Pith. sign in

REVIEW 5 major objections 6 minor 52 references

Bridging Robustness and Generalization Against Word Substitution Attacks in NLP via the Growth Bound Matrix Approach

T0 review · 5 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A matrix bound on every input–output derivative certifies text models against synonym substitutions; training to shrink it lifts IMDB robust accuracy to 84.3%.

desk verdict Solid empirical regularizer with fast training, but the paper's certification claim is unsupported: the 84.3% 'certified' accuracy is just accuracy under PSO, with no margin argument and unspecified LSTM input intervals. read the letter →

arxiv 2507.10330 v1 pith:WMRHVV5S submitted 2025-07-14 cs.CL cs.AIcs.LG

Mohammed Bouri , Adnane Saoud This is my paper
classification cs.CLcs.AIcs.LG
keywords adversarialrobustnesswordsubstitutionattacktextclassificationgrowthboundmatrixcertifieddefenseLSTMstatespacemodelsCNN
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that one object, a Growth Bound Matrix (GBM), can both certify and improve the robustness of text classifiers to word-substitution attacks. A GBM is a matrix whose entries bound the partial derivative of each output dimension with respect to each input dimension over an input region; once such a matrix is known, a mean-value argument bounds how much any perturbation within that region can change the output. The paper derives explicit GBM formulas for three architectures—LSTM, the state-space model S4, and TextCNN—and trains with the sum of the matrix entries added to the cross-entropy loss. The claim is that this regularization both preserves clean accuracy and lifts accuracy under attack, e.g., to 84.3% certified robust accuracy on IMDB, surpassing interval-bound propagation by about 16.7 percentage points. If true, this gives the first robustness analysis for S4 text classification and a cheaper certificate than IBP.

What carries the argument

The load-bearing object is the Growth Bound Matrix itself, with the mean value theorem acting as the bridge. In the LSTM case the construction is a chain of interval bounds: Proposition 6 bounds each gate pre-activation $T^i_{\mathrm{gate}}$ from intervals on the word embedding, hidden state, and cell state; Proposition 5 bounds the derivatives $\sigma'$ and $\tanh'$ on those intervals; Proposition 7 bounds the cell state $c^i_t$; and Algorithms 1–5 assemble these into upper and lower bounds on the three blocks $M_v$, $M_h$, $M_c$ of Eq. (7). For S4, the GBM is computed directly from the discretized parameters—$\|(\tilde{C}\tilde{B})_{i,j}+\tilde{D}_{i,j}\|$ for the embedding columns and $\|(\tilde{C}\tilde{A})_{i,j}\|$ for the hidden-state columns. For the CNN, the GBM is the maximum filter weight selected by the max-pooling index functions $\alpha$ and $\beta$ in Eq. (14).

What would settle it

Take a GBM-trained LSTM on IMDB, generate hundreds of one-word substitutions from the k=8, distance-0.5 GloVe neighborhoods, and check whether the observed change in each logit ever exceeds the GBM bound with the matrix saved after training; one violation falsifies Proposition 1 and the claimed certificate.

Watch

Extended reading notes

Core claim

The central discovery is a reduction: robustness against word-substitution attacks is reduced to bounding and shrinking a per-entry matrix of partial derivatives. For a mapping $F$ with input region $X \subseteq \mathbb{R}^{n_x}$, a Growth Bound Matrix is any $M\in\mathbb{R}^{n_y\times n_x}$ satisfying $\left|\frac{\partial F_i}{\partial x_j}(x)\right| \le M_{ij}$ for every $x\in X$. Proposition 1 applies the mean value theorem to conclude that for any perturbation $\delta$ with $x+\delta\in X$, each output component obeys $\left|F_i(x+\delta)-F_i(x)\right|\le \sum_{j=1}^{n_x} M_{ij}|\delta_j|$. The paper's training objective (Eq. 3) adds $\beta\sum_{i,j}M_{ij}$ to the cross-entropy loss, so that shrinking the matrix entries shrinks the worst-case output change. Closed-form GBMs are proven for the LSTM cell (Proposition 2, via bounds on gate pre-activations and cell-state derivatives), for the S4 cell (Proposition 3, read from $\tilde{C}\tilde{B}$, $\tilde{C}\tilde{A}$, and $\tilde{D}$), and for TextCNN (Proposition 4, read from convolution-filter weights). Empirically the paper reports that this training produces accuracy under attack up to 84.3% on IMDB, surpassing the interval-bound-propagation baseline by roughly 16.7 percentage points.

Load-bearing premise

The certificate holds only if the box-shaped regions used to build the Growth Bound Matrix actually contain every embedding and internal state the model can reach at test time; the paper does not specify how those regions are chosen.

Editorial extensions

If this is right

  • Certified robustness against all synonym substitutions in a word neighborhood would be obtained for LSTM, S4, and CNN text classifiers without running attacks at test time.
  • The certificate would be substantially cheaper than IBP: on IMDB, the paper reports per-epoch training times of 4:53 vs 0:25 minutes for BiLSTM, and 0:05 vs 0:02 for CNN.
  • The S4 experiments would mark the first robustness evaluation of state-space text classification, and the method's gains under PSO and TextFooler attacks suggest the defense is not limited to one architecture.
  • Because a global Lipschitz constant is only the largest entry of the GBM, the matrix form gives a tighter, direction-aware certificate than a single Lipschitz bound.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves the construction of the LSTM intervals $V$, $H$, $C$ to the appendix algorithms without specifying how the boundaries are chosen; a reader who wants a deployable certificate must fix this by deriving the boxes from the actual synonym-neighborhood embedding sets, which would make the certificate directly testable.
  • The same proof structure should transfer to other recurrent and state-space cells—GRUs, LSTMs with peepholes, or Mamba's S6—once analogous derivative bounds are derived, because the mean-value argument does not depend on the specific cell equations.
  • The per-entry structure of the matrix invites a sensitivity attribution use: the largest entries of $M$ identify which embedding coordinates are most responsible for output variation under synonym swaps, which could guide targeted data augmentation or embedding-space defenses.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes a regularization method based on Growth Bound Matrices (GBM) for NLP classifiers, with model-specific derivations for BiLSTM, S4, and CNN architectures. The authors claim that minimizing a GBM regularizer certifies robustness against all synonym substitutions in Sadv(x), and they report large gains in what the abstract calls "certified robust accuracy" (e.g., 84.3% on IMDB). The mathematical content includes Proposition 1, a mean-value-theorem bound on output-component changes, and Propositions 2-4 giving GBM formulas for LSTM, S4, and CNN cells. Experiments compare the method against several defenses under heuristic attacks (PWWS, GA, PSO, TextFooler) on IMDB and Yahoo! Answers. The central issue is that the paper's advertised certification claim is not established: the bound in Proposition 1 is never connected to class invariance, the reported metric is not a certified accuracy, and the LSTM GBM relies on input intervals whose definition is absent.

Significance. If the certification claim were valid, a scalable certified defense for recurrent and state-space models would be a valuable contribution, and the paper's explicit GBM formulas for S4 and CNN, plus the training-time comparison with IBP, would be useful. However, the paper does not deliver that contribution. The proven result bounds output components for a generic cell mapping; it does not certify the decision of a complete classifier. The headline "certified robust accuracy" is, by the table caption, accuracy under a specific heuristic attack. The empirical gains may indicate that GBM regularization is a useful sensitivity-reduction heuristic, but the formal robustness guarantee that motivates the paper is unsupported. I credit the authors for providing explicit model-specific bound derivations and for reporting efficiency data, but these do not compensate for the missing certification step.

major comments (5)
  1. [Section 4.1.2, Proposition 1] The proposition bounds each output component by |F_i(x') - F_i(x)| ≤ Σ_j M_ij |δ_j|, but no argument connects this bound to classification invariance. Certification of f(x')=f(x) requires a margin condition such as F_y(x') - max_{c≠y} F_c(x') > 0, which would need both a margin at the original input and a bound on the relevant logit differences. No such condition is derived, no per-input certified radius is computed, and no certified accuracy is evaluated. The sentence "This provides a certification that the outputs of the perturbed and non-perturbed inputs remain within the same class" is therefore not a mathematical consequence of the stated result.
  2. [Abstract and Table 1] The abstract's claim of "84.3% certified robust accuracy" on IMDB is contradicted by Table 1's caption, which defines every non-Clean column as Accuracy Under Attack (AUA) against specific heuristic attacks; the 84.3% entry is the AUA of BiLSTM-GBM against PSO. No certified accuracy metric appears anywhere in the paper. This is not a wording issue: the headline result is reported as a certificate in the abstract and conclusion, while the experiments measure accuracy under particular attacks rather than robustness against all perturbations in Sadv(x).
  3. [Section 4.3, Eq. (7) and Algorithms 1-5] The LSTM GBM is defined as a bound over input domains V, H, and C, but the paper never specifies how these intervals are constructed. In particular, there is no description of how the embedding interval for each word in S(wi) is chosen, nor how intervals for hidden states and cell states are propagated across the sequence. If V, H, and C are not guaranteed to over-approximate the reachable states for every x' ∈ Sadv(x), the matrix M computed by Algorithms 1-3 is not known to satisfy the GBM condition in Eq. (2). This gap is load-bearing for the claimed LSTM certification.
  4. [Section E.4 and Proposition 1] For the BiLSTM, the GBM is computed only on the last cell in each direction, and for CNN and S4 it is computed on the cell or convolutional layer, not on the full classifier that maps the representation to logits and decisions. Proposition 1 applies to the cell mapping F, not to the full model f whose output space is the label set. Even with a margin bound at the cell level, no compositional argument is given to certify the full model's prediction. A complete certification would require bounding the entire network, including the classification head, which the paper does not do.
  5. [Section 5.2, Figure 3] The S4 experiments report no baseline because this is described as the first robustness study of S4 in NLP, which is acceptable as a novelty claim. However, the absence of any certified-evaluation protocol means the S4 numbers have the same status as the other AUA results: they show empirical resistance to specific attacks, not certified robustness.
minor comments (6)
  1. [Section 4.3, Proposition 2] The notation in Eq. (7) is confusing: the expression max{∥(M)ij∥, ∥(M)ij∥} uses two visually identical symbols for the lower and upper bounds. Please use distinct overline/underline notation consistently, as in the surrounding text.
  2. [Section 5.1, Evaluation Metrics] The paper never defines "certified robust accuracy," the metric used in the abstract. If certification is to be claimed, the metric must be defined and computed through a margin-based verification procedure, not through attack success rates.
  3. [Appendix A.1, Proof of Proposition 1] The mean-value theorem requires differentiability on a neighborhood of the segment between x and x'. The proof should state this smoothness assumption explicitly, especially since the paper later applies the result to activations that are not differentiable everywhere (e.g., ReLU in the CNN).
  4. [Table 1] The last row of each block contains six gain values while the table has eight numeric columns per model block; the alignment is unclear and should be corrected or explained.
  5. [Eq. (14)] The modulo operation is used on quantities such as i-a that may be negative; the paper should specify whether a mathematical or programming-language modulo is intended.
  6. [Section 4.3, Eq. (13)] There is a typo: "ad in Eq. (1)" should read "as in Eq. (1)."

Circularity Check

1 steps flagged · score 6.0 of 10

The advertised '84.3% certified robust accuracy' is the empirical PSO-AUA number from Table 1 relabeled; no certification procedure connects the GBM bound to class invariance.

  1. renaming known result [Abstract; cf. Table 1 (BiLSTM/IMDB, PSO column) and Section 5.1 Evaluation Metrics]
    "On the IMDB dataset, GBM achieves an impressive 84.3% certified robust accuracy, surpassing IBP by approximately 16.7%."

    Table 1 reports 84.3 as the GBM-BiLSTM IMDB entry in the PSO column, and Section 5.1 defines AUA as 'the model's prediction accuracy under specific adversarial attack methods.' No certified-accuracy metric, such as a margin condition verified over all x' in Sadv(x), is defined, computed, or evaluated anywhere in the paper. The abstract's '84.3% certified robust accuracy' is therefore the same number as the empirical accuracy under the PSO attack, renamed as a certificate. The central certification claim reduces by construction to a table entry rather than to Proposition 1, so the headline result is an empirical attack-accuracy number presented as a derived guarantee.

full rationale

The GBM mathematics itself is not circular: M is defined in Eq. (2) as an elementwise bound on partial derivatives, Proposition 1 bounds |F_i(x')-F_i(x)| via the mean value theorem, and Eq. (3) minimizes the GBM as a regularizer. The interval-bounding lemmas (Propositions 5-7) are cited from external sources (Liu et al.; Meyer et al.) and are not self-citations; the authors' own prior work (Jouret et al. 2023) appears only as a future-work mention and is not load-bearing. However, Section 4.1.2 asserts 'This provides a certification that the outputs of the perturbed and non-perturbed inputs remain within the same class' directly from a sensitivity bound, without deriving any margin condition, and for BiLSTM the GBM is computed only for the last cell (Appendix E.4), not the full classifier. That passage is an omitted-support step rather than a construction-level circularity, but it reinforces the main issue: the advertised 'certified robust accuracy' is, by the paper's own Table 1 caption and Section 5.1 definition, the PSO Accuracy Under Attack value relabeled as a certificate. The regularization method retains independent empirical content, but the central certification claim partially reduces to a renamed empirical result, warranting a score of 6.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The method depends on standard calculus, interval-bounding lemmas from prior work, and an unstated choice of domain intervals for LSTM. The only explicit tuned scalar is β. No new physical or mathematical entities are postulated.

free parameters (2)
  • beta (β) = not reported; tuned per dataset/model
    Loss weight between cross-entropy and GBM regularization in Eq. 3; Figure 6 shows the trade-off but no exact values are given.
  • LSTM input intervals V, H, C = not specified
    The GBM for LSTM requires bounds on the embedding, hidden, and cell state domains; Algorithms 1-5 take these intervals as inputs without defining how they are obtained.
assumptions (5)
  • standard math Mean value theorem for differentiable component functions F_i
    Used to prove Proposition 1 (Appendix A).
  • standard math Derivative bounds for sigmoid and tanh from Proposition 5
    Used to bound σ' and tanh' in the LSTM GBM computation (Appendix C).
  • domain assumption Interval bounds for pre-activations (Proposition 6, adapted from Liu et al. 2021)
    Assumes input and hidden state intervals are available to bound T_gate (Appendix C).
  • domain assumption Interval bounds for cell state c_t (Proposition 7, adapted from Meyer et al. 2021)
    Assumes V, H, C intervals are valid to bound c_t components (Appendix D).
  • domain assumption Word substitutions can be represented as bounded Euclidean perturbations in embedding space
    The perturbation set Sadv and the distance de=0.5 in GloVe space define the threat model (Section 3).

how reviews work

0 comments
Cite this review

Pith. "Pith review of Bridging Robustness and Generalization Against Word Substitution Attacks in NLP via the Growth Bound Matrix Approach." pith.science (2026). https://pith.science/paper/WMRHVV5S

@misc{pith2026250710330,
  author       = {Pith},
  title        = {Pith review of: Bridging Robustness and Generalization Against Word Substitution Attacks in NLP via the Growth Bound Matrix Approach},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WMRHVV5S}},
  note         = {Machine review of arXiv:2507.10330}
}
read the original abstract

Despite advancements in Natural Language Processing (NLP), models remain vulnerable to adversarial attacks, such as synonym substitutions. While prior work has focused on improving robustness for feed-forward and convolutional architectures, the robustness of recurrent networks and modern state space models (SSMs), such as S4, remains understudied. These architectures pose unique challenges due to their sequential processing and complex parameter dynamics. In this paper, we introduce a novel regularization technique based on Growth Bound Matrices (GBM) to improve NLP model robustness by reducing the impact of input perturbations on model outputs. We focus on computing the GBM for three architectures: Long Short-Term Memory (LSTM), State Space models (S4), and Convolutional Neural Networks (CNN). Our method aims to (1) enhance resilience against word substitution attacks, (2) improve generalization on clean text, and (3) providing the first systematic analysis of SSM (S4) robustness. Extensive experiments across multiple architectures and benchmark datasets demonstrate that our method improves adversarial robustness by up to 8.8% over existing baselines. These results highlight the effectiveness of our approach, outperforming several state-of-the-art methods in adversarial defense. Codes are available at https://github.com/BouriMohammed/GBM

Figures

Figures reproduced from arXiv: 2507.10330 by the authors.

Figure 1
Figure 1. Word substitution-based perturbations in sen [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Training Pipeline with Growth Bound Matrix (GBM) Regularization. This pipeline integrates GBM [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. The CA (%) for standard training and AUA [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Comparison of GBM M in BiLSTM Models on the IMDB dataset with and without GBM Regularization. The left heatmap corresponds to the model regularized with GBM, while the heatmap on the right represents the unregularized (baseline) model. The red circles highlight represe…
Figure 5
Figure 5. Figure 5: Comparison of the distribution of elements in the GBM [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: The impact of the hyperparameter β on the performance of CNN, BiLSTM, and S4 models when subjected to the PWWS adversarial attack. The evaluation is conducted on the Yahoo! Answers and IMDB datasets, with CNN and BiLSTM assessed on both datasets, while S4 is evaluated …
Figure 7
Figure 7. Figure 7: Examples of a synonym substitution attack, [PITH_FULL_IMAGE:figures/full_fig_p018_7.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

52 extracted references · 36 canonical work pages

  1. [1]

    Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, and Kai-Wei Chang. 2018. Generating natural language adversarial examples. In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing

    work page 2018

  2. [2]

    Xinshuai Dong, Anh Tuan Luu, Rongrong Ji, and Hong Liu. 2021. Towards robustness against natural language word substitutions. In 9th International Conference on Learning Representations

    work page 2021

  3. [3]

    Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018. H ot F lip: White-box adversarial examples for text classification. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics

    work page 2018

  4. [4]

    Steffen Eger and Yannik Benz. 2020. From hero to z \'e roe: A benchmark of low-level adversarial attacks. In Proceedings of the 1st conference of the Asia-Pacific chapter of the association for computational linguistics and the 10th international joint conference on natural language processing, pages 786--803

    work page 2020

  5. [5]

    Tao Ge, Xingxing Zhang, Furu Wei, and Ming Zhou. 2019. https://doi.org/10.18653/v1/P19-1609 Automatic grammatical error correction for sequence-to-sequence text generation: An empirical study . In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pages 6059--6064, Florence, Italy. Association for Computational Linguistics

    work page doi:10.18653/v1/p19-1609 2019

  6. [6]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and harnessing adversarial examples. In 3rd International Conference on Learning Representations

    work page 2015

  7. [7]

    Albert Gu and Tri Dao. 2023. Mamba: Linear-time sequence modeling with selective state spaces. arXiv preprint arXiv:2312.00752

    arXiv 2023

  8. [8]

    Albert Gu, Karan Goel, and Christopher R \' e . 2022. Efficiently modeling long sequences with structured state spaces. In ICLR

    work page 2022

Show all 52 references
  1. [9]

    Sepp Hochreiter and J \"u rgen Schmidhuber. 1997. Long short-term memory. Neural computation, 9(8):1735--1780

    1997

  2. [10]

    Po-Sen Huang, Robert Stanforth, Johannes Welbl, Chris Dyer, Dani Yogatama, Sven Gowal, Krishnamurthy Dvijotham, and Pushmeet Kohli. 2019. Achieving verified robustness to symbol substitutions via interval bound propagation. In Proceedings of the 2019 Conference on Empirical Me...

    2019

  3. [11]

    Maor Ivgi and Jonathan Berant. 2021. Achieving model robustness through discrete adversarial training. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 1529--1544

    2021

  4. [12]

    Robin Jia, Aditi Raghunathan, Kerem G \" o ksel, and Percy Liang. 2019. Certified robustness to adversarial word substitutions. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Langu...

    2019

  5. [13]

    Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2020. Is bert really robust? a strong baseline for natural language attack on text classification and entailment. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pages 8018--8025

    2020

  6. [14]

    Louis Jouret, Adnane Saoud, and Sorin Olaru. 2023. Safety verification of neural-network-based controllers: a set invariance approach. IEEE Control Systems Letters, 7:3842--3847

    2023

  7. [15]

    Yoon Kim. 2014. https://arxiv.org/abs/1408.5882 Convolutional neural networks for sentence classification . CoRR, abs/1408.5882

    2014 arXiv

  8. [17]

    Linyang Li and Xipeng Qiu. 2020 b . https://arxiv.org/abs/2004.14543 Tavat: Token-aware virtual adversarial training for language understanding . Preprint, arXiv:2004.14543

    2020 arXiv

  9. [18]

    Zongyi Li, Jianhan Xu, Jiehang Zeng, Linyang Li, Xiaoqing Zheng, Qi Zhang, Kai-Wei Chang, and Cho-Jui Hsieh. 2021. Searching for an effective defender: Benchmarking defense against adversarial word substitution. arXiv preprint arXiv:2108.12777

    2021 arXiv

  10. [19]

    Changliu Liu, Tomer Arnon, Christopher Lazarus, Christopher Strong, Clark Barrett, Mykel J Kochenderfer, et al. 2021. Algorithms for verifying deep neural networks. Foundations and Trends in Optimization , 4(3-4):244--404

    2021

  11. [20]

    Maas, Raymond E

    Andrew L. Maas, Raymond E. Daly, Peter T. Pham, Dan Huang, Andrew Y. Ng, and Christopher Potts. 2011. Learning word vectors for sentiment analysis. In The 49th Annual Meeting of the Association for Computational Linguistics: Human Language Technologies

    2011

  12. [21]

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards deep learning models resistant to adversarial attacks. In 6th International Conference on Learning Representations

    2018

  13. [22]

    Rishabh Maheshwary, Saket Maheshwary, and Vikram Pudi. 2021. Generating natural language attacks in a hard label black box setting. In Thirty-Fifth AAAI Conference on Artificial Intelligence

    2021

  14. [23]

    Pierre-Jean Meyer, Alex Devonport, and Murat Arcak. 2021. Interval reachability analysis: Bounding trajectories of uncertain systems with boxes for control and verification. Springer Nature

    2021

  15. [24]

    John Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, Di Jin, and Yanjun Qi. 2020. Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: Sy...

    2020

  16. [25]

    Weiping Pei and Chuan Yue. 2022. Generating content-preserving and semantics-flipping adversarial text. In Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security, pages 975--989

    2022

  17. [26]

    Danish Pruthi, Bhuwan Dhingra, and Zachary C. Lipton. 2019 a . Combating adversarial misspellings with robust word recognition. In Proceedings of the 57th Conference of the Association for Computational Linguistics, pages 5582--5591

    2019

  18. [27]

    Danish Pruthi, Bhuwan Dhingra, and Zachary C. Lipton. 2019 b . https://doi.org/10.18653/v1/P19-1561 Combating adversarial misspellings with robust word recognition . In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pages 5582--5591, F...

    2019 doi

  19. [28]

    Biqing Qi, Yang Luo, Junqi Gao, Pengfei Li, Kai Tian, Zhiyuan Ma, and Bowen Zhou. 2024. Exploring adversarial robustness of deep state space models. arXiv preprint arXiv:2406.05532

    2024 arXiv

  20. [29]

    Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. 2019. Generating natural language adversarial examples through probability weighted word saliency. In Proceedings of the 57th Conference of the Association for Computational Linguistics

    2019

  21. [30]

    Muhammad Sajjad, Soonil Kwon, et al. 2020. Clustering-based speech emotion recognition by incorporating learned features and deep bilstm. IEEE access, 8:79861--79875

    2020

  22. [31]

    Erfan Shayegani, Md Abdullah Al Mamun, Yu Fu, Pedram Zaree, Yue Dong, and Nael Abu-Ghazaleh. 2023. Survey of vulnerabilities in large language models revealed by adversarial attacks. arXiv preprint arXiv:2310.10844

    2023 arXiv

  23. [32]

    Chenglei Si, Zhengyan Zhang, Fanchao Qi, Zhiyuan Liu, Yasheng Wang, Qun Liu, and Maosong Sun. 2020. Better robustness by more coverage: Adversarial training with mixup augmentation for robust fine-tuning. arXiv preprint arXiv:2012.15699

    2020 arXiv

  24. [33]

    Liwei Song, Xinwei Yu, Hsuan-Tung Peng, and Karthik Narasimhan. 2021. Universal adversarial attacks with natural triggers for text classification. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Langua...

    2021

  25. [34]

    Arnold Tustin. 1947. A method of analysing the behaviour of linear systems in terms of time series. Journal of the Institution of Electrical Engineers-Part IIA: Automatic Regulators and Servo Mechanisms, 94(1):130--142

    1947

  26. [35]

    Boxin Wang, Hengzhi Pei, Boyuan Pan, Qian Chen, Shuohang Wang, and Bo Li. 2020 a . T3: Tree-autoencoder constrained adversarial text generation for targeted attack. In Conference on Empirical Methods in Natural Language Processing

    2020

  27. [36]

    Boxin Wang, Shuohang Wang, Yu Cheng, Zhe Gan, Ruoxi Jia, Bo Li, and Jingjing Liu. 2020 b . Infobert: Improving robustness of language models from an information theoretic perspective. 9th International Conference on Learning Representations (ICLR)

    2020

  28. [37]

    Wenjie Wang, Pengfei Tang, Jian Lou, and Li Xiong. 2021 a . Certified robustness to word substitution attack with differential privacy. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies

    2021

  29. [38]

    Xiaosen Wang, Hao Jin, Yichen Yang, and Kun He. 2021 b . Natural language adversarial defense through synonym encoding. In Proceedings of the 37th Conference on Uncertainty in Artificial Intelligence

    2021

  30. [39]

    Xiaosen Wang, Yichen Yang, Yihe Deng, and Kun He. 2021 c . Adversarial training with fast gradient projection method against synonym substitution based text attacks. In AAAI Conference on Artificial Intelligence

    2021

  31. [40]

    Zimu Wang, Wei Wang, Qi Chen, Qiufeng Wang, and Anh Nguyen. 2024. Generating valid and natural adversarial examples with large language models. In 2024 27th International Conference on Computer Supported Cooperative Work in Design (CSCWD), pages 1716--1721. IEEE

    2024

  32. [41]

    Zeyu Yang, Zhao Meng, Xiaochen Zheng, and Roger Wattenhofer. 2024. Assessing adversarial robustness of large language models: An empirical study. arXiv preprint arXiv:2405.02764

    2024 arXiv

  33. [42]

    Mao Ye, Chengyue Gong, and Qiang Liu. 2020. https://doi.org/10.18653/v1/2020.acl-main.317 SAFER : A structure-free approach for certified robustness to adversarial word substitutions . In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, ...

    2020 doi

  34. [43]

    Yuan Zang, Fanchao Qi, Chenghao Yang, Zhiyuan Liu, Meng Zhang, Qun Liu, and Maosong Sun. 2020. Word-level textual adversarial attacking as combinatorial optimization. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics

    2020

  35. [44]

    Guoyang Zeng, Fanchao Qi, Qianrui Zhou, Tingji Zhang, Zixian Ma, Bairu Hou, Yuan Zang, Zhiyuan Liu, and Maosong Sun. 2021 a . https://doi.org/10.18653/v1/2021.acl-demo.43 O pen A ttack: An open-source textual adversarial attack toolkit . In Proceedings of the 59th Annual Meeti...

    2021 doi

  36. [45]

    Jiehang Zeng, Xiaoqing Zheng, Jianhan Xu, Linyang Li, Liping Yuan, and Xuanjing Huang. 2021 b . Certified robustness to text adversarial attacks by randomized [MASK] . In Findings of Association for Computational Linguistics

    2021

  37. [46]

    Jiehang Zeng, Xiaoqing Zheng, Jianhan Xu, Linyang Li, Liping Yuan, and Xuanjing Huang. 2021 c . Certified robustness to text adversarial attacks by randomized [ MASK ]. arXiv preprint arXiv:2105.03743

    2021 arXiv

  38. [47]

    Xiang Zhang, Junbo Jake Zhao, and Yann LeCun. 2015. Character-level convolutional networks for text classification. In Advances in Neural Information Processing Systems

    2015

  39. [48]

    Xinyu Zhang, Hanbin Hong, Yuan Hong, Peng Huang, Binghui Wang, Zhongjie Ba, and Kui Ren. 2024. Text-crs: A generalized certified robustness framework against textual adversarial attacks. In 2024 IEEE Symposium on Security and Privacy (SP), pages 2920--2938. IEEE

    2024

  40. [49]

    Yuhao Zhang, Aws Albarghouthi, and Loris D ' Antoni. 2021. https://doi.org/10.18653/v1/2021.emnlp-main.82 Certified robustness to programmable transformations in LSTM s . In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 1068--108...

    2021 doi

  41. [50]

    Yi Zhou, Xiaoqing Zheng, Cho-Jui Hsieh, Kai-wei Chang, and Xuanjing Huang. 2020. Defense against adversarial attacks in nlp via dirichlet neighborhood ensemble. arXiv preprint arXiv:2006.11627

    2020 arXiv

  42. [51]

    Chen Zhu, Yu Cheng, Zhe Gan, Siqi Sun, Tom Goldstein, and Jingjing Liu. 2020. https://openreview.net/forum?id=BygzbyHFvB Freelb: Enhanced adversarial training for natural language understanding . In 8th International Conference on Learning Representations, ICLR 2020, Addis Aba...

    2020

  43. [52]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list...

  44. [53]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.