{"id":"9a4f2ee0-d4e3-4b22-8f31-f030e8eb4a04","arxiv_id":"2507.16164","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"AdvChar is a character-level black-box attack that uses interpreter importance scores to pick tokens, fooling NLP classifiers while keeping post-hoc explanations similar.","lead":"This paper introduces AdvChar, a black-box attack that changes a few characters in text to fool NLP classifiers while keeping the explanations produced by interpretability tools looking similar to those for benign inputs. The attack is evaluated on seven transformer models and three explanation methods, reaching success rates around 80 percent in some settings while modifying about two characters per sample.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Explanation preservation is enforced only on token-order, not on interpretation maps; the IoU metric is undefined, so the central claim that AdvChar keeps explanations similar is not yet established.","rationale":"The reader's verdict is CONDITIONAL, and my analysis supports that conditionality rather than moving to accept or reject. The most load-bearing weakness is in the operationalization of 'explanation similarity': the attack enforces a rank-order constraint on token importance scores, but the paper's central claim is about explanation maps being similar, and the only reported evidence for that claim is an undefined IoU metric. This is not merely a missing baseline or a threat-model question; it is a potential mismatch between what the algorithm guarantees and what the headline asserts. If the rank-order constraint does not actually control map-level similarity, then the attack's second objective is unsupported, and the paper's novelty as an attack on interpretable systems is substantially weakened. The proposed test is concrete and would settle the issue by comparing AdvChar against a random-substitution control using standard continuous similarity measures. I do not see a reason to change the reader's conditional verdict: the issue is addressable with a re-analysis, but it must be addressed before the central claim can be considered established. I credit the paper for its broad experimental sweep across seven models and three interpreters, and for reporting query counts and perturbation amounts, but those strengths do not compensate for the undefined similarity metric at the core of the claimed contribution.","tokens_in":22952,"tokens_out":10557,"duration_ms":129743,"concrete_test":"Re-analyze the generated adversarial examples with a precisely defined explanation-similarity metric: compute both the correlation (e.g., Pearson or Spearman) and cosine similarity between the full attribution vectors g and g' for benign and adversarial inputs, and also compute IoU with an explicit binarization rule (e.g., top-k tokens). Compare AdvChar against a control that applies the same character substitutions to randomly selected tokens with the same perturbation budget. If the control achieves comparable explanation similarity, the rank-order constraint is not responsible for explanation preservation and the central claim must be weakened; if AdvChar significantly exceeds the control on the continuous metrics, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's second objective—keeping the interpreter's explanation similar to the benign input—is never enforced or measured in the way the headline claims. The only mechanism for explanation preservation in the attack is the similarity function S in Section IV.A (Algorithm 1), which bounds changes in the ranking of token importance scores: S = ||argsort[I(t_i)] - argsort[I(t'_i)]|| <= theta. Rank preservation is strictly weaker than explanation-map similarity: all importance magnitudes can collapse or shift while the order stays fixed, and a human-visible attribution map can change substantially even when S = 0. The evidence for similarity is an IoU score (Figure 2), but the paper never defines how IoU is computed on interpretation maps (threshold? top-k tokens? continuous values?), whether it is restricted to successful attacks, or whether the rank-order constraint is what produces it. A reviewer cannot tell whether AdvChar genuinely preserves explanations or whether the result is an artifact of a weak rank-order constraint combined with very small per-token changes. This directly threatens the central claim that INLPS explanations can be kept similar under attack, not just the efficiency numbers.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes AdvChar, a black-box character-level adversarial attack against Interpretable Natural Language Processing Systems (INLPS). The attack uses the outputs of a post-hoc interpreter (SHAP, saliency maps, or LIME) to rank token importance, then iteratively applies visually similar character substitutions to the most important tokens until the classifier misclassifies the input, while enforcing a similarity constraint on the ordering of importance scores between the benign and adversarial inputs. The authors evaluate AdvChar on seven NLP classifiers (GPT-2, BERT, DistilBERT, Electra, CANINE, FNet, XLM-R) and three interpreters across SST-2, AG News, and Yahoo Answers, reporting attack success rates up to roughly 80%, low query counts, small numbers of modified characters, and IoU scores indicating high similarity between benign and adversarial interpretations. The paper also studies transferability across interpreters and classifiers, and reports a limited adversarial-training defense experiment. The central claim is that AdvChar can mislead classifiers while keeping the interpreter's explanation similar to that of benign inputs, thereby exploiting trust in system transparency.","tokens_in":23170,"tokens_out":3583,"duration_ms":41863,"significance":"If the central claim is substantiated, the paper makes a useful contribution by demonstrating that explanation modules in NLP systems can create an attack surface rather than a safeguard, and by showing that interpreter-guided token selection can yield query-efficient character-level attacks. The scope of the evaluation is broad: seven classifiers, three interpreters, and three benchmark datasets, with comparisons against TextBugger. However, the current manuscript does not yet establish the explanation-similarity claim: the similarity constraint is a rank-order condition, the IoU metric is never formally defined, and no thresholds, sample sizes, or error bars are reported. These gaps are load-bearing because the paper's novelty over prior character-level attacks depends on preserving interpretations, not merely on achieving misclassification with few character changes. The paper would be strengthened by a precise definition of the interpretation-similarity metric, a clear statement of all hyperparameters, and a de-circularized evaluation that shows similarity holds even when the attack is not guided by the same interpreter used for measurement.","major_comments":[{"comment":"The explanation-preservation claim is not established because the only similarity constraint in the attack is rank-order based: S(x_i, x'_i) = ||argsort[I(t_i)] - argsort[I(t'_i)]||, which bounds changes in the ordering of importance scores, not changes in the interpretation maps themselves. Importance magnitudes can collapse or shift arbitrarily while the rank order is preserved, so a human-visible attribution map can change substantially even when S = 0. The IoU metric used in Figure 2 and Table IV is never defined: the paper does not state whether IoU is computed on thresholded maps, top-k tokens, continuous values, or binary masks, nor whether it is restricted to successful attacks. Without this definition, the reported IoU values cannot be interpreted as evidence that interpretations are similar. Please define the IoU computation precisely, report it separately for successful and failed attacks, and include a map-level distance measure that accounts for both ranking and magnitude.","section":"§IV.A, Algorithm 1, §IV.C, Figure 2"},{"comment":"Hyperparameters and experimental settings are missing. The attack formulation introduces a similarity threshold θ, but Algorithm 1 checks \"if S(x, x') > ϵ\" and the text later refers to a \"perturbation threshold θ\"; no values for ϵ, θ, or the character substitution set are reported anywhere. This makes the attack irreproducible and prevents the reader from understanding the trade-off between preservation and attack success. In addition, Table III's caption states that ASR, MC, PA, and QC denote attack success rate, misclassification confidence, character perturbation amount, and query count, but the table columns are labeled \"ASR CQ MC PA\", and the text in §V.A refers to \"Number of Queries (#)\" without a matching column. Please reconcile these labels, report all threshold values, and state the sample size used for each dataset and model combination.","section":"§IV.A, Algorithm 1, Table III"},{"comment":"The high IoU scores may be partly enforced by construction rather than being an emergent property. AdvChar selects tokens using the interpreter G's importance scores and also constrains changes to the ordering of those same scores, and then Figure 2 measures IoU for the same interpreter G on benign versus adversarial inputs. This creates a circularity: the attack is explicitly optimizing for a quantity closely related to the measured metric. A concrete way to de-confound this is to compute IoU using an interpreter that was not used during the attack (e.g., attack with LIME and measure similarity with SHAP or saliency maps), or to compare against a baseline that perturbs the same number of characters randomly or via a non-interpreter heuristic. Without such a control, the claim that \"interpretations are similar\" is not distinguishable from \"the rank-order constraint forced token order to remain similar.\"","section":"§IV.A, §V.B, Figure 2"},{"comment":"There are inconsistencies in the headline success-rate numbers. The abstract says the attack reduces accuracy \"by altering just two characters on average,\" and the introduction states peak success rates of 79% (AG News, LIME/CANINE), 79% (SST-2, Saliency/BERT), and 80% (Yahoo, LIME/BERT). Table III actually reports ASR = 0.81 for CANINE on Yahoo Answers with LIME, and multiple 0.80 entries, so the text understates the results. More importantly, no confidence intervals or error bars are given for any ASR, MC, PA, or IoU value, and no sample size is stated. Given that Table V includes ASR values as low as 0.04 for some transferability cells, small evaluation subsets could make those numbers statistically meaningless. Please report per-cell sample sizes and variances, or clearly indicate that the reported values are point estimates on a fixed test set.","section":"§I, §V.A, Table III"}],"minor_comments":[{"comment":"The organization paragraph says \"§III presents the proposed attack and its underlying mechanisms,\" but §III is titled \"Notations and Definitions\" and the methodology appears in §IV; the section reference should be corrected.","section":"§I (Organization)"},{"comment":"The caption contains a typo: \"charcter perturbation amount\" should be \"character perturbation amount.\"","section":"Table III caption"},{"comment":"In the sorted-importance notation, the least important token is written as t′_n with a prime, but it should be t_n; the prime is used elsewhere for adversarial tokens and is confusing here.","section":"§IV.A, Step 1"},{"comment":"The sentence \"while maintaining an attack success rate of 67.33%, BERT required an increased 110.71 queries on average\" is grammatically awkward; consider \"required an average of 110.71 queries,\" and similarly for other query-count descriptions.","section":"§V.A (AG News paragraph)"},{"comment":"References [7] and [37] are the same SHAP paper duplicated in the reference list; one should be removed or the citation should point to a single entry.","section":"References [7] and [37]"}],"recommendation":"major_revision","confidential_remarks":"The paper has a reasonably broad evaluation and the attack itself is plausible, but the central novelty—explanation preservation—is currently supported only by an undefined IoU metric and a rank-order constraint that may trivially produce high similarity for the interpreter used in the attack. I would encourage the editor to request the missing definitions, hyperparameters, and de-circularization experiments before considering the paper for publication. The repeated references to the authors' own prior conference papers are not inappropriate, but the manuscript would benefit from a clearer positioning statement distinguishing AdvChar from those works."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nShort take: AdvChar is a real variation on character-level NLP attacks. It uses the interpreter's importance scores to select which tokens to perturb, rather than prediction-confidence shifts, and it explicitly aims to keep the interpreter's output stable. That combination is genuinely new relative to TextBugger and to the authors' earlier AdvEdge/SingleAdv work, and the experimental sweep is broad: seven models, three interpreters, three datasets, plus transferability. The attack success rates (60-80%) and the two-character average perturbation are plausible and consistent with existing character-level attacks. Credit also for running transferability experiments; most attack papers skip that.\n\nThe soft spots are in how the second claimed objective is measured. The paper's formal constraint is only on the ordering of importance scores (S = norm of difference of argsort vectors), which is strictly weaker than similarity of interpretation maps. Magnitudes can change substantially while the order stays fixed, so the S constraint does not by itself establish that LIME/SHAP/saliency maps look similar. And the paper's own IoU metric is never defined: no statement of how a continuous or token-level attribution map is turned into a set for intersection-over-union, whether top-k tokens are used, or whether IoU is computed only on successful attacks. Figure 2 shows numbers, but a reader cannot reproduce them. That is more than a cosmetic issue because \"explanation remains similar\" is the headline claim.\n\nSmaller issues: Section IV.A introduces both epsilon and theta but Algorithm 1 uses epsilon for the similarity threshold; no error bars or sample sizes appear anywhere; no code or artifact is released. The TextBugger comparison uses the authors' default settings, which is acceptable, but it is a single baseline and the perturbation reduction is not surprising given the attacks work differently. The defense experiment at the end is too quick to draw conclusions, though the authors do label it as a check.\n\nThe central attack result, misclassification with small character-level changes, is solid. The explanation-preservation result is not yet established. The instability of interpreter rankings under character-level changes is a real concern, and the transferability numbers suggest cross-interpreter similarity is often weak, consistent with that worry.\n\nWho this is for: people working on adversarial NLP or on the security of explainability. It deserves a serious referee and a conditional review. I would want the authors to define IoU, align the threshold notation, report error bars or at least sample counts, and compare the rank-order constraint against an alternative similarity metric.\n\nRecommendation: send to peer review with requests for revision. The core idea is worth the community's time.","headline":"AdvChar is a plausible new character-level attack that uses interpreter importance scores to pick tokens, but the paper's headline claim that explanations stay similar is undercut by an undefined IoU metric and a rank-order-only similarity constraint.","tokens_in":23667,"tokens_out":1808,"would_cite":false,"duration_ms":20732,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Character-level edits can mislead an NLP classifier while leaving its explanation map nearly unchanged.","keywords":["adversarial machine learning","interpretable NLP","black-box attacks","character-level perturbation","explanation similarity","transferability","LIME","text classification"],"falsifier":"In a deployment that returns only the prediction and not the explanation map, AdvChar's success rate should fall to around the level of random character substitution; observing otherwise would show the interpreter is not the load-bearing component.","tokens_in":22779,"feed_emoji":"🎯","tokens_out":10294,"duration_ms":98692,"temperature":0.7,"pith_summary":"The paper introduces AdvChar, a black-box character-level attack against interpretable NLP systems. It aims to establish that an attacker who can query a classifier and its interpreter can flip the classifier's prediction by modifying on average about two characters per input, while keeping the interpreter's explanation map nearly identical to that of the benign input. The attack works by ranking tokens by interpreter importance scores, then substituting visually similar characters in the most important tokens until the classifier is fooled, subject to a similarity threshold on the importance ordering. The paper reports attack success rates up to 80% across seven models and three interpreters on three datasets, and shows better efficiency and interpretation preservation than the TextBugger baseline. If true, this demonstrates that explanation modules, intended to increase trust, become a practical attack surface rather than a safety guarantee.","feed_headline":"Two-character edit flips NLP predictions, explanations unchanged","feed_subtitle":"Because the explanation stays nearly the same, transparency tools no longer catch the attack.","key_machinery":"The central mechanism is the interpreter-guided token ranking combined with a rank-order similarity constraint. The interpreter G produces an importance map; AdvChar sorts tokens by importance, then applies a character substitution function R(t_i, ζ) to the most important tokens first. The similarity function S(x_i, x'_i) = || argsort_{t_i} [I(t_i,F,G)] − argsort_{t'_i} [I(t'_i,F,G)] ||, with a threshold θ, ensures the ordering of token importance stays close to the benign ordering after perturbation. That constraint is what keeps the adversarial explanation similar to the benign one; without it, character-level perturbations would still flip the label but would change the explanation. The attack iterates until F(x') ≠ c, the similarity threshold is exceeded, or tokens run out.","core_discovery":"AdvChar leverages the interpreter's explanation map to guide character-level perturbations. For each input, it converts the interpreter output into normalized importance scores, sorts tokens by those scores, and then iteratively replaces one character in the most important tokens with a visually similar but out-of-vocabulary character (e.g., Latin \"n\" to Cyrillic \"є\" or \"f\" to \"ƒ\"). The perturbation is accepted only if the similarity function S(x, x'), which compares the argsort of importance scores before and after perturbation, stays within a threshold θ; the loop stops when the classifier misclassifies the input. The authors claim this is the first black-box interpreter-guided attack that preserves the interpretation map, and they support it with experiments on BERT, GPT-2, DistilBERT, Electra, CANINE, FNet, and XLM-R using SHAP, saliency maps, and LIME on SST-2, AG News, and Yahoo Answers, achieving attack success rates up to 80% with an average of roughly two modified characters and high IoU between benign and adversarial explanations.","pith_inferences":["If deployed systems do not expose interpreter outputs to end users, the practical threat is smaller: the paper's threat model requires the adversary to query the interpreter, so a system that hides explanations would break the attack's token-selection step.","The paper measures explanation similarity with IoU; a human study comparing paired explanations side by side would test whether the preserved importance ordering actually translates into perceived similarity, which the automatic metric may overstate.","Because the attack relies on importance rankings being stable under character substitution, it is likely to be less effective against models whose explanations are spread evenly across tokens or whose attributions are unstable to tiny input changes, suggesting a concrete robustness criterion for interpreters.","The same rank-order similarity constraint could be converted into a detection rule: flagging large shifts in importance ordering after a character change would catch the attack's perturbations."],"forward_implications":["Explanation modules of NLP systems are not a defense against adversarial manipulation; they can be exploited to select the tokens that most efficiently flip a prediction.","Because the adversarial text differs by only about two characters on average, it is likely to pass human inspection and conventional spell-check style defenses.","The attack transfers across classifiers and interpreters in some combinations (e.g., SM-to-LIME for BERT), so a system built from one model-interpreter pair can be vulnerable to samples crafted against a different pair.","Simple adversarial training that randomly injects the attack's characters into the training data reduces the success rate from around 0.7 to about 0.25, but does not eliminate the vulnerability.","When the LIME interpreter is used, the attack is both more successful and more query-efficient, suggesting that local surrogate-based explanations are a particularly useful guide for the attacker."],"supporting_citations":[{"why":"Defines the SHAP interpreter used to produce importance scores that rank tokens for perturbation.","marker":"[7]"},{"why":"Provides the saliency-map interpreter used as a second explanation source in the attack evaluation.","marker":"[8]"},{"why":"Defines LIME, the interpreter against which the attack reaches its highest success rates and lowest query counts.","marker":"[9]"},{"why":"TextFooler, the word-level attack whose confidence-shift scoring AdvChar explicitly contrasts with interpreter-guided scoring.","marker":"[29]"},{"why":"Supplies the SST-2 sentiment dataset used to measure attack success, interpretation similarity, and transferability.","marker":"[39]"},{"why":"Supplies the AG News and Yahoo Answers datasets used for the multi-class evaluation.","marker":"[40]"},{"why":"TextBugger, the character-level black-box baseline compared for success rate, query count, perturbation amount, and IoU.","marker":"[41]"}],"fun_headline_variants":["Char-level tweaks fool models, keep explanations intact","Explanation-guided attack: 2 characters, zero detection","Adversarial chars: explainable AI still blind","Black-box char attack preserves interpretation maps"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack assumes the adversary can query the interpreter and that the interpreter's word-importance ranking stays stable when characters are swapped, since both the token selection and the claimed explanation similarity rest on that stability.","fun_headline_variants_meta":{"raw":{"variants":["Char-level tweaks fool models, keep explanations intact","Explanation-guided attack: 2 characters, zero detection","Adversarial chars: explainable AI still blind","Black-box char attack preserves interpretation maps"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000289,"raw_usage":{"total_tokens":1703,"prompt_tokens":964,"completion_tokens":739,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":580,"completion_tokens_details":{"reasoning_tokens":679}},"tokens_in":580,"tokens_out":739,"duration_ms":9439,"temperature":1.0,"reasoning_tokens":679,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T15:16:30.697691+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"In a deployment that returns only the prediction and not the explanation map, AdvChar's success rate should fall to around the level of random character substitution; observing otherwise would show the interpreter is not the load-bearing component.","supporting_citations":[{"cited_title":"Grad-cam: Visual explanations from deep networks via gradient-based localization,","cited_arxiv_id":null,"evidence_quote":"Provides the saliency-map interpreter used as a second explanation source in the attack evaluation."},{"cited_title":"” why should i trust you?","cited_arxiv_id":null,"evidence_quote":"Defines LIME, the interpreter against which the attack reaches its highest success rates and lowest query counts."},{"cited_title":"Is bert really robust? a strong baseline for natural language attack on text classification and entailment,","cited_arxiv_id":null,"evidence_quote":"TextFooler, the word-level attack whose confidence-shift scoring AdvChar explicitly contrasts with interpreter-guided scoring."},{"cited_title":"Recursive deep models for semantic compositionality over a sentiment treebank,","cited_arxiv_id":null,"evidence_quote":"Supplies the SST-2 sentiment dataset used to measure attack success, interpretation similarity, and transferability."},{"cited_title":"Character-level convolutional networks for text classification,","cited_arxiv_id":null,"evidence_quote":"Supplies the AG News and Yahoo Answers datasets used for the multi-class evaluation."},{"cited_title":"Textbugger: Generating adversarial text against real-world applications,","cited_arxiv_id":null,"evidence_quote":"TextBugger, the character-level black-box baseline compared for success rate, query count, perturbation amount, and IoU."}],"review_version":1}