@inproceedings{ebrahimi-etal-2018-hotflip,
    title = "{H}ot{F}lip: White-Box Adversarial Examples for Text Classification",
    author = "Ebrahimi, Javid  and
      Rao, Anyi  and
      Lowd, Daniel  and
      Dou, Dejing",
    editor = "Gurevych, Iryna  and
      Miyao, Yusuke",
    booktitle = "Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers)",
    month = jul,
    year = "2018",
    address = "Melbourne, Australia",
    publisher = "Association for Computational Linguistics",
    url = "https://preview.aclanthology.org/fix-sig-urls/P18-2006/",
    doi = "10.18653/v1/P18-2006",
    pages = "31--36",
    abstract = "We propose an efficient method to generate white-box adversarial examples to trick a character-level neural classifier. We find that only a few manipulations are needed to greatly decrease the accuracy. Our method relies on an atomic flip operation, which swaps one token for another, based on the gradients of the one-hot input vectors. Due to efficiency of our method, we can perform adversarial training which makes the model more robust to attacks at test time. With the use of a few semantics-preserving constraints, we demonstrate that HotFlip can be adapted to attack a word-level classifier as well."
}