Research map / Adversarial robustness and security / Certified and empirical robustness
Word Level Robustness Enhancement: Fight Perturbation with Perturbation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| apply FPP instead of the base classifier | BiLSTM on IMDB · IMDB | TextFooler successful attack rate: 86.24 -> 3.70 | Helped |
| apply FPP instead of the base classifier | BERT on MR · MR | SemPSO robustness accuracy: 24.00 -> 72.50 | Helped |
| apply FPP instead of the base classifier | BiLSTM on SNLI · SNLI | clean accuracy: 84.35 -> 80.27 | Hurt |
| apply FPP instead of the base classifier | BERT on SNLI · SNLI | SemPSO robustness accuracy: 25.00 -> 59.00 | Helped |
| use 1-gram and 2-gram frequency information together in stage-one perturbation, varying λ (ablation) | FPP · MR and IMDB | clean accuracy | Mixed |
| increase λ toward 2-gram-only perturbation (ablation) | FPP · MR and IMDB | robustness accuracy | Hurt |
| replace the base classifier with one trained using weak-robustness-targeted adversarial examples (ablation) | FPP on MR, BiLSTM · MR | SemPSO robustness accuracy: 54.00 -> 62.00 | Helped |
| replace conventional adversarial augmentation with weak-robustness-targeted adversarial training (ablation) | FPP on MR, BiLSTM · MR | SemPSO robustness accuracy: 54.00 -> 62.00 | Helped |
| replace the base classifier with one trained using weak-robustness-targeted adversarial examples (ablation) | FPP on SNLI, BERT · SNLI | SemPSO robustness accuracy: 59.00 -> 67.50 | Helped |
| replace conventional adversarial augmentation with weak-robustness-targeted adversarial training (ablation) | FPP on SNLI, BERT · SNLI | SemPSO robustness accuracy: 61.50 -> 67.50 | Helped |
| use weak-robustness-targeted adversarial training rather than conventional adversarial augmentation (ablation) | FPP on SNLI, BiLSTM · SNLI | TextFooler successful attack rate: 20.41 -> 16.89 | Helped |
Closest papers by meaning
- Towards Robustness Against Natural Language Word Substitutions (ICLR 2021 · similarity 0.90)
- TextGrad: Advancing Robustness Evaluation in NLP by Gradient-Driven Optimization (ICLR 2023 · similarity 0.90)
- Harnessing Non-Adversarial Robustness in Large Language Models (ICML 2026 · similarity 0.89)
- Adversarial Training for Improving Model Robustness? Look at Both Prediction and Interpretation (AAAI 2022 · similarity 0.89)
- Scaling Trends in Language Model Robustness (ICML 2025 · similarity 0.87)
- Perturbation-Invariant Adversarial Training for Neural Ranking Models: Improving the Effectiveness-Robustness Trade-Off (AAAI 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.