%3B+Srivastava%2C+M%2E%3B+and+Chang%2C+K%2E%2DW%2E+2018%2E+Generating+natural+language+adversarial+examples%2E+arXiv+preprint+arXiv%3A1804%2E07998%2E+%5B2015%5D+Bowman%2C+S%2E+R%2E) [our card](https://md.research.elamur.ai/free/en/papers/alzantot-2018-generating-natural-language-adversarial-examples/) 2. [2015] Hill, F.; Reichart, R.; and Korhonen, A. 2015. Simlex-999: Evaluating semantic models with (genuine) similarity estimation. Computational Linguistics 41(4):665– 695. [1997] Hochreiter, S., and Schmidhuber, J. 1997. Long short-term memory. Neural computation 9(8):1735–1780. [2014] Kim, Y. 2014… [find](https://scholar.google.com/scholar?q=%5B2015%5D+Hill%2C+F%2E%3B+Reichart%2C+R%2E%3B+and+Korhonen%2C+A%2E+2015%2E+Simlex%2D999%3A+Evaluating+semantic+models+with+%28genuine%29+similarity+estimation%2E+Computational+Linguistics+41%284%29%3A665%E2%80%93+695%2E+%5B1997%5D+Hochreiter%2C+S%2E%2C+and+) [our card](https://md.research.elamur.ai/free/en/papers/kim-2014-convolutional-neural-networks-sentence-classification/) 3. ACM. [2014] Pennington, J.; Socher, R.; and Manning, C. 2014. Glove: Global vectors for word representation. In Proceedings of the 2014 conference on empirical methods in natural language processing (EMNLP), 1532–1543. [2018] Ribeiro, M. T.; Singh, S.; and Guestrin, C. 2018. Semantically equivalent… [find](https://scholar.google.com/scholar?q=ACM%2E+%5B2014%5D+Pennington%2C+J%2E%3B+Socher%2C+R%2E%3B+and+Manning%2C+C%2E+2014%2E+Glove%3A+Global+vectors+for+word+representation%2E+In+Proceedings+of+the+2014+conference+on+empirical+methods+in+natural+language+processing+%28) 4. [2013] Szegedy, C.; Zaremba, W.; Sutskever, I.; Bruna, J.; Erhan, D.; Goodfellow, I.; and Fergus, R. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199. [2017] Williams, A.; Nangia, N.; and Bowman, S. R. 2017. A broad-coverage challenge corpus for sentence understanding t… [find](https://scholar.google.com/scholar?q=%5B2013%5D+Szegedy%2C+C%2E%3B+Zaremba%2C+W%2E%3B+Sutskever%2C+I%2E%3B+Bruna%2C+J%2E%3B+Erhan%2C+D%2E%3B+Goodfellow%2C+I%2E%3B+and+Fergus%2C+R%2E+2013%2E+Intriguing+properties+of+neural+networks%2E+arXiv+preprint+arXiv%3A1312%2E6199%2E+%5B2017%5D+Williams%2C+A%2E) [our card](https://md.research.elamur.ai/free/en/papers/szegedy-2013-intriguing-properties-neural-networks/)