Pith. sign in

REVIEW 4 major objections 6 minor 47 references

Q-FAKER: Query-free Hard Black-box Attack via Controlled Generation

T0 review · 4 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A single generated sentence flips a text classifier with zero queries.

desk verdict A zero-query black-box attack with a clever controlled-generation core, but the ablation doesn't show the surrogate gradient is actually doing the work. read the letter →

arxiv 2504.13551 v1 pith:WT4PGSKY submitted 2025-04-18 cs.CR cs.AIcs.CL

CheolWon Na , YunSeok Choi , Jee-Hyong Lee This is my paper · ORCID
classification cs.CRcs.AIcs.CL
keywords hardblack-boxattackquery-freeadversarialcontrolledtextgenerationtransferabilityclassificationsurrogatemodelexample
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Q-faker sets out to show that a text classifier can be fooled in the hardest realistic setting: no access to the target model's output, parameters, or training data, and no budget for queries. It does this by training a single-layer classification head on a surrogate language model using a different dataset from the same task, then using that head's gradients to steer the frozen generator's output distribution. The result is one generated adversarial sentence per input, produced in roughly $O(n/2)$ time with zero queries to the victim. In experiments across eight datasets for spam, disinformation, toxicity, and sensitive-information detection, the paper reports attack success rates that beat black-box baselines allowed up to twenty queries. If true, this would make closed text-classification APIs attackable with a single crafted input and at very low preparation cost.

What carries the argument

The load-bearing machinery is the adversarially updated output distribution of a frozen generative language model, obtained through the controlled-generation update $\tilde{h}_t \leftarrow h_t + \alpha \nabla_{h_t}\mathcal{L}_{\mathrm{sur}}$ with the update repeated ten times, followed by post-norm fusion $\tilde{p}_{\mathrm{fusion}}(x_{t+1}) = p_{\mathrm{orig}}(x_{t+1})^{1-\lambda}\,\tilde{p}(x_{t+1})^\lambda$. The single-layer surrogate head is what produces $\mathcal{L}_{\mathrm{sur}}$; without it there is no adversarial signal. The fixed context of the first half of the sentence ($r=0.5$) anchors the meaning, and $\lambda=0.97$ keeps the output close to the fluent original LM while still biased toward misclassification. This machinery replaces token-by-token query search with a single forward pass through a surrogate-coupled generator.

What would settle it

Train a target classifier on one dataset with normal labels and a surrogate on a second dataset with the label convention reversed; if Q-faker still flips the target at high rates, the attack is not driven by label-directed gradients, and if it collapses to chance, transfer is confirmed. A cleaner check: replace the trained surrogate head with a randomly initialized one; high attack success with a random head would falsify the claimed mechanism.

Watch

Extended reading notes

Core claim

The central claim is that a hard black-box attack on an encoder-based text classifier can be run with a single one-shot generation, using only the gradient signal of a surrogate model trained on a different dataset for the same task. The paper builds the surrogate as a frozen pretrained GPT-2 with a single-layer classification head of roughly 1K trainable parameters, and it trains only that head. At attack time, adversarial gradients of the surrogate's loss are propagated into the generator's hidden states, and the next token is sampled from a post-norm fusion of the original and the adversarially updated distributions. Keeping half the original sentence as fixed context preserves meaning, and the fusion coefficient $\lambda = 0.97$ keeps the text fluent. The paper reports that this zero-query procedure outperforms query-based baselines on seven of eight victim models, and that its success is more consistent across six target architectures.

Load-bearing premise

The method stands or falls on whether gradients from a surrogate trained on a different dataset for the same task transfer to the target model despite architecture differences, and the paper supports that transfer only with empirical results rather than error bars.

Editorial extensions

If this is right

  • Closed target APIs become attackable with a single submitted input, since no query feedback loop is needed to craft it.
  • Training cost falls to roughly one thousand trainable parameters, so an attacker can prepare surrogate heads for many tasks cheaply.
  • The generated examples are low-perplexity and grammatical by construction, so perplexity-based filters are unlikely to catch them.
  • The same adversarial sentence transfers across several encoder architectures, meaning one crafted input can be reused against a family of victim models.
  • The method's success rate does not degrade as the query budget shrinks, since its performance is independent of query count.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the mechanism is shared pretraining rather than task transfer, then swapping the surrogate's language model to one with a different pretraining corpus should sharply reduce attack success; the paper does not test this.
  • The same gradient-steering loop could be applied to non-classification surfaces such as adversarial prompts for generative models, because the controlled generation step does not depend on the target being an encoder.
  • The requirement that the attacker know the target task could be relaxed with a multi-task surrogate head; that extension is not in the paper.
  • Since the first half of the sentence is preserved, the attack is effectively a continuation attack; a testable extension would be to let the model rewrite earlier tokens while keeping a semantic anchor, which might raise success on short inputs.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes Q-faker, a query-free hard black-box attack against text classifiers. The method trains a lightweight surrogate classification head on top of a frozen GPT-2 generator, using a dataset for the same target task but different from the target's training data. At inference, it keeps the first half of an input sentence and generates the second half by performing PPLM-style gradient ascent on the hidden states to maximize the surrogate's loss, then fusing the updated distribution with the unmodified GPT-2 distribution. The authors claim this yields adversarial examples that transfer to unseen BERT-family targets with zero queries, outperforming query-based baselines and the hard black-box CT-GAT baseline across eight tasks, while preserving fluency and semantics. The paper includes ablations, transferability analysis, quality evaluations, and detector-evasion experiments.

Significance. If the central mechanism is confirmed, the contribution is significant: Q-faker is the first hard black-box attack that requires no target queries and only a single forward pass, making it practical in restrictive real-world scenarios. The training cost is remarkably low (a single classification head with roughly 1K parameters on a frozen GPT-2), and the cross-dataset surrogate setup is a genuine attempt to respect the hard black-box assumption. The paper also provides a useful comparison with existing black-box and hard black-box baselines, and the quality evaluations (including human and LLM-based) are a strength. However, the significance hinges on whether the adversarial gradient update is actually responsible for the attack's success; if a natural GPT-2 continuation already flips targets at comparable rates, the contribution reduces to a simple generation-based attack without the claimed controlled-generation mechanism.

major comments (4)
  1. [§5.5, Figure 2] The ablation study on λ (post-norm fusion weight in Eq. 7) is not reported with numerical values, and the ASR at λ=0 is not given. Since λ=0 corresponds to the unmodified GPT-2 distribution, a high ASR at λ=0 would indicate that natural continuations of the retained prefix already attack the target successfully, making the surrogate gradient update in Eqs. 5-6 incidental. The paper's statement that 'increasing λ slightly improves ASR' is therefore weak evidence for the central mechanism. Please report the full λ sweep including λ=0 and compare ASR at λ=0 vs λ=0.97, and ideally include a control with a randomly initialized surrogate head to show that the gradient direction, not just the loss value, is what transfers.
  2. [§4.2, Eqs. (3)-(4)] The surrogate input interface is underspecified. Eq. (3) defines p(xt) as the probability of the current token (a scalar), yet Eq. (4) computes the gradient of the surrogate loss with respect to the hidden state ht via ∂Lsur/∂p(xt)·∂p(xt)/∂ht, which implies the surrogate loss is a function of this scalar token probability. This is unusual for a classification head; typically the head would take the full hidden state or the full next-token distribution. Please clarify exactly what the single-layer head consumes, and show how the chain rule in Eq. (4) is computed. Without this, the correctness of the gradient update cannot be assessed.
  3. [§5.5, Tables 2-3 and Figure 4] The main experimental results are reported without any measure of variance (standard deviation, confidence intervals) or significance tests. Several ASR differences in Table 2 are modest (e.g., HSOL: Q-faker 53.1 vs CT-GAT 55.8; CGFake: 13.4 vs 12.4), and the transferability heatmap in Figure 4 lacks any indication of statistical spread. Since the paper claims 'higher and more consistent ASR across target models,' the consistency claim needs quantitative support. Please provide mean and standard deviation over at least three random seeds, or bootstrap confidence intervals, and state the number of runs.
  4. [§4.1 and §5.4] The wording in §4.1 ('the surrogate model is trained on same target task dataset') is inconsistent with the cross-dataset setting described in §5.4, which is central to the hard black-box claim. This should be corrected to avoid confusion. More substantively, the paper does not discuss how the attacker obtains the 'different dataset for the same task' in a real hard black-box scenario, nor does it analyze the sensitivity of the method to the choice of surrogate training data. A brief discussion of the availability and selection of surrogate datasets would strengthen the practical-application argument.
minor comments (6)
  1. [Abstract] The phrase 'prove its practical' is ungrammatical; it should be 'prove its practicality'.
  2. [Problem Statement] There is a typo: 'Since the our experimental setting' should be 'Since our experimental setting'.
  3. [Conclusion] The sentence 'and and has proven effective' contains a duplicated 'and'.
  4. [Table 8] The baseline name is misspelled as 'TextFlooler' in the table header; it should be 'TextFooler'.
  5. [§5.5] The sentence 'This demonstrates the superiority of our method in real-world scenarios with limited queries' appears twice (in §6.1 and Appendix B.1); one occurrence should be removed.
  6. [§4.2, Eq. (5)] The notation ∥∇ht Lsur∥γ is undefined. If γ is an exponent in the denominator, specify that the norm is (∥·∥2)^γ; if γ=1.0, state explicitly that this is L2 normalization.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the surrogate is trained on a disjoint dataset, hyperparameters are fixed, and the target is never queried.

full rationale

The paper's derivation chain is not circular in the sense defined by the rubric. Q-faker trains a single-layer classification head on GPT-2 using one dataset for a task (Section 4.1, Eq. 2), then uses gradients of that surrogate loss with respect to GPT-2 hidden states (Eqs. 4-5) to shift the generation distribution, and finally samples a continuation with post-norm fusion (Eq. 7). The target model is never queried, and the surrogate is trained on a different dataset from the target model's training data (Section 5.4, cross-dataset setting). The attack success rate is therefore an external measure against a model whose parameters and training data were not used to fit anything in the method. Hyperparameters (alpha, gamma, r, lambda) are fixed and not fitted to target outputs. The self-citations in the paper (Choi et al. 2022; Na et al. 2023) appear in related-work lists and are not load-bearing for the proposed mechanism. The ablation in Section 5.5 reports that 'increasing λ slightly improves ASR' and does not report a λ=0 no-gradient control; this is a legitimate empirical weakness about whether the surrogate gradient is necessary, but it is a question of experimental support, not a definitional reduction of the prediction to its input. Even if unmodified GPT-2 continuation drove the attack success, the method would be less novel, not circular. The Limitations section's acknowledgment that the task must be known is a stated assumption, not a hidden redefinition of the target. Overall, no step in the derivation is equivalent by construction to the claimed output.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The method does not invent new entities and does not fit parameters to the target model. It relies on transferability of surrogate gradients, the adequacy of GPT-2 as generator/surrogate backbone, and the sufficiency of the first half of the sentence as task context. These are domain assumptions with empirical support only.

free parameters (5)
  • alpha (surrogate gradient step size) = 0.06
    Chosen by hand; controls how strongly the LM is steered by the surrogate. Not tuned to the target model.
  • gamma (gradient normalization exponent) = 1.0
    Chosen by hand; normalizes the gradient update. Fixed across all experiments.
  • r (ratio of given tokens) = 0.5
    Selected from an ablation on Jigsaw; balances ASR against meaning preservation (USE). Applied to all datasets, including Jigsaw, which introduces mild leakage.
  • lambda (post-norm fusion weight) = 0.97
    Chosen by hand; controls the trade-off between fluency and adversarial steering. Ablation shows higher lambda improves ASR.
  • number of gradient ascent steps per token = 10
    Mentioned in Section 4.2 but not listed in hyperparameters; affects the strength of the perturbation.
assumptions (4)
  • domain assumption PPLM-style gradient ascent on hidden states is a valid way to steer text generation toward a desired classifier outcome.
    The method borrows the controlled-generation framework of Dathathri et al. (2020) and assumes it works with a surrogate classifier trained on GPT-2 hidden states.
  • domain assumption Adversarial gradients from a surrogate trained on a different dataset of the same task transfer to the target model.
    This is the core transferability premise, empirically tested but not proven; if it fails, Q-faker collapses.
  • domain assumption Keeping the first half of the original sentence preserves enough task-relevant context for the generated second half to remain a valid input for the target classifier.
    The choice r=0.5 fixes a trade-off between meaning preservation and attack success, implying the first half alone is assumed sufficient for label-relevant content.
  • domain assumption GPT-2 (medium) is an adequate generator and surrogate backbone for all eight tasks.
    The same generator is used everywhere; no per-task architecture search is performed. The paper accepts this as a given pretrained model.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Q-FAKER: Query-free Hard Black-box Attack via Controlled Generation." pith.science (2026). https://pith.science/paper/WT4PGSKY

@misc{pith2026250413551,
  author       = {Pith},
  title        = {Pith review of: Q-FAKER: Query-free Hard Black-box Attack via Controlled Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WT4PGSKY}},
  note         = {Machine review of arXiv:2504.13551}
}
read the original abstract

Many adversarial attack approaches are proposed to verify the vulnerability of language models. However, they require numerous queries and the information on the target model. Even black-box attack methods also require the target model's output information. They are not applicable in real-world scenarios, as in hard black-box settings where the target model is closed and inaccessible. Even the recently proposed hard black-box attacks still require many queries and demand extremely high costs for training adversarial generators. To address these challenges, we propose Q-faker (Query-free Hard Black-box Attacker), a novel and efficient method that generates adversarial examples without accessing the target model. To avoid accessing the target model, we use a surrogate model instead. The surrogate model generates adversarial sentences for a target-agnostic attack. During this process, we leverage controlled generation techniques. We evaluate our proposed method on eight datasets. Experimental results demonstrate our method's effectiveness including high transferability and the high quality of the generated adversarial examples, and prove its practical in hard black-box settings.

Figures

Figures reproduced from arXiv: 2504.13551 by the authors.

Figure 1
Figure 1. The process of Q-faker has three main steps: (1) Training the surrogate model using a different dataset for [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Results of ablation study on Jigsaw. The solid [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Comparison of ASR according to the number of queries (from 20 to 1). The red star( [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Consistent attack capabilities on various target models. This heatmap illustrates the difference ratio in [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Comparison of ASR according to the number [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

47 extracted references · 13 canonical work pages

  1. [1]

    Christopher Burger, Lingwei Chen, and Thai Le. 2023. https://doi.org/10.18653/v1/2023.emnlp-main.792 `` are your explanations reliable? '' investigating the stability of LIME in explaining text classifiers by marrying XAI and adversarial attack . In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 12831--12844,...

    doi:10.18653/v1/2023.emnlp-main.792 2023

  2. [2]

    Daniel Cer, Yinfei Yang, Sheng-yi Kong, Nan Hua, Nicole Limtiaco, Rhomni St John, Noah Constant, Mario Guajardo-Cespedes, Steve Yuan, Chris Tar, et al. 2018. Universal sentence encoder. arXiv preprint arXiv:1803.11175

    arXiv 2018

  3. [3]

    Pappas, and Eric Wong

    Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. 2023. https://arxiv.org/abs/2310.08419 Jailbreaking black box large language models in twenty queries . Preprint, arXiv:2310.08419

    arXiv 2023

  4. [5]

    Yangyi Chen, Hongcheng Gao, Ganqu Cui, Fanchao Qi, Longtao Huang, Zhiyuan Liu, and Maosong Sun. 2022 b . https://doi.org/10.18653/v1/2022.emnlp-main.771 Why should adversarial perturbations be imperceptible? rethink the research paradigm in adversarial NLP . In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 1...

    doi:10.18653/v1/2022.emnlp-main.771 2022

  5. [6]

    YunSeok Choi, Hyojun Kim, and Jee-Hyong Lee. 2022. Tabs: Efficient textual adversarial attack for pre-trained nl code model using semantic beam search. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 5490--5498

    work page 2022

  6. [7]

    Sumanth Dathathri, Andrea Madotto, Janice Lan, Jane Hung, Eric Frank, Piero Molino, Jason Yosinski, and Rosanne Liu. 2020. Plug and play language models: A simple approach to controlled text generation. In International Conference on Learning Representations

    work page 2020

  7. [8]

    Boyi Deng, Wenjie Wang, Fuli Feng, Yang Deng, Qifan Wang, and Xiangnan He. 2023. https://doi.org/10.18653/v1/2023.findings-emnlp.143 Attack prompt generation for red teaming and defending large language models . In Findings of the Association for Computational Linguistics: EMNLP 2023, pages 2176--2189, Singapore. Association for Computational Linguistics

    doi:10.18653/v1/2023.findings-emnlp.143 2023

  8. [9]

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. https://doi.org/10.18653/v1/N19-1423 BERT : Pre-training of deep bidirectional transformers for language understanding . In Proceedings of the 2019 Conference of the North A merican Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long a...

    doi:10.18653/v1/n19-1423 2019

Show all 47 references
  1. [10]

    Xinshuai Dong, Anh Tuan Luu, Min Lin, Shuicheng Yan, and Hanwang Zhang. 2021. How should pre-trained language models be fine-tuned towards adversarial robustness? Advances in Neural Information Processing Systems, 34:4356--4369

    2021

  2. [11]

    Ji Gao, Jack Lanchantin, Mary Lou Soffa, and Yanjun Qi. 2018. Black-box generation of adversarial text sequences to evade deep learning classifiers. In 2018 IEEE Security and Privacy Workshops (SPW), pages 50--56. IEEE

    2018

  3. [12]

    Biyang Guo, Xin Zhang, Ziyuan Wang, Minqi Jiang, Jinran Nie, Yuxuan Ding, Jianwei Yue, and Yupeng Wu. 2023. https://arxiv.org/abs/2301.07597 How close is chatgpt to human experts? comparison corpus, evaluation, and detection . Preprint, arXiv:2301.07597

    2023 arXiv

  4. [13]

    Chuan Guo, Alexandre Sablayrolles, Herv \'e J \'e gou, and Douwe Kiela. 2021. https://doi.org/10.18653/v1/2021.emnlp-main.464 Gradient-based adversarial attacks against text transformers . In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processin...

    2021 doi

  5. [14]

    Pengcheng He, Xiaodong Liu, Jianfeng Gao, and Weizhu Chen. 2020. Deberta: Decoding-enhanced bert with disentangled attention. arXiv preprint arXiv:2006.03654

    2020 arXiv

  6. [15]

    Yichen Huang and Timothy Baldwin. 2023. Robustness tests for automatic machine translation metrics with adversarial attacks. In Findings of the Association for Computational Linguistics: EMNLP 2023, pages 5126--5135

    2023

  7. [16]

    Yining Huang, Keke Tang, and Meilian Chen. 2024. A comprehensive survey on evaluating large language model applications in the medical industry. arXiv preprint arXiv:2404.15777

    2024 arXiv

  8. [17]

    Dongfu Jiang, Xiang Ren, and Bill Yuchen Lin. 2023. Llm-blender: Ensembling large language models with pairwise ranking and generative fusion. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 14165--14178

    2023

  9. [18]

    Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2020. Is bert really robust? a strong baseline for natural language attack on text classification and entailment. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pages 8018--8025

    2020

  10. [19]

    Ryan Koo, Minhwa Lee, Vipul Raheja, Jong Inn Park, Zae Myung Kim, and Dongyeop Kang. 2024. https://doi.org/10.18653/v1/2024.findings-acl.29 Benchmarking cognitive biases in large language models as evaluators . In Findings of the Association for Computational Linguistics ACL 2...

    2024 doi

  11. [20]

    Z Lan. 2019. Albert: A lite bert for self-supervised learning of language representations. arXiv preprint arXiv:1909.11942

    2019 arXiv

  12. [21]

    Guoyi Li, Bingkang Shi, Zongzhen Liu, Dehan Kong, Yulei Wu, Xiaodan Zhang, Longtao Huang, and Honglei Lyu. 2023 a . https://doi.org/10.18653/v1/2023.findings-emnlp.1053 Adversarial text generation by search and learning . In Findings of the Association for Computational Lingui...

    2023 doi

  13. [22]

    Haoran Li, Dadi Guo, Wei Fan, Mingshi Xu, Jie Huang, Fanpu Meng, and Yangqiu Song. 2023 b . https://doi.org/10.18653/v1/2023.findings-emnlp.272 Multi-step jailbreaking privacy attacks on C hat GPT . In Findings of the Association for Computational Linguistics: EMNLP 2023, page...

    2023 doi

  14. [23]

    Linyang Li, Ruotian Ma, Qipeng Guo, Xiangyang Xue, and Xipeng Qiu. 2020. Bert-attack: Adversarial attack against bert using bert. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 6193--6202

    2020

  15. [24]

    Yufei Li, Zexin Li, Yingfan Gao, and Cong Liu. 2023 c . White-box multi-objective adversarial attack on dialogue generation. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 1778--1792

    2023

  16. [25]

    Aiwei Liu, Honghai Yu, Xuming Hu, Shu ' ang Li, Li Lin, Fukun Ma, Yawen Yang, and Lijie Wen. 2022. https://doi.org/10.18653/v1/2022.emnlp-main.522 Character-level white-box adversarial attacks against transformers via attachable subwords substitution . In Proceedings of the 20...

    2022 doi

  17. [26]

    Yinhan Liu. 2019. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:1907.11692

    2019 arXiv

  18. [27]

    Minxuan Lv, Chengwei Dai, Kun Li, Wei Zhou, and Songlin Hu. 2023. Ct-gat: Cross-task generative adversarial attack based on transferability. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 5581--5591

    2023

  19. [28]

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations

    2018

  20. [29]

    Edoardo Mosca, Shreyash Agarwal, Javier Rando Ram \' rez, and Georg Groh. 2022. https://doi.org/10.18653/v1/2022.acl-long.538 `` that is a suspicious reaction! '' : Interpreting logits variation to detect NLP adversarial attacks . In Proceedings of the 60th Annual Meeting of t...

    2022 doi

  21. [30]

    CheolWon Na, YunSeok Choi, and Jee-Hyong Lee. 2023. https://doi.org/10.18653/v1/2023.acl-long.430 DIP : Dead code insertion based black-box attack for programming language model . In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volum...

    2023 doi

  22. [31]

    Mutsumi Nakamura, Santosh Mashetty, Mihir Parmar, Neeraj Varshney, and Chitta Baral. 2023. https://doi.org/10.18653/v1/2023.findings-emnlp.889 L ogic A ttack: Adversarial attacks for evaluating logical consistency of natural language inference . In Findings of the Association ...

    2023 doi

  23. [32]

    Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. 2016. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.07277

    2016 arXiv

  24. [33]

    Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. 2022. Red teaming language models with language models. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing...

    2022

  25. [34]

    Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. 2019. https://doi.org/10.18653/v1/P19-1103 Generating natural language adversarial examples through probability weighted word saliency . In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics...

    2019 doi

  26. [35]

    V Sanh. 2019. Distilbert, a distilled version of bert: Smaller, faster, cheaper and lighter. arXiv preprint arXiv:1910.01108

    2019 arXiv

  27. [36]

    Felix Stahlberg, James Cross, and Veselin Stoyanov. 2018. https://doi.org/10.18653/v1/W18-6321 Simple fusion: Return of the language model . In Proceedings of the Third Conference on Machine Translation: Research Papers, pages 204--211, Brussels, Belgium. Association for Compu...

    2018 doi

  28. [37]

    Lichao Sun, Yue Huang, Haoran Wang, Siyuan Wu, Qihui Zhang, Yuan Li, Chujie Gao, Yixin Huang, Wenhan Lyu, Yixuan Zhang, Xiner Li, Zhengliang Liu, et al. 2024. https://arxiv.org/abs/2401.05561 Trustllm: Trustworthiness in large language models . Preprint, arXiv:2401.05561

    2024 arXiv

  29. [38]

    Boxin Wang, Chejian Xu, Xiangyu Liu, Yu Cheng, and Bo Li. 2022. https://doi.org/10.18653/v1/2022.findings-naacl.14 S em A ttack: Natural textual attacks via different semantic spaces . In Findings of the Association for Computational Linguistics: NAACL 2022, pages 176--205, Se...

    2022 doi

  30. [39]

    Shenao Wang, Yanjie Zhao, Xinyi Hou, and Haoyu Wang. 2024. Large language model supply chain: A research agenda. arXiv preprint arXiv:2404.12736

    2024 arXiv

  31. [40]

    Zhilin Yang, Zihang Dai, Yiming Yang, Jaime Carbonell, Russ R Salakhutdinov, and Quoc V Le. 2019. https://proceedings.neurips.cc/paper_files/paper/2019/file/dc6a7e655d7e5840e66733e9ee67cc69-Paper.pdf Xlnet: Generalized autoregressive pretraining for language understanding . In...

    2019

  32. [41]

    Zhen Yu, Xiaosen Wang, Wanxiang Che, and Kun He. 2022. https://doi.org/10.18653/v1/2022.findings-emnlp.44 T ext H acker: Learning based hybrid local search algorithm for text hard-label adversarial attack . In Findings of the Association for Computational Linguistics: EMNLP 20...

    2022 doi

  33. [42]

    Yuan Zang, Fanchao Qi, Chenghao Yang, Zhiyuan Liu, Meng Zhang, Qun Liu, and Maosong Sun. 2020. Word-level textual adversarial attacking as combinatorial optimization. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 6066--6080

    2020

  34. [43]

    Guoyang Zeng, Fanchao Qi, Qianrui Zhou, Tingji Zhang, Zixian Ma, Bairu Hou, Yuan Zang, Zhiyuan Liu, and Maosong Sun. 2021. https://doi.org/10.18653/v1/2021.acl-demo.43 O pen A ttack: An open-source textual adversarial attack toolkit . In Proceedings of the 59th Annual Meeting ...

    2021 doi

  35. [44]

    Jiahao Zhao and Wenji Mao. 2023. Generative adversarial training with perturbed token detection for model robustness. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 13012--13025

    2023

  36. [45]

    Rui Zheng, Shihan Dou, Yuhao Zhou, Qin Liu, Tao Gui, Qi Zhang, Zhongyu Wei, Xuanjing Huang, and Menghan Zhang. 2023. https://doi.org/10.18653/v1/2023.findings-acl.717 Detecting adversarial samples through sharpness of loss landscape . In Findings of the Association for Computa...

    2023 doi

  37. [46]

    Andy Zou, Zifan Wang, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043

    2023 arXiv

  38. [47]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list...

  39. [48]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.