Text Adversarial Attacks and Defenses: Issues, Taxonomy, and Perspectives

Table 3

Categories of adversarial attacks (from perturbation level to methods).

Perturbation level	Attack phase	Access knowledge	Relative work
Char	Location	Blind	[79]
	Perturbation	Gradient	[28, 80]
		Blind	[27, 29, 79, 81–83]
Word	Location	Gradient	[29, 61, 81, 84, 84–89]
		Score	[7, 27, 89–94]
	Perturbation	Gradient	[6, 42, 90, 95–98]
		Score	[92, 99–106]
		Decision	[107, 108]
		Blind	[29, 60, 85, 93, 101, 109–111]
Sentence	Perturbation	Score	[45, 93, 112]
		Decision	[7, 113]
		Blind	[86, 114]
	Generation	Gradient	[115]
		Score	[59, 116]
		Decision	[19, 44, 58, 59, 64, 117]
		Blind	[43, 60, 118]
Hybrid	Generation	Score	[119]