Word-level Textual Adversarial Attacking as Combinatorial Optimization
Table 10: Automatic evaluation results of adversarial example quality. “%M”, “%I” and “PPL” indicate the modification rate, grammatical error increase rate and language model perplexity respectively.
['Victim Model', 'Word Substitution Method', 'Search Algorithm', 'IMDB %M', 'IMDB %I', 'IMDB PPL', 'SST-2 %M', 'SST-2 %I', 'SST-2 PPL', 'SNLI %M', 'SNLI %I', 'SNLI PPL']
We can find that Sememe and PSO obtain higher overall adversarial example quality than other word substitution methods and adversarial example search algorithms, respectively.