Natural Language Adversarial Attack and Defense in Word Level
Table 4: Classification accuracy (%) on adversarial examples by human evaluation.
['[EMPTY]', 'Word-CNN', 'LSTM', 'Bi-LSTM']
This is counter-intuitive as we do not adopt the syntax check module as GA does, however, as IGA chooses synonyms within a small embedding distance and tries to avoid local minimum to achieve a lower word substitution rate, leading IGA a slightly better human evaluation.