[Paper Review] Adversarial Attacks on Deep Learning Models in Natural Language Processing: A Survey

Wei Emma Zhang, Quan Z. Sheng+2 more|arXiv (Cornell University)|Jan 21, 2019

Adversarial Robustness in Machine Learning165 references257 citations

TL;DR

A comprehensive survey of adversarial attacks on textual deep neural networks, detailing challenges unique to text data and summarizing attack and defense approaches in NLP.

ABSTRACT

With the development of high computational devices, deep neural networks (DNNs), in recent years, have gained significant popularity in many Artificial Intelligence (AI) applications. However, previous efforts have shown that DNNs were vulnerable to strategically modified samples, named adversarial examples. These samples are generated with some imperceptible perturbations but can fool the DNNs to give false predictions. Inspired by the popularity of generating adversarial examples for image DNNs, research efforts on attacking DNNs for textual applications emerges in recent years. However, existing perturbation methods for images cannotbe directly applied to texts as text data is discrete. In this article, we review research works that address this difference and generatetextual adversarial examples on DNNs. We collect, select, summarize, discuss and analyze these works in a comprehensive way andcover all the related information to make the article self-contained. Finally, drawing on the reviewed literature, we provide further discussions and suggestions on this topic.

Motivation & Objective

• Provide a self-contained overview of adversarial attacks on textual DNNs in NLP.
• Classify and organize existing literature on textual adversarial examples.
• Discuss differences between image and text attacks and identify open issues and future directions.

Proposed method

• Survey and synthesis of high-quality papers from top NLP/AI venues and arXiv based on quality, novelty, and citations.
• Introduce general taxonomy of adversarial attacks and threat models for DNNs in NLP.
• Explain how textual perturbations differ from image perturbations and summarize representative attack methods (FGSM, JSMA, C&W, DeepFool, substitute models, GAN-based approaches).
• Map attack methods to text-specific challenges such as discreteness, perceptibility, and semantics.
• Discuss defense strategies and open issues to guide robust textual DNN development.

Experimental results

Research questions

• RQ1 What are the main categories and taxonomies of adversarial attacks applicable to textual deep learning models?
• RQ2 How do textual adversarial attacks differ from image-based attacks in terms of perturbations, perceptibility, and semantics?
• RQ3 What are the state-of-the-art attack and defense techniques for NLP models, and what open issues remain?
• RQ4 How can adversarial examples be generated and evaluated for text data to assess robustness of NLP systems?

Key findings

• The survey identifies a taxonomy and classification schemes for textual adversarial attacks and defenses.
• It explains the unique challenges of text data, including discreteness, perceptibility, and semantic changes, compared to images.
• It covers foundational attack methods adapted for text (e.g., FGSM, JSMA, C&W, DeepFool) and text-specific strategies like substitute models and GAN-based approaches.
• It consolidates how attacks are evaluated and contextualizes defense strategies within NLP applications.
• The paper highlights open issues and potential directions for building more robust textual DNN models.