Research map / Adversarial robustness and security / Black-box and transfer attacks
HQA-Attack: Toward High Quality Black-Box Hard-Label Adversarial Attack on Text
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use HQA-Attack instead of the strongest reported baseline | BERT text classification attacks · MR, AG's News, Yahoo, Yelp, and IMDB | semantic similarity: MR: 67.3 -> 74.2; AG: 63.2 -> 73.8; Yahoo: 70.2 -> 76.4; Yelp: 73.8 -> 81.9; IMDB: 84.7 -> 89.2 | Helped |
| Use HQA-Attack instead of the strongest reported baseline | BERT text classification attacks · MR, AG's News, Yahoo, Yelp, and IMDB | perturbation rate: MR: 11.905 -> 11.128; AG: 15.766 -> 10.981; Yahoo: 6.841 -> 5.609; Yelp: 9.585 -> 6.756; IMDB: 5.202 -> 3.615 | Helped |
| Add original-word back-substitution (ablation) | HQA-Attack · MR, AG's News, and Yahoo (WordCNN) | semantic similarity: MR: 74.4 -> 75.1; AG: 80.2 -> 82.7; Yahoo: 73.1 -> 82.4 | Helped |
| Add original-word back-substitution (ablation) | HQA-Attack · MR, AG's News, and Yelp (WordCNN) | perturbation rate: MR: 12.638 -> 11.224; AG: 16.519 -> 8.831; Yelp: 19.342 -> 6.312 | Helped |
| Add synonym-based optimization after substituting original words back (ablation) | HQA-Attack · MR and AG's News (WordCNN) | semantic similarity: MR: 74.2 -> 75.1; AG: 79.3 -> 82.7 | Helped |
| Add synonym-based optimization after substituting original words back (ablation) | HQA-Attack · AG's News, Yahoo, Yelp, and IMDB (WordCNN) | perturbation rate: AG: 11.305 -> 8.831; Yahoo: 7.445 -> 6.132; Yelp: 7.883 -> 6.312; IMDB: 3.923 -> 3.285 | Helped |
| Replace initialization-plus-optimization with random initialization only (ablation) | HQA-Attack · MR and AG's News (WordCNN) | semantic similarity: MR: 18.2 -> 75.1; AG: 30.5 -> 82.7 | Hurt |
| Vary transition-word sample count r from 3 to 9 (ablation) | HQA-Attack · WordLSTM text classification; MR, AG's News, Yahoo, Yelp, and IMDB | semantic similarity: MR: 73.9, 74.2, 74.0, 74.1; AG: 75.3, 75.5, 75.7, 75.7; Yahoo: 73.9, 74.1, 74.2, 74.2; Yelp: 86.7, 86.9, 86.8, 86.6; IMD | No clear effect |
| Vary updating-direction sample count k from 5 to 15 (ablation) | HQA-Attack · WordLSTM text classification; MR, AG's News, Yahoo, Yelp, and IMDB | semantic similarity: MR: 74.2, 74.2, 74.1; AG: 75.5, 75.6, 75.7; Yahoo: 74.1, 74.2, 74.4; Yelp: 86.9, 86.7, 86.8; IMDB: 92.0, 91.9, 91.9 | No clear effect |
| Use the proposed word back-substitution strategy instead of LeapAttack's original strategy (ablation) | LeapAttack · WordCNN text classification; MR, AG's News, Yahoo, Yelp, and IMDB | semantic similarity: MR: 63.2 -> 65.3; AG: 72.0 -> 74.8; Yahoo: 74.3 -> 74.6; Yelp: 80.1 -> 81.5; IMDB: 89.7 -> 90.8 | Helped |
Closest papers by meaning
- HQA-VLAttack: Towards High Quality Adversarial Attack on Vision-Language Pre-Trained Models (NeurIPS 2025 · similarity 0.90)
- LimeAttack: Local Explainable Method for Textual Hard-Label Adversarial Attack (AAAI 2024 · similarity 0.89)
- Ask, Attend, Attack: An Effective Decision-Based Black-Box Targeted Attack for Image-to-Text Models (NeurIPS 2024 · similarity 0.86)
- Adversarial Paraphrasing: A Universal Attack for Humanizing AI-Generated Text (NeurIPS 2025 · similarity 0.85)
- Semantic-Aware Multi-Label Adversarial Attacks (CVPR 2024 · similarity 0.84)
- Revisiting Character-level Adversarial Attacks for Language Models (ICML 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.