Pith. sign in

REVIEW 5 major objections 6 minor 29 references

Pay Attention to the Robustness of Chinese Minority Language Models! Syllable-level Textual Adversarial Attack on Tibetan Script

T0 review · 5 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Syllable swaps cut Tibetan model accuracy by up to 38.6 points

desk verdict First Tibetan syllable-level attack, but headline ASR is miscalculated; core attack still works but needs metric fixes and baselines. read the letter →

arxiv 2412.02323 v2 pith:2ZMIGJJW submitted 2024-12-03 cs.CL cs.CR

Xi Cao , Dolma Dawa , Nuo Qun , Trashi Nyima This is my paper · ORCID
classification cs.CLcs.CR
keywords TibetanNLPtextualadversarialattacksyllable-levelblack-boxCINOrobustnessevaluationcosinedistanceminoritylanguages
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

TSAttacker is a black-box textual adversarial attack that perturbs Tibetan text one syllable at a time and, the paper argues, fools fine-tuned classifiers reliably. The paper applies it to six models built from CINO, a multilingual pre-trained language model that includes Tibetan, across news-title, news-document, and sentiment tasks, and reports large accuracy drops and high attack success rates in every case. The low average Levenshtein distance of the perturbed texts is offered as evidence that the adversarial samples are high-quality, implying that defenders cannot simply filter them by edit distance. The motivation is that robustness research has concentrated on English and Chinese, leaving Chinese minority languages such as Tibetan without adversarial stress tests. If the attack works as described, it gives the community a concrete way to measure Tibetan NLP robustness and argues that the involved models need strengthening.

What carries the argument

The load-bearing mechanism is a syllable-substitution loop with two governing quantities. First, the candidate pool is fixed by syllable cosine distance in a pretrained Tibetan syllable embedding space: a candidate $s'$ is admissible only if $d = 1 - \frac{s \cdot s'}{|s||s'|} \le d_{\max}$, with $d_{\max} = 0.2929$, so replacements stay near the original in that geometric space. Second, the substitution order is set by a probability-weighted saliency score $H_i = \mathrm{softmax}(S_i) \cdot \Delta P_{i*}$, where $S_i$ is the drop in true-class probability when syllable $i$ is masked and $\Delta P_{i*}$ is the largest probability drop achievable by any admissible replacement. The procedure queries only the victim model's output probabilities, which is what makes it a black-box attack.

What would settle it

Run a native-speaker evaluation in which Tibetan readers rate the fluency and semantic fidelity of the released adversarial samples; if they consistently identify the substituted syllable or judge the text unnatural, the high-quality claim is refuted. Alternatively, replace the cosine-distance candidate selection with random syllables that match each original's Levenshtein distance; if random substitution achieves comparable attack success rates, then the embedding-based selection is not the cause of the reported vulnerability.

Watch

Extended reading notes

Core claim

The paper's central claim is that a syllable-level, query-only attack consistently lowers the accuracy of fine-tuned Tibetan text classifiers while keeping the perturbed syllables close to the original in an embedding space. For each syllable in an input, TSAttacker forms a candidate set from pretrained Tibetan syllable embeddings whose cosine distance to the original is at most $d_{\max} = 0.2929$ (a 45-degree angle), then selects the replacement that most reduces the probability of the true class, ordering substitutions by a softmax-weighted saliency score. On the TNCC-title test set the procedure drops cino-base-v2 accuracy from 0.6731 to 0.3085 (an accuracy drop value of 0.3646) with an attack success rate of 0.7605, and the other five models show drops of at least 0.2240. The article also reports that models fine-tuned on orthographically standard Tibetan text with tsheg separators perform better than models trained on space- or no-space variants, and it concludes that CINO's Tibetan robustness has considerable room for improvement.

Load-bearing premise

The entire method leans on the premise that cosine distance in a syllable embedding space captures what a Tibetan reader would accept as a subtle, meaning-preserving substitution; if that premise fails, the generated texts may look wrong to native speakers even though they meet the geometric threshold.

Editorial extensions

If this is right

  • The released attack and code give future Tibetan NLP work a standard baseline for robustness evaluation, allowing researchers to compare defenses and model variants against a common adversary.
  • The accuracy drops on all six fine-tuned CINO models imply that current Tibetan classifiers are not yet safe for high-stakes deployment without adversarial defense.
  • The attack succeeds on short titles, long documents, and sentiment texts, so the vulnerability appears to be general across Tibetan text classification rather than limited to one task length.
  • Because average Levenshtein distances are low (about 1.6 syllables for titles and under 3 for sentiment texts), simple edit-distance-based adversarial filters would miss many of these attacks.
  • The tsheg-standard fine-tuning comparison suggests that following Tibetan orthographic conventions during training improves model performance, a lesson for future dataset construction.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same attack recipe could transfer to other syllable-based Chinese minority languages, such as Mongolian or Uyghur, whenever a syllable embedding table exists; the paper does not test this transfer.
  • A human judgment study would probably narrow the candidate pool further, because embedding cosine distance is neither phonetic nor visual; adding such a filter could make the attack both stronger and more clearly imperceptible.
  • Adversarial training on TSAttacker examples, or fine-tuning on tsheg-standard corpora, is a natural defense to test next; the paper evaluates attacks only, so the defender's side remains open.
  • The observation that larger models are not always more robust suggests that tokenization and training-data quality may matter more than parameter count for minority-language robustness, a hypothesis the paper leaves implicit.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes TSAttacker, a syllable-level black-box textual adversarial attack for Tibetan text classification. The attack selects candidate substitution syllables from fastText embeddings within a cosine-distance threshold dmax and orders substitutions by a probability-weighted saliency score. The authors fine-tune two CINO models on three Tibetan datasets and report accuracy drop (ADV), attack success rate (ASR), and Levenshtein distance (LD), claiming high effectiveness and high-quality adversarial samples. The work targets an important and under-explored area: robustness of NLP models for Chinese minority languages.

Significance. If the claims are substantiated, the paper would be a useful first step in adversarial robustness for Tibetan NLP, providing a reusable attack implementation and an evaluation of CINO's Tibetan components. The syllable-level attack design is linguistically appropriate for Tibetan, since the syllable is a natural granularity between character and word. The paper also releases its code and data, which supports reproducibility. However, the current experimental validation does not yet meet the standard needed to support the headline claims: the ASR metric is internally inconsistent with the formal definition, there is no baseline comparison, and sample quality is measured only by edit distance.

major comments (5)
  1. [Section 3.2.2, Appendix A, Section 4.2, Table 4] The success condition used in the algorithm and the formal definition are inconsistent. Eq. (2) defines a successful attack as F(x') != y_true, but the pseudocode (Algorithm 1, line 22) and the text in Section 3.2.2 use F(x') != F(x), i.e., any change in the predicted label. This directly affects the reported ASR. For cino-base-v2+TNCC-title(tsheg), pre-attack accuracy is 0.6731 and post-attack accuracy is 0.3085, so if ASR were the fraction of all samples that flip from correct to incorrect, it could not exceed 0.6731, yet the reported ASR is 0.7605. If ASR were the fraction of originally correct samples that flip, the implied accuracy drop (ASR * 0.6731 ≈ 0.51) would far exceed the observed ADV of 0.3646. The only way to reconcile the numbers is that ASR counts all prediction changes, including changes between two incorrect labels (and even incorrect-to-correct changes). The authors must align the implementation with Eq. (2), recompute ASR accordingly, or explicitly redefine ASR as a prediction-change rate and revise the claim of a high attack success rate.
  2. [Section 4.2] No baseline comparison is provided. The paper reports ADV, ASR, and LD for TSAttacker only, without comparing to random syllable substitution, a greedy synonym attack, or any existing adversarial attack adapted to Tibetan. Without a baseline, the claim in the abstract that TSAttacker is effective is not statistically substantiated; a random perturbation under the same dmax and query budget might achieve comparable results. At minimum, the authors should add a random-substitution baseline and report query counts, so that the contribution of the scoring mechanism and cosine-distance candidate selection can be isolated.
  3. [Section 4.2, Appendix B] The quality of adversarial samples is judged solely by Levenshtein distance. LD measures edit distance, not perceptual, phonetic, or semantic similarity; two substitutions at the same LD can be visually or semantically very different. For TNCC-document, the average LD is 39.18 and 41.97, which is non-trivial even relative to the average length of 689 syllables. The paper provides no human evaluation, fluency scores, or meaning-preservation metrics, so the claim that TSAttacker generates high-quality adversarial samples is not adequately supported. The authors should add human judgments or at least a semantic similarity metric (e.g., BERTScore or embedding similarity) alongside LD.
  4. [Table 3] Table 3 contains duplicated rows: cino-large-v2+TNCC-document(space) and cino-large-v2+TNCC-document(no space) have exactly the same accuracy, macro-F1, and other metrics as the corresponding cino-base-v2 rows (0.7380/0.6985/... and 0.7435/0.6967/...). This is almost certainly a copy-paste error and makes the evaluation of cino-large-v2 on TNCC-document incomplete. The authors must correct the table and, if the large-model fine-tuning was actually performed, report the correct numbers.
  5. [Section 4.2, Section 4.3] The default value of dmax (0.2929) is chosen without a principled justification, and the ablation in Section 4.3 only examines three values (0.1340, 0.2929, 0.5) without a clear criterion for the default. Since dmax controls the candidate pool and, through it, the trade-off between attack success and sample quality, the authors should justify the chosen default (e.g., via a validation set) and report the sensitivity of the main results to this parameter, ideally with error bars over multiple runs.
minor comments (6)
  1. [Figure 1] The x-axis labels in Figure 1 appear as '0.1 340', '0.2 929', and '0.5' instead of the intended '0.1340', '0.2929', and '0.5'.
  2. [Section 4.2] The sentence 'ASR refers to the percentage of the attack that successfully fool the victim model' is ambiguous; after addressing the metric inconsistency, this definition should be restated precisely.
  3. [Appendix A] In Algorithm 1, line 12 reuses the notation ΔP_i inside the inner loop, overwriting the value; the pseudocode should use ΔP_{ij} to match Equation (6).
  4. [Appendix B] The adversarial samples in Appendix B are shown with placeholders in the provided text; ensure the actual Tibetan script is rendered and that the bold/red marking of substituted syllables is visible in the final PDF.
  5. [Section 2] The related work on English textual attacks is somewhat dated; adding recent methods such as BERT-Attack or genetic-algorithm-based attacks would improve the survey, though this is not critical.
  6. [Section 4.1.2] The hyperparameter table does not report the number of training steps or the early-stopping criterion; adding these would improve reproducibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: TSAttacker's effectiveness claim is grounded in external fastText embeddings and the victim model's own outputs, not in a self-referential derivation.

full rationale

The derivation chain is self-contained rather than circular. Candidate substitution syllables are selected using pre-trained external fastText Tibetan syllable embeddings via cosine distance (Eq. 4), and the substitution choice is driven by the victim model's probability drop (Eqs. 6-9), with ordering from the PWWS saliency formula (Eqs. 11-12). None of these steps defines the attack's success in terms of the conclusion being asserted: the fastText embeddings are an external resource, the model probabilities are the target system's outputs rather than fitted parameters, and the free parameter dmax is ablated in Section 4.3. The 'high-quality' claim rests on low average Levenshtein distance and the cosine-distance threshold; cosine similarity as an imperceptibility proxy is an assumption, not a circular reduction. The cited TNCC and TU_SA datasets and the CINO PLM are external resources, and the paper's self-citations (Qun et al. 2017; Zhu et al. 2023) are dataset sources rather than load-bearing evidence for attack effectiveness. The reported ASR numbers appear inconsistent with the stated definition (e.g., ASR 0.7605 exceeds pre-attack accuracy 0.6731 for cino-base-v2+TNCC-title), but that is a measurement/definition concern, not a circularity. Therefore the circularity score is 0.

Assumptions & free parameters 1 free parameters · 3 assumptions · 0 invented entities

The only free parameter is dmax. The main assumptions are standard black-box attack premises and the suitability of fastText embeddings for Tibetan syllable similarity. No new physical or conceptual entities are introduced.

free parameters (1)
  • dmax = 0.2929
    Maximum cosine distance for selecting candidate syllables; set to 0.2929 (45 degrees) and ablated over 0.1340, 0.2929, 0.5. This threshold controls candidate set size and affects attack success and fluency, yet no principled justification is given for the main value.
assumptions (3)
  • domain assumption fastText Tibetan syllable embeddings capture meaningful syllable similarity
    The attack relies on Grave et al. (2018) embeddings and a cleaned vocabulary of 7,652 syllables to define semantically or perceptually similar candidates. This is cited prior work, but the paper does not verify that cosine distance correlates with human perception or contextual appropriateness.
  • domain assumption The victim model exposes probability outputs over classes
    TSAttacker queries P(y|x) for original and perturbed inputs. This is standard for score-based black-box attacks, but it means the method is not applicable to models that only output hard labels without a score API.
  • domain assumption Tibetan syllable is the appropriate perturbation granularity for imperceptibility
    The paper argues syllable granularity sits between character and word in Tibetan, making it a natural unit. This is plausible, but the claim that syllable-level edits are imperceptible is not validated by human studies.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Pay Attention to the Robustness of Chinese Minority Language Models! Syllable-level Textual Adversarial Attack on Tibetan Script." pith.science (2026). https://pith.science/paper/2ZMIGJJW

@misc{pith2026241202323,
  author       = {Pith},
  title        = {Pith review of: Pay Attention to the Robustness of Chinese Minority Language Models! Syllable-level Textual Adversarial Attack on Tibetan Script},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2ZMIGJJW}},
  note         = {Machine review of arXiv:2412.02323}
}
read the original abstract

The textual adversarial attack refers to an attack method in which the attacker adds imperceptible perturbations to the original texts by elaborate design so that the NLP (natural language processing) model produces false judgments. This method is also used to evaluate the robustness of NLP models. Currently, most of the research in this field focuses on English, and there is also a certain amount of research on Chinese. However, to the best of our knowledge, there is little research targeting Chinese minority languages. Textual adversarial attacks are a new challenge for the information processing of Chinese minority languages. In response to this situation, we propose a Tibetan syllable-level black-box textual adversarial attack called TSAttacker based on syllable cosine distance and scoring mechanism. And then, we conduct TSAttacker on six models generated by fine-tuning two PLMs (pre-trained language models) for three downstream tasks. The experiment results show that TSAttacker is effective and generates high-quality adversarial samples. In addition, the robustness of the involved models still has much room for improvement.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

29 extracted references · 10 canonical work pages

  1. [1]

    URL: " 'urlintro :=

    ENTRY address author booktitle chapter edition editor howpublished institution journal key month note number organization pages publisher school series title type volume year eprint doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRINGS urlintro eprinturl eprintpr...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    YunSeok Choi, Hyojun Kim, and Jee-Hyong Lee. 2022. https://aclanthology.org/2022.emnlp-main.369 TABS : Efficient textual adversarial attack for pre-trained NL code model using semantic beam search . In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 5490--5498, Abu Dhabi, United Arab Emirates. Association for ...

    work page 2022

  4. [4]

    Alexis Conneau, Kartikay Khandelwal, Naman Goyal, Vishrav Chaudhary, Guillaume Wenzek, Francisco Guzm \'a n, Edouard Grave, Myle Ott, Luke Zettlemoyer, and Veselin Stoyanov. 2020. https://doi.org/10.18653/v1/2020.acl-main.747 Unsupervised cross-lingual representation learning at scale . In Proceedings of the 58th Annual Meeting of the Association for Comp...

    doi:10.18653/v1/2020.acl-main.747 2020

  5. [5]

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. https://doi.org/10.18653/v1/N19-1423 BERT : Pre-training of deep bidirectional transformers for language understanding . In Proceedings of the 2019 Conference of the North A merican Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long a...

    doi:10.18653/v1/n19-1423 2019

  6. [6]

    Xiaohu Du, Hongming Wu, Zibo Yi, Shasha Li, Jun Ma, and Jie Yu. 2021. Adversarial text attack and defense: A review. Journal of Chinese Information Processing, 35(08):1--15

    work page 2021

  7. [7]

    Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018. https://doi.org/10.18653/v1/P18-2006 H ot F lip: White-box adversarial examples for text classification . In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pages 31--36, Melbourne, Australia. Association for Computational Linguistics

    doi:10.18653/v1/p18-2006 2018

  8. [8]

    o zde G \

    Steffen Eger, G \"o zde G \"u l S ahin, Andreas R \"u ckl \'e , Ji-Ung Lee, Claudia Schulz, Mohsen Mesgar, Krishnkant Swarnkar, Edwin Simpson, and Iryna Gurevych. 2019. https://doi.org/10.18653/v1/N19-1165 Text processing like humans do: Visually attacking and shielding NLP systems . In Proceedings of the 2019 Conference of the North A merican Chapter of ...

    doi:10.18653/v1/n19-1165 2019

Show all 29 references
  1. [9]

    Ji Gao, Jack Lanchantin, Mary Lou Soffa, and Yanjun Qi. 2018. https://doi.org/10.1109/SPW.2018.00016 Black-box generation of adversarial text sequences to evade deep learning classifiers . In 2018 IEEE Security and Privacy Workshops (SPW), pages 50--56

    2018

  2. [10]

    Siddhant Garg and Goutham Ramakrishnan. 2020. https://doi.org/10.18653/v1/2020.emnlp-main.498 BAE : BERT -based adversarial examples for text classification . In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 6174--6181, O...

    2020 doi

  3. [11]

    Edouard Grave, Piotr Bojanowski, Prakhar Gupta, Armand Joulin, and Tomas Mikolov. 2018. https://aclanthology.org/L18-1550 Learning word vectors for 157 languages . In Proceedings of the Eleventh International Conference on Language Resources and Evaluation ( LREC 2018) , Miyaz...

    2018

  4. [12]

    Robin Jia and Percy Liang. 2017. https://doi.org/10.18653/v1/D17-1215 Adversarial examples for evaluating reading comprehension systems . In Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing, pages 2021--2031, Copenhagen, Denmark. Associati...

    2017 doi

  5. [13]

    Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2019. Is BERT really robust? a strong baseline for natural language attack on text classification and entailment. In AAAI Conference on Artificial Intelligence

    2019

  6. [14]

    Armand Joulin, Edouard Grave, Piotr Bojanowski, Matthijs Douze, H \'e rve J \'e gou, and Tomas Mikolov. 2016. Fasttext.zip: Compressing text classification models. arXiv preprint arXiv:1612.03651

    2016 arXiv

  7. [15]

    Jiwei Li, Will Monroe, and Dan Jurafsky. 2016. Understanding neural networks through representation erasure. ArXiv, abs/1612.08220

    2016 arXiv

  8. [16]

    Sisi Liu, Junjie Deng, Yuan Sun, and Xiaobing Zhao. 2022. https://doi.org/10.1109/SMC53654.2022.9945074 Tibert: Tibetan pre-trained language model . In 2022 IEEE International Conference on Systems, Man, and Cybernetics (SMC), pages 2956--2961

    2022

  9. [17]

    John Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, Di Jin, and Yanjun Qi. 2020. https://doi.org/10.18653/v1/2020.emnlp-demos.16 T ext A ttack: A framework for adversarial attacks, data augmentation, and adversarial training in NLP . In Proceedings of the 2020 Conference on ...

    2020 doi

  10. [18]

    Nuo Qun, Xing Li, Xipeng Qiu, and Xuanjing Huang. 2017. End-to-end neural text classification for tibetan. In Chinese Computational Linguistics and Natural Language Processing Based on Naturally Annotated Big Data, pages 472--480, Cham. Springer International Publishing

    2017

  11. [19]

    Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. 2019. https://doi.org/10.18653/v1/P19-1103 Generating natural language adversarial examples through probability weighted word saliency . In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics...

    2019 doi

  12. [20]

    Erhan, Ian J

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, D. Erhan, Ian J. Goodfellow, and Rob Fergus. 2013. Intriguing properties of neural networks. CoRR, abs/1312.6199

    2013 arXiv

  13. [21]

    Xin Tong, Luona Wang, Runzheng Wang, and Jingya Wang. 2020. A generation method of word-level adversarial samples for chinese text classification. Netinfo Security, 20(09):12--16

    2020

  14. [22]

    Jindong Wang, Xixu Hu, Wenxin Hou, Haoxing Chen, Runkai Zheng, Yidong Wang, Linyi Yang, Haojun Huang, Weirong Ye, Xiubo Geng, Binxing Jiao, Yue Zhang, and Xingxu Xie. 2023. On the robustness of chatgpt: An adversarial and out-of-distribution perspective. ArXiv, abs/2302.12095

    2023 arXiv

  15. [23]

    Wenqi Wang, Run Wang, Lina Wang, and Benxiao Tang. 2019. Adversarial examples generation approach for tendency classification on chinese texts. Journal of Software, 30(08):2415--2427

    2019

  16. [24]

    Xiao Wang, Qin Liu, Tao Gui, Qi Zhang, Yicheng Zou, Xin Zhou, Jiacheng Ye, Yongxin Zhang, Rui Zheng, Zexiong Pang, Qinzhuo Wu, Zhengyan Li, Chong Zhang, Ruotian Ma, Zichu Fei, Ruijian Cai, Jun Zhao, Xingwu Hu, Zhiheng Yan, Yiding Tan, Yuan Hu, Qiyuan Bian, Zhihua Liu, Shan Qin...

    2021 doi

  17. [25]

    Ziqing Yang, Zihang Xu, Yiming Cui, Baoxin Wang, Min Lin, Dayong Wu, and Zhigang Chen. 2022. https://aclanthology.org/2022.coling-1.346 CINO : A C hinese minority pre-trained language model . In Proceedings of the 29th International Conference on Computational Linguistics, pag...

    2022

  18. [26]

    Guoyang Zeng, Fanchao Qi, Qianrui Zhou, Tingji Zhang, Zixian Ma, Bairu Hou, Yuan Zang, Zhiyuan Liu, and Maosong Sun. 2021. https://doi.org/10.18653/v1/2021.acl-demo.43 O pen A ttack: An open-source textual adversarial attack toolkit . In Proceedings of the 59th Annual Meeting ...

    2021 doi

  19. [27]

    Shunxiang Zhang, Houyue Wu, Guangli Zhu, Xin Xu, and Mingxing Su. 2022. Character-level adversarial samples generation approach for chinese text classification. Journal of Electronics & Information Technology

    2022

  20. [28]

    Haibin Zheng, Jinyin Chen, Yan Zhang, Xuhong Zhang, Chunpeng Ge, Zhe Liu, Yike Ouyang, and Shouling Ji. 2021. Survey of adversarial attack, defense and robustness analysis for natural language processing. Journal of Computer Research and Development, 58(08):1727--1750

    2021

  21. [29]

    Yulei Zhu, Kazhuo Deji, Nuo Qun, and Tashi Nyima. 2023. Sentiment analysis of tibetan short texts based on graphical neural networks and pre-training models. Journal of Chinese Information Processing, 37(02):71--79

    2023

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.