Pith. sign in

REVIEW 6 major objections 6 minor 70 references

Cross-Entropy Attacks to Language Models via Rare Event Simulation

T0 review · 6 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that a single black-box attack built on cross-entropy optimization, CEA, treats adversarial examples as rare events and outperforms existing text attacks on classifiers, machine translation models, and small LLMs while…

desk verdict Hard-label branch of CEA degenerates to random substitution under the reported hyperparameters, undercutting the central unified-attack claim, but the broad experiments and identifiable, fixable flaws make it worth a serious referee. read the letter →

arxiv 2501.11852 v1 pith:2W3ZPKNE submitted 2025-01-21 cs.CL cs.CRcs.LG

Mingze Ni , Yongshun Gong , Wei Liu This is my paper · ORCID
classification cs.CLcs.CRcs.LG
keywords adversarialattackscross-entropyoptimizationrareeventsimulationblack-boxhard-labelmachinetranslationtextclassification
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that textual adversarial attacks can be driven by one optimization method across settings that are usually treated separately: soft-label classifiers, hard-label classifiers, and neural machine translation. The method, Cross-Entropy Attack (CEA), treats a successful adversarial example as a rare event in a well-trained model and uses cross-entropy optimization to sample and refine word substitutions until the model's behavior changes. The paper reports that CEA achieves higher attack success rates, lower modification rates, higher semantic similarity, and better fluency than existing attacks on document classification, translation, and small LLM classification tasks. The practical point is that a unified black-box attack lowers the cost of robustness evaluation and forces defenses to handle distribution-refining sampling attacks, not just saliency-ranked word swaps.

What carries the argument

The load-bearing mechanism is a sequence of rare-event simulations over a multivariate Categorical distribution. Each word position $i$ is assigned a substitution set $s_i$, formed as the intersection of masked-language-model top candidates and synonyms from a sememe-based thesaurus, and a candidate rewrite is drawn position-by-position from $\text{Cat}(\theta_i)$. At each iteration the threshold $\hat{\gamma}$ is set to the $(1-\rho)$-quantile of sampled objective values, and each substitution probability $\hat{p}_{(i,j)}$ is updated as the frequency of that substitution among the samples above threshold. This distribution-refinement loop converts discrete replacement search into tractable sampling, and the same loop is reused for soft-label, hard-label, and NMT objectives; only the performance measure $m(F(\cdot))$ changes.

What would settle it

Count, on the reported datasets, the fraction of word positions whose intersection set $s_i$ is empty or contains no substitution that changes the target model's output, and compare CEA against uniform random sampling from the same sets; a high empty fraction or similar success under random sampling would show the cross-entropy refinement is not the active ingredient.

Watch

Extended reading notes

Core claim

The central claim is that the hard combinatorial problem of finding a minimal, meaning-preserving word substitution can be reformulated as maximizing a single scalar objective $f(\tilde{x}|x)=m(F(\tilde{x}))\cdot \text{Sem}(\tilde{x}|x)$ under constraints on modification rate and semantic similarity, and that cross-entropy optimization solves that objective without gradients or saliency rankings. For classifiers, the paper sets $m(\cdot)$ to a truncated confidence term that gives no extra reward once the model's confidence on the true class falls below the uniform threshold $1/K$ (soft-label), or to the indicator of a label flip (hard-label). For NMT, it sets $m(\cdot)=1-\text{BLEU}(F(\tilde{x})|y)\cdot \text{Sem}(F(\tilde{x})|y)$, so successful attacks lower BLEU and semantic fidelity together. The cross-entropy loop samples $N$ candidate texts from a categorical distribution over per-word substitution sets, raises the acceptance threshold to the $(1-\rho)$-quantile of sampled scores, and re-estimates substitution probabilities from the samples above threshold; after $T$ iterations it outputs the highest-probability substitution at each position. The paper claims this one loop attains the best attacking performance, imperceptibility, and sentence quality in its experiments.

Load-bearing premise

The attack succeeds only when the substitution sets built in Section 3.2 contain enough replacement words that actually change the target model's behavior; the paper does not report how often those sets are empty or miss the decisive word.

Editorial extensions

If this is right

  • A single optimizer, CEA, covers soft-label classifiers, hard-label classifiers, and NMTs, so an adversary does not need to pick a method by model type.
  • Because CEA needs only predicted labels in the hard-label setting, it works in realistic black-box scenarios where confidence scores are hidden.
  • The reported low modification rates and high semantic similarity imply adversarial texts that are harder for a casual reader to notice.
  • The NMT objective, which combines BLEU drop with semantic drop, generates translations that are both lower quality and less faithful, giving robustness evaluators a stronger stress test.
  • Adversarial retraining with CEA examples improves downstream robustness up to a point, beyond which clean accuracy declines, so the attack is useful for generating training data as well as for evaluation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: If the gain comes from concentrating probability on rare effective substitutions, the same loop should transfer to other discrete search problems with a cheap scalar score, such as prompt-level attacks on instruction-following language models.
  • Editorial inference: A controlled comparison that replaces the CE update with uniform random sampling from the same candidate sets would isolate how much of the reported success comes from the optimizer rather than from the MLM-plus-thesaurus candidate construction.
  • Editorial inference: The paper's threshold and candidate-count ablations suggest a query-budget trade-off; a word-level adaptive threshold or early-stopping rule could reduce attack cost further on easy examples.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 6 minor

Summary. The manuscript proposes CEA, a black-box textual adversarial attack based on the cross-entropy (CE) optimization method for rare-event simulation. The attack defines a multiplicative objective f(x|x)=m(F(x))·Sem(x|x) with model-specific performance measures for soft-label classifiers (Eq. 5), hard-label classifiers (Eq. 6), and NMTs (Eq. 7), constructs substitution candidates as the intersection of MLM suggestions and HowNet sememe-based synonyms (Sec. 3.2), and iteratively samples N candidates, updates a threshold gamma by the (1-rho)-quantile, and updates categorical distributions over the elite samples (Sec. 3.3). The empirical section compares CEA with PSO, TextFooler, CLARE, RJA, HLBB, LimeAttack, Seq2Sick, HAA, and others on document classification and English-Chinese translation, and additionally reports results on small LLMs, defenses, transferability, targeted attacks, adversarial retraining, and efficiency. The central claim is that CEA consistently outperforms existing methods in attack success, imperceptibility, and sentence quality across soft-label, hard-label, and NMT settings.

Significance. If the empirical claims held, CEA would be a valuable single black-box attack framework spanning classifiers and sequence-to-sequence models, with the practical strengths of a unified objective, a public code repository, and a broad experimental coverage including LLMs, defenses, transferability, and ablation studies. The paper is less convincing as a demonstration of cross-entropy optimization: the hard-label branch as written degenerates under the reported hyperparameters, the reported tables are single runs without variance estimates, and the closest CE-based textual attack baselines are cited but never compared. These issues directly affect the paper's advertised contribution, so the current evidence does not support the strong 'consistently excels' conclusion.

major comments (6)
  1. [Sec. 3.3 (Eqs. 6, 10, 11) and Sec. 4.1] The hard-label branch of CEA cannot perform the claimed CE optimization under the reported hyperparameters. With the hard-label objective m(F(x))=1(F(x)!=y) in Eq. 6, every non-flipping candidate has f=0 (its Sem factor is multiplied by zero). With rho=0.5 (Sec. 4.1), Eq. 10 sets gamma_t to the median of the N=100 objective values. Whenever fewer than half of the sampled candidates flip the victim, the median is 0, and Eq. 11 selects all N candidates because every f>=0. The updated distribution is then just the empirical frequency of unconditional substitutions, with no information about which substitutions caused flips; CE learning begins only in the regime where more than half of a batch already flips, i.e., after the attack has essentially succeeded. The hard-label results in Tables 3, 8, and 10 therefore cannot be attributed to cross-entropy or rare-event optimization. Please re-run the hard-label experiments with an elite-selection rule that can select a proper subset under sparse rewards (for example, a small fixed rho or a positive threshold when any flip occurs), and report whether the final x' constructed by Algorithm 1 lines 13-16 actually flips the victim.
  2. [Sec. 3 (Eqs. 4 and 5)] The objective and the soft-label threshold are internally inconsistent as printed. Eq. 4 imposes Sem(x|x) <= epsilon, but f=m·Sem is increasing in Sem, so the constraint as written caps the quantity the attacker is trying to maximize; if the intended constraint is semantic preservation, it should read Sem(x|x) >= epsilon, and the values of epsilon and eta must be specified. In Eq. 5, the text states that 'a consistent m(F(x)) <= 1/K value will guarantee a misclassified example', but with m=1-F_c this condition reads 1-F_c <= 1/K, i.e., F_c >= 1-1/K, which is a high-confidence correct prediction and does not imply misclassification. The intended piecewise definition of Eq. 5 and the pigeonhole argument need to be restated carefully.
  3. [Secs. 4.1, 4.8.2 and Tables 2-4] The hyperparameters N=100, rho=0.5, and T=50 were selected in the ablation study on IMDB and WMT T1 (Sec. 4.8.2) and then used to produce the headline results on those same datasets (Tables 2-4), which is a selection-on-test procedure; no held-out tuning split is described. In addition, all reported metrics are point estimates from a single run with no error bars, confidence intervals, or significance tests. The 'consistently achieves' comparison to baselines in Sec. 4.6 is therefore not statistically supported. Please report results over multiple random seeds and a separate validation split for any hyperparameter choice.
  4. [Secs. 2.3 and 4.4] The related-work section cites [32] and [33] as existing applications of cross-entropy optimization to adversarial text generation, yet neither method is included in any experiment. Because the paper's central claim is that CEA is a new and superior CE-based attack, omitting the closest CE baselines makes the specific contribution over prior CE work impossible to assess. Please add these baselines to the comparison or justify their exclusion with concrete reasons.
  5. [Sec. 3.2 and Tables 2-4] The candidate substitution set si = sM_i ∩ ssyn_i underlies every experiment, but the paper reports no statistics on the size of si, the fraction of positions for which the intersection is empty, or the value of the MLM top-K parameter. If the intersection is frequently empty, many words cannot be modified, and if it omits the words that actually flip the victim, the CE sampler has no path to success. Reporting the average candidate-set size and the empty-intersection rate per dataset would directly test this load-bearing assumption.
  6. [Table 4, WMT T2/T5 row] In Table 4, CEA's BLEU Drop on WMT T2 with T5 is 16, which is lower than HAA's 17, yet Sec. 4.6.1 states that CE 'surpasses static baselines in attack performance' and the abstract claims consistent superiority. This row contradicts the 'consistently' claim and should be acknowledged or explained in the text.
minor comments (6)
  1. [Throughout] There are many typographical and wording errors, including 'the an customised' (Sec. 3), 't‘ e performance' (Sec. 3.3), 'smenatics' (Sec. 4.6.1), 'Rostbustness' (Fig. 6), 'TexCNN' (Fig. 4), 'deprave' (Sec. 3.1.2), 'substations' (Sec. 3.3), and '4Seq2sick' (Table 7). A careful proofread is needed.
  2. [Sec. 3.2] The MLM top-K value is never reported; please specify K and whether it varies across datasets or positions.
  3. [Algorithm 1, lines 13-16] Constructing the final example x' by taking the per-position argmax of the learned marginals can yield a combination that was never sampled as a whole; please describe how ties are broken and whether the final constructed example is verified to satisfy the attack objective.
  4. [Sec. 4.8.2] The initial-probability ablation is not well-defined because p(i,j)=0.1-0.5 cannot be varied independently for all positions while maintaining sum_j p(i,j)=1 for arbitrary candidate-set sizes ni; please describe exactly how this ablation was performed.
  5. [Table 1] The Emotion dataset is described in Sec. 4.2.1 and used in Sec. 4.11 but is missing from the dataset statistics in Table 1.
  6. [Declarations] The code-availability statements list inconsistent repository URLs (github.com/MingzeLucasNi/RCEAgit and github.com/MingzeLucasNi/CEA.git); please unify them.

Circularity Check

1 steps flagged · score 6.0 of 10

Hard-label CEA update degenerates under rho=0.5: Eq. 11 selects all samples whenever fewer than half of a batch flips, so the hard-label results do not demonstrate CE optimization.

  1. other [Sec. 3.1.1 Eq. (6); Sec. 3.3 Eqs. (10)-(11); Sec. 4.1 (rho=0.5)]
    "hard-label: m (F (x)) = 1(F (x) ̸= y) (6) ... We set a threshold update rate of ρ = 0.5 ... ˆγt+1 = f⌈(1−ρ)N⌉. (10) ... ˆpt+1 (i,j) = P N h=1 1{f (xt h|x) ≥ ˆγt}1{st (i,h) = s(i,j)} / P N h=1 1{f (xt h|x) ≥ ˆγt} (11)"

    With Eq. (6), every non-flipping candidate has f=0 and every flipping candidate has f=Sem(x|x)>0. Under the reported rho=0.5, Eq. (10) sets gamma_t to the median of the 100 sampled f-values. If fewer than half of the candidates flip, the median is 0, so the indicator 1{f>=gamma_t} in Eq. (11) is 1 for all N samples. The numerator then counts substitutions over the whole batch and the denominator is N, so p_{t+1} is the unconditional empirical frequency of the current sample, with no dependence on which substitutions caused flips. The claimed CE rare-event update therefore reduces to a stationary random-walk update by construction whenever the per-batch flip rate is below 50%, which covers most hard-label settings in Tables 3 and 8.

full rationale

CEA's claimed novelty is CE/rare-event optimization across soft-label, hard-label, and NMT. The soft-label and NMT objectives are continuous, so the quantile update in Eqs. (10)-(11) is meaningful there and constitutes independent algorithmic content. However, the hard-label branch is degenerate under the paper's own equations and reported hyperparameters: because f is 0 for all non-flipping candidates and rho=0.5 makes gamma_t the median, any batch with fewer than 50% flips selects all samples, so the update is just the empirical sampling distribution. The hard-label SAR numbers in Tables 3 and 8 are thus not evidence for CE optimization; they are at best evidence for the candidate sets and the final argmax. This is a construction-level reduction of a central claim, hence partial circularity. Self-citations to RJA, FBA, and HAA are ordinary baselines and are not load-bearing; no uniqueness theorem or prior-authority ansatz is invoked. Separately, hyperparameters were tuned on IMDB and WMT T1, the same datasets used in the headline tables, which is a validity concern but not itself a circularity. Overall, partial circularity: score 6.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central claim rests on the CE method's convergence, on the sufficiency of sememe-plus-MLM candidate sets, and on the design of the attack objectives. None of these is justified beyond citation or assertion, and one of the assertions (the pigeonhole bound in Eq 5) is incorrect as written.

free parameters (6)
  • gamma0 = 0.5
    Initial rare-event threshold in Algorithm 1; hand-set neutral starting point, not ablated in Section 4.8.2.
  • rho = 0.5
    Quantile update rate in Eq 10; chosen by hyperparameter sweep on IMDB and WMT T1, the same datasets used in main tables.
  • N = 100
    Number of adversarial candidates per iteration; selected from a 10-500 sweep on IMDB and WMT T1.
  • T = 50
    Maximum iterations; selected because gains saturate at 50 in Section 4.8.2 on the same test sets.
  • soft-label objective floor = 1/K
    Lower truncation in Eq 5; justified via pigeonhole principle, but the stated guarantee is incorrect and the floor is not ablated.
  • MLM top-K candidate count = not reported
    Candidate substitution sets depend on K from the masked language model; the value affects search space but is not specified in experiments.
assumptions (5)
  • standard math CE iterates converge to the optimal substitution distribution and threshold (Section 3.3, Eqs 9-11).
    Assumes standard cross-entropy method convergence properties from Rubinstein [25] hold for discrete text search.
  • domain assumption Intersection si = sM_i ∩ ssyn_i is non-empty and contains effective substitutions for enough words (Section 3.2).
    Attack success depends on candidate set sufficiency; no statistics on average |si| or empty intersections are reported.
  • ad hoc to paper Multiplicative objective f = m(F(x)) * Sem(x|x) with constraints (Eq 4) is a valid proxy for attack quality.
    Authors define the objective without comparison to alternative objectives such as additive or weighted combinations.
  • ad hoc to paper Pigeonhole principle ensures m(F(x)) <= 1/K guarantees misclassification (Section 3.1.1, Eq 5).
    This statement is mathematically incorrect under the paper's own definition m = 1 - F_c; it is an unsupported justification for the truncation.
  • domain assumption BLEU and semantic similarity jointly measure translation degradation in Eq 7.
    Assumes 1 - BLEU*Sem captures the attack objective for NMT without calibration.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Cross-Entropy Attacks to Language Models via Rare Event Simulation." pith.science (2026). https://pith.science/paper/2W3ZPKNE

@misc{pith2026250111852,
  author       = {Pith},
  title        = {Pith review of: Cross-Entropy Attacks to Language Models via Rare Event Simulation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2W3ZPKNE}},
  note         = {Machine review of arXiv:2501.11852}
}
read the original abstract

Black-box textual adversarial attacks are challenging due to the lack of model information and the discrete, non-differentiable nature of text. Existing methods often lack versatility for attacking different models, suffer from limited attacking performance due to the inefficient optimization with word saliency ranking, and frequently sacrifice semantic integrity to achieve better attack outcomes. This paper introduces a novel approach to textual adversarial attacks, which we call Cross-Entropy Attacks (CEA), that uses Cross-Entropy optimization to address the above issues. Our CEA approach defines adversarial objectives for both soft-label and hard-label settings and employs CE optimization to identify optimal replacements. Through extensive experiments on document classification and language translation problems, we demonstrate that our attack method excels in terms of attacking performance, imperceptibility, and sentence quality.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

70 extracted references · 54 canonical work pages

  1. [32]

    Advances in Neural Information Processing Systems 33, 2345–2356 (2020)

    Wang, L., Kroese, D.P.: Adversarial example generation via cross-entropy opti- mization: A rare-event simulation perspective. Advances in Neural Information Processing Systems 33, 2345–2356 (2020)

    work page 2020

  2. [33]

    Proceedings of the Association for Computational Linguistics (ACL) 58, 2141–2152 (2020)

    Chen, Y., Zhou, L.: Using cross-entropy optimization for robust adversarial text generation. Proceedings of the Association for Computational Linguistics (ACL) 58, 2141–2152 (2020)

    work page 2020

  3. [2]

    In: Pro- ceedings of the AAAI Conference on Artificial Intelligence, vol

    Cheng, M., Yi, J., Chen, P.-Y., Zhang, H., Hsieh, C.-J.: Seq2sick: Evaluating the robustness of sequence-to-sequence models with adversarial examples. In: Pro- ceedings of the AAAI Conference on Artificial Intelligence, vol. 34, pp. 3601–3608 (2020)

    work page 2020

  4. [3]

    In: Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pp

    Tan, S., Joty, S., Kan, M.-Y., Socher, R.: It’s morphin’ time! Combating lin- guistic discrimination with inflectional perturbations. In: Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pp. 2920–2935. Association for Computational Linguistics, Online (2020)

    work page 2020

  5. [4]

    In: Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pp

    Zang, Y., Qi, F., Yang, C., Liu, Z., Zhang, M., Liu, Q., Sun, M.: Word-level textual adversarial attacking as combinatorial optimization. In: Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pp. 6066–6080 (2020)

    work page 2020

  6. [5]

    In: Proceedings of the AAAI Conference on Artificial Intelligence, pp

    Yang, X., Liu, W., Bailey, J., Tao, D., Liu, W.: Bigram and unigram based text attack via adaptive monotonic heuristic search. In: Proceedings of the AAAI Conference on Artificial Intelligence, pp. 706–714 (2021)

    work page 2021

  7. [6]

    In: Proceedings of 27 the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pp

    Li, D., Zhang, Y., Peng, H., Chen, L., Brockett, C., Sun, M.-T., Dolan, W.B.: Contextualized perturbation for textual adversarial attack. In: Proceedings of 27 the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pp. 5053–5069 (2021)

    work page 2021

  8. [7]

    In: Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pp

    Li, L., Ma, R., Guo, Q., Xue, X., Qiu, X.: Bert-attack: Adversarial attack against bert using bert. In: Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pp. 6193–6202 (2020)

    work page 2020

Show all 70 references
  1. [8]

    In: Proceedings of the AAAI Conference on Artificial Intelligence, pp

    Ye, M., Miao, C., Wang, T., Ma, F.: Texthoaxer: Budgeted hard-label adversarial attacks on text. In: Proceedings of the AAAI Conference on Artificial Intelligence, pp. 3877–3884 (2022)

    2022

  2. [9]

    In: Proceedings of the AAAI Conference on Artificial Intelligence, pp

    Liu, H., Xu, Z., Zhang, X., Xu, X., Zhang, F., Ma, F., Chen, H., Yu, H., Zhang, X.: Sspattack: a simple and sweet paradigm for black-box hard-label textual adver- sarial attack. In: Proceedings of the AAAI Conference on Artificial Intelligence, pp. 13228–13235 (2023)

    2023

  3. [10]

    In: Proceedings of the AAAI Conference on Artificial Intelligence, pp

    Zhu, H., Zhao, Q., Shang, W., Wu, Y., Liu, K.: Limeattack: Local explainable method for textual hard-label adversarial attack. In: Proceedings of the AAAI Conference on Artificial Intelligence, pp. 19759–19767 (2024)

    2024

  4. [11]

    Advances in neural information processing systems 30 (2017)

    Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, L., Polosukhin, I.: Attention is all you need. Advances in neural information processing systems 30 (2017)

    2017

  5. [12]

    In: AAAI Conference on Artificial Intelligence (2020)

    Maheshwary, R., Maheshwary, S., Pudi, V.: Generating natural language attacks in a hard label black box setting. In: AAAI Conference on Artificial Intelligence (2020)

    2020

  6. [13]

    In: NAACL (2019)

    Devlin, J., Chang, M.-W., Lee, K., Toutanova, K.: Bert: Pre-training of deep bidirectional transformers for language understanding. In: NAACL (2019)

    2019

  7. [14]

    In: Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pp

    Ren, S., Deng, Y., He, K., Che, W.: Generating natural language adversarial examples through probability weighted word saliency. In: Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pp. 1085–1097 (2019)

    2019

  8. [15]

    In: Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pp

    Alzantot, M., Sharma, Y., Elgohary, A., Ho, B.-J., Srivastava, M., Chang, K.-W.: Generating natural language adversarial examples. In: Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pp. 2890–2896 (2018)

    2018

  9. [16]

    Jia, R., Raghunathan, A., G¨ oksel, K., Liang, P.: Certified robustness to adver- sarial word substitutions. In: Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Con- ference on Natural Language Processing (...

    2019

  10. [17]

    In: International Conference on Learning Representations (2018)

    Belinkov, Y., Bisk, Y.: Synthetic and natural noise both break neural machine translation. In: International Conference on Learning Representations (2018)

    2018

  11. [18]

    In: Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pp

    Tan, S., Joty, S., Kan, M.-Y., Socher, R.: It’s morphin’time! combating linguistic discrimination with inflectional perturbations. In: Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pp. 2920–2935 (2020)

    2020

  12. [19]

    In: Proceedings of the 40th Annual Meeting of the Association for Computational Linguistics, pp

    Papineni, K., Roukos, S., Ward, T., Zhu, W.-J.: Bleu: a method for automatic evaluation of machine translation. In: Proceedings of the 40th Annual Meeting of the Association for Computational Linguistics, pp. 311–318 (2002)

    2002

  13. [20]

    In: Proceedings of the ACL (2019)

    Jin, D., et al.: Textfooler: A model for evaluating robustness of natural language processing models. In: Proceedings of the ACL (2019)

    2019

  14. [21]

    In: Proceedings of the AAAI (2018)

    Gao, L., et al.: Black-box generation of adversarial text sequences to evade deep learning classifiers. In: Proceedings of the AAAI (2018)

    2018

  15. [22]

    In: Proceedings of the 57th Annual Meeting of the Associa- tion for Computational Linguistics

    Zhang, H., Zhou, H., Miao, N., Li, L.: Generating fluent adversarial examples for natural languages. In: Proceedings of the 57th Annual Meeting of the Associa- tion for Computational Linguistics. Association for Computational Linguistics, Florence, Italy (2019)

    2019

  16. [23]

    IEEE Transactions on Knowledge and Data Engineering (2024)

    Ni, M., Sun, Z., Liu, W.: Fraud’s bargain attack: Generating adversarial text samples via word manipulation process. IEEE Transactions on Knowledge and Data Engineering (2024)

    2024

  17. [24]

    Machine Learning, 1–31 (2024)

    Ni, M., Sun, Z., Liu, W.: Reversible jump attack to textual classifiers with modification reduction. Machine Learning, 1–31 (2024)

    2024

  18. [25]

    Methodology and Computing in Applied Probability 1(2), 127–190 (1999)

    Rubinstein, R.Y.: The cross-entropy method for combinatorial and continuous optimization. Methodology and Computing in Applied Probability 1(2), 127–190 (1999)

    1999

  19. [26]

    Annals of Operations Research 134(1), 31–51 (2005)

    Boer, P.-T., Kroese, D.P., Mannor, S., Rubinstein, R.Y.: A cross-entropy algo- rithm for the traveling salesman problem. Annals of Operations Research 134(1), 31–51 (2005)

    2005

  20. [27]

    Computational Optimization and Applications 27(2), 131–155 (2004)

    Rubinstein, R.Y., Kroese, D.P.: The cross-entropy method for the max-cut problem. Computational Optimization and Applications 27(2), 131–155 (2004)

    2004

  21. [28]

    Journal of Heuristics 8(5), 503–520 (2002)

    Rubenstein, R.Y., Zhou, S., Kroese, D.P.: Solving the quadratic assignment problem using the cross-entropy method. Journal of Heuristics 8(5), 503–520 (2002)

    2002

  22. [29]

    Advances in Neural Information Processing Systems 26, 2546–2554 (2013) 29

    Bergstra, J., Yamins, D., Cox, D.: Hyperparameter optimization using cross- entropy and gaussian processes. Advances in Neural Information Processing Systems 26, 2546–2554 (2013) 29

    2013

  23. [30]

    Computational Statistics and Data Analysis 47(4), 630–646 (2004)

    Zhou, S., Rubinstein, R.Y.: Feature selection with the cross-entropy method: A comparative study. Computational Statistics and Data Analysis 47(4), 630–646 (2004)

    2004

  24. [31]

    Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 1–9 (2018)

    Liu, H., Simonyan, K., Yang, Y.: Neural architecture search using cross-entropy sampling. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 1–9 (2018)

    2018

  25. [34]

    Unknown Publisher, ??? (1622)

    Leurechon, J.: Selectæ Propositiones. Unknown Publisher, ??? (1622)

  26. [35]

    In: Coling 2010: Demonstrations, pp

    Dong, Z., Dong, Q., Hao, C.: Hownet and its computation of meaning. In: Coling 2010: Demonstrations, pp. 53–56 (2010)

    2010

  27. [36]

    arXiv preprint arXiv:1901.09957 (2019)

    Qi, F., Yang, C., Liu, Z., Dong, Q., Sun, M., Dong, Z.: Openhownet: An open sememe-based lexical knowledge base. arXiv preprint arXiv:1901.09957 (2019)

    2019 arXiv

  28. [37]

    In: NIPS (2015)

    Zhang, X., Zhao, J.J., LeCun, Y.: Character-level convolutional networks for text classification. In: NIPS (2015)

    2015

  29. [38]

    In: Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pp

    Saravia, E., Liu, H.-C.T., Huang, Y.-H., Wu, J., Chen, Y.-S.: CARER: Contex- tualized affect representations for emotion recognition. In: Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pp. 3687–3697. Association for Computational Lingui...

    2018

  30. [39]

    In: Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing, pp

    Socher, R., Perelygin, A., Wu, J., Chuang, J., Manning, C.D., Ng, A., Potts, C.: Recursive deep models for semantic compositionality over a sentiment tree- bank. In: Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing, pp. 1631–1642. Associat...

    2013

  31. [40]

    In: Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics: Human Language Technologies, pp

    Maas, A.L., Daly, R.E., Pham, P.T., Huang, D., Ng, A.Y., Potts, C.: Learning word vectors for sentiment analysis. In: Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics: Human Language Technologies, pp. 142–150. Association for Computationa...

    2011

  32. [41]

    In: Proceedings of the 22nd Annual Conferenec of the European Association for Machine Translation (EAMT), Lisbon, Portugal (2020) 30

    Tiedemann, J., Thottingal, S.: OPUS-MT — Building open translation services for the World. In: Proceedings of the 22nd Annual Conferenec of the European Association for Machine Translation (EAMT), Lisbon, Portugal (2020) 30

    2020

  33. [42]

    In: Proceedings of the Third Conference on Machine Translation, Volume 2: Shared Task Papers, pp

    Bojar, O.r., Federmann, C., Fishel, M., Graham, Y., Haddow, B., Huck, M., Koehn, P., Monz, C.: Findings of the 2018 conference on machine transla- tion (wmt18). In: Proceedings of the Third Conference on Machine Translation, Volume 2: Shared Task Papers, pp. 272–307. Associati...

    2018

  34. [43]

    ArXiv abs/1910.01108 (2019)

    Sanh, V., Debut, L., Chaumond, J., Wolf, T.: Distilbert, a distilled version of bert: Smaller, faster, cheaper and lighter. ArXiv abs/1910.01108 (2019)

    2019 arXiv

  35. [44]

    In: EMNLP (2014)

    Kim, Y.: Convolutional neural networks for sentence classification. In: EMNLP (2014)

    2014

  36. [45]

    ArXiv abs/2210.11416 (2022)

    Chung, H.W., Hou, L., Longpre, S., Zoph, B., Tay, Y., Fedus, W., Li, E., Wang, X., Dehghani, M., Brahma, S., Webson, A., Gu, S.S., Dai, Z., Suzgun, M., Chen, X., Chowdhery, A., Valter, D., Narang, S., Mishra, G., Yu, A.W., Zhao, V., Huang, Y., Dai, A.M., Yu, H., Petrov, S., Ch...

    2022 arXiv

  37. [46]

    ArXiv abs/2008.00401 (2020)

    Tang, Y., Tran, C., Li, X., Chen, P.-J., Goyal, N., Chaudhary, V., Gu, J., Fan, A.: Multilingual translation with extensible multilingual pretraining and finetuning. ArXiv abs/2008.00401 (2020)

    2020 arXiv

  38. [47]

    In: AAAI (2020)

    Jin, D., Jin, Z., Zhou, J.T., Szolovits, P.: Is bert really robust? a strong baseline for natural language attack on text classification and entailment. In: AAAI (2020)

    2020

  39. [48]

    Machine Learning 111(11), 3977–4002 (2022)

    Ni, M., Wang, C., Zhu, T., Yu, S., Liu, W.: Attacking neural machine translations via hybrid attention learning. Machine Learning 111(11), 3977–4002 (2022)

    2022

  40. [49]

    In: Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pp

    Cer, D., Yang, Y., Kong, S.-y., Hua, N., Limtiaco, N., John, R.S., Constant, N., Guajardo-Cespedes, M., Yuan, S., Tar, C., et al.: Universal sentence encoder for english. In: Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing: System Demonst...

    2018

  41. [50]

    OpenAI (2019)

    Radford, A., Wu, J., Child, R., Luan, D., Amodei, D., Sutskever, I.: Language models are unsupervised multitask learners. OpenAI (2019)

    2019

  42. [51]

    Citeseer (2003)

    Naber, D., et al.: A rule-based style and grammar checker. Citeseer (2003)

    2003

  43. [52]

    arXiv preprint arXiv:2407.21783 (2024)

    Dubey, A., Jauhri, A., Pandey, A., Kadian, A., Al-Dahle, A., Letman, A., Mathur, A., Schelten, A., Yang, A., Fan, A., et al.: The llama 3 herd of models. arXiv preprint arXiv:2407.21783 (2024)

    2024 arXiv

  44. [53]

    arXiv preprint arXiv:2403.08295 (2024) 31

    Team, G., Mesnard, T., Hardin, C., Dadashi, R., Bhupatiraju, S., Pathak, S., Sifre, L., Rivi` ere, M., Kale, M.S., Love, J., et al.: Gemma: Open models based on gemini research and technology. arXiv preprint arXiv:2403.08295 (2024) 31

    2024 arXiv

  45. [54]

    In: Proceedings of the 16th Conference of the European Chapter of the Association for Computational Linguistics: Main Volume, pp

    Mozes, M., Stenetorp, P., Kleinberg, B., Griffin, L.: Frequency-guided word substitutions for detecting textual adversarial examples. In: Proceedings of the 16th Conference of the European Chapter of the Association for Computational Linguistics: Main Volume, pp. 171–186 (2021)

    2021

  46. [55]

    Computational Linguistics 49(2), 395–427 (2023)

    Zeng, J., Xu, J., Zheng, X., Huang, X.: Certified robustness to text adversar- ial attacks by randomized [MASK]. Computational Linguistics 49(2), 395–427 (2023)

    2023

  47. [57]

    IEEE Transactions on Knowledge and Data Engineering (TKDE) 33(11), 3568–3581 (2020)

    Chivukula, A.S., Yang, X., Liu, W., Zhu, T., Zhou, W.: Game theoretical adversarial deep learning with variational adversaries. IEEE Transactions on Knowledge and Data Engineering (TKDE) 33(11), 3568–3581 (2020)

    2020

  48. [58]

    arXiv preprint arXiv:1312.6199 (2013)

    Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., Fer- gus, R.: Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013)

    2013 arXiv

  49. [59]

    arXiv preprint arXiv:1412.6572 (2014)

    Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)

    2014 arXiv

  50. [60]

    In: IEEE European Symposium on Security and Privacy (EuroSP) (2016)

    Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z.B., Swami, A.: The limitations of deep learning in adversarial settings. In: IEEE European Symposium on Security and Privacy (EuroSP) (2016)

    2016

  51. [61]

    arXiv preprint arXiv:1607.02533 (2016)

    Kurakin, A., Goodfellow, I., Bengio, S.: Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533 (2016)

    2016 arXiv

  52. [62]

    In: Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pp

    Ebrahimi, J., Rao, A., Lowd, D., Dou, D.: Hotflip: White-box adversarial exam- ples for text classification. In: Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pp. 31–36 (2018)

    2018

  53. [63]

    arXiv preprint arXiv:1704.08006 (2017)

    Liang, B., Li, H., Su, M., Bian, P., Li, X., Shi, W.: Deep text classification can be fooled. arXiv preprint arXiv:1704.08006 (2017)

    2017 arXiv

  54. [64]

    In: International Conference on Learning Representations (2017)

    Zhao, Z., Dua, D., Singh, S.: Generating natural adversarial examples. In: International Conference on Learning Representations (2017)

    2017

  55. [65]

    In: International Conference on Learning Representations (2017)

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. In: International Conference on Learning Representations (2017)

    2017

  56. [66]

    In: International Conference on Learning 32 Representations (2017)

    Sinha, A., Namkoong, H., Duchi, J.: Certifying some distributional robustness with principled adversarial training. In: International Conference on Learning 32 Representations (2017)

    2017

  57. [67]

    arXiv preprint arXiv:1805.12152 (2018)

    Tsipras, D., Santurkar, S., Engstrom, L., Turner, A., Madry, A.: There is no free lunch in adversarial robustness (but there are unexpected benefits). arXiv preprint arXiv:1805.12152 (2018)

    2018 arXiv

  58. [68]

    arXiv preprint arXiv:1901.08573 (2019)

    Zhang, H., Yu, Y., Jiao, J., Xing, E.P., Ghaoui, L.E., Jordan, M.I.: Theo- retically principled trade-off between robustness and accuracy. arXiv preprint arXiv:1901.08573 (2019)

    2019 arXiv

  59. [69]

    arXiv preprint arXiv:1810.04805 (2018)

    Devlin, J., Chang, M.-W., Lee, K., Toutanova, K.: Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805 (2018)

    2018 arXiv

  60. [70]

    OpenAI (2018)

    Radford, A., Narasimhan, K., Salimans, T., Sutskever, I.: Improving language understanding by generative pre-training. OpenAI (2018)

    2018

  61. [71]

    In: Proceedings of the 11th International Workshop on Semantic Evaluation (SemEval-2017), pp

    Xu, Z., Jiang, Z., Ren, F.: Virginia tech at semeval-2017 task 4: A simple ensem- ble method for sentiment polarity classification. In: Proceedings of the 11th International Workshop on Semantic Evaluation (SemEval-2017), pp. 638–642 (2017)

    2017

  62. [72]

    In: Empirical Methods in Natural Language Processing (2019) 33

    Jia, R., Raghunathan, A., G¨ oksel, K., Liang, P.: Certified robustness to adver- sarial word substitutions. In: Empirical Methods in Natural Language Processing (2019) 33

    2019

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.