Extend Adversarial Policy Against Neural Machine Translation via Unknown Token

Jiajun Chen; Shujian Huang; Wei Zou

REVIEW 4 major objections 6 minor 29 references

Extend Adversarial Policy Against Neural Machine Translation via Unknown Token

T0 review · 4 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that adding an 'unknown' token to a reinforcement-learning adversarial policy, plus noisy augmentation of its semantic check, lets character-level typos degrade machine translation while preserving meaning.

desk verdict A well-explained extension of RL-attacker to character-level perturbations, with consistent gains but an evaluation that needs stronger evidence on semantic preservation. read the letter →

arxiv 2501.12183 v1 pith:EIVWEFKX submitted 2025-01-21 cs.CL

Wei Zou , Shujian Huang , Jiajun Chen This is my paper · ORCID

classification cs.CL

keywords neuralmachinetranslationadversarialexamplesreinforcementlearningcharacter-levelperturbationunknowntokensemanticdiscriminatornoisydataaugmentationfine-tuning

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper extends a reinforcement-learning attack on neural machine translation—previously centered on replacing whole tokens with similar ones—by adding the unknown (UNK) token as a substitution candidate. When the agent picks UNK, a deterministic routine swaps, inserts, or substitutes characters until the tokenizer treats the word as unknown, turning arbitrary typos into single actions the policy can learn. The authors also retrain the semantic-matching discriminator with positive examples noised by the same character edits, so edits that change how the model splits text but not what it means are no longer rejected. As a result, on shared-vocabulary English-German the method raises translation-quality degradation to 51.9 from the RL baseline's 29.9 while keeping pairing accuracy near 0.9, at roughly the RL attack's low overhead. This would give a cheap way to test and harden translation systems against realistic typo-style noise.

What carries the argument

The load-bearing object is the UNK token used as an action interface, paired with the perturbation functions of Algorithms 1 and 2. UNK is added to all substitution candidates, so the RL agent can select 'perturb this token at character level' as one discrete action; the algorithms then search left-to-right through swap, insertion, and substitution (with keyboard-vicinity and homoglyph dictionaries; deletion is excluded) for a low-frequency variant the target vocabulary treats as unknown. The supporting mechanism is noisy data augmentation of the discriminator: positive semantic-matching examples are randomly perturbed with the same DexChar edits at a confidence-dependent rate $\xi = \rho - \bar{\rho}$ and retokenized, so $D$ stops issuing false negatives for character edits that preserve meaning. This pair—an entry point for arbitrary perturbation granularity and a reward signal that tolerates it—carries the whole argument.

What would settle it

Have independent human judges score a large sample (for example, 1,000 or more pairs per setting) of DexChar adversarial inputs against the original annotation; if true pairing accuracy falls substantially below the reported ~0.9 while translation degradation stays high, the discriminator's reward is not tracking semantics.

Watch

Extended reading notes

Core claim

The central claim is that the barrier to character-level adversarial attacks on NMT is not the search loss but the policy's entry point and its semantic reward. DexChar adds UNK to every substitution candidate; choosing it triggers a left-to-right character perturbation—swapping adjacent characters, inserting a repeated character, or substituting from keyboard/homoglyph dictionaries—until the tokenizer treats the word as unknown, with a second algorithm chaining actions if one edit fails. This maps arbitrarily many low-frequency character edits onto one discrete RL action, so the policy can learn to use them without a handcrafted, tokenization-dependent loss. To keep those edits semantically safe, the discriminator $D$ is trained with positive pairs noised by random DexChar-style edits at probability $\xi = \rho - \bar{\rho}$, where $\rho$ is $D$'s current validation confidence, so it learns to accept meaning-preserving character perturbations even when tokenization shifts. The paper reports that this combination yields high translation degradation and high pairing accuracy where substitution-only baselines stall, and that adversarial fine-tuning with the generated examples improves robustness to mixed character/subword noise.

Load-bearing premise

The method's success depends on the semantic check's reward genuinely tracking meaning preservation after noisy augmentation, rather than merely accepting the character-perturbation style it was trained on.

Editorial extensions

If this is right

In shared-vocabulary settings where substitution-only adversaries stall, character-level RL attacks recover high degradation: en-de shared-vocab translation-quality degradation rises to 51.9 from the RL baseline's 29.9.
The generated adversarial examples stay meaning-preserving: LLM-based pairing accuracy remains around 0.9 across language pairs and embedding settings.
The extension adds negligible overhead, keeping the RL paradigm about 200 times faster than gradient search.
Fine-tuning a target NMT on DexChar-generated pairs improves robustness to character noise and mixed character/subword attacks more than fine-tuning on RL-attacker examples.
The method applies across base, shared-vocabulary, and pretrained-embedding NMT settings, so it does not depend on one tokenizer.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The UNK-as-action trick should transfer to other subword-tokenized generation tasks such as summarization, dialogue, or code generation, because any low-frequency character edit changes tokenization in the same way and can be reached through one discrete action.
A testable extension would replace the learned discriminator reward with a fixed semantic-similarity metric, isolating whether DexChar's gains come from the UNK action space or from the noisy augmentation.
The confidence-gated augmentation schedule $\xi = \rho - \bar{\rho}$ could be reused as a general curriculum for training auxiliary classifiers that must tolerate tokenization shifts.
The method doubles as an automated typo-data generator for robustness fine-tuning of any encoder-decoder model, not only translation.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Your reader's conditional verdict is right, and I'd go slightly further: this is a useful, clearly-written extension of the RL-attacker with a plausible mechanism, but the evaluation is not yet tight enough to fully pin down the semantic-preservation claim.

The genuinely new pieces are the UNK-as-entry for character-level edits and the dynamic augmentation of the discriminator with the same perturbation family. That second piece is double-edged: it solves the false-negative problem, but it raises exactly the circularity concern the stress-test note flags. D is trained to accept DexChar-style edits; if it learns surface cues, the policy can exploit it. The paper's counters are the GPT-3.5 PA and a 100-pair human check. These help, but they are not decisive: the human sample is small and only validates GPT's judgments on a subsample, and the PA is measured on the same perturbation distribution the policy was trained to produce. A clean ablation separating the UNK action from the augmentation, plus a few D validation curves, would have settled this. The absence of variance estimates, significance tests, and released code then makes it hard to judge the size and stability of the reported gains.

What the paper does well: the tokenization failure is clearly diagnosed in Table 2, the POS analysis in Figure 3 gives useful qualitative insight into where character-level attacks land, and the fine-tuning experiments show a concrete practical use. The improvements over RL-attacker are consistent across Tables 4 and 5, which gives me confidence the effect is real even if the magnitude is uncertain.

I don't see a load-bearing flaw. The circularity is a genuine worry, but it is not a refutation; it is a request for more evidence. The lack of a direct comparison to existing character-level attack baselines (e.g., HotFlip-style) is a gap, not an error.

Who this is for: people working on adversarial robustness of NMT, especially those who want a cheap way to generate character-level perturbations for testing and fine-tuning. It deserves a serious referee: the idea is simple, the problem is real, and the paper does enough to justify the work. I'd send it to review with a request for ablations, variance, code, and a stronger external semantic check.

Recommendation: do not desk-reject. Send to peer review; expect revision.

Referee Report

4 major / 6 minor

Summary. The paper proposes DexChar, an extension of the RL-attacker framework for generating adversarial examples against NMT. DexChar adds an 'UNK' token as a substitution candidate, backed by a deterministic character perturbation generator (Algorithms 1 and 2), and augments the semantic discriminator's positive training data with DexChar-style perturbations. Experiments on WMT14 en-de and CWMT17 en-zh across three embedding settings report BLEURT-based metric degradation, degradation per edit, and GPT-3.5-based pairing accuracy, together with a fine-tuning robustness analysis.

Significance. If validated, the contribution would be practically relevant: it offers a way to generate character-level adversarial examples for subword-based NMT systems, a scenario where token-substitution attacks are ineffective. The algorithmic specification is concrete and the experimental coverage across language pairs and embedding regimes is broad. The use of an external LLM semantic oracle with human validation, and the fine-tuning analysis, are positive elements. However, the lack of variance estimates, ablations, and a direct comparison to character-level attack baselines currently limits confidence in the claimed results.

major comments (4)

[Section 3.2, Figure 1, Section 4.1] The discriminator D is trained with positive samples generated by the same DexChar perturbation family (Algorithms 1 and 2) that the policy is optimized to emit. Because D operates on the tokenized input and subword tokenization maps the low-frequency character combinations to a single UNK token, D cannot explicitly represent which character-level edit was applied; the augmentation conditions D to accept UNK tokens as semantically preserved. This makes the survival reward (Figure 1, step 3) susceptible to reward hacking, so the high PA values in Tables 4 and 5 do not by themselves establish semantic preservation. The external GPT-3.5 PA is an independent check, but the human validation (acc) covers only 100 sampled pairs per experiment and validates the oracle's decisions on that sample rather than the full generated set. The paper does not report validation curves for D (the ρ values used for dynamic augmentation) or ablate the augmentation, so the reward signal's fidelity to true semantic equivalence remains unverified.
[Tables 4 and 5] All reported MD, DPE, PA, and acc values come from a single pass without variance estimates or significance tests. RL training is stochastic, and the GPT-3.5 oracle is sampled, so point estimates cannot establish that Ours significantly outperforms RL-attacker, particularly in settings where the gap is small (e.g., en-zh shared-vocab MD 27.2 vs 21.32) or where PA differences are within a few points. Repeated runs with confidence intervals or statistical tests are needed to support the central empirical claims.
[Section 3.1 and Section 3.2] The two contributions—the DexChar UNK action and the noisy augmentation of D—are never ablated independently. Without comparing (i) DexChar without augmentation, (ii) augmentation without the UNK entry, and (iii) the full method, the paper cannot attribute the observed MD/DPE and PA improvements to the proposed mechanism. This is load-bearing because the augmentation directly affects the reward model, and the circularity concern from the preceding comment cannot be resolved without such an ablation.
[Section 4.1 and Section 4.2] No existing character-level adversarial attack is used as a baseline. RNI is a random noise sanity check, while GS and RL-attacker are substitution-based and are the direct predecessor. To support the claim that the method is 'compatible with the scenario where baseline adversaries fail' and to position the work against prior art, the authors should compare against at least one character-level attack method (e.g., HotFlip-style attacks or a character-level variant of an existing attack) on the same target NMT models.

minor comments (6)

[Section 4.1] The 'UNK setting' is not clearly an experimental setting; the sentence 'We follow the baseline transformer training setting to truncate the top 30k vocabulary...' describes how the vocabulary is constructed. Please clarify whether this is a distinct scenario or a general setting applied to all experiments.
[Figures 2 and 3] The captions of Figures 2 and 3 appear to be copied from Figure 1 and do not describe the overhead and POS preference results. Please provide correct captions.
[Tables 4 and 5] The baseline is named 'RL-base' in Table 4 and 'RL-attacker' in Table 5; please standardize the naming.
[Table 3] The system prompt contains the typo 'knowledgable'; it should be 'knowledgeable'.
[Section 5.2] The reference to the '863 standard' for POS tags is only a URL; please add a proper bibliographic reference.
[Algorithms 1 and 2] The pseudocode has minor issues: 'return bywfinal' should be 'return wfinal', and the variable names `wfinal` and `wtmp` are difficult to read. Please polish the pseudocode.

Circularity Check

1 steps flagged · score 4.0 of 10

The discriminator's positive training data come from the same DexChar perturbation family the RL policy is trained to emit, making the semantic-preservation reward partly self-confirming; final PA/human checks provide partial independent grounding.

self definitional [Section 3.2 'Noisy Data Augmentation for Discriminator' (p. 6-7), together with the reward loop in Figure 1 (steps 2-3) and Section 3.1 Algorithms 1-2.]
"We augment the positive data with a small amount of semantic-preserving character perturbation modeled by Sec 3.1 to cater to false-negative discrimination triggered by perturbations of various granularity."

The 'semantic-preserving' label is assigned by construction to the same character-perturbation family (Swap/Ins/Sub via UNK, Algorithms 1-2) that the DexChar policy is trained to emit. In the RL loop (Figure 1), D's positive probability is the survival reward for the policy, so D is the operative semantic constraint. Training D's positives on the policy's own edit family allows D to learn to accept UNK/low-frequency character edits rather than true semantic equivalence; high reward can then be achieved by producing exactly the edits D was shown. Reported PA is measured by GPT-3.5 and a 100-pair human sample per experiment, which is external but too thin to rule out systematic reward hacking; no D validation curves are reported.

full rationale

The paper is an empirical ML contribution, not a formal derivation, so most of the chain is independent of its inputs: the target NMT, BLEURT degradation, and GPT-3.5/human pairing scores are external evaluation. The one load-bearing circular step is the discriminator augmentation in Section 3.2: D, which supplies the RL survival reward, is trained with positive examples generated by the same DexChar perturbation algorithms that the policy is rewarded for producing. This makes the semantic-preservation constraint partially self-referential. However, the paper does not invoke a self-citation uniqueness theorem, and the final PA is checked by an external LLM and human samples, so the central result retains independent content. Score 4 reflects partial circularity rather than a fully forced reduction. The self-citation to the authors' RL-attacker [29] is used as a baseline extension, not as an unverified load-bearing premise, and therefore does not by itself raise the score.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central mechanism rests on a handful of hand-chosen thresholds (vocab sizes, augmentation schedule, fine-tuning weight), plus assumptions about the semantic evaluators and the transferability of D's reward. No new physical entities are introduced.

free parameters (5)

Vocabulary truncation size (30k / 50k tokens) = 30k for base; 50k for mBART embedding
The UNK entry point is defined relative to these manually chosen vocabularies; changing them changes which character perturbations count as UNK and thus the attack surface (Section 4.1).
Discriminator augmentation probability xi = xi = rho - rho_bar (dynamic)
A hand-designed schedule keyed to discriminator confidence; no sensitivity analysis or principled derivation is given (Section 3.2).
Adversarial fine-tuning coefficient lambda = 0.2
Chosen for the fine-tuning experiment in Section 5.3; no sweep is reported.
RNI noise probability = 0.2
Random noise injection baseline probability in Section 4.1; also reused in fine-tuning tests. It is a comparison baseline rather than a core contribution, but it affects fairness of the reported gains.
Nearest-neighbor candidate radius = 10
Used for GS and RL-attacker substitution candidates (Section 4.1), which affects baseline strength and the comparison.

assumptions (5)

domain assumption GPT-3.5-turbo's yes/no semantic matching is an accurate measure of annotation preservation
PA is the primary semantic-validity metric in Tables 4 and 5; human validation covers only 100 pairs per experiment with no confidence intervals (Section 4.1, Table 3).
domain assumption BLEURT degradation approximates translation quality degradation for adversarial evaluation
MD is defined as a BLEURT drop; different metrics could rank attacks differently (Section 4.1).
domain assumption The augmented discriminator D, trained partly on DexChar's own character perturbations, provides a reliable reward signal for semantic preservation
If D learns to accept the policy's perturbation distribution rather than true semantic preservation, the RL reward can be hacked; Section 3.2 makes this assumption without independent validation of D itself.
domain assumption Low-frequency character combinations are ubiquitous, so a vocabulary of 30k or 50k tokens makes UNK a sensible stand-in for natural typos rather than unrecognized text
Stated in Section 3.1 as motivation for the UNK channel; no quantitative evidence is given that the truncated vocabularies support this.
domain assumption BPE tokenization of mBART and subword-nmt behaves as a fixed statistical procedure during all re-tokenizations
The method relies on deterministic re-tokenization after perturbation; this is standard practice in the cited prior work.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Extend Adversarial Policy Against Neural Machine Translation via Unknown Token." pith.science (2026). https://pith.science/paper/EIVWEFKX

@misc{pith2026250112183,
  author       = {Pith},
  title        = {Pith review of: Extend Adversarial Policy Against Neural Machine Translation via Unknown Token},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EIVWEFKX}},
  note         = {Machine review of arXiv:2501.12183}
}

read the original abstract

Generating adversarial examples contributes to mainstream neural machine translation~(NMT) robustness. However, popular adversarial policies are apt for fixed tokenization, hindering its efficacy for common character perturbations involving versatile tokenization. Based on existing adversarial generation via reinforcement learning~(RL), we propose the `DexChar policy' that introduces character perturbations for the existing mainstream adversarial policy based on token substitution. Furthermore, we improve the self-supervised matching that provides feedback in RL to cater to the semantic constraints required during training adversaries. Experiments show that our method is compatible with the scenario where baseline adversaries fail, and can generate high-efficiency adversarial examples for analysis and optimization of the system.

Figures

Figures reproduced from arXiv: 2501.12183 by the authors.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

29 extracted references · 16 canonical work pages

[1]

arXiv preprint arXiv:1409.0473 (2014)

Bahdanau, D., Cho, K., Bengio, Y.: Neural machine translation by jointly learning to align and translate. arXiv preprint arXiv:1409.0473 (2014)

arXiv 2014
[2]

arXiv preprint arXiv:1711.02173 (2017)

Belinkov, Y., Bisk, Y.: Synthetic and natural noise both break neural machine translation. arXiv preprint arXiv:1711.02173 (2017)

arXiv 2017
[3]

Exploring the Robustness of NMT Systems to Nonsensical Inputs

Chaturvedi, A., KP, A., Garain, U.: Exploring the robustness of nmt systems to nonsensical inputs. arXiv preprint arXiv:1908.01165 (2019)

work page Pith review arXiv 2019
[4]

In: Proc

Cheng, M., Yi, J., Chen, P.Y., Zhang, H., Hsieh, C.J.: Seq2sick: Evaluating the robustness of sequence-to-sequence models with adversarial examples. In: Proc. of AAAI (2020)

work page 2020
[5]

arXiv preprint arXiv:1906.02443 (2019)

Cheng,Y.,Jiang,L.,Macherey,W.:Robustneuralmachinetranslationwithdoubly adversarial inputs. arXiv preprint arXiv:1906.02443 (2019)

arXiv 2019
[6]

arXiv preprint arXiv:1806.09030 (2018)

Ebrahimi, J., Lowd, D., Dou, D.: On adversarial examples for character-level neural machine translation. arXiv preprint arXiv:1806.09030 (2018)

arXiv 2018
[7]

arXiv preprint arXiv:1712.06751 (2017)

Ebrahimi, J., Rao, A., Lowd, D., Dou, D.: Hotflip: White-box adversarial examples for text classification. arXiv preprint arXiv:1712.06751 (2017)

arXiv 2017
[8]

arXiv preprint arXiv:2004.01970 (2020)

Garg, S., Ramakrishnan, G.: Bae: Bert-based adversarial examples for text classi- fication. arXiv preprint arXiv:2004.01970 (2020)

arXiv 2020

Show all 29 references

[9]

arXiv preprint arXiv:1412.6572 (2014)

Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)

2014 arXiv
[10]

Security and Communication Networks (2022)

Han, X., Zhang, Y., Wang, W., Wang, B., et al.: Text adversarial attacks and de- fenses: Issues, taxonomy, and perspectives. Security and Communication Networks (2022)

2022
[11]

In: Proceedings of the 5th Workshop on Noisy User-generated Text (W-NUT 2019) (2019)

Karpukhin, V., Levy, O., Eisenstein, J., Ghazvininejad, M.: Training on synthetic noise improves robustness to natural noise in machine translation. In: Proceedings of the 5th Workshop on Noisy User-generated Text (W-NUT 2019) (2019)

2019
[12]

arXiv preprint arXiv:2011.10492 (2020) 14 W.Zou, et al

Le, T., Park, N., Lee, D.: Detecting universal trigger’s adversarial attack with honeypot. arXiv preprint arXiv:2011.10492 (2020) 14 W.Zou, et al

2020 arXiv
[13]

TACL (2020)

Liu, Y., Gu, J., Goyal, N., Li, X., Edunov, S., Ghazvininejad, M., Lewis, M., Zettlemoyer, L.: Multilingual denoising pre-training for neural machine translation. TACL (2020)

2020
[14]

arXiv preprint arXiv:1903.06620 (2019)

Michel, P., Li, X., Neubig, G., Pino, J.M.: On evaluation of adversarial perturba- tions for sequence-to-sequence models. arXiv preprint arXiv:1903.06620 (2019)

2019 arXiv
[15]

arXiv preprint arXiv:2004.14174 (2020)

Morris, J.X., Lifland, E., Lanchantin, J., Ji, Y., Qi, Y.: Reevaluating adversarial examples in natural language. arXiv preprint arXiv:2004.14174 (2020)

2020 arXiv
[16]

OpenAI: https://openai.com/blog/chatgpt (2022)

2022
[17]

Post,M.:Acallforclarityinreportingbleuscores.arXivpreprintarXiv:1804.08771 (2018)

2018 arXiv
[18]

In: Proceedings of EMNLP (2021)

Pu, A., Chung, H.W., Parikh, A.P., Gehrmann, S., Sellam, T.: Learning compact metrics for mt. In: Proceedings of EMNLP (2021)

2021
[19]

In: Proc

Sadrizadeh, S., Dolamic, L., Frossard, P.: Block-sparse adversarial attack to fool transformer-based text classifiers. In: Proc. of ICASSP (2022)

2022
[20]

arXiv preprint arXiv:1707.02812 (2017)

Samanta, S., Mehta, S.: Towards crafting text adversarial samples. arXiv preprint arXiv:1707.02812 (2017)

2017 arXiv
[21]

In: Proceedings of ACL (2020)

Sellam, T., Das, D., Parikh, A.P.: Bleurt: Learning robust metrics for text gener- ation. In: Proceedings of ACL (2020)

2020
[22]

arXiv (2015)

Sennrich, R., Haddow, B., Birch, A.: Neural machine translation of rare words with subword units. arXiv (2015)

2015
[23]

arXiv preprint arXiv:2405.03789 (2024)

Sooksatra, K., Khanal, B., Rivas, P.: On adversarial examples for text classification by perturbing latent representations. arXiv preprint arXiv:2405.03789 (2024)

2024 arXiv
[24]

MIT press (2018)

Sutton, R.S., Barto, A.G.: Reinforcement learning: An introduction. MIT press (2018)

2018
[25]

Vaswani,A.,Shazeer,N.,Parmar,N.,Uszkoreit,J.,Jones,L.,Gomez,A.N.,Kaiser, Ł., Polosukhin, I.: Attention is all you need. Proc. of NeurIPS (2017)

2017
[26]

arXiv preprint arXiv:2205.01287 (2022)

Wang, B., Xu, C., Liu, X., Cheng, Y., Li, B.: Semattack: Natural textual attacks via different semantic spaces. arXiv preprint arXiv:2205.01287 (2022)

2022 arXiv
[27]

arXiv preprint arXiv:2305.14189 (2023)

Wu, D., Monz, C.: Beyond shared vocabulary: Increasing representational word similarities across languages for multilingual machine translation. arXiv preprint arXiv:2305.14189 (2023)

2023 arXiv
[28]

Journal of Electronics and In- formation Technology (2023)

Zhang, S., Wu, H., Zhu, G., Xin, X., Su, M.: Character-level adversarial samples generation approach for chinese text classification. Journal of Electronics and In- formation Technology (2023)

2023
[29]

In: Proc

Zou,W.,Huang,S.,Xie,J.,Dai,X.,Chen,J.:Areinforcedgenerationofadversarial examples for neural machine translation. In: Proc. of ACL (2020).https://doi. org/10.18653/v1/2020.acl-main.319

2020 doi

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.

[1] [1]

arXiv preprint arXiv:1409.0473 (2014)

Bahdanau, D., Cho, K., Bengio, Y.: Neural machine translation by jointly learning to align and translate. arXiv preprint arXiv:1409.0473 (2014)

arXiv 2014

[2] [2]

arXiv preprint arXiv:1711.02173 (2017)

Belinkov, Y., Bisk, Y.: Synthetic and natural noise both break neural machine translation. arXiv preprint arXiv:1711.02173 (2017)

arXiv 2017

[3] [3]

Exploring the Robustness of NMT Systems to Nonsensical Inputs

Chaturvedi, A., KP, A., Garain, U.: Exploring the robustness of nmt systems to nonsensical inputs. arXiv preprint arXiv:1908.01165 (2019)

work page Pith review arXiv 2019

[4] [4]

In: Proc

Cheng, M., Yi, J., Chen, P.Y., Zhang, H., Hsieh, C.J.: Seq2sick: Evaluating the robustness of sequence-to-sequence models with adversarial examples. In: Proc. of AAAI (2020)

work page 2020

[5] [5]

arXiv preprint arXiv:1906.02443 (2019)

Cheng,Y.,Jiang,L.,Macherey,W.:Robustneuralmachinetranslationwithdoubly adversarial inputs. arXiv preprint arXiv:1906.02443 (2019)

arXiv 2019

[6] [6]

arXiv preprint arXiv:1806.09030 (2018)

Ebrahimi, J., Lowd, D., Dou, D.: On adversarial examples for character-level neural machine translation. arXiv preprint arXiv:1806.09030 (2018)

arXiv 2018

[7] [7]

arXiv preprint arXiv:1712.06751 (2017)

Ebrahimi, J., Rao, A., Lowd, D., Dou, D.: Hotflip: White-box adversarial examples for text classification. arXiv preprint arXiv:1712.06751 (2017)

arXiv 2017

[8] [8]

arXiv preprint arXiv:2004.01970 (2020)

Garg, S., Ramakrishnan, G.: Bae: Bert-based adversarial examples for text classi- fication. arXiv preprint arXiv:2004.01970 (2020)

arXiv 2020