ROBAD: Robust Adversary-aware Local-Global Attended Bad Actor Detection Sequential Model

Bing He; Mustaque Ahamad; Srijan Kumar

REVIEW 5 major objections 5 minor 44 references

ROBAD: Robust Adversary-aware Local-Global Attended Bad Actor Detection Sequential Model

T0 review · 5 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read ROBAD, a transformer model with local-global attention and contrastive adversarial training, reports the highest F1 score among compared bad actor detectors and the lowest F1 drop under PETGEN and LLaMA next-post attacks.

desk verdict Good clean classification results and a sensible architecture, but the paper's central robustness claim is contradicted by its own Table 6. read the letter →

arxiv 2507.15067 v1 pith:3UJNLNDA submitted 2025-07-20 cs.LG cs.SI

Bing He , Mustaque Ahamad , Srijan Kumar This is my paper

classification cs.LGcs.SI

keywords badactordetectionadversarialrobustnesstransformercontrastivelearningsequenceclassificationnextpostattacksocialmediaintegrity

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

ROBAD is a transformer-based classifier that tries to identify bad actors (fraudulent reviewers, Wikipedia vandals) from the sequence of their posts while staying robust to adversarial evasion. Existing sequence detectors are brittle: appending one carefully generated post can flip their prediction. ROBAD addresses this with two ideas: encode each post bidirectionally and then attend over the sequence of posts, and train on attacker-modified sequences with a contrastive loss so the model treats an original sequence and its attacked version as the same user. On Yelp and Wikipedia ground-truth datasets, the paper reports that ROBAD has the highest F1 score among compared sequence and defense baselines with no attack, and the smallest F1 drop when PETGEN or LLaMA appends a next post. If the robustness holds, it means platforms can field a detector that is harder to game by writing new posts.

What carries the argument

Two coupled modules carry the argument. The local-global attended module is a dual transformer: an encoder block processes each post token-wise to form a post embedding, and a decoder block processes the chronological list of post embeddings with masked self-attention to form the user sequence embedding. The adversary-aware module feeds both the original sequence embedding and the embedding of a mimicked-attacked sequence through a projection head, then optimizes an InfoNCE contrastive loss (borrowed from SimCLR) alongside the cross-entropy classification losses; this forces attacked and original versions of the same user to be close in representation space while separating different users. The combination is what the paper credits for both accuracy and robustness.

What would settle it

Train ROBAD with attack sequences generated by one procedure (for example, random appends) and evaluate it against PETGEN and LLaMA attacks; if the F1 drop then approaches the baselines' drops, the reported robustness is an artifact of matching training and test attack distributions rather than a general defense. A direct adaptive-attack experiment that optimizes a post against ROBAD itself would also settle the claim.

Watch

Extended reading notes

Core claim

The paper's central claim is that adversarial robustness in bad actor detection can be built by combining local-global sequence understanding with adversary-aware contrastive training, rather than by treating robustness as a separate defense step. Concretely, ROBAD first uses a transformer encoder to encode each post bidirectionally into a post embedding (local information), then uses a transformer decoder's masked attention over those post embeddings to produce a sequence embedding (global information). For each user, the model also computes an embedding of a modified sequence in which a mimicked attacker has appended a new post, and a contrastive loss pulls the original and modified sequence embeddings together while pushing other users' embeddings apart. The classification loss and contrastive loss are combined in a weighted multi-task objective. In experiments on Yelp and Wikipedia, the paper states that ROBAD achieves the highest F1 score with no attack and the lowest F1 drop under PETGEN and LLaMA attacks.

Load-bearing premise

The robustness claim rests on the assumption that the 'modified sequences by mimicked attackers' used in training are produced by the same kind of procedure as the PETGEN and LLaMA attacks used in evaluation; the paper does not specify how the training attacks are crafted, so if that distribution differs, the reported low F1 drop may not generalize.

Editorial extensions

If this is right

If ROBAD's robustness transfers, a deployed detector could keep a near-constant F1 when bad actors append newly written posts, instead of losing 3 to 13 points as the compared baselines do.
The local-global design implies that both post content and the ordering of posts matter; users can be represented by a compact sequence embedding that is stable under appended input.
The contrastive, adversary-aware training objective can be added to other sequence classifiers as a regularizer, not only to a transformer backbone.
The weight of the contrastive loss is a critical control: the paper finds 0.1 optimal, with larger weights degrading un-attacked F1, so practical deployments should tune this term carefully.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A natural test the paper does not run is to vary the attack generator between training and evaluation; if matching matters, ROBAD's robustness should drop when training attacks are simple appends and test attacks are LLM-optimized.
The contrastive adversary-aware scheme is not inherently limited to sequences; applying it to graph-based user histories or multimodal posts is a plausible next step the text hints at but does not explore.
Because the paper only evaluates against non-adaptive PETGEN and LLaMA attacks, an adaptive attacker that queries ROBAD and optimizes a next post against it would be a stronger robustness benchmark and likely a harder one.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Read this if you work on robust sequential user classifiers. The clean detection results are solid, but the paper's headline robustness claim doesn't survive contact with its own tables, and the training attack setup is underspecified.

What's actually new: ROBAD stacks a per-post transformer encoder, a decoder over the post sequence, and a SimCLR-style contrastive loss that pulls embeddings of original and attacker-modified sequences together. That specific combination for bad actor detection is new, and it earns credit for being plausible. The clean F1 numbers on Yelp and Wikipedia are consistently better than the TIES, HRNN, and BERT baselines, and the ablations show both modules contribute. That part of the empirical story looks credible.

Now the soft spots. The central claim in Section 5.6 is that ROBAD has the lowest F1 drop under PETGEN and LLaMA attacks. Table 6 (Yelp) contradicts this: under LLaMA, FT-Defense drops from 0.656 to 0.652 (delta 0.004) while ROBAD drops from 0.708 to 0.682 (delta 0.026). Under PETGEN, using Table 6, FT-Defense drops 0.006 and ROBAD 0.008. Table 7 changes FT-Defense's clean score to 0.665, which fails to match Tables 4 and 6, and reports only PETGEN; that shifted baseline is what makes ROBAD look like the best defender. So the 'lowest F1 drop' claim is not supported by the recorded numbers as they stand.

The other issues are real but less damaging. There are no error bars across the five folds, despite five-fold CV. The 'modified sequences by mimicked attackers' used during training (Section 4.3.1) are never specified. Since evaluation uses exactly PETGEN and LLaMA, the low drop under those attacks could partly be a restatement of the training objective. The attack scope is also narrow: only next-post generation, no modification attacks, no adaptive attacker.

The clean classification results are still worth engaging with. The architecture is coherent, the ablation is clean, and a better-defended robust detector would be useful to the community. But the robustness narrative needs real repair before I'd trust it.

Recommendation: accept for serious review, not desk reject. A revision that reconciles Tables 6 and 7, reports per-fold variance, specifies the training attack generation procedure, and evaluates on at least one held-out attack family would turn this into a solid paper. As-is, it's a conditional accept that needs those changes before publication.

Referee Report

5 major / 5 minor

Summary. The paper proposes ROBAD, a transformer-based sequential classifier for detecting bad actors (vandals, fake reviewers) from a user's chronological post sequence. The architecture combines a transformer encoder that embeds each post bidirectionally (local level) with a transformer decoder that models the sequence of post embeddings (global level), plus a contrastive-learning adversary-aware training objective that also classifies sequences modified by 'mimicked attackers.' The authors evaluate on the Wikipedia vandal and Yelp fake-reviewer datasets, comparing with HRNN, TIES, F-BERT, FT-Defense, and MDA-Defense, and claim the highest clean F1 score and the lowest F1 drop under PETGEN and LLaMA next-post attacks.

Significance. If the robustness claim were established, ROBAD would be a useful step toward deployable sequential bad-actor detectors that withstand adversarial post insertion. The paper's strengths are its use of two real-world labeled datasets, a clear two-level architectural rationale, ablation studies for both modules, hyperparameter sensitivity analysis, and inclusion of two defense baselines. However, the headline claim of 'lowest F1 drop' is contradicted by the paper's own tables on the Yelp dataset, and the training-time attack generation is unspecified. The contribution is therefore not currently verified, although the core ideas remain plausible and worth a revision rather than outright rejection.

major comments (5)

[§5.6, Tables 6 and 7]
[§4.3.1 and §5.6]
[§5.4 and §5.6]
[§5.6 and Table 7]
[§5.6, attack evaluation protocol]

minor comments (5)

[§3, Problem Definition]
[§5.8, Tables 10 and 11]
[§5.6, paragraph 2]
[§1, Introduction]
[General]

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: ROBAD's robust accuracy is an empirical result on held-out users, not a restatement of its training loss; the paper's internal Table 6 inconsistency is a correctness issue, not a circular derivation.

full rationale

ROBAD's derivation chain is self-contained: the local-global transformer encoder/decoder embeddings (Eqs. 1-2), the classification losses (Eqs. 3-6), and the contrastive InfoNCE loss (Eqs. 7-8) are standard, explicitly specified objective functions. The reported F1 values are measured on held-out users via five-fold cross-validation, so the accuracy claim is not an identity with any fitted parameter. The only plausible circularity would be if the 'modified sequences by mimicked attackers' in Eq. (5) were generated by exactly the same PETGEN/LLaMA generators used for evaluation in Sec. 5.6, and even then it would be an in-distribution evaluation rather than a logical equivalence. The paper never states that the training and evaluation attack posts are the same instances or even the same generators, so that reduction cannot be exhibited from the text and remains an underspecified training detail, not a demonstrated circularity. The self-citation [14] supplies the PETGEN attack benchmark and motivating vulnerability numbers from prior published work; it is not used as a uniqueness theorem or as the sole justification for ROBAD's design, so it does not make the central claim true by citation. Separately, Sec. 5.6's 'lowest F1 drop' claim conflicts with Table 6 (Yelp/LLaMA: FT-Defense drops 0.656 to 0.652, a 0.004 drop, while ROBAD drops 0.708 to 0.682, a 0.026 drop), and Table 7's clean FT-Defense value of 0.665 conflicts with Tables 4 and 6, where it is 0.656. That is an internal-consistency and correctness problem to resolve before accepting the robustness claim, but it is not a circularity of derivation.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central claim rests on standard transformer and contrastive learning machinery plus two domain assumptions: that post sequences encode user intent, and that the specific attack generators used in training are representative of the test attacks. The tuning of w_contrastive, layer count, and embedding size are free parameters chosen empirically. No new physical or conceptual entities are introduced.

free parameters (5)

w_contrastive = 0.1
Weight of contrastive loss tuned on validation; Table 12 shows 0.1 best on both datasets.
number of transformer encoder/decoder layers = 1
Tuned; deeper layers degrade F1 (Tables 10, 11).
embedding size = 128
Chosen in Section 5.4, no sensitivity analysis.
number of attention heads = 2
Chosen in Section 5.4, no sensitivity analysis.
learning rate = 1e-3
Fixed choice in Section 5.4.

assumptions (5)

standard math Transformer encoder and decoder self-attention architectures capture textual and sequential patterns
The method invokes standard transformer blocks [37] without modification.
standard math InfoNCE contrastive loss with cosine similarity aligns positive pairs
Uses SimCLR framework [5] as a regularizer.
domain assumption Sequences of user posts are sufficient to identify bad actors
The problem definition assumes labels can be inferred from post sequences alone; no graph or metadata used.
ad hoc to paper Mimicked attacker-generated posts are a valid proxy for real adversarial posts
The adversary-aware module trains on 'modified sequences by mimicked attackers'; the paper does not verify that these mimic real attack distributions.
ad hoc to paper The evaluation attacks (PETGEN, LLaMA-generated next posts) represent the space of adversaries
Robustness claims are based on these two attack generators only.

how reviews work

0 comments

Cite this review

Pith. "Pith review of ROBAD: Robust Adversary-aware Local-Global Attended Bad Actor Detection Sequential Model." pith.science (2026). https://pith.science/paper/3UJNLNDA

@misc{pith2026250715067,
  author       = {Pith},
  title        = {Pith review of: ROBAD: Robust Adversary-aware Local-Global Attended Bad Actor Detection Sequential Model},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3UJNLNDA}},
  note         = {Machine review of arXiv:2507.15067}
}

read the original abstract

Detecting bad actors is critical to ensure the safety and integrity of internet platforms. Several deep learning-based models have been developed to identify such users. These models should not only accurately detect bad actors, but also be robust against adversarial attacks that aim to evade detection. However, past deep learning-based detection models do not meet the robustness requirement because they are sensitive to even minor changes in the input sequence. To address this issue, we focus on (1) improving the model understanding capability and (2) enhancing the model knowledge such that the model can recognize potential input modifications when making predictions. To achieve these goals, we create a novel transformer-based classification model, called ROBAD (RObust adversary-aware local-global attended Bad Actor Detection model), which uses the sequence of user posts to generate user embedding to detect bad actors. Particularly, ROBAD first leverages the transformer encoder block to encode each post bidirectionally, thus building a post embedding to capture the local information at the post level. Next, it adopts the transformer decoder block to model the sequential pattern in the post embeddings by using the attention mechanism, which generates the sequence embedding to obtain the global information at the sequence level. Finally, to enrich the knowledge of the model, embeddings of modified sequences by mimicked attackers are fed into a contrastive-learning-enhanced classification layer for sequence prediction. In essence, by capturing the local and global information (i.e., the post and sequence information) and leveraging the mimicked behaviors of bad actors in training, ROBAD can be robust to adversarial attacks. Extensive experiments on Yelp and Wikipedia datasets show that ROBAD can effectively detect bad actors when under state-of-the-art adversarial attacks.

Figures

Figures reproduced from arXiv: 2507.15067 by the authors.

**Figure 1.** Bad actor detection sequential models are always used to identify bad actors. However, the next post attack by an adversary [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗

**Figure 2.** Overview of the ROBAD architecture. 4.2 Local-Global Attended Module In this module, the goal is to generate the local-global attended embedding such that the embedding can comprehensively represent both the local post and global sequence information of the user. To achieve it, motivated by the self-attention mechanism in transformer [37], we build the encoder and decoder-based dual transformer architecture, as show… view at source ↗

**Figure 3.** Local-Global attended module in ROBAD. and obtain the post embedding ℎ 𝑖 𝑙 as the final post embedding (Note that the value of hyperparameter 𝑛 is examined in Section 5.8). This process is mathematically formulated as: ℎ 𝑖 0 = 𝑝 𝑖 𝑢𝑊𝑒 +𝑊𝑝 ℎ 𝑖 𝑙 = transformer_encoder_block(ℎ 𝑖 𝑙−1 ), ∀𝑙 ∈ [1, 𝑛] (1) 4.2.2 Transformer Decoder-based Component at the Global Sequence Level. After passing a sequence of post {𝑝 1 𝑢 , ..., … view at source ↗

Figures from the paper (1 more)

**Figure 4.** Figure 4: Adversary-aware module in ROBAD. where 𝑊 is the weight matrix for the linear layer. For the classification task, we deploy the cross entropy as the loss function: L𝐶𝐸 = − 1 𝑁 ∑︁ 𝑁 𝑖=1 𝑦𝑢 log 𝑝(𝑦𝑢 |𝐸𝑚𝑏𝑢) + (1 − 𝑦𝑢) log(1 − 𝑝(𝑦𝑢 |𝐸𝑚𝑏𝑢)) (4) We have a similar loss functio…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

44 extracted references · 28 canonical work pages

[1]

Anish Athalye, Nicholas Carlini, and David Wagner. 2018. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning . PMLR, 274–283

2018
[2]

Iz Beltagy, Matthew E Peters, and Arman Cohan. 2020. Longformer: The long-document transformer. arXiv preprint arXiv:2004.05150 (2020)

arXiv 2020
[3]

Raghavendra Chalapathy and Sanjay Chawla. 2019. Deep learning for anomaly detection: A survey. arXiv preprint arXiv:1901.03407 (2019)

arXiv 2019
[4]

Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. 2020. A simple framework for contrastive learning of visual representations. In International conference on machine learning . PMLR, 1597–1607

2020
[5]

Saheb Chhabra, Puspita Majumdar, Mayank Vatsa, and Richa Singh. 2019. Data fine-tuning. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 33. 8223–8230

work page 2019
[6]

Hung-Yun Chiang, Yi-Syuan Chen, Yun-Zhu Song, Hong-Han Shuai, and Jason S Chang. 2023. Shilling Black-box Review-based Recommender Systems through Fake Review Generation. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . 286–297

work page 2023
[7]

Xiang Dai, Ilias Chalkidis, Sune Darkner, and Desmond Elliott. 2022. Revisiting Transformer-based Models for Long Document Classification. In Findings of the Association for Computational Linguistics: EMNLP 2022 . 7212–7230

work page 2022
[8]

Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2018. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805 (2018)

arXiv 2018

Show all 44 references

[9]

Teodora Dobrilova. 2020. https://review42.com/what-percentage-of-amazon-reviews-are-fake/. [Online; accessed 02-02-2021]

2020
[10]

Yingtong Dou, Guixiang Ma, Philip S Yu, and Sihong Xie. 2020. Robust spammer detection by nash reinforcement learning. In Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining . 924–933

2020
[11]

Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2017. Hotflip: White-box adversarial examples for text classification. ACL (2017)

2017
[12]

Christian Esposito, Vincenzo Moscato, and Giancarlo Sperlì. 2023. Detecting malicious reviews and users affecting social reviewing systems: A survey. Computers & Security 133 (2023), 103407

2023
[13]

Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)

2014 arXiv
[14]

Bing He, Mustaque Ahamad, and Srijan Kumar. 2021. Petgen: Personalized text generation attack on deep sequence embedding-based classification models. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining . 575–584

2021
[15]

Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. 2020. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition . 9729–9738

2020
[16]

Jeff Heaton. 2017. Ian Goodfellow, Yoshua Bengio, and Aaron Courville: Deep learning: The MIT Press, 2016, 800 pp, ISBN: 0262035618. Genetic Programming and Evolvable Machines 19, 1-2 (2017)

2017
[17]

Xiaowei Jia, Sheng Li, Handong Zhao, Sungchul Kim, and Vipin Kumar. 2019. Towards robust and discriminative sequential data learning: When and how to perform adversarial training?. In SIGKDD. 1665–1673

2019
[18]

Diederik P Kingma and Jimmy Ba. 2014. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 (2014)

2014 arXiv
[19]

Srijan Kumar, Justin Cheng, Jure Leskovec, and VS Subrahmanian. 2017. An army of me: Sockpuppets in online discussion communities. In WWW. 857–866

2017
[20]

Srijan Kumar, Bryan Hooi, Disha Makhija, Mohit Kumar, Christos Faloutsos, and VS Subrahmanian. 2018. Rev2: Fraudulent user prediction in rating platforms. In WSDM. 333–341

2018
[21]

Subrahmanian

Srijan Kumar, Francesca Spezzano, and V.S. Subrahmanian. 2015. VEWS: A Wikipedia Vandal Early Warning System. In SIGKDD. ACM

2015
[22]

Leskovec

Srijan Kumar, Xikun Zhang, and J. Leskovec. 2019. Predicting Dynamic Embedding Trajectory in Temporal Interaction Networks. SIGKDD (2019)

2019
[23]

Thai Le, Suhang Wang, and Dongwon Lee. 2020. Malcom: Generating malicious comments to attack neural fake news detection models. ICDM (2020)

2020
[24]

Ji Young Lee and Franck Dernoncourt. 2016. Sequential short-text classification with recurrent and convolutional neural networks. NAACL (2016)

2016
[25]

Jinfeng Li, Shouling Ji, Tianyu Du, Bo Li, and Ting Wang. 2018. Textbugger: Generating adversarial text against real-world applications. NDSS

2018
[26]

Xiaodong Liu, Pengcheng He, Weizhu Chen, and Jianfeng Gao. 2019. Multi-task deep neural networks for natural language understanding. arXiv preprint arXiv:1901.11504 (2019). Manuscript submitted to ACM ROBAD: Robust Adversary-aware Local-Global Attended Bad Actor Detection Sequ...

2019 arXiv
[27]

Takeru Miyato, Andrew M Dai, and Ian Goodfellow. 2016. Adversarial training methods for semi-supervised text classification. arXiv preprint arXiv:1605.07725 (2016)

2016 arXiv
[28]

John X Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, Di Jin, and Yanjun Qi. 2020. Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp. arXiv preprint arXiv:2005.05909 (2020)

2020 arXiv
[29]

Weili Nie, Nina Narodytska, and Ankit Patel. 2018. Relgan: Relational generative adversarial networks for text generation. In ICLR

2018
[30]

Nima Noorshams, Saurabh Verma, and Aude Hofleitner. 2020. TIES: Temporal Interaction Embeddings For Enhancing Social Media Integrity At Facebook. In SIGKDD. 3128–3135

2020
[31]

Aaron van den Oord, Yazhe Li, and Oriol Vinyals. 2018. Representation learning with contrastive predictive coding. arXiv preprint arXiv:1807.03748 (2018)

2018 arXiv
[32]

Danish Pruthi, Bhuwan Dhingra, and Zachary C Lipton. 2019. Combating adversarial misspellings with robust word recognition. ACL (2019)

2019
[33]

Shebuti Rayana and Leman Akoglu. 2015. Collective opinion spam detection: Bridging review networks and metadata. In SIGKDD. 985–994

2015
[34]

Pouya Samangouei, Maya Kabkab, and Rama Chellappa. 2018. Defense-gan: Protecting classifiers against adversarial attacks using generative models. arXiv preprint arXiv:1805.06605 (2018)

2018 arXiv
[35]

Kai Shu, Amy Sliva, Suhang Wang, Jiliang Tang, and Huan Liu. 2017. Fake news detection on social media: A data mining perspective.ACM SIGKDD explorations newsletter 19, 1 (2017), 22–36

2017
[36]

Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. 2023. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288 (2023)

2023 arXiv
[37]

Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. In NeurIPS. 5998–6008

2017
[38]

Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. 2019. Universal Adversarial Triggers for Attacking and Analyzing NLP. In EMNLP

2019
[39]

Jingkang Wang, Tianyun Zhang, Sijia Liu, Pin-Yu Chen, Jiacen Xu, Makan Fardad, and Bo Li. 2021. Adversarial attack generation empowered by min-max optimization. Advances in Neural Information Processing Systems 34 (2021), 16020–16033

2021
[40]

Tianyu Wu, Shizhu He, Jingping Liu, Siqi Sun, Kang Liu, Qing-Long Han, and Yang Tang. 2023. A brief overview of ChatGPT: The history, status quo and potential future development. IEEE/CAA Journal of Automatica Sinica 10, 5 (2023), 1122–1136

2023
[41]

Zichao Yang, Diyi Yang, Chris Dyer, Xiaodong He, Alex Smola, and Eduard Hovy. 2016. Hierarchical attention networks for document classification. In NAACL

2016
[42]

Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. 2017. mixup: Beyond empirical risk minimization. arXiv preprint arXiv:1710.09412 (2017)

2017 arXiv
[43]

Wei Emma Zhang, Quan Z Sheng, Ahoud Alhazmi, and Chenliang Li. 2020. Adversarial attacks on deep-learning models in natural language processing: A survey. ACM TIST 11, 3 (2020), 1–41

2020
[44]

Yi Zhao, Yanyan Shen, and Junjie Yao. 2019. Recurrent Neural Network for Text Classification with Hierarchical Multiscale Dense Connections.. In IJCAI. Manuscript submitted to ACM

2019

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

Anish Athalye, Nicholas Carlini, and David Wagner. 2018. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning . PMLR, 274–283

2018

[2] [2]

Iz Beltagy, Matthew E Peters, and Arman Cohan. 2020. Longformer: The long-document transformer. arXiv preprint arXiv:2004.05150 (2020)

arXiv 2020

[3] [3]

Raghavendra Chalapathy and Sanjay Chawla. 2019. Deep learning for anomaly detection: A survey. arXiv preprint arXiv:1901.03407 (2019)

arXiv 2019

[4] [4]

Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. 2020. A simple framework for contrastive learning of visual representations. In International conference on machine learning . PMLR, 1597–1607

2020

[5] [5]

Saheb Chhabra, Puspita Majumdar, Mayank Vatsa, and Richa Singh. 2019. Data fine-tuning. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 33. 8223–8230

work page 2019

[6] [6]

Hung-Yun Chiang, Yi-Syuan Chen, Yun-Zhu Song, Hong-Han Shuai, and Jason S Chang. 2023. Shilling Black-box Review-based Recommender Systems through Fake Review Generation. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . 286–297

work page 2023

[7] [7]

Xiang Dai, Ilias Chalkidis, Sune Darkner, and Desmond Elliott. 2022. Revisiting Transformer-based Models for Long Document Classification. In Findings of the Association for Computational Linguistics: EMNLP 2022 . 7212–7230

work page 2022

[8] [8]

Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2018. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805 (2018)

arXiv 2018