Pith. sign in

REVIEW 4 major objections 5 minor 41 references

Attacking interpretable NLP systems

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Character-level edits can mislead an NLP classifier while leaving its explanation map nearly unchanged.

desk verdict AdvChar is a plausible new character-level attack that uses interpreter importance scores to pick tokens, but the paper's headline claim that explanations stay similar is undercut by an undefined IoU metric and a rank-order-only similarity constraint. read the letter →

arxiv 2507.16164 v1 pith:FPTVVTCB submitted 2025-07-22 cs.CR cs.AIcs.LG

Eldor Abdukhamidov , Tamer Abuhmed , Joanna C. S. Santos , Mohammed Abuhamad This is my paper
classification cs.CRcs.AIcs.LG
keywords adversarialmachinelearninginterpretableNLPblack-boxattackscharacter-levelperturbationexplanationsimilaritytransferabilityLIMEtextclassification
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper introduces AdvChar, a black-box character-level attack against interpretable NLP systems. It aims to establish that an attacker who can query a classifier and its interpreter can flip the classifier's prediction by modifying on average about two characters per input, while keeping the interpreter's explanation map nearly identical to that of the benign input. The attack works by ranking tokens by interpreter importance scores, then substituting visually similar characters in the most important tokens until the classifier is fooled, subject to a similarity threshold on the importance ordering. The paper reports attack success rates up to 80% across seven models and three interpreters on three datasets, and shows better efficiency and interpretation preservation than the TextBugger baseline. If true, this demonstrates that explanation modules, intended to increase trust, become a practical attack surface rather than a safety guarantee.

What carries the argument

The central mechanism is the interpreter-guided token ranking combined with a rank-order similarity constraint. The interpreter G produces an importance map; AdvChar sorts tokens by importance, then applies a character substitution function R(t_i, ζ) to the most important tokens first. The similarity function S(x_i, x'_i) = || argsort_{t_i} [I(t_i,F,G)] − argsort_{t'_i} [I(t'_i,F,G)] ||, with a threshold θ, ensures the ordering of token importance stays close to the benign ordering after perturbation. That constraint is what keeps the adversarial explanation similar to the benign one; without it, character-level perturbations would still flip the label but would change the explanation. The attack iterates until F(x') ≠ c, the similarity threshold is exceeded, or tokens run out.

What would settle it

In a deployment that returns only the prediction and not the explanation map, AdvChar's success rate should fall to around the level of random character substitution; observing otherwise would show the interpreter is not the load-bearing component.

Watch

Extended reading notes

Core claim

AdvChar leverages the interpreter's explanation map to guide character-level perturbations. For each input, it converts the interpreter output into normalized importance scores, sorts tokens by those scores, and then iteratively replaces one character in the most important tokens with a visually similar but out-of-vocabulary character (e.g., Latin "n" to Cyrillic "є" or "f" to "ƒ"). The perturbation is accepted only if the similarity function S(x, x'), which compares the argsort of importance scores before and after perturbation, stays within a threshold θ; the loop stops when the classifier misclassifies the input. The authors claim this is the first black-box interpreter-guided attack that preserves the interpretation map, and they support it with experiments on BERT, GPT-2, DistilBERT, Electra, CANINE, FNet, and XLM-R using SHAP, saliency maps, and LIME on SST-2, AG News, and Yahoo Answers, achieving attack success rates up to 80% with an average of roughly two modified characters and high IoU between benign and adversarial explanations.

Load-bearing premise

The attack assumes the adversary can query the interpreter and that the interpreter's word-importance ranking stays stable when characters are swapped, since both the token selection and the claimed explanation similarity rest on that stability.

Editorial extensions

If this is right

  • Explanation modules of NLP systems are not a defense against adversarial manipulation; they can be exploited to select the tokens that most efficiently flip a prediction.
  • Because the adversarial text differs by only about two characters on average, it is likely to pass human inspection and conventional spell-check style defenses.
  • The attack transfers across classifiers and interpreters in some combinations (e.g., SM-to-LIME for BERT), so a system built from one model-interpreter pair can be vulnerable to samples crafted against a different pair.
  • Simple adversarial training that randomly injects the attack's characters into the training data reduces the success rate from around 0.7 to about 0.25, but does not eliminate the vulnerability.
  • When the LIME interpreter is used, the attack is both more successful and more query-efficient, suggesting that local surrogate-based explanations are a particularly useful guide for the attacker.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If deployed systems do not expose interpreter outputs to end users, the practical threat is smaller: the paper's threat model requires the adversary to query the interpreter, so a system that hides explanations would break the attack's token-selection step.
  • The paper measures explanation similarity with IoU; a human study comparing paired explanations side by side would test whether the preserved importance ordering actually translates into perceived similarity, which the automatic metric may overstate.
  • Because the attack relies on importance rankings being stable under character substitution, it is likely to be less effective against models whose explanations are spread evenly across tokens or whose attributions are unstable to tiny input changes, suggesting a concrete robustness criterion for interpreters.
  • The same rank-order similarity constraint could be converted into a detection rule: flagging large shifts in importance ordering after a character change would catch the attack's perturbations.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes AdvChar, a black-box character-level adversarial attack against Interpretable Natural Language Processing Systems (INLPS). The attack uses the outputs of a post-hoc interpreter (SHAP, saliency maps, or LIME) to rank token importance, then iteratively applies visually similar character substitutions to the most important tokens until the classifier misclassifies the input, while enforcing a similarity constraint on the ordering of importance scores between the benign and adversarial inputs. The authors evaluate AdvChar on seven NLP classifiers (GPT-2, BERT, DistilBERT, Electra, CANINE, FNet, XLM-R) and three interpreters across SST-2, AG News, and Yahoo Answers, reporting attack success rates up to roughly 80%, low query counts, small numbers of modified characters, and IoU scores indicating high similarity between benign and adversarial interpretations. The paper also studies transferability across interpreters and classifiers, and reports a limited adversarial-training defense experiment. The central claim is that AdvChar can mislead classifiers while keeping the interpreter's explanation similar to that of benign inputs, thereby exploiting trust in system transparency.

Significance. If the central claim is substantiated, the paper makes a useful contribution by demonstrating that explanation modules in NLP systems can create an attack surface rather than a safeguard, and by showing that interpreter-guided token selection can yield query-efficient character-level attacks. The scope of the evaluation is broad: seven classifiers, three interpreters, and three benchmark datasets, with comparisons against TextBugger. However, the current manuscript does not yet establish the explanation-similarity claim: the similarity constraint is a rank-order condition, the IoU metric is never formally defined, and no thresholds, sample sizes, or error bars are reported. These gaps are load-bearing because the paper's novelty over prior character-level attacks depends on preserving interpretations, not merely on achieving misclassification with few character changes. The paper would be strengthened by a precise definition of the interpretation-similarity metric, a clear statement of all hyperparameters, and a de-circularized evaluation that shows similarity holds even when the attack is not guided by the same interpreter used for measurement.

major comments (4)
  1. [§IV.A, Algorithm 1, §IV.C, Figure 2] The explanation-preservation claim is not established because the only similarity constraint in the attack is rank-order based: S(x_i, x'_i) = ||argsort[I(t_i)] - argsort[I(t'_i)]||, which bounds changes in the ordering of importance scores, not changes in the interpretation maps themselves. Importance magnitudes can collapse or shift arbitrarily while the rank order is preserved, so a human-visible attribution map can change substantially even when S = 0. The IoU metric used in Figure 2 and Table IV is never defined: the paper does not state whether IoU is computed on thresholded maps, top-k tokens, continuous values, or binary masks, nor whether it is restricted to successful attacks. Without this definition, the reported IoU values cannot be interpreted as evidence that interpretations are similar. Please define the IoU computation precisely, report it separately for successful and failed attacks, and include a map-level distance measure that accounts for both ranking and magnitude.
  2. [§IV.A, Algorithm 1, Table III] Hyperparameters and experimental settings are missing. The attack formulation introduces a similarity threshold θ, but Algorithm 1 checks "if S(x, x') > ϵ" and the text later refers to a "perturbation threshold θ"; no values for ϵ, θ, or the character substitution set are reported anywhere. This makes the attack irreproducible and prevents the reader from understanding the trade-off between preservation and attack success. In addition, Table III's caption states that ASR, MC, PA, and QC denote attack success rate, misclassification confidence, character perturbation amount, and query count, but the table columns are labeled "ASR CQ MC PA", and the text in §V.A refers to "Number of Queries (#)" without a matching column. Please reconcile these labels, report all threshold values, and state the sample size used for each dataset and model combination.
  3. [§IV.A, §V.B, Figure 2] The high IoU scores may be partly enforced by construction rather than being an emergent property. AdvChar selects tokens using the interpreter G's importance scores and also constrains changes to the ordering of those same scores, and then Figure 2 measures IoU for the same interpreter G on benign versus adversarial inputs. This creates a circularity: the attack is explicitly optimizing for a quantity closely related to the measured metric. A concrete way to de-confound this is to compute IoU using an interpreter that was not used during the attack (e.g., attack with LIME and measure similarity with SHAP or saliency maps), or to compare against a baseline that perturbs the same number of characters randomly or via a non-interpreter heuristic. Without such a control, the claim that "interpretations are similar" is not distinguishable from "the rank-order constraint forced token order to remain similar."
  4. [§I, §V.A, Table III] There are inconsistencies in the headline success-rate numbers. The abstract says the attack reduces accuracy "by altering just two characters on average," and the introduction states peak success rates of 79% (AG News, LIME/CANINE), 79% (SST-2, Saliency/BERT), and 80% (Yahoo, LIME/BERT). Table III actually reports ASR = 0.81 for CANINE on Yahoo Answers with LIME, and multiple 0.80 entries, so the text understates the results. More importantly, no confidence intervals or error bars are given for any ASR, MC, PA, or IoU value, and no sample size is stated. Given that Table V includes ASR values as low as 0.04 for some transferability cells, small evaluation subsets could make those numbers statistically meaningless. Please report per-cell sample sizes and variances, or clearly indicate that the reported values are point estimates on a fixed test set.
minor comments (5)
  1. [§I (Organization)] The organization paragraph says "§III presents the proposed attack and its underlying mechanisms," but §III is titled "Notations and Definitions" and the methodology appears in §IV; the section reference should be corrected.
  2. [Table III caption] The caption contains a typo: "charcter perturbation amount" should be "character perturbation amount."
  3. [§IV.A, Step 1] In the sorted-importance notation, the least important token is written as t′_n with a prime, but it should be t_n; the prime is used elsewhere for adversarial tokens and is confusing here.
  4. [§V.A (AG News paragraph)] The sentence "while maintaining an attack success rate of 67.33%, BERT required an increased 110.71 queries on average" is grammatically awkward; consider "required an average of 110.71 queries," and similarly for other query-count descriptions.
  5. [References [7] and [37]] References [7] and [37] are the same SHAP paper duplicated in the reference list; one should be removed or the citation should point to a single entry.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the attack's explanation-preservation constraint is explicit in Algorithm 1, and the misclassification results are independently grounded in classifier outputs.

full rationale

The paper contains no derivation chain whose output is equivalent to its inputs. The attack's objective (2), g' ≈ g, is implemented directly as the similarity constraint S(x, x') ≤ θ in Algorithm 1, which stops perturbation once the rank-order of interpreter importance scores changes too much. Thus explanation preservation is an explicit construction constraint, not a hidden fitted parameter or a predicted emergent property. The attack success rate is measured against independent classifier outputs F(x') ≠ c, and the reported IoU figures are a separate evaluation of the same constraint; while the paper never defines how IoU is computed on interpretation maps, that is a reporting and rigor weakness, not circularity. The self-citations ([14]–[17]) appear only as background examples of attacks on interpretable systems and are not load-bearing for the method. No uniqueness theorem or external result is imported from the authors' prior work, and no known result is renamed. The fact that the same interpreter G guides token selection and is the subject of the similarity constraint is transparent in the algorithm and does not make the empirical success rate circular. Therefore no circular step can be quoted and exhibited; the appropriate finding is no significant circularity.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The attack's central claim depends on several unreported free parameters (epsilon, theta, the substitution set, and the evaluation sample size) plus empirical assumptions about interpreter reliability and query access. No new entities are introduced.

free parameters (4)
  • perturbation threshold epsilon = not reported
    Algorithm 1 stops when the similarity function S(x, x') exceeds epsilon; the value is never given, though it controls the perturbation budget and success rate.
  • similarity threshold theta = not reported
    Section IV.A defines S(xi, x'i) <= theta to limit changes in token importance order; the chosen value is not reported and directly affects interpretation preservation.
  • character substitution set = not reported
    The attack requires visually similar characters (e.g., Cyrillic 'e' for Latin 'e') but the paper does not enumerate the substitution mapping, so the exact perturbation space is unspecified.
  • evaluation sample size = not reported
    The number of test instances attacked per dataset is not stated, so the reported ASR and IoU aggregates lack a defined denominator.
assumptions (3)
  • domain assumption Interpreters (SHAP, LIME, Saliency) provide meaningful and stable token importance scores for transformer classifiers.
    Section IV.A step 1 uses interpreter output to rank tokens; if these scores are noisy or change after perturbation, the attack's token selection is unreliable.
  • domain assumption The adversary can query both the classifier and the interpreter in the black-box setting.
    Threat model in Section III grants query access to G(x, F) for any input; real systems may not expose explanations to users.
  • domain assumption Visually similar character substitutions are treated by the target models as distinct, out-of-distribution tokens.
    Section IV.A relies on characters 'visually similar to the target character but unfamiliar to the target NLP model'; modern tokenizers or input sanitizers may defeat this.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Attacking interpretable NLP systems." pith.science (2026). https://pith.science/paper/FPTVVTCB

@misc{pith2026250716164,
  author       = {Pith},
  title        = {Pith review of: Attacking interpretable NLP systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FPTVVTCB}},
  note         = {Machine review of arXiv:2507.16164}
}
read the original abstract

Studies have shown that machine learning systems are vulnerable to adversarial examples in theory and practice. Where previous attacks have focused mainly on visual models that exploit the difference between human and machine perception, text-based models have also fallen victim to these attacks. However, these attacks often fail to maintain the semantic meaning of the text and similarity. This paper introduces AdvChar, a black-box attack on Interpretable Natural Language Processing Systems, designed to mislead the classifier while keeping the interpretation similar to benign inputs, thus exploiting trust in system transparency. AdvChar achieves this by making less noticeable modifications to text input, forcing the deep learning classifier to make incorrect predictions and preserve the original interpretation. We use an interpretation-focused scoring approach to determine the most critical tokens that, when changed, can cause the classifier to misclassify the input. We apply simple character-level modifications to measure the importance of tokens, minimizing the difference between the original and new text while generating adversarial interpretations similar to benign ones. We thoroughly evaluated AdvChar by testing it against seven NLP models and three interpretation models using benchmark datasets for the classification task. Our experiments show that AdvChar can significantly reduce the prediction accuracy of current deep learning models by altering just two characters on average in input samples.

Figures

Figures reproduced from arXiv: 2507.16164 by the authors.

Figure 1
Figure 1. Example texts comparing a benign sample and a sample subject to our proposed attack, along with their corresponding interpretations based on LIME interpreter. Both inputs gener￾ate similar interpretations regardless of differences. different sectors. For example, adversarial attacks on AI sys￾tems for social media moderation, opinion analysis, customer reviews, or market trends could result in failures to identify h… view at source ↗
Figure 2
Figure 2. IoU scores of AdvChar and TextBugger [41] against seven classifiers with three interpreters on three datasets. our results with the existing attack TextBugger [41]. For this comparison, we use the default settings provided in TextBug￾ger’s original implementation [41]. TextBugger is selected as a baseline because it is one of the most widely used and well￾established character-level black-box attacks for text classi… view at source ↗
Figure 3
Figure 3. Results of interpreters on benign and adversarial texts generated by AdvChar against BERT, GPT and Electra models. Ben. and Adv. stand for benign and adversarial texts, respectively. Samples are selected randomly from SST-2 and AG datasets. adversarial examples from LIME, when measured by SHAP, often showed lower transferability, with IoU scores dropping to 0.12 for BERT and GPT-2 in the SST-2 dataset. For the AG Ne… view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Density plots showcasing the distribution of input text [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: Density plots showcasing the distribution of misclassification confidence (MC) concerning query count and perturbation amount (QC and PA) for different models, using three interpreters - SHAP, SM, and LIME. ident that AdvChar on different machine learning models, as ev…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

41 extracted references · 31 canonical work pages

  1. [1]

    A survey on sentiment analysis methods, applications, and challenges,

    M. Wankhade, A. C. S. Rao, and C. Kulkarni, “A survey on sentiment analysis methods, applications, and challenges,” Artificial Intelligence Review, vol. 55, no. 7, pp. 5731–5780, 2022

    2022

  2. [2]

    A survey of multilingual neural machine translation,

    R. Dabre, C. Chu, and A. Kunchukuttan, “A survey of multilingual neural machine translation,” ACM Computing Surveys (CSUR) , vol. 53, no. 5, pp. 1–38, 2020

    work page 2020

  3. [3]

    Recent advances in deep learning based dialogue systems: A systematic survey,

    J. Ni, T. Young, V . Pandelea, F. Xue, and E. Cambria, “Recent advances in deep learning based dialogue systems: A systematic survey,” Artificial intelligence review, vol. 56, no. 4, pp. 3055–3155, 2023

    work page 2023

  4. [4]

    Parafuzz: An interpretability-driven technique for detecting poisoned samples in nlp,

    L. Yan, Z. Zhang, G. Tao, K. Zhang, X. Chen, G. Shen, and X. Zhang, “Parafuzz: An interpretability-driven technique for detecting poisoned samples in nlp,” in Advances in Neural Information Processing Systems, A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, Eds., vol. 36. Curran Associates, Inc., 2023, pp. 66 755–66 767

    work page 2023

  5. [5]

    Adversarial attacks on deep-learning models in natural language processing: A survey,

    W. E. Zhang, Q. Z. Sheng, A. Alhazmi, and C. Li, “Adversarial attacks on deep-learning models in natural language processing: A survey,”ACM Transactions on Intelligent Systems and Technology (TIST) , vol. 11, no. 3, pp. 1–41, 2020

    work page 2020

  6. [6]

    Adversarial nlp for social network applications: Attacks, defenses, and research directions,

    I. Alsmadi, K. Ahmad, M. Nazzal, F. Alam, A. Al-Fuqaha, A. Khreishah, and A. Algosaibi, “Adversarial nlp for social network applications: Attacks, defenses, and research directions,” IEEE Transactions on Com- putational Social Systems , vol. 10, no. 6, pp. 3089–3108, 2023

    work page 2023

  7. [7]

    A unified approach to interpreting model predictions,

    S. M. Lundberg and S.-I. Lee, “A unified approach to interpreting model predictions,” in Advances in Neural Information Processing Systems 30, I. Guyon, U. V . Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett, Eds. Curran Associates, Inc., 2017, pp. 4765–4774

    2017

  8. [8]

    Grad-cam: Visual explanations from deep networks via gradient-based localization,

    R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra, “Grad-cam: Visual explanations from deep networks via gradient-based localization,” in Proceedings of the IEEE international conference on computer vision , 2017, pp. 618–626

    work page 2017

Show all 41 references
  1. [9]

    ” why should i trust you?

    M. T. Ribeiro, S. Singh, and C. Guestrin, “” why should i trust you?” explaining the predictions of any classifier,” in Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, 2016, pp. 1135–1144

    2016

  2. [10]

    Defending pre-trained language models from adversarial word substitution without performance sacrifice,

    R. Bao, J. Wang, and H. Zhao, “Defending pre-trained language models from adversarial word substitution without performance sacrifice,” in Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021, C. Zong, F. Xia, W. Li, and R. Navigli, Eds., Aug. 2021, pp. 3248–3258

    2021

  3. [11]

    Generating natural language adversarial examples through probability weighted word saliency,

    S. Ren, Y . Deng, K. He, and W. Che, “Generating natural language adversarial examples through probability weighted word saliency,” in Proceedings of the 57th annual meeting of the association for compu- tational linguistics, 2019, pp. 1085–1097

    2019

  4. [12]

    Fasttextdodger: Decision-based adversarial attack against black-box nlp models with extremely high efficiency,

    X. Hu, G. Liu, B. Zheng, L. Zhao, Q. Wang, Y . Zhang, and M. Du, “Fasttextdodger: Decision-based adversarial attack against black-box nlp models with extremely high efficiency,” IEEE Transactions on Information Forensics and Security , vol. 19, pp. 2398–2411, 2024

    2024

  5. [13]

    Nuat- gan: Generating black-box natural universal adversarial triggers for text classifiers using generative adversarial networks,

    H. Gao, H. Zhang, J. Wang, X. Zhang, H. Wang, W. Li, and T. Tu, “Nuat- gan: Generating black-box natural universal adversarial triggers for text classifiers using generative adversarial networks,” IEEE Transactions on Information Forensics and Security , vol. 19, pp. 6484–6498, 2024

    2024

  6. [14]

    Advedge: Optimizing adversarial perturbations against in- terpretable deep learning,

    E. Abdukhamidov, M. Abuhamad, F. Juraev, E. Chan-Tin, and T. AbuHmed, “Advedge: Optimizing adversarial perturbations against in- terpretable deep learning,” in Computational Data and Social Networks: 10th International Conference, CSoNet 2021, Virtual Event, November 15–17, 20...

    2021

  7. [15]

    Hardening interpretable deep learning systems: Investigat- ing adversarial threats and defenses,

    E. Abdukhamidov, M. Abuhamad, S. S. Woo, E. Chan-Tin, and T. Abuhmed, “Hardening interpretable deep learning systems: Investigat- ing adversarial threats and defenses,” IEEE Transactions on Dependable and Secure Computing , vol. 21, no. 4, pp. 3963–3976, 2023

    2023

  8. [16]

    Black- box and target-specific attack against interpretable deep learning sys- tems,

    E. Abdukhamidov, F. Juraev, M. Abuhamad, and T. Abuhmed, “Black- box and target-specific attack against interpretable deep learning sys- tems,” in Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security , 2022, pp. 1216–1218

    2022

  9. [17]

    Singleadv: single-class target-specific attack against in- terpretable deep learning systems,

    E. Abdukhamidov, M. Abuhamad, G. K. Thiruvathukal, H. Kim, and T. Abuhmed, “Singleadv: single-class target-specific attack against in- terpretable deep learning systems,” IEEE Transactions on Information Forensics and Security, 2024

    2024

  10. [18]

    A survey of black-box adversarial attacks on computer vision models,

    S. Bhambri, S. Muku, A. Tulasi, and A. B. Buduru, “A survey of black-box adversarial attacks on computer vision models,”arXiv preprint arXiv:1912.01667, 2019

    1912 arXiv

  11. [19]

    Seqvat: Virtual adversarial training for semi-supervised sequence labeling,

    L. Chen, W. Ruan, X. Liu, and J. Lu, “Seqvat: Virtual adversarial training for semi-supervised sequence labeling,” in Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics , 2020, pp. 8801–8811

    2020

  12. [20]

    Tianyu du, xiangyu liu, rong zhang, hui xue, and shouling ji. 2021. enhancing model robustness by incorporating adversarial knowledge into semantic representation,

    J. Li, “Tianyu du, xiangyu liu, rong zhang, hui xue, and shouling ji. 2021. enhancing model robustness by incorporating adversarial knowledge into semantic representation,” in ICASSP, vol. 2021, 2021, pp. 7708–7712

    2021

  13. [21]

    Robust neural machine transla- tion with doubly adversarial inputs,

    Y . Cheng, L. Jiang, and W. Macherey, “Robust neural machine transla- tion with doubly adversarial inputs,” arXiv preprint arXiv:1906.02443 , 2019

    1906 arXiv

  14. [22]

    A survey of adversarial defenses and robustness in NLP,

    S. Goyal, S. Doddapaneni, M. M. Khapra, and B. Ravindran, “A survey of adversarial defenses and robustness in NLP,” ACM Computing Surveys, vol. 55, no. 14s, pp. 1–39, 2023

    2023

  15. [23]

    Efficiently generating sentence-level textual adversarial examples with seq2seq stacked auto-encoder,

    A. Li, F. Zhang, S. Li, T. Chen, P. Su, and H. Wang, “Efficiently generating sentence-level textual adversarial examples with seq2seq stacked auto-encoder,” Expert Systems with Applications , vol. 213, p. 119170, 2023

    2023

  16. [24]

    Joint character-level word embedding and adversarial stability training to defend adversarial text,

    H. Liu, Y . Zhang, Y . Wang, Z. Lin, and Y . Chen, “Joint character-level word embedding and adversarial stability training to defend adversarial text,” in Proceedings of the AAAI conference on artificial intelligence , vol. 34, no. 05, 2020, pp. 8384–8391

    2020

  17. [25]

    Financial sentiment analysis: Techniques and applications,

    K. Du, F. Xing, R. Mao, and E. Cambria, “Financial sentiment analysis: Techniques and applications,” ACM Comput. Surv., vol. 56, no. 9, 2024

    2024

  18. [26]

    A survey of text classification with transformers: How wide? how large? how long? how accurate? how expensive? how safe?

    J. Fields, K. Chovanec, and P. Madiraju, “A survey of text classification with transformers: How wide? how large? how long? how accurate? how expensive? how safe?” IEEE Access, 2024

    2024

  19. [27]

    Non- autoregressive machine translation with probabilistic context-free gram- mar,

    S. Gui, C. Shao, Z. Ma, x. zhang, Y . Chen, and Y . Feng, “Non- autoregressive machine translation with probabilistic context-free gram- mar,” in Advances in Neural Information Processing Systems , A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, Eds., vol....

    2023

  20. [28]

    Flexkbqa: A flexible llm-powered framework for few-shot knowledge base question answering,

    Z. Li, S. Fan, Y . Gu, X. Li, Z. Duan, B. Dong, N. Liu, and J. Wang, “Flexkbqa: A flexible llm-powered framework for few-shot knowledge base question answering,” Proceedings of the AAAI Conference on Artificial Intelligence, vol. 38, no. 17, pp. 18 608–18 616, Mar. 2024

    2024

  21. [29]

    Is bert really robust? a strong baseline for natural language attack on text classification and entailment,

    D. Jin, Z. Jin, J. T. Zhou, and P. Szolovits, “Is bert really robust? a strong baseline for natural language attack on text classification and entailment,” in Proceedings of the AAAI conference on artificial intelligence, vol. 34, no. 05, 2020, pp. 8018–8025

    2020

  22. [30]

    Language models are unsupervised multitask learners,

    A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, I. Sutskever et al., “Language models are unsupervised multitask learners,” OpenAI blog , vol. 1, no. 8, p. 9, 2019

    2019

  23. [31]

    Bert: Pre-training of deep bidirectional transformers for language understanding,

    J. D. M.-W. C. Kenton and L. K. Toutanova, “Bert: Pre-training of deep bidirectional transformers for language understanding,” in Proceedings of naacL-HLT, vol. 1, 2019, p. 2

    2019

  24. [32]

    Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter,

    V . Sanh, L. Debut, J. Chaumond, and T. Wolf, “Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter,” arXiv preprint arXiv:1910.01108, 2019

    1910 arXiv

  25. [33]

    Electra: Pre- training text encoders as discriminators rather than generators,

    K. Clark, M.-T. Luong, Q. V . Le, and C. D. Manning, “Electra: Pre- training text encoders as discriminators rather than generators,” arXiv preprint arXiv:2003.10555, 2020

    2003 arXiv

  26. [34]

    Canine: Pre-training an efficient tokenization-free encoder for language representation,

    J. H. Clark, D. Garrette, I. Turc, and J. Wieting, “Canine: Pre-training an efficient tokenization-free encoder for language representation,” Trans- actions of the Association for Computational Linguistics , vol. 10, pp. 73–91, 2022

    2022

  27. [35]

    Fnet: Mixing tokens with fourier transforms,

    J. Lee-Thorp, J. Ainslie, I. Eckstein, and S. Ontanon, “Fnet: Mixing tokens with fourier transforms,” arXiv preprint arXiv:2105.03824, 2021

    2021 arXiv

  28. [36]

    Unsu- pervised cross-lingual representation learning at scale,

    A. Conneau, K. Khandelwal, N. Goyal, V . Chaudhary, G. Wenzek, F. Guzm´an, E. Grave, M. Ott, L. Zettlemoyer, and V . Stoyanov, “Unsu- pervised cross-lingual representation learning at scale,” arXiv preprint arXiv:1911.02116, 2019

    1911 arXiv

  29. [37]

    A unified approach to interpreting model predictions,

    S. M. Lundberg and S.-I. Lee, “A unified approach to interpreting model predictions,” Advances in neural information processing systems, vol. 30, 2017

    2017

  30. [38]

    Deep inside convolutional networks: Visualising image classification models and saliency maps,

    K. Simonyan, A. Vedaldi, and A. Zisserman, “Deep inside convolutional networks: Visualising image classification models and saliency maps,” arXiv preprint arXiv:1312.6034 , 2013

    2013 arXiv

  31. [39]

    Recursive deep models for semantic compositionality over a sentiment treebank,

    R. Socher, A. Perelygin, J. Wu, J. Chuang, C. D. Manning, A. Ng, and C. Potts, “Recursive deep models for semantic compositionality over a sentiment treebank,” in Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing , Oct. 2013

    2013

  32. [40]

    Character-level convolutional networks for text classification,

    X. Zhang, J. J. Zhao, and Y . LeCun, “Character-level convolutional networks for text classification,” in NIPS, 2015

    2015

  33. [41]

    Textbugger: Generating adversarial text against real-world applications,

    J. Li, S. Ji, T. Du, B. Li, and T. Wang, “Textbugger: Generating adversarial text against real-world applications,” in Proceedings 2019 Network and Distributed System Security Symposium . Internet Society, 2019

    2019

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.