| Perturbation level | Attack phase | Access knowledge | Relative work |
| Char | Location | Blind | [79] | Perturbation | Gradient | [28, 80] | Blind | [27, 29, 79, 81–83] |
| Word | Location | Gradient | [29, 61, 81, 84, 84–89] | Score | [7, 27, 89–94] | Perturbation | Gradient | [6, 42, 90, 95–98] | Score | [92, 99–106] | Decision | [107, 108] | Blind | [29, 60, 85, 93, 101, 109–111] |
| Sentence | Perturbation | Score | [45, 93, 112] | Decision | [7, 113] | Blind | [86, 114] | Generation | Gradient | [115] | Score | [59, 116] | Decision | [19, 44, 58, 59, 64, 117] | Blind | [43, 60, 118] |
| Hybrid | Generation | Score | [119] |
|
|