Research map / Adversarial robustness and security / Attacks on text and graphs
Revisiting Character-level Adversarial Attacks for Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Charmer, a query-based greedy character-level adversarial attack with top-n position pre-selection using Levenshtein-distance perturbations, achieving near-100% ASR on BERT/RoBERTa TextAttack models and Llama 2-Chat 7B, and tests adversarial training and typo-corrector defenses.
Problem
Token-level adversarial attacks in NLP often change sentence semantics, while character-level attacks, though semantics-preserving, are considered weak and hard to scale efficiently or adapt to gradient methods, and are thought easy to defend.
Approach
A greedy, black-box character-level attack that ranks candidate positions by a loss-based test-character replacement heuristic (top-n position subset), then greedily applies the single-character edit (replacement, insertion, or deletion via expansion/contraction operators) with highest CW loss at each step, with importance re-evaluated after each perturbation.
Key results
- On BERT with SST-2 (TextAttack), Charmer reaches 100% ASR with d_lev 1.47 versus 90.94% for the prior best character attack [cite].
- On AG-News with BERT, Charmer improves ASR to 98.51% vs 90.02% for the prior best character attack; Charmer-Fast reaches >95% ASR in all TextAttack benchmarks.
- On Llama 2-Chat 7B, Charmer-Fast achieves 95.47% ASR on SST-2 with d_lev 2.55, versus 85.79% for TextFooler.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use Charmer instead of the strongest listed baseline | BERT and RoBERTa classifiers · TextAttack benchmarks (AG-News, MNLI-m, QNLI, RTE, SST-2) | ASR (%) | Helped |
| Reduce candidate positions from n=20 to n=1 (Charmer-Fast) (ablation) | Charmer · TextAttack benchmarks | ASR (%): BERT AG-News 98.51 -> 95.86; BERT RTE 97.01 -> 89.55; BERT SST-2 100.00 -> 100.00 | Mixed |
| Use Charmer-Fast instead of the strongest listed baseline | Llama 2-Chat 7B · SST-2, QNLI, RTE | ASR (%): 85.79 -> 95.47; 64.04 -> 93.51; 90.78 -> 97.10 | Helped |
| Train using Charmer adversarial examples rather than standard training | BERT-base · SST-2 | ASR-Char (%): 64.02 -> 20.34 ± (1.17) | Helped |
| Train using TextGrad adversarial examples rather than standard training | BERT-base · SST-2 | ASR-Char (%): 64.02 -> 67.34 ± (4.87) | Hurt |
| Train using Charmer adversarial examples rather than standard training | BERT-base · SST-2 | ASR-Token (%): 95.16 -> 95.17 ± (1.15) | No clear effect |
| Add Pruthi-Jones constraints to the attack (ablation) | Charmer against the robust encoding defense · BERT-SST-2 | ASR (%): 100.00 -> 0.96 | Hurt |
| Remove LowEng while retaining the other PJC constraints (ablation) | Charmer against the robust encoding defense · BERT-SST-2 | ASR (%): 0.96 -> 98.09 | Helped |
| Remove End while retaining the other PJC constraints (ablation) | Charmer against the robust encoding defense · BERT-SST-2 | ASR (%): 0.96 -> 71.72 | Helped |
| Remove Start while retaining the other PJC constraints (ablation) | Charmer against the robust encoding defense · BERT-SST-2 | ASR (%): 0.96 -> 88.93 | Helped |
| Remove Length while retaining the other PJC constraints (ablation) | Charmer against the robust encoding defense · BERT-SST-2 | ASR (%): 0.96 -> 0.96 | No clear effect |
| Remove Repeat while retaining the other PJC constraints (ablation) | Charmer against the robust encoding defense · BERT-SST-2 | ASR (%): 0.96 -> 5.46 | Helped |
Surprising findings
- Adversarial training with a character-level attack does not improve token-level robustness, while TextGrad (token-level) hinders character-level robustness.
- Robust word recognition defenses reach near-zero ASR under Pruthi-Jones constraints (0.96%) but are broken to 98.09% ASR when the LowEng constraint is relaxed.
Limitations
- Perplexity is not a reliable imperceptibility metric per the authors, so semantic imperceptibility is assessed via USE similarity only.
- Robust word recognition defenses are broken only under relaxed constraints; full Charmer does not beat Pruthi-Jones-constrained defenses without relaxing constraints in the study.
- LLM experiments limited to Llama 2-Chat 7B (and Vicuna 7B in appendix) and classification; Charmer-Fast used for LLM due to cost.
Experimental setup
Datasets: SST-2 MNLI-m RTE QNLI AG-News
Benchmarks: SST-2 MNLI-m RTE QNLI AG-News
Metrics: attack success rate Levenshtein distance USE cosine similarity runtime GPT-2 perplexity
Baselines: BAE-R TextFooler BERT-attack GBDA TextGrad DeepWordBug TextBugger CWBA
Builds on: Carlini-Wagner loss TextAttack TRADES DeepWordBug
Closest papers by meaning
- An LLM can Fool Itself: A Prompt-Based Adversarial Attack (ICLR 2024 · similarity 0.88)
- AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs (ICML 2025 · similarity 0.87)
- REINFORCE Adversarial Attacks on Large Language Models: An Adaptive, Distributional, and Semantic Objective (ICML 2025 · similarity 0.87)
- Fast Adversarial Attacks on Language Models In One GPU Minute (ICML 2024 · similarity 0.87)
- Improved Generation of Adversarial Examples Against Safety-aligned LLMs (NeurIPS 2024 · similarity 0.87)
- Semantic Representation Attack against Aligned Large Language Models (NeurIPS 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.