\section{Related Work}
% related work in evaluation of adversarial examples on seq2seq problems: adversarial learning paradigm
\newcite{cheng2018seq2sick} and \newcite{cheng2018towards} applied continuous perturbation learning on token's embedding and then manage a lexical representation out of a perturbed embedding. \newcite{zhao2017generating} learned such perturbation on the encoded representation of a sequence, and then decode it back as an adversarial example.
These methods are applicable for simple NLP classification tasks, while failing machine translation which requires higher semantic constraints.
\newcite{zhao2017generating} further attempted to constrain semantic in such paradigm by introducing multi-task modeling with accessory annotation, which further limits applicability. 

% \SJ{Two problems in previous work: 1. sampling on a perturbed continuous space does not guarantee corresponding valid tokens; 2. require annotation. Make sure they hold. }

On the other hand, \newcite{ebrahimi2018adversarial}, \newcite{Chaturvedi2019ExploringTR} and \newcite{cheng2019robust} regarded it as a search problem by maximizing surrogate gradient losses.
% However, designing a loss upon single token for overall semantic similarity is hardly possible, thus they usually put restrictions to the search paradigm instead of similarity modeling. 
Due to the formidable gradient computation, such methods are less viable to more complex neural architectures. 
\newcite{cheng2019robust} introduced a learned language model to constrain generation. However, a learned language model is not apt for common typos or UNK. 
Another pitfall of this paradigm is that surrogate losses defined by a fixed tokenization for non-character level systems, risks being invalidated once the attack changes tokenization. Therefore, \newcite{ebrahimi2018adversarial} simply focused on char-level systems, while \newcite{michel2019evaluation} specially noted to exclude scenarios where attack changes tokenization in their paradigm.
% it still does not model semantic resemblance necessary for adversarial examples.

Other works turn to more sophisticated generation paradigms, e.g., \newcite{Vidnerov2016Evolutionary} adopts a genetic algorithm for an evolutionary generation targeting simple machine learning models. 
\newcite{Zang2019Textual} consider adversarial generation as a word substitution-based combinatorial optimization problem tackled by particle swarm algorithm. 
Our paradigm shares some common ideology with \newcite{miao2019cgmh} and \newcite{ijcai2018-543}, which iteratively edit inputs constrained by generative adversarial learning. 
