Pith. sign in

REVIEW 3 major objections 6 minor 67 references

The paper argues that leading Arabic BERT-family models are highly vulnerable to black-box adversarial attacks—diacritics insertion alone can cut accuracy by up to 92%—and that standard adversarial training only partially fixes the problem.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 01:22 UTC pith:IWBFV54X

load-bearing objection Useful first-pass robustness measurements for Arabic BERT models, but the attack validity claim needs human or stronger semantic validation before the headline numbers can be taken at face value. the 3 major comments →

arxiv 2607.25814 v1 pith:IWBFV54X submitted 2026-07-28 cs.CL cs.CR

Evaluation of Adversarial Robustness in Arabic Language Models

Anwar Alajmi , Ayed Salman , Imtiaz Ahmad This is my paper
classification cs.CL cs.CR
keywords adversarial attacksArabic NLPBERTdiacriticsrobustnessadversarial trainingsentiment analysisblack-box attack
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper tries to establish that five state-of-the-art Arabic and multilingual language models are seriously vulnerable to six black-box adversarial attacks operating at character, word, and sentence levels. Its headline result is that simply inserting Arabic diacritics (tashkeel) drops AraBERT's sentiment-classification accuracy from 94% to 2%, and that other attacks—visual character swaps, phonetic dialect shifts, synonym substitution, conjunction manipulation, and full paraphrasing—also degrade accuracy substantially. It also claims that adversarial training improves robustness across all models, with MARBERT the most robust and AraBERT showing the largest relative gains, but character-level noise remains a hard challenge. A sympathetic reader would care because Arabic models are increasingly deployed in real-world tools, and the finding suggests current defenses are not sufficient for high-stakes use.

Core claim

On the paper's own terms, the central discovery is that Arabic BERT-family models can be fooled by small, semantically preservable perturbations at every granularity. The strongest evidence is the diacritics attack: inserting vowel marks—a natural and grammatically valid operation in Arabic—reduces accuracy by up to 92% (AraBERT from 94% to 2%) while perturbing only about 15% of characters and keeping high cosine similarity. Word-level conjunction replacement preserves over 90% cosine similarity while cutting accuracy by up to 58%, and sentence-level paraphrasing reduces all models' accuracy by an average of 76%. After adversarial training, every model improves, with MARBERT remaining the mo

What carries the argument

The evaluation is carried by a three-level attack taxonomy (character, word, sentence) under a black-box, non-targeted setting. Character-level attacks are edit-based: diacritics insertion, visually similar character substitution (e.g., dot changes), and phonetic/dialectal replacement. Word-level attacks are importance-based: SHAP scores identify the most influential tokens, then AraBERT's masked language model replaces a word with a synonym, or Arabic conjunctions are swapped for semantically similar ones. Sentence-level attack is paraphrase-based, using an Arabic abstractive summarization model to rephrase inputs while preserving meaning. The same machinery, adversarial training on perturb

Load-bearing premise

The evaluation assumes the adversarial examples are grammatically correct and semantically similar Arabic, but this is asserted in Section 4.1 without human validation; if the perturbed texts are unnatural or off-distribution, the large accuracy drops would reflect input corruption rather than a genuine semantic-preserving attack.

What would settle it

Collect human judgments, or a grammar checker, on a sample of the generated adversarial examples (especially diacritics-inserted and paraphrased sentences). If native Arabic readers judge a large fraction as unnatural, ungrammatical, or meaning-shifted, the claim of semantic preservation fails. Alternatively, run the diacritics attack then strip diacritics before inference: if accuracy returns to near-baseline, the model is being fooled by surface noise, not by changed meaning.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If the central claim holds, Arabic BERT-family models are not yet reliable for safety-critical deployments such as healthcare, finance, or governance without additional defense mechanisms.
  • Diacritics insertion is a low-cost, high-impact attack: it requires no model access, has low perturbation rates, and can collapse accuracy by 92% on a leading model.
  • Adversarial training improves robustness across all tested models, but character-level attacks remain a stubborn gap, so defenses must go beyond conventional adversarial training.
  • Conjunction manipulation is a word-level attack that preserves high semantic similarity while degrading accuracy, making it hard to detect by similarity-based filters.
  • Paraphrase attacks are the most uniformly effective strategy, reducing accuracy by an average of 76% across all models, suggesting that surface-form variation is a fundamental weakness.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The paper does not test normalization-based defenses; a cheap and untested corollary is that stripping or restoring diacritics at input time could neutralize the strongest attack class, since the adversarial signal appears to live in surface characters rather than semantics.
  • The robustness ordering (MARBERT > others) may reflect pre-training data diversity (exposure to noisy, dialectal Twitter text) more than architectural superiority; a way to test this is to pre-train two identical architectures on clean MSA versus mixed dialectal data and compare attack resistance.
  • Because Arabic diacritics and visually similar letters have analogues in other morphologically rich scripts (e.g., Hebrew niqqud, Urdu, Persian), the attack patterns should transfer; a reader could test whether the same attacks generalize to those languages.
  • The paraphrase attack's uniform adversarial set (shared across models) means its reported average 76% drop is a property of the task and dataset as much as of the models; comparing against human accuracy on the same paraphrases would separate model brittleness from task difficulty.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. This paper reports a black-box, non-targeted adversarial robustness evaluation of five BERT-family Arabic/multilingual models (AraBERT, MARBERT, CaMeLBERT, mBERT, XLM-T) on binary sentiment classification. Six attack types are applied at character, word, and sentence granularity: diacritics insertion, visual substitution, phonetic substitution, AraBERT-MLM substitution, conjunction replacement, and paraphrasing. The authors report large clean-accuracy drops (up to 92% for AraBERT under diacritics; average 76% under paraphrase), perturbation and similarity metrics, and an adversarial-training defense study. They conclude that Arabic LMs are highly vulnerable to these attacks, that MARBERT is the most robust overall, and that adversarial training helps most against word- and sentence-level attacks while character-level vulnerabilities persist.

Significance. If the attack-validity assumptions are accepted, this is a useful first multi-granularity comparison of Arabic adversarial robustness: it covers three granularity levels, uses public models and a public dataset, and includes a defense comparison. The paper's empirical regularities are internally consistent (e.g., the average paraphrase decrease of 76% matches Table 9), and the results provide a baseline for future work on morphologically rich languages. However, the headline quantitative claims rest on the unvalidated assertion that generated perturbations are grammatically correct and semantically similar, and the absence of code, configurations, and repeated seeds limits reproducibility. The work would be substantially strengthened by human evaluation of perturbation quality, a random-corruption baseline, and a reproducibility package.

major comments (3)
  1. [§3.2, §4.1 (Tables 4 and 9)] The load-bearing claim that the attacks satisfy grammatical and semantic constraints is asserted, not demonstrated. Diacritics are absent from the raw dataset (§3.2), so diacritic insertion moves inputs off the training distribution. The reported similarity scores are moderate (e.g., Table 4: AraBERT cosine 84%, USE 56%; paraphrase average cosine 39.43%, USE 61.48%) and are not calibrated against human judgments of Arabic semantic preservation. Without human evaluation, grammar validation, or a comparison to random character-level corruption of the same perturbation magnitude, the large accuracy drops could reflect input corruption or tokenization mismatch rather than semantics-preserving adversarial examples. This directly affects the central vulnerability claims.
  2. [§4, §4.2, Table 10] No code, hyperparameters, random seeds, or repeated runs are provided; all accuracy and similarity metrics appear to be single runs on a test set of about 1.08K samples. Table 10's improvement column is also ambiguous: the listed 'pre-attack accuracy' remains the original clean accuracy (e.g., 94%), while the text states adversarial training causes a 1–2% clean-accuracy decline, and the improvement values appear to be differences from the unfortified post-attack accuracies rather than from a re-measured fortified baseline. Without variance estimates or a clear definition of the improvement metric, differences of a few points (e.g., MARBERT vs. mBERT under several attacks) may be noise, and the numerical headlines are hard to verify.
  3. [§3.4, §4.1 (paraphrase attack)] The paraphrase attack produces a single shared set of examples applied to all models, yet the paper does not report how many sentences were paraphrased, how they were sampled, or whether the AraT5 output was filtered for semantic fidelity before evaluation. The text acknowledges the high perturbation rate (83%) and moderate similarity (average USE 61.48%), but then claims the methods 'have met the constraints of providing grammatically correct and semantically similar perturbed samples.' This conclusion is not supported by the evidence presented. At minimum, the authors should show representative paraphrase outputs with Arabic-speaking annotations or a validated Arabic semantic textual similarity benchmark.
minor comments (6)
  1. [§3.3–3.4] Section 3.3 states the attacks are non-targeted, but Section 3.4 concludes 'This procedure yields targeted, minimally invasive adversarial examples.' This is contradictory and should be fixed.
  2. [Table 3 and §3.4] Table 3 labels Paraphrase as 'Sentence-level Edit-based,' while §3.4 describes it as 'paraphrase-based.' The taxonomy in Figure 1 also appears to classify paraphrasing separately; please align the terminology.
  3. [References] Reference [2] is misattributed: 'Intriguing properties of adversarial examples' is by Szegedy et al. (arXiv:1312.6199), not the given arXiv:1711.02846. Also, several model names are misspelled in the text ('AraBER T', 'MARBER T', 'CaMeLBER T').
  4. [§4, Equation (2)] ASR is defined but the main tables report only accuracy decrease; ASR is shown only in figures. Providing numeric ASR tables would make the 'attack success rate' component of the evaluation directly assessable.
  5. [§3.2] The dataset description is imprecise: 'roughly 16K samples in total are labeled' and the train/test sizes are 14.7K/1.08K. Please clarify whether up/down-sampling was applied only to the training set and whether the reported clean accuracies refer to the balanced or unbalanced test set.
  6. [§1 contributions] The claim of being 'the first of its kind to evaluate the adversarial robustness of Arabic NLP models' is overstated in view of the paper's own related work, which includes Arabic-specific adversarial evaluations ([28], [35], [38], [46]) and the authors' earlier Arabic spam-classifier study ([37]/[60]). Please reposition the novelty claim to the specific multi-granularity, multi-model comparison.

Circularity Check

0 steps flagged

Empirical vulnerability evaluation; no circular derivation, but self-citation burden and unvalidated attack-validity assumption.

full rationale

The central claim is an empirical benchmark, not a derived prediction: the paper fine-tunes public pretrained Arabic/multilingual BERT-family models on a sentiment dataset and measures accuracy drops under six perturbation strategies. There is no fitted parameter that is later renamed as a prediction, no uniqueness theorem imported from the authors, and no equation that reduces to its own inputs. The self-citations to the authors' attack framework [60]/[37] and dataset [55] provide the generation tools and training data, but the reported vulnerability numbers are new measurements on external victim models, so the evaluation is not equivalent to the construction by definition. The main validity concern is Section 4.1's assertion that 'the proposed methods have met the constraints of providing grammatically correct and semantically similar perturbed samples,' which is not independently validated; the reported automated similarity scores are moderate (e.g., USE similarity around 50-68% for character-level attacks and 61.48% for paraphrase), so the semantic-preservation premise is an unsupported empirical assumption rather than a demonstrated derivation. That is a correctness risk, not circularity. Score 2 reflects the non-load-bearing but non-independent provenance of the attack framework and dataset.

Axiom & Free-Parameter Ledger

0 free parameters · 4 axioms · 0 invented entities

No fitted numerical parameters or new entities are introduced. The strongest assumptions are linguistic-validity of the attacks and the representativeness of the evaluation setup.

axioms (4)
  • domain assumption Generated adversarial examples are grammatically valid and semantically similar Arabic.
    Section 4.1 asserts the attacks 'met the constraints' of grammatical correctness and semantic similarity, but only automatic cosine/USE scores support this; no human or grammar validation is reported.
  • domain assumption SHAP with fixed context=1 identifies the most influential tokens for the victim models.
    Section 3.4 uses shap.Explainer with fixed_context=1 to choose perturbation targets; if the attributions are noisy, the word-level attack results would change.
  • domain assumption AraT5 abstractive summarization preserves meaning when used for paraphrasing.
    Section 3.4 uses AraT5 to paraphrase sentences as a sentence-level attack; semantic preservation is assumed, with cosine/USE similarity as a proxy.
  • domain assumption Five BERT-family models fine-tuned on one Arabic sentiment dataset represent deployed Arabic LMs.
    The paper generalizes conclusions about Arabic LM robustness from five models trained on a single ~16K-tweet dataset with class balancing; cross-task and cross-dataset behavior is untested.

pith-pipeline@v1.3.0-alltime-deepseek · 15652 in / 10690 out tokens · 97812 ms · 2026-08-01T01:22:54.513934+00:00 · methodology

0 comments
read the original abstract

The emergence of the recent outstanding capabilities of Arabic Language Models has opened doors for exposing their vulnerabilities. One of the major security risks associated with such Natural Language Processing models is adversarial attacks. These attacks can deceive the model into the wrong prediction, raising critical model security and safety concerns. This study aims to assess the robustness of five state-of-the-art Arabic Language Models under a distinct set of Arabic adversarial attacks applied at various levels of granularity and using different example generation strategies. We also explore a defense technique based on adversarial training to enhance model robustness. The results show that insertion of diacritics can reduce the accuracy of some models by 92% while maintaining a low perturbation distance. For word-level attacks, manipulating Arabic conjunctions preserves high semantic similarity scores, low perturbation distance, and leads to an accuracy degradation of up to 58%. For sentence-level attacks, paraphrasing proves its effectiveness by an average reduction of 76% in the victim models' performance. While adversarial training improves overall resilience, with MARBERT being the most robust and AraBERT showing the greatest relative gains, challenges persist, particularly against character-level noise. These findings highlight both the potential and limitations of current defense strategies in morphologically rich languages like Arabic.

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

67 extracted references · 1 canonical work pages

  1. [1]

    CoRRabs/1606.06565(2016) 1606.06565

    Amodei, D., Olah, C., Steinhardt, J., Christiano, P.F., Schulman, J., Man´ e, D.: Concrete problems in AI safety. CoRRabs/1606.06565(2016) 1606.06565

    Pith/arXiv arXiv 2016

  2. [2]

    arXiv preprint arXiv:1711.02846 (2017)

    Cubuk, E.D., Zoph, B., Schoenholz, S.S., Le, Q.V.: Intriguing properties of adversarial examples. arXiv preprint arXiv:1711.02846 (2017)

    Pith/arXiv arXiv 2017

  3. [3]

    arXiv preprint arXiv:1412.6572 (2014)

    Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)

    Pith/arXiv arXiv 2014

  4. [4]

    CoRRabs/2112.08313(2021) 2112.08313 28

    Wang, X., Wang, H., Yang, D.: Measure and improve robustness in NLP models: A survey. CoRRabs/2112.08313(2021) 2112.08313 28

    Pith/arXiv arXiv 2021

  5. [5]

    Knowledge-Based Systems191, 105210 (2020) https://doi.org/10

    Alshemali, B., Kalita, J.: Improving the reliability of deep neural networks in nlp: A review. Knowledge-Based Systems191, 105210 (2020) https://doi.org/10. 1016/j.knosys.2019.105210

    arXiv 2020

  6. [6]

    Neurocomputing492, 278–307 (2022) https://doi.org/10.1016/j.neucom.2022.04.020

    Qiu, S., Liu, Q., Zhou, S., Huang, W.: Adversarial attack and defense technologies in natural language processing: A survey. Neurocomputing492, 278–307 (2022) https://doi.org/10.1016/j.neucom.2022.04.020

    doi:10.1016/j.neucom.2022.04.020 2022

  7. [7]

    arXiv preprint arXiv:1911.05268 (2019)

    Wiyatno, R.R., Xu, A., Dia, O., De Berker, A.: Adversarial examples in modern machine learning: A review. arXiv preprint arXiv:1911.05268 (2019)

    Pith/arXiv arXiv 1911

  8. [8]

    arXiv preprint arXiv:1805.12152 (2018)

    Tsipras, D., Santurkar, S., Engstrom, L., Turner, A., Madry, A.: Robustness may be at odds with accuracy. arXiv preprint arXiv:1805.12152 (2018)

    Pith/arXiv arXiv 2018

  9. [9]

    CoRRabs/2003.02460(2020) 2003.02460

    Yang, Y., Rashtchian, C., Zhang, H., Salakhutdinov, R., Chaudhuri, K.: Adver- sarial robustness through local lipschitzness. CoRRabs/2003.02460(2020) 2003.02460

    Pith/arXiv arXiv 2003

  10. [10]

    SIL International

    Eberhard, D.M., Simons, G.F., Fennig, C.D.: Ethnologue: Languages of the World. SIL International. Online version (2025). https://www.ethnologue.com

    2025

  11. [11]

    ACM Transactions on Asian and Low-Resource Language Information Processing24(3), 1–21 (2025)

    Alajmi, A., Altabaa, H., Abed, S., Ahmad, I.: Arabic question generation using transformers. ACM Transactions on Asian and Low-Resource Language Information Processing24(3), 1–21 (2025)

    2025

  12. [12]

    Springer (2022)

    Habash, N.Y.: Introduction to Arabic Natural Language Processing. Springer (2022)

    2022

  13. [13]

    International journal of corpus linguistics11(2), 135–171 (2006)

    Al-Sulaiti, L., Atwell, E.S.: The design of a corpus of contemporary arabic. International journal of corpus linguistics11(2), 135–171 (2006)

    2006

  14. [14]

    CoRRabs/2003.00104(2020) 2003.00104

    Antoun, W., Baly, F., Hajj, H.M.: Arabert: Transformer-based model for arabic language understanding. CoRRabs/2003.00104(2020) 2003.00104

    Pith/arXiv arXiv 2003

  15. [15]

    Abdul-Mageed, M., Elmadany, A.,et al.: Arbert & marbert: Deep bidirectional transformers for arabic. In: Proceedings of the 59th Annual Meeting of the Associ- ation for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), pp. 7088–7105 (2021)

    2021

  16. [16]

    In: 6th Ara- bic Natural Language Processing Workshop, W ANLP 2021, pp

    Inoue, G., Alhafni, B., Baimukan, N., Bouamor, H., Habash, N.: The interplay of variant, size, and task type in arabic pre-trained language models. In: 6th Ara- bic Natural Language Processing Workshop, W ANLP 2021, pp. 92–104 (2021). Association for Computational Linguistics (ACL)

    2021

  17. [18]

    In: Proceedings of the Thirteenth Language Resources and Evaluation Conference, pp

    Barbieri, F., Anke, L.E., Camacho-Collados, J.: Xlm-t: Multilingual language models in twitter for sentiment analysis and beyond. In: Proceedings of the Thirteenth Language Resources and Evaluation Conference, pp. 258–266 (2022)

    2022

  18. [19]

    arXiv preprint arXiv:2004.14174 (2020)

    Morris, J.X., Lifland, E., Lanchantin, J., Ji, Y., Qi, Y.: Reevaluating adversarial examples in natural language. arXiv preprint arXiv:2004.14174 (2020)

    Pith/arXiv arXiv 2004

  19. [20]

    Applied Sciences9(5), 909 (2019)

    Qiu, S., Liu, Q., Zhou, S., Wu, C.: Review of artificial intelligence adversarial attack and defense technologies. Applied Sciences9(5), 909 (2019)

    2019

  20. [21]

    arXiv preprint arXiv:2109.04367 (2021)

    Chen, Y., Su, J., Wei, W.: Multi-granularity textual adversarial attack with behavior cloning. arXiv preprint arXiv:2109.04367 (2021)

    Pith/arXiv arXiv 2021

  21. [22]

    arXiv preprint arXiv:1803.11175 (2018)

    Cer, D., Yang, Y., Kong, S.-y., Hua, N., Limtiaco, N., John, R.S., Constant, N., Guajardo-Cespedes, M., Yuan, S., Tar, C., et al.: Universal sentence encoder. arXiv preprint arXiv:1803.11175 (2018)

    Pith/arXiv arXiv 2018

  22. [23]

    In: Inui, K., Jiang, J., Ng, V., Wan, X

    Reimers, N., Gurevych, I.: Sentence-BERT: Sentence embeddings using Siamese BERT-networks. In: Inui, K., Jiang, J., Ng, V., Wan, X. (eds.) Proceed- ings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pp. 3982–3992. Association for Computat...

    doi:10.18653/v1/d19-1410 2019

  23. [24]

    arXiv preprint arXiv:2203.06414 (2022)

    Shreya, G., Khapra, M.M.: A survey in adversarial defences and robustness in nlp. arXiv preprint arXiv:2203.06414 (2022)

    Pith/arXiv arXiv 2022

  24. [25]

    Eger, S., Benz, Y.: From hero to z´ eroe: A benchmark of low-level adversarial attacks. In: Proceedings of the 1st Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics and the 10th International Joint Conference on Natural Language Processing, pp. 786–803. Association for Com- putational Linguistics, Suzhou, China (2020)...

    2020

  25. [26]

    In: Findings of the Association for Computational Linguistics: EACL 2023, pp

    Formento, B., Foo, C.S., Tuan, L.A., Ng, S.K.: Using punctuation as an adver- sarial attack on deep learning-based NLP systems: An empirical study. In: Findings of the Association for Computational Linguistics: EACL 2023, pp. 1–34. Association for Computational Linguistics, Dubrovnik, Croatia (2023). https://aclanthology.org/2023.findings-eacl.1

    2023

  26. [27]

    IEEE Transactions on Knowledge and Data Engineering, 1–14 (2023) https://doi.org/10.1109/TKDE.2023.3270581

    Chai, Y., Liang, R., Samtani, S., Zhu, H., Wang, M., Liu, Y., Jiang, Y.: Addi- tive feature attribution explainable methods to craft adversarial attacks for text classification and text regression. IEEE Transactions on Knowledge and Data Engineering, 1–14 (2023) https://doi.org/10.1109/TKDE.2023.3270581

    arXiv 2023

  27. [28]

    In: 30 2021 20th IEEE International Conference on Machine Learning and Applications (ICMLA), pp

    Alshemali, B., Kalita, J.: Character-level adversarial examples in arabic. In: 30 2021 20th IEEE International Conference on Machine Learning and Applications (ICMLA), pp. 9–14 (2021). IEEE

    2021

  28. [29]

    In: Guyon, I., Luxburg, U.V., Bengio, S., Wallach, H., Fergus, R., Vishwanathan, S., Garnett, R

    Lundberg, S.M., Lee, S.-I.: A unified approach to interpreting model predictions. In: Guyon, I., Luxburg, U.V., Bengio, S., Wallach, H., Fergus, R., Vishwanathan, S., Garnett, R. (eds.) Advances in Neural Information Processing Systems 30, pp. 4765–4774. Curran Associates, Inc., ??? (2017)

    2017

  29. [30]

    In: 2018 IEEE Security and Privacy Workshops (SPW), pp

    Gao, J., Lanchantin, J., Soffa, M.L., Qi, Y.: Black-box generation of adversarial text sequences to evade deep learning classifiers. In: 2018 IEEE Security and Privacy Workshops (SPW), pp. 50–56 (2018). IEEE

    2018

  30. [31]

    arXiv preprint arXiv:1812.05271 (2018)

    Li, J., Ji, S., Du, T., Li, B., Wang, T.: Textbugger: Generating adversarial text against real-world applications. arXiv preprint arXiv:1812.05271 (2018)

    Pith/arXiv arXiv 2018

  31. [32]

    arXiv preprint arXiv:2005.05909 (2020)

    Morris, J.X., Lifland, E., Yoo, J.Y., Grigsby, J., Jin, D., Qi, Y.: Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp. arXiv preprint arXiv:2005.05909 (2020)

    Pith/arXiv arXiv 2005

  32. [34]

    In: Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pp

    Garg, S., Ramakrishnan, G.: BAE: BERT-based adversarial examples for text classification. In: Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pp. 6174–6181. Association for Computational Linguistics, Online (2020). https://doi.org/10.18653/v1/2020. emnlp-main.498 .https://aclanthology.org/2020.emnlp-main.498

    doi:10.18653/v1/2020 2020

  33. [35]

    In: 2019 International Conference on Computational Science and Computational Intelligence (CSCI), pp

    Alshemali, B., Kalita, J.: Adversarial examples in arabic. In: 2019 International Conference on Computational Science and Computational Intelligence (CSCI), pp. 371–376 (2019). IEEE

    2019

  34. [36]

    In: Findings of the Association for Computational Linguistics: AACL-IJCNLP 2022, pp

    Ekbal, A.,et al.: Adversarial sample generation for aspect based sentiment classification. In: Findings of the Association for Computational Linguistics: AACL-IJCNLP 2022, pp. 478–492 (2022)

    2022

  35. [37]

    Neural Computing and Applications37(6), 4323–4343 (2025)

    Alajmi, A., Ahmad, I., Mohammed, A.: Evaluating the adversarial robustness of arabic spam classifiers. Neural Computing and Applications37(6), 4323–4343 (2025)

    2025

  36. [38]

    In: 2023 Fifth International Conference on Transdisciplinary AI (TransAI), pp

    Alshalan, H., Rekabdar, B.: Attacking a transformer-based models for arabic language as low resources language (lrl) using word-substitution methods. In: 2023 Fifth International Conference on Transdisciplinary AI (TransAI), pp. 95–101 (2023). IEEE 31

    2023

  37. [39]

    arXiv preprint arXiv:2109.00544 (2021)

    Yoo, J.Y., Qi, Y.: Towards improving adversarial training of nlp models. arXiv preprint arXiv:2109.00544 (2021)

    Pith/arXiv arXiv 2021

  38. [41]

    arXiv preprint arXiv:2302.05892 (2023)

    Shen, L., Zhang, X., Ji, S., Pu, Y., Ge, C., Yang, X., Feng, Y.: Textdefense: Adversarial text detection based on word importance entropy. arXiv preprint arXiv:2302.05892 (2023)

    Pith/arXiv arXiv 2023

  39. [42]

    In: Proceedings of the 7th Workshop on Representation Learning for NLP, pp

    Huber, L., K¨ uhn, M.A., Mosca, E., Groh, G.: Detecting word-level adversarial text attacks via shapley additive explanations. In: Proceedings of the 7th Workshop on Representation Learning for NLP, pp. 156–166 (2022)

    2022

  40. [43]

    arXiv preprint arXiv:2004.05887 (2020)

    Mozes, M., Stenetorp, P., Kleinberg, B., Griffin, L.D.: Frequency-guided word substitutions for detecting textual adversarial examples. arXiv preprint arXiv:2004.05887 (2020)

    Pith/arXiv arXiv 2004

  41. [44]

    arXiv preprint arXiv:1909.03084 (2019)

    Zhou, Y., Jiang, J.-Y., Chang, K.-W., Wang, W.: Learning to discriminate per- turbations for blocking adversarial attacks in text classification. arXiv preprint arXiv:1909.03084 (2019)

    Pith/arXiv arXiv 1909

  42. [45]

    arXiv preprint arXiv:2006.11627 (2020)

    Zhou, Y., Zheng, X., Hsieh, C.-J., Chang, K.-w., Huang, X.: Defense against adversarial attacks in nlp via dirichlet neighborhood ensemble. arXiv preprint arXiv:2006.11627 (2020)

    Pith/arXiv arXiv 2006

  43. [46]

    arXiv preprint arXiv:2402.03477 (2024)

    Alshahrani, N., Alshahrani, S., Wali, E., Matthews, J.: Arabic syn- onym bert-based adversarial examples for text classification. arXiv preprint arXiv:2402.03477 (2024)

    Pith/arXiv arXiv 2024

  44. [47]

    Neural computation 9(8), 1735–1780 (1997)

    Hochreiter, S., Schmidhuber, J.: Long short-term memory. Neural computation 9(8), 1735–1780 (1997)

    1997

  45. [48]

    In: Mos- chitti, A., Pang, B., Daelemans, W

    Kim, Y.: Convolutional neural networks for sentence classification. In: Mos- chitti, A., Pang, B., Daelemans, W. (eds.) Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP), pp. 1746–

    2014

  46. [49]

    Advances in neural information processing systems30(2017)

    Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, L., Polosukhin, I.: Attention is all you need. Advances in neural information processing systems30(2017)

    2017

  47. [50]

    CoRRabs/1810.04805(2018) 1810.04805 32

    Devlin, J., Chang, M., Lee, K., Toutanova, K.: BERT: pre-training of deep bidirec- tional transformers for language understanding. CoRRabs/1810.04805(2018) 1810.04805 32

    Pith/arXiv arXiv 2018

  48. [51]

    arXiv preprint arXiv:1907.11692 (2019)

    Liu, Y., Ott, M., Goyal, N., Du, J., Joshi, M., Chen, D., Levy, O., Lewis, M., Zettlemoyer, L., Stoyanov, V.: Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:1907.11692 (2019)

    Pith/arXiv arXiv 1907

  49. [52]

    arXiv preprint arXiv:1910.01108 (2019)

    Sanh, V., Debut, L., Chaumond, J., Wolf, T.: Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter. arXiv preprint arXiv:1910.01108 (2019)

    Pith/arXiv arXiv 1910

  50. [53]

    In: Proceedings of the 22nd ACM SIGKDD Inter- national Conference on Knowledge Discovery and Data Mining, pp

    Ribeiro, M.T., Singh, S., Guestrin, C.: ” why should i trust you?” explaining the predictions of any classifier. In: Proceedings of the 22nd ACM SIGKDD Inter- national Conference on Knowledge Discovery and Data Mining, pp. 1135–1144 (2016)

    2016

  51. [54]

    In: Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pp

    Conneau, A., Khandelwal, K., Goyal, N., Chaudhary, V., Wenzek, G., Guzm´ an, F., Grave, ´E., Ott, M., Zettlemoyer, L., Stoyanov, V.: Unsupervised cross-lingual representation learning at scale. In: Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pp. 8440–8451 (2020)

    2020

  52. [55]

    https://huggingface

    Alajmi, A.M.: Arabic Sentiment Analysis [dataset], 2023. https://huggingface. co/datasets/Anwaarma/MySentimentAnwarBig/viewer/default/train?p=1

    2023

  53. [56]

    OSACT3, 20 (2018)

    Elmadany, A., Mubarak, H., Magdy, W.: Arsas: An arabic speech-act and sentiment corpus of tweets. OSACT3, 20 (2018)

    2018

  54. [57]

    In: Proceed- ings of the Thirteenth Language Resources and Evaluation Conference, pp

    Barbieri, F., Espinosa Anke, L., Camacho-Collados, J.: XLM-T: Multilingual language models in Twitter for sentiment analysis and beyond. In: Proceed- ings of the Thirteenth Language Resources and Evaluation Conference, pp. 258–266. European Language Resources Association, Marseille, France (2022). https://aclanthology.org/2022.lrec-1.27

    2022

  55. [58]

    In: Proceedings of the 2016 Conference of the North American Chapter of the Association for Computational Linguistics: Demonstra- tions, pp

    Abdelali, A., Darwish, K., Durrani, N., Mubarak, H.: Farasa: A fast and furi- ous segmenter for Arabic. In: Proceedings of the 2016 Conference of the North American Chapter of the Association for Computational Linguistics: Demonstra- tions, pp. 11–16. Association for Computational Linguistics, San Diego, California (2016). https://doi.org/10.18653/v1/N16-...

    work page doi:10.18653/v1/n16-3003 2016

  56. [59]

    In: Proceed- ings of the 2018 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pp

    Kudo, T., Richardson, J.: SentencePiece: A simple and language independent subword tokenizer and detokenizer for neural text processing. In: Proceed- ings of the 2018 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pp. 66–71. Association for Computational Linguistics, Brussels, Belgium (2018). https://doi.org/10.1865...

    doi:10.18653/v1/d18-2012 2018

  57. [60]

    Neural Computing and Applications, 1–21 (2024)

    Alajmi, A., Ahmad, I., Mohammed, A.: Evaluating the adversarial robustness of arabic spam classifiers. Neural Computing and Applications, 1–21 (2024)

    2024

  58. [61]

    Information Processing & Man- agement60(2), 103227 (2023)

    Bani-Almarjeh, M., Kurdy, M.-B.: Arabic abstractive text summarization using 33 rnn-based and transformer-based architectures. Information Processing & Man- agement60(2), 103227 (2023)

    2023

  59. [62]

    In: Soviet Physics Doklady, vol

    Levenshtein, V.I.,et al.: Binary codes capable of correcting deletions, insertions, and reversals. In: Soviet Physics Doklady, vol. 10, pp. 707–710 (1966). Soviet Union

    1966

  60. [63]

    IEEE transactions on neural networks and learning systems30(9), 2805–2824 (2019)

    Yuan, X., He, P., Zhu, Q., Li, X.: Adversarial examples: Attacks and defenses for deep learning. IEEE transactions on neural networks and learning systems30(9), 2805–2824 (2019)

    2019

  61. [64]

    In: Proceedings of ArabicNLP 2023, pp

    Kadaoui, K., Magdy, S., Waheed, A., Khondaker, M.T.I., El-Shangiti, A., Abdul- Mageed, M.,et al.: Tarjamat: Evaluation of bard and chatgpt on machine translation of ten arabic varieties. In: Proceedings of ArabicNLP 2023, pp. 52–75 (2023)

    2023

  62. [65]

    arXiv preprint arXiv:2305.14976 (2023)

    Khondaker, M.T.I., Waheed, A., Nagoudi, E.M.B., Abdul-Mageed, M.: Gptarae- val: A comprehensive evaluation of chatgpt on arabic nlp. arXiv preprint arXiv:2305.14976 (2023)

    Pith/arXiv arXiv 2023

  63. [66]

    Computer Science Review49, 100573 (2023)

    Bountakas, P., Zarras, A., Lekidis, A., Xenakis, C.: Defense strategies for adversarial machine learning: A survey. Computer Science Review49, 100573 (2023)

    2023

  64. [67]

    arXiv preprint arXiv:2206.05511 (2022)

    Zhang, C., Zhou, X., Wan, Y., Zheng, X., Chang, K.-W., Hsieh, C.-J.: Improving the adversarial robustness of nlp models by information bottleneck. arXiv preprint arXiv:2206.05511 (2022)

    Pith/arXiv arXiv 2022

  65. [68]

    arXiv preprint arXiv:1810.12715 (2018)

    Gowal, S., Dvijotham, K., Stanforth, R., Bunel, R., Qin, C., Uesato, J., Arand- jelovic, R., Mann, T., Kohli, P.: On the effectiveness of interval bound propagation for training verifiably robust models. arXiv preprint arXiv:1810.12715 (2018)

    Pith/arXiv arXiv 2018

  66. [69]

    ACM Computing Surveys55(14s), 1–39 (2023) 34

    Goyal, S., Doddapaneni, S., Khapra, M.M., Ravindran, B.: A survey of adversarial defenses and robustness in nlp. ACM Computing Surveys55(14s), 1–39 (2023) 34

    2023

  67. [1751]

    https: //doi.org/10.3115/v1/D14-1181 .https://aclanthology.org/D14-1181

    Association for Computational Linguistics, Doha, Qatar (2014). https: //doi.org/10.3115/v1/D14-1181 .https://aclanthology.org/D14-1181

    doi:10.3115/v1/d14-1181 2014