OASIS: Optimizing Attacker Sequences for Hard-Label Black-Box Text Attacks

OASIS: Optimizing Attacker Sequences for Hard-Label Black-Box Text Attacks Qian Chen∗ , Shiliang Xiao∗ , and Yuzhi Liang†

arXiv:2608.29568v1 [cs.CR] 30 Aug 2026

School of Information Science and Technology Guangdong University of Foreign Studies, China 20241050023@mail.gdufs.edu.cn, slxiao@mail.gdufs.edu.cn, yzliang@gdufs.edu.cn ∗ Equal contribution. † Corresponding author.

Abstract. Different attack methods follow different search trajectories, they succeed on different subsets of samples, whereas existing hard-label black-box text attacks mainly focus on improving individual attackers or manually combining them. We present OASIS, a method for optimizing attacker sequences in hard-label black-box text attacks. OASIS first performs a one-time bi-objective attack chain search over candidate sequences to balance attack success rate and perturbation, and then reuses the selected fixed global chain during attack chain execution. Experiments across multiple datasets, victim models, and large language models show that OASIS consistently outperforms strong standalone baselines and simple manually constructed chains. These results suggest that attacker composition is not merely an implementation choice, but a practical optimization target for improving hard-label black-box text attacks. Keywords: Hard-Label Black-Box Text Attack · Attacker Sequence Optimization · Attack Chain Search · Attacker Complementarity · Multi-Objective Optimization

1

Introduction

Deep neural networks have achieved strong performance across a wide range of NLP tasks, yet they remain vulnerable to adversarial examples. In realistic settings, target models often expose no intermediate information and operate under limited query budgets. Hard-label black-box text attacks aim to induce misclassification by making only a small number of perturbations to the original text while preserving its semantics as much as possible, given only label-only feedback. Different attack methods follow different search trajectories, and therefore their successful attack sets do not fully overlap. This raises a central challenge: how can we search for an attack chain that exploits cross-attacker complementarity so as to maximize the overall coverage of successful attacks? Existing hard-label black-box text attacks mainly focus on designing stronger standalone attackers or manually combining attack methods. Methods such as LeapAttack [29] and TextHoaxer [30] seek better attack directions under label-only feedback, while LimeAttack [35], VIWHard [33], and TextHacker [31] improve token ranking, surrogate modeling, or local search. Meanwhile, empirical hand-crafted attack combinations such as OpenFact [11] do not treat attacker complementarity as an explicit optimization target. Because different attackers follow different search trajectories, they succeed on different subsets of samples. Moreover, strong attackers often exhibit larger overlap in their successful attack sets, whereas relatively weaker attackers may cover residual cases missed by stronger ones. Overall, most existing methods either focus on improving individual attackers or rely on manually combining them, without explicitly exploiting the complementarity among attackers induced by different search trajectories. To address this issue, we propose OASIS1 , a method for Optimizing Attacker Sequences in hard-label black-box text attackS. Specifically, our method consists of two stages: local chain search and attack chain execution. On a local model and dataset, we perform a one-time search over candidate attack chains, jointly maximizing ASR and minimizing Pert as a bi-objective optimization problem. We use NSGA-II to search for the Pareto front, and then define the positive ideal solution and negative ideal solution in this solution space to select a fixed global attack chain via TOPSIS. On target models and datasets, the same global attack chain is reused and executed sequentially on each sample. 1

Our code is anonymously available at https://github.com/s1xiao/OASIS.

2

Q. Chen et al.

Extensive experiments across multiple target datasets, target models, and large language models show that OASIS consistently outperforms strong standalone baselines and manual compositions, while the selected attack chain remains effective beyond the local search setting. Our main contributions are as follows: – We identify that different attackers follow different search trajectories and therefore cover only partially overlapping subsets of successful samples. – We propose a global attack-chain search framework that selects a fixed reusable attack chain by capturing cross-attacker complementarity. – Experiments across target datasets and victim models show that the searched chain consistently outperforms strong standalone attackers and manually constructed chains.

2

Related Work

Research on textual adversarial attacks is formally categorized based on the adversary’s knowledge of the victim model. White-box Attacks. When richer feedback is available, adversarial text generation can rely on gradients or confidence scores for more direct optimization. In the white-box setting, HotFlip [5] performs gradient-based character perturbations, GBDA [8] optimizes adversarial distributions through Gumbel-Softmax relaxation, and TextGrad [9] further exploits gradient signals for robustness-oriented text optimization. Some early attacks also combine perturbations across different granularities: TextBugger [14] integrates character- and word-level modifications, while DeepWordBug [6] uses scoring-based character manipulations. In soft-label black-box settings, where gradients are unavailable but confidence scores can still guide search, representative methods mainly differ in how they select and generate substitutions. Many substitution-based attacks are built on lexical resources such as WordNet [21] and HowNet [4]. PWWS [25], PSOAttack [32], and TextFooler [10] focus on saliency-guided or search-based word substitution, whereas BERT-Attack [15], BAE [7], and CLARE [12] improve substitution quality with masked language models and richer edit operations. Beyond direct substitution, ATGSL [13] leverages conditional generation to produce fluent adversarial examples, and ALGEN [2] studies few-shot embedding inversion via cross-model alignment. The development of this line of work has also been supported by toolkit efforts such as TextAttack [22], which systematizes adversarial attack recipes in NLP. Black-box Attacks. Hard-label black-box attacks are more restrictive because the attacker observes only the final predicted label. Existing work in this setting mainly improves the search procedure of a single attacker, although the technical routes differ. Population-based methods such as HLBB [19] adopt genetic search for hard-label attack generation, while HyGloadAttack [18] introduces hybrid optimization to alleviate local optima during label-only search. Boundary-approximation and direction-guided methods instead focus on how to approach the decision boundary more efficiently: GeoAttack [20] exploits geometric structure to approximate effective perturbation directions, LeapAttack [29] further explores the decision boundary through directional cues under label-only feedback, and TextHoaxer [30] refines search directions in continuous embedding space for hard-label attacks. Another line of work improves local token selection and perturbation refinement under discrete constraints: SemAttack [28] emphasizes semantic consistency during adversarial generation, TextHacker [31] improves local search with token-level perturbation heuristics and attack-history feedback, LimeAttack [35] estimates token importance with local surrogate signals and combines them with beam search, and VIWHard [33] identifies important words with masked language models to guide natural substitutions. This direction is also related to model-agnostic explanation methods such as Anchors [26] and to constrained synonym spaces built from counter-fitted word vectors [23]. More recent methods also place greater emphasis on attack quality under hard-label feedback: HQAAttack [17] focuses on query-efficient generation of high-quality adversarial texts, and SSPAttack [16] strengthens substitution-based attacks with structure-aware perturbation design. Beyond single-attacker optimization, some empirical attack pipelines also combine multiple methods; OpenFact [11] manually integrates attack algorithms for fact-checking tasks. However, such combinations do not explicitly optimize attacker complementarity or the order of attacker execution.

OASIS

3

Fig. 1: Overall framework of OASIS. The method first performs attack chain search on the local dataset under the local model to identify an effective fixed global chain using NSGA-II and TOPSIS, and then reuses the selected chain on target datasets and target models under query budget and quality constraints.

3

Methodology

Before introducing the algorithm in detail, we first clarify an important intuition: OASIS does not aim to directly select the attacker combination with the highest standalone performance in the search space. Instead, since different attackers succeed on different subsets of samples, OASIS explicitly exploits crossattacker complementarity and identifies a chain whose components work well together, thereby improving the overall coverage of successful attacks. The overall workflow is illustrated in Figure 1. Specifically, OASIS consists of two stages: (1) Attack Chain Search, where candidate chains are evaluated on a local dataset under a local model and optimized under a joint ASR–Pert objective; and (2) Attack Chain Execution, where the selected fixed global chain is reused across target datasets and target models under a limited query budget and unified quality constraints. 3.1

Attack Chain Formulation

Problem definition. Given a text classifier f : X → Y, an input X = [w1 , w2 , . . . , wn ] with label y, a query budget B, a perturbation threshold ρ, and a semantic similarity threshold τ , the goal in the hard-label black-box setting is to find an adversarial example X ′ such that f (X ′ ) ̸= y, Pert(X, X ′ ) ≤ ρ, Sim(X, X ′ ) ≥ τ, Qused ≤ B (1) Pn where Pert(X, X ′ ) = n1 i=1 1(wi ̸= wi′ ), Sim(X, X ′ ) is measured by the same sentence-level similarity module used in the quality check during attack execution, and Qused is the total number of victim-model queries. We evaluate attacks only on originally correct samples satisfying f (X) = y. Attack chain. Standalone performance does not determine chain performance, so we optimize the ordered attacker sequence directly. Let the attacker pool be A = {a1 , a2 , . . . , aK }, where K = 7. The attack chain is defined as an ordered sequence without repetition:
C = aσ(1) , aσ(2) , . . . , aσ(L) , σ : {1, . . . , L} → {1, . . . , K} injective. (2)

4

Q. Chen et al.

The candidate space is denoted by CL , with cardinality |CL | = P (K, L) = K!/(K − L)!. During execution, attackers are invoked sequentially on the same original input X. At step i, the i-th attacker receives the original text, the gold label, and the remaining budget, and produces X

(i) (i) (i) Xcand , si , qi = aσ(i) X, y, Brem , Brem =B− qj , (3) j<i (i)

where Xcand is the returned candidate text, si ∈ {0, 1} indicates whether the attacker finds a label-flipping candidate, and qi is the number of queries consumed at that step. If the candidate is empty or violates the quality constraints, the chain continues to the next attacker. All candidates are checked against the same original input X. corr To evaluate one chain on the local development set, let DL = {(X, y) ∈ DL : f (X) = y} be the subset of originally correct samples. Let s(X; C) ∈ {0, 1} denote whether chain C returns a valid adversarial example corr for sample X, and let S(C) = {X ∈ DL : s(X; C) = 1} be the successful subset. We then define X 1 s(X; C), (4) ASRL (C) = corr |DL | corr X∈DL

PertL (C) =

1 |S(C)|

X

Pert X, Xadv (X; C) ,

(5)

X∈S(C)

where Xadv (X; C) denotes the accepted adversarial output returned by C on X. If S(C) = ∅, we assign the worst perturbation score PertL (C) = 1. OASIS therefore aims to find a fixed reusable chain that jointly attains high ASRL and low PertL . 3.2

Attack Chain Search via NSGA-II

Exhaustively evaluating all P (K, L) candidate chains is impractical because each candidate requires real attack queries on the victim model. We therefore perform a one-time search with NSGA-II([3]) on the local dataset under the local model, using a small development set Ddev with Neval = 100 samples, and then reuse the selected chain across target datasets and target models. The search stage solves the following bi-objective problem:
(6) min f (C) = −ASRL (C), PertL (C) . C∈CL

Let Pt ⊆ CL denote the population at generation t, where each individual is a valid attack chain of length L. We initialize P0 by sampling valid non-repeated chains from CL and evaluate every chain under the same budget and quality constraints as in final testing. Given two parent chains (1)

(1)

C (1) = (a1 , . . . , aL ),

(2)

(2)

C (2) = (a1 , . . . , aL ),

we generate offspring by an order-preserving crossover: a crossover point r ∈ {1, . . . , L − 1} is first sampled, (1) (1) the offspring inherits the prefix (a1 , . . . , ar ) from the first parent, and the remaining positions are filled by scanning the second parent from left to right and appending attackers that have not yet appeared in the inherited prefix. In this way, crossover is defined directly on ordered attacker chains and preserves both order information and the no-repetition constraint as much as possible. We then apply a chain-level mutation to each offspring. With probability pm , we either swap two positions in the chain or replace one position with an attacker that is not currently used in that chain. The swap operator changes the execution order of attackers, whereas the replace operator changes the attacker composition itself. After crossover and mutation, duplicated decoded chains are removed. If an offspring contains repeated attackers, it is treated as invalid. Let Ot denote the offspring set generated from Pt−1 . NSGA-II then selects the next population from the combined parent–offspring set:
(7) Pt = SelectNSGA-II Pt−1 ∪ Ot ; P, f . After G generations, we obtain the final Pareto front Fpareto , from which TOPSIS selects a single compromise chain for later attack chain execution. The overall search procedure is shown in Algorithm 1.

OASIS

5

Algorithm 1 Attack-Chain Search 1: P0 ← sample P valid chains from CL 2: Evaluate each C ∈ P0 and compute f (C) 3: for t = 1, 2, . . . , G do 4: Select parent pairs from Pt−1 5: Generate offspring Ot by order-preserving crossover 6: Apply swap-or-replace mutation to each offspring 7: Remove duplicated chains and penalize invalid repeated chains 8: Evaluate each valid C ∈ Ot and compute f (C) 9: Pt ← SelectNSGA-II (Pt−1 ∪ Ot ; P, f ) 10: Extract the final Pareto front Fpareto from PG

3.3

TOPSIS-based Chain Selection

After NSGA-II terminates, the Pareto front Fpareto contains multiple candidate chains with different ASR– Pert trade-offs. We use TOPSIS [1] (Technique for Order Preference by Similarity to Ideal Solution) to select a single compromise solution, which is used as the fixed global chain in OASIS. Let the candidate set be Fpareto = {C (1) , . . . , C (m) }, where each chain is associated with a score pair (ASRL (C (i) ), PertL (C (i) )). We first normalize these attributes to form a decision matrix, then define the positive ideal solution as A+ = (maxi ASRL (C (i) ), mini PertL (C (i) )) and the negative ideal solution as A− = (mini ASRL (C (i) ), maxi PertL (C (i) )). Let d(·, ·) denote Euclidean distance in the normalized twoobjective space. The selected chain is the one with the highest relative closeness: C ∗ = arg max C (i) ∈Fpareto

d(C (i) , A− ) d(C (i) , A+ ) + d(C (i) , A− )

(8)

The purpose of this selection step is not to pursue an extreme optimum on one metric, but to obtain a globally reusable chain with a more balanced ASR–Pert trade-off. In our implementation, this amounts to selecting the Pareto-front solution that is closest to the normalized ideal point of high ASR and low Pert. As a result, TOPSIS naturally disfavors frontier endpoints that look strong only because they over-optimize one objective on the local dataset under the local model, and instead prefers compromise chains that remain competitive on both metrics. 3.4

Attack Chain Execution

For each test sample X, we first query the victim model. If f (X) ̸= y, the sample is skipped and is not counted as a valid attack target. Otherwise, the fixed chain C ∗ = (aσ(1) , . . . , aσ(L) ) is executed sequentially under the shared budget. At step i, attacker aσ(i) is invoked according to Eq. (3), and the total query count is updated as Qused ← Qused + qi . If Qused ≥ B, the execution terminates immediately. (i) If Xcand is empty, the chain directly proceeds to the next attacker. Otherwise, the candidate is accepted (i) only when it both flips the prediction and satisfies the quality constraints, i.e., Pert(X, Xcand ) ≤ ρ and (i) (i) Sim(X, Xcand ) ≥ τ . If these conditions are met, the chain terminates and returns Xcand ; otherwise, the candidate is discarded and the next attacker starts a fresh attempt from the same original input X under the remaining budget.

4

Experiments

We study the following research questions: – RQ1: How does OASIS compare with baselines under a fixed query budget? – RQ2: How does the performance of OASIS change under different query budgets? – RQ3: How does the performance of OASIS change under different perturbation thresholds? – RQ4: Can the fixed global chain selected on the local dataset and local model remain effective across target datasets and target models? – RQ5: Can OASIS outperform manually constructed attack chains? – RQ6: How do the key components of OASIS affect performance?

6

Q. Chen et al. Dataset Train Test Class Length SST-2 MR Yelp AG Yahoo

70K 2K 9K 1K 560K 38K 120K 7.6K 1400K 60K

2 2 2 4 10

8 18 133 43 151

Table 1: Dataset statistics of the five classification benchmarks used in this work. 4.1

Experimental Setup

Datasets. We use five public text classification datasets in total: MR [24], SST-2 [27], AG News [34], Yahoo [34], and Yelp [34]. MR serves as the local dataset for the global attack chain search, while SST-2, AG News, Yahoo, and Yelp are treated as target datasets. Table 1 summarizes their scale, label space, and average input length. Victim Models. Following prior hard-label black-box attack studies [35], we evaluate OASIS on victim models from three architectural paradigms: traditional neural models (WordCNN and WordLSTM), a pretrained language model (DistilBERT), and large language models (Qwen2.5 in zero-shot and fine-tuned settings). In addition, BERT serves as the local model for the global attack chain search on MR, while the remaining evaluated victims are treated as target models. Baselines. We compare OASIS against nine representative hard-label black-box text attack algorithms: VIWHard [33], TextHoaxer [30], LeapAttack [29], TextHacker [31], SSPAttack [16], HQAAttack [17], LimeAttack [35]. In addition, to examine whether a searched chain can also outperform manually designed compositions, we further include two sequential combinations introduced in OpenFact [11]: BAm2&Genetic and GSWSE&T, in the overall comparison. – VIWHard [33]: Introduces an important-word discriminator trained on a local surrogate model to identify vulnerable tokens without querying the target. It generates context-aware substitutions via a Masked Language Model (MLM) and optimizes the attack using a genetic algorithm. – TextHoaxer [30]: A greedy heuristic that prioritizes token positions, using a few probing queries to determine whether a substitution is worthwhile before committing. – LeapAttack [29]: Employs finite-difference boundary exploration with gradient-like directions to jointly select positions and synonyms, pushing inputs into the misclassification region. – TextHacker [31]: Maintains an online-updated word-importance table derived from edit-flip history, which guides a hybrid local search. – SSPAttack [16]: First obtains a successful adversarial example via synonym substitutions, and then reduces perturbations by reverting unnecessary replacements while preserving the attack. This process aims to improve text quality under a limited query budget. – HQAAttack [17]: Focuses on generating high-quality adversarial texts under hard-label feedback. Starting from an adversarial example, it refines substitutions and optimizes critical token positions to reduce perturbation while maintaining attack success. – LimeAttack [35]: Leverages a local explainable method to approximate word importance ranking, and then adopts beam search to find the optimal solution. – BAm2&Genetic [11]: A combination introduced in OpenFact, where the Genetic Algorithm is applied for cases in which BAm2 fails, in order to bolster the attack success rate. – GSWSE&TF [11]: A method introduced in OpenFact, where TextFooler is applied to texts for which GSWSE is unable to change the model decision. Evaluation Metrics. Consistent with prior work such as LimeAttack and VIWHard, we use Attack Success Rate (ASR), Perturbation Rate (Pert), and Semantic Similarity (Sim) as evaluation metrics. ASR is computed over originally correct samples only, and measures the proportion of valid attack targets that are successfully flipped by the attack. To assess adversarial text quality, Pert quantifies the fraction of modified tokens, while Sim measures the degree of semantic preservation with respect to the original input using the same sentence-level similarity module as the attack constraint.

OASIS

7

Implementation Details. A key protocol of our evaluation is that the attack chain is searched only once on the local dataset under the local model and then reused across all target datasets and target models. Concretely, each candidate chain is an ordered length-L = 3 sequence sampled without repetition from the seven hard-label attackers. NSGA-II optimizes these candidates under a dual objective of maximizing ASR and minimizing Pert on N = 100 correctly classified local samples, using the same constraints as the final evaluation setting (B = 1000, ρ = 0.1, τ = 0.9). TOPSIS is then applied to select a single fixed global chain for all target evaluations: HQAAttack → VIWHard → TextHacker. For the final attack setting, we use B = 1000, M = 50, ρ = 0.1, and τ = 0.9. For NSGA-II, we use population size P = 30, maximum generations G = 10, crossover probability pc = 0.85, and mutation probability pm = 0.2. Each target evaluation uses N = 1000 samples. All results are averaged over three independent runs on an NVIDIA RTX 3080 Ti GPU (13 GB).

4.2

Overall Result (RQ1)

Table 2 shows that the searched chain consistently achieves higher ASR than strong standalone baselines while keeping Pert in a comparable range on both conventional classifiers and LLM victims. On WordCNN for SST-2, OASIS reaches 52.3% ASR, clearly above LeapAttack and HQAAttack (both 36.5%), with similar Pert (6.4%). The same trend appears on Qwen2.5-FT for SST-2, where OASIS achieves 42.0% ASR, outperforming HQAAttack (37.5%) and LeapAttack (35.4%) with comparable perturbation (6.8%). Moreover, OASIS’s results consistently surpass those of the two combination baselines adapted from OpenFact. This gain is better explained by attacker complementarity. Different attackers follow different search trajectories and therefore succeed on different subsets of samples. The attack chain exploits this complementarity, allowing later attackers to cover residual cases missed by earlier ones and thus improve overall ASR. In addition, OASIS outperforms the combination baselines because OpenFact uses manually constructed combinations, whereas our method searches for the attack chain automatically, allowing it to better exploit the complementarity among different attackers.

4.3

ASR under Varying Query Budgets (RQ2)

Figure 2 shows the ASR trends on Qwen2.5-FT for SST-2 and Yahoo under five query budgets, with B ∈ {100, 300, 500, 700, 900}. Across all budgets, OASIS stays above the baselines, and the gap becomes more visible once the budget is large enough for later attackers to act on residual hard examples, especially on Yahoo. This behavior is consistent with the chain acting as a fallback over complementary search trajectories: later attackers do not receive extra budget, but they can still solve cases that earlier search patterns miss. The improvement therefore comes from broader sample coverage, rather than from budget inflation.

4.4

ASR under Varying PERT (RQ3)

Figure 3 reports four ASR–PERT curves on Qwen2.5-FT and DistilBERT for SST-2 and Yahoo under perturbation thresholds ρ ∈ [0.03, 0.12]. The clearest pattern appears on Yahoo, where OASIS traces the upper frontier across almost the entire threshold range for both victim models; on SST-2, the curves are closer, but OASIS still stays on or near the favorable frontier. This shows that its gains do not come from relaxing the perturbation constraint. This stability is consistent with the design of OASIS: NSGA-II jointly optimizes ASR and Pert, and TOPSIS selects a balanced chain rather than one that attains high ASR through larger edits. As a result, the selected chain shows a smaller ASR drop as the perturbation threshold becomes stricter, while later attackers can still cover some valid low-perturbation adversarial examples missed by earlier ones.

8

Q. Chen et al.

Model

Method

SST-2

AG

Yahoo

Yelp

ASR↑ Pert↓ ASR↑ Pert↓ ASR↑ Pert↓ ASR↑ Pert↓

WordCNN

OASIS LimeAttack VIWHard TextHacker TextHoaxer LeapAttack HQAAttack SSPAttack BAM2&Genetic GSWSE&TF

52.3 35.3 32.9 22.4 34.1 36.5 36.5 30.6 33.7 48.2

6.4 6.7 6.6 7.0 6.4 6.2 6.3 6.4 6.8 6.9

60.3 26.7 18.9 43.3 53.3 59.1 58.9 45.6 30.5 28.8

6.0 3.1 2.6 6.0 6.1 5.5 5.7 5.7 5.9 4.8

79.8 43.6 33.8 69.0 66.2 56.3 76.1 64.8 41.9 35.2

4.2 2.9 2.4 4.6 4.6 3.3 4.2 1.2 3.6 3.1

85.2 31.4 18.6 65.1 74.4 54.7 81.4 65.1 47.8 33.5

3.7 2.4 2.4 4.6 4.0 3.4 3.7 4.2 3.5 3.3

WordLSTM

OASIS LimeAttack VIWHard TextHacker TextHoaxer LeapAttack HQAAttack SSPAttack BAM2&Genetic GSWSE&TF

38.7 28.6 26.1 21.4 25.6 29.6 28.4 24.9 27.8 35.2

7.0 6.9 6.9 6.7 6.3 6.4 7.0 7.2 6.9 6.6

42.5 26.4 25.7 32.3 36.6 36.2 42.2 36.4 31.5 34.7

6.0 3.8 2.7 5.8 5.6 5.6 5.9 5.6 5.8 5.7

66.1 34.8 32.4 52.9 62.2 51.5 61.7 61.2 44.3 50.8

4.2 3.0 2.3 4.4 4.2 3.7 3.8 4.4 3.9 3.6

89.3 29.1 23.3 73.3 79.1 70.9 81.4 68.6 62.7 74.5

3.7 2.7 2.8 4.2 1.0 3.7 1.0 3.7 3.6 3.5

DistilBERT

OASIS LimeAttack VIWHard TextHacker TextHoaxer LeapAttack HQAAttack SSPAttack BAM2&Genetic GSWSE&TF

44.8 31.6 25.8 15.1 36.6 18.7 43.8 36.0 24.4 42.1

6.9 6.8 6.3 6.2 6.7 6.9 7.0 7.0 7.6 6.8

36.8 12.9 12.2 9.8 27.3 15.4 32.5 23.8 28.4 36.3

6.0 4.2 2.8 4.8 5.1 5.7 6.0 5.6 3.4 3.0

61.2 30.6 27.7 21.8 45.8 36.8 55.6 46.9 28.5 17.4

3.9 2.8 2.4 3.2 3.6 4.0 4.0 3.9 4.8 3.4

75.1 19.0 12.5 19.0 63.8 52.0 73.9 58.2 40.7 18.4

4.0 2.4 1.9 3.0 4.1 4.3 3.9 4.1 3.5 2.9

Qwen2.5 (Zero-shot)

OASIS LimeAttack VIWHard TextHacker TextHoaxer LeapAttack HQAAttack SSPAttack BAM2&Genetic GSWSE&TF

48.7 47.2 45.4 17.1 11.6 34.6 18.5 10.6 29.8 31.5

6.3 6.3 6.7 6.2 7.0 6.2 6.7 6.4 6.4 6.5

60.4 53.6 45.4 19.5 10.7 31.6 19.3 12.4 27.9 29.4

2.8 3.4 2.3 4.6 3.9 4.1 4.3 3.9 4.2 4.0

51.5 49.4 38.5 14.2 15.6 33.6 18.7 15.8 26.7 28.9

2.2 2.3 1.4 4.7 3.4 3.1 3.5 3.1 3.4 3.0

40.1 38.3 36.1 13.4 9.5 32.2 16.1 14.7 24.6 26.3

2.1 2.2 1.7 3.5 2.3 2.3 2.8 2.2 2.6 2.4

OASIS LimeAttack VIWHard TextHacker Qwen2.5 TextHoaxer (Fine-tuned) LeapAttack HQAAttack SSPAttack BAM2&Genetic GSWSE&TF

42.0 22.9 17.7 18.7 29.2 35.4 37.5 23.9 33.8 41.6

6.8 6.4 7.0 7.4 6.7 6.7 6.9 6.9 6.9 6.7

41.2 15.7 14.6 15.7 30.3 40.1 40.4 17.9 34.6 37.1

6.0 3.4 2.8 6.2 3.7 3.8 4.0 3.7 5.8 6.3

56.5 22.1 20.7 23.3 36.3 46.7 55.8 19.4 46.1 42.3

4.4 2.2 3.0 4.3 2.3 2.4 2.4 2.3 3.9 3.8

64.2 16.2 10.4 32.0 42.4 58.8 61.3 38.5 51.7 56.4

4.7 3.5 2.3 3.7 4.8 4.9 4.8 4.6 4.5 4.6

Table 2: Comprehensive performance comparison (ASR % and Pert %) across all victim models and datasets under a 1000-Query Budget.

OASIS

(a) SST-2

9

(b) Yahoo

Fig. 2: ASR under different query budget thresholds. 4.5

Transferability of the Fixed Global Chain (RQ4)

To assess whether the fixed global chain selected on the local dataset under the local model transfers beyond its local search condition, we evaluate all 11 Pareto-front candidate chains across target datasets and target models. Figure 4 collects eight transfer plots on Yahoo, Yelp, SST-2, and AG for Qwen2.5-FT and DistilBERT. Across these target settings, the TOPSIS-selected chain (Solution 2) stays on or near the favorable ASR–Pert frontier. This pattern follows directly from TOPSIS: after normalizing ASR and Pert, it selects the Pareto-front chain nearest to the ideal point of high ASR and low Pert, rather than an endpoint optimized for a single objective. Equivalently, TOPSIS favors the chain with the smallest joint shortfall on the two objectives, so the selected compromise chain preserves a balanced margin on both metrics and is less sensitive to model and dataset shifts. 4.6

Comparison with Manually Constructed Chains (RQ5)

Table 3 compares OASIS with two manually specified chains on SST-2 and Yahoo using Qwen2.5-FT: best3 (the manually constructed chain formed by the top-3 standalone attackers on the local dataset under the local model; HQAAttack → TextHoaxer → SSPAttack), random-3 (a randomly constructed 3-attacker chain; SSPAttack → LimeAttack → VIWHard). OASIS achieves higher ASR than both manually constructed chains on both datasets. In particular, on Yahoo, OASIS surpasses best-3 by 7.0%, although its Pert is slightly higher. This is because the additional successfully attacked samples are harder cases, which often require perturbing more words to flip the prediction. Model

Method

SST-2

Yahoo

ASR↑ Pert↓ ASR↑ Pert↓ OASIS best-3 Qwen2.5-FT random-3

42.0 40.1 34.5

6.8 6.7 6.4

56.5 49.5 42.6

4.4 4.1 3.6

Table 3: Comparison with manually constructed baselines on Qwen2.5-FT.

4.7

Ablation Study (RQ6)

To isolate the contribution of the three components introduced in Sec. 3, we compare OASIS with three reduced variants on SST-2 and Yahoo using Qwen2.5-FT: (1) w/o multi-objective, which replaces the biobjective score in Eq. (6) with ASR-only search and selects the best-ASR chain (VIWHard → HQAAttack →

10

Q. Chen et al.

(a) SST-2 (Qwen2.5-FT)

(b) Yahoo (Qwen2.5-FT)

(c) SST-2 (DistilBERT)

(d) Yahoo (DistilBERT)

Fig. 3: ASR–PERT curves under different perturbation thresholds on Qwen2.5-FT and DistilBERT. The first row shows Qwen2.5-FT, and the second row shows DistilBERT. TextHoaxer); (2) w/o NSGA-II, which keeps the same bi-objective evaluation and final selector but replaces NSGA-II with random search in the same chain space (VIWHard → TextHoaxer → SSPAttack); and (3) w/o TOPSIS, which keeps the bi-objective NSGA-II search but replaces the final compromise selector with 10 randomly selected Pareto-front solutions and reports their average performance. As shown in Table 4, removing any of the three components hurts performance. On Yahoo, the drops are much larger: ASR falls from 56.5 for OASIS to 38.8 without TOPSIS and further to 27.3 and 28.1 without multi-objective optimization or NSGA-II-based search. Notably, these degraded variants often achieve lower Pert, because they tend to succeed only on relatively easy samples, and such fragile samples can often be flipped by changing only a few words, even at random positions. Model

Method

SST-2

Yahoo

ASR↑ Pert↓ ASR↑ Pert↓ OASIS w/o multi-objective Qwen2.5-FT w/o NSGA-II w/o TOPSIS

42.0 40.8 41.2 37.1

6.8 6.8 6.7 7.2

56.5 27.3 28.1 38.8

Table 4: Component ablation results on Qwen2.5-FT.

4.4 3.4 3.3 3.8

OASIS

(a) Yahoo (Qwen2.5-FT)

(b) Yahoo (DistilBERT)

(c) Yelp (Qwen2.5-FT)

(d) Yelp (DistilBERT)

(e) SST-2 (Qwen2.5-FT)

(f) SST-2 (DistilBERT)

(g) AG (Qwen2.5-FT)

(h) AG (DistilBERT)

11

Fig. 4: Transfer performance of the 11 Pareto-front candidate chains across Yahoo, Yelp, SST-2, and AG on Qwen2.5-FT and DistilBERT. Higher points indicate higher ASR, and horizontal position indicates Pert. Solution 2 (red) is the TOPSIS-selected chain.

Fig. 5: Success-set overlap on local data/model (N = 100). Diagonal: successful samples; darker color: stronger pairwise overlap. We further analyze attacker complementarity with the overlap matrix in Figure 5, computed on the local dataset under the local model using N = 100 samples. The diagonal entries are the numbers of successfully attacked samples for each attacker, while off-diagonal colors indicate pairwise overlap intensity (darker means stronger overlap). Notably, the three attackers in best-3, namely HQAAttack, TextHoaxer, and SSPAttack, all show relatively dark overlap cells with one another in the matrix. This suggests that simply combining the strongest standalone attackers may provide limited additional coverage. In contrast,

12

Q. Chen et al. Method

Label Constraint Adversarial Text

HQAAttack

✓

... harshly “ shakes the clown ” , a much funnier film with a similar theme and an equally great robin williams performance ... ... roughly “ shakes the clown ” , a much funnier film with a similar theme and an equally great robin williams performance ... ... roughly “ shakes the clown ” , a much funnier film with a similar theme and an equally great robin williams performance ...

VIWHard OASIS ✓

HQAAttack VIWHard OASIS HQAAttack VIWHard OASIS

✓ ✓

smoothly found in its ability to spoof both black and white stereotypes equally. gently found in its ability to spoof both black and white stereotypes equally. warmly found in its ability to spoof both black and white stereotypes equally.

HQAAttack

✓

VIWHard

✓

OASIS

harmoniously speaking we ’re in all of me realm again and strictly speaking schneider is no steve martin smoothly speaking we ’re in all of me territory again and strictly speaking schneider is no steve martin smoothly speaking we ’re in all of me territory again and strictly speaking schneider is no steve martin

harshly are now two signs that m. night shyamalan ’s debut feature sucked up all he has to give to the mystic genres of cinema: unbreakable and signs. roughly are now two signs that m. night shyamalan ’s debut feature sucked up all he has to give to the mystic genres of cinema: unbreakable and signs. coldly are now two signs that m. night shyamalan ’s debut feature sucked up all he has to give to the mystic genres of cinema: unbreakable and signs.

Table 5: Case study on DistilBERT (SST-2) using the selected chain HQAAttack → VIWHard → TextHacker. A checkmark under Label indicates that the prediction is unchanged, while a checkmark under Constraint indicates that the candidate is rejected by the unified quality constraints. the searched chain can better capture complementarity across different attackers, which helps explain why sequence-level optimization is beneficial. 4.8

Case Study

Table 5 presents four representative DistilBERT examples on SST-2 under the selected chain. A clear pattern emerges: earlier attackers often fail either because they do not flip the prediction or because their candidates violate the unified quality constraints, while later attackers can still find valid adversarial examples for the same input. This shows that different attackers cover different residual cases, and that the gain of the chain comes from cross-attacker complementarity rather than from any single attacker alone.

5

Conclusion

We revisit hard-label black-box text attacks from the perspective of attacker composition rather than singleattacker design. We show that different attackers follow different search trajectories and exhibit non-trivial complementarity. To address this, OASIS formulates attacker composition as an attacker-sequence optimization problem and searches for a fixed reusable global chain. Across datasets, victim models, and large language models, the searched chain consistently outperforms strong standalone baselines and simple manual compositions. Notably, it exposes the vulnerability of Large Language Models (e.g., Qwen2.5) in both zero-shot and robust fine-tuned settings.

References 1. Behzadian, M., Otaghsara, S.K., Yazdani, M., Ignatius, J.: A state-of the-art survey of TOPSIS applications. Expert Syst. Appl. 39(17), 13051–13069 (2012). https://doi.org/10.1016/J.ESWA.2012.05.056, https://doi. org/10.1016/j.eswa.2012.05.056 2. Chen, Y., Xu, Q., Bjerva, J.: ALGEN: few-shot inversion attacks on textual embeddings via cross-model alignment and generation. In: Che, W., Nabende, J., Shutova, E., Pilehvar, M.T. (eds.) Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2025, Vienna, Austria, July 27 - August 1, 2025. pp. 24330–24348. Association for Computational Linguistics (2025), https://aclanthology.org/2025.acl-long.1185/

OASIS

13

3. Deb, K., Agrawal, S., Pratap, A., Meyarivan, T.: A fast and elitist multiobjective genetic algorithm: NSGA-II. IEEE Trans. Evol. Comput. 6(2), 182–197 (2002). https://doi.org/10.1109/4235.996017, https://doi.org/ 10.1109/4235.996017 4. Dong, Z., Dong, Q.: Hownet And The Computation Of Meaning (With Cd-rom). World Scientific Publishing Company (2006), https://books.google.co.jp/books?id=RdTICgAAQBAJ 5. Ebrahimi, J., Rao, A., Lowd, D., Dou, D.: Hotflip: White-box adversarial examples for text classification. In: Gurevych, I., Miyao, Y. (eds.) Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics, ACL 2018, Melbourne, Australia, July 15-20, 2018, Volume 2: Short Papers. pp. 31–36. Association for Computational Linguistics (2018). https://doi.org/10.18653/V1/P18-2006, https://aclanthology.org/ P18-2006/ 6. Gao, J., Lanchantin, J., Soffa, M.L., Qi, Y.: Black-box generation of adversarial text sequences to evade deep learning classifiers. In: 2018 IEEE Security and Privacy Workshops, SP Workshops 2018, San Francisco, CA, USA, May 24, 2018. pp. 50–56. IEEE Computer Society (2018). https://doi.org/10.1109/SPW.2018.00016, https://doi.org/10.1109/SPW.2018.00016 7. Garg, S., Ramakrishnan, G.: BAE: bert-based adversarial examples for text classification. In: Webber, B., Cohn, T., He, Y., Liu, Y. (eds.) Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing, EMNLP 2020, Online, November 16-20, 2020. pp. 6174–6181. Association for Computational Linguistics (2020). https://doi.org/10.18653/V1/2020.EMNLP-MAIN.498, https://doi.org/10.18653/v1/2020. emnlp-main.498 8. Guo, C., Sablayrolles, A., Jégou, H., Kiela, D.: Gradient-based adversarial attacks against text transformers. In: Moens, M., Huang, X., Specia, L., Yih, S.W. (eds.) Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, EMNLP 2021, Virtual Event / Punta Cana, Dominican Republic, 7-11 November, 2021. pp. 5747–5757. Association for Computational Linguistics (2021). https://doi.org/10.18653/V1/2021. EMNLP-MAIN.464, https://doi.org/10.18653/v1/2021.emnlp-main.464 9. Hou, B., Jia, J., Zhang, Y., Zhang, G., Zhang, Y., Liu, S., Chang, S.: Textgrad: Advancing robustness evaluation in NLP by gradient-driven optimization. In: The Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023. OpenReview.net (2023), https://openreview.net/forum? id=5tKXUZil3X 10. Jin, D., Jin, Z., Zhou, J.T., Szolovits, P.: Is BERT really robust? A strong baseline for natural language attack on text classification and entailment. In: The Thirty-Fourth AAAI Conference on Artificial Intelligence, AAAI 2020, The Thirty-Second Innovative Applications of Artificial Intelligence Conference, IAAI 2020, The Tenth AAAI Symposium on Educational Advances in Artificial Intelligence, EAAI 2020, New York, NY, USA, February 7-12, 2020. pp. 8018–8025. AAAI Press (2020). https://doi.org/10.1609/AAAI.V34I05.6311, https://doi.org/10. 1609/aaai.v34i05.6311 11. Lewoniewski, W., Stolarski, P., Strózyna, M., Lewanska, E., Wojewoda, A., Ksiezniak, E., Sawinski, M.: Openfact at checkthat! 2024: Combining multiple attack methods for effective adversarial text generation. CoRR abs/2409.02649 (2024). https://doi.org/10.48550/ARXIV.2409.02649, https://doi.org/10.48550/arXiv. 2409.02649 12. Li, D., Zhang, Y., Peng, H., Chen, L., Brockett, C., Sun, M., Dolan, B.: Contextualized perturbation for textual adversarial attack. In: Toutanova, K., Rumshisky, A., Zettlemoyer, L., Hakkani-Tür, D., Beltagy, I., Bethard, S., Cotterell, R., Chakraborty, T., Zhou, Y. (eds.) Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, NAACL-HLT 2021, Online, June 6-11, 2021. pp. 5053–5069. Association for Computational Linguistics (2021). https://doi.org/ 10.18653/V1/2021.NAACL-MAIN.400, https://doi.org/10.18653/v1/2021.naacl-main.400 13. Li, G., Shi, B., Liu, Z., Kong, D., Wu, Y., Zhang, X., Huang, L., Lyu, H.: Adversarial text generation by search and learning. In: Bouamor, H., Pino, J., Bali, K. (eds.) Findings of the Association for Computational Linguistics: EMNLP 2023, Singapore, December 6-10, 2023. pp. 15722–15738. Association for Computational Linguistics (2023). https://doi.org/10.18653/V1/2023.FINDINGS-EMNLP.1053, https://doi.org/10.18653/v1/ 2023.findings-emnlp.1053 14. Li, J., Ji, S., Du, T., Li, B., Wang, T.: Textbugger: Generating adversarial text against real-world applications. In: 26th Annual Network and Distributed System Security Symposium, NDSS 2019, San Diego, California, USA, February 24-27, 2019. The Internet Society (2019), https://www.ndss-symposium.org/ndss-paper/ textbugger-generating-adversarial-text-against-real-world-applications/ 15. Li, L., Ma, R., Guo, Q., Xue, X., Qiu, X.: BERT-ATTACK: adversarial attack against BERT using BERT. In: Webber, B., Cohn, T., He, Y., Liu, Y. (eds.) Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing, EMNLP 2020, Online, November 16-20, 2020. pp. 6193–6202. Association for Computational Linguistics (2020). https://doi.org/10.18653/V1/2020.EMNLP-MAIN.500, https: //doi.org/10.18653/v1/2020.emnlp-main.500 16. Liu, H., Xu, Z., Zhang, X., Xu, X., Zhang, F., Ma, F., Chen, H., Yu, H., Zhang, X.: Sspattack: A simple and sweet paradigm for black-box hard-label textual adversarial attack. In: Williams, B., Chen, Y., Neville, J. (eds.)

14

Q. Chen et al.

Thirty-Seventh AAAI Conference on Artificial Intelligence, AAAI 2023, Thirty-Fifth Conference on Innovative Applications of Artificial Intelligence, IAAI 2023, Thirteenth Symposium on Educational Advances in Artificial Intelligence, EAAI 2023, Washington, DC, USA, February 7-14, 2023. pp. 13228–13235. AAAI Press (2023). https://doi.org/10.1609/AAAI.V37I11.26553, https://doi.org/10.1609/aaai.v37i11.26553 17. Liu, H., Xu, Z., Zhang, X., Zhang, F., Ma, F., Chen, H., Yu, H., Zhang, X.: Hqa-attack: Toward high quality black-box hard-label adversarial attack on text. CoRR abs/2402.01806 (2024). https://doi.org/10.48550/ ARXIV.2402.01806, https://doi.org/10.48550/arXiv.2402.01806 18. Liu, Z., Xiong, X., Li, Y., Yu, Y., Lu, J., Zhang, S., Xiong, F.: Hygloadattack: Hard-label black-box textual adversarial attacks via hybrid optimization. Neural Networks 178, 106461 (2024). https://doi.org/10.1016/ J.NEUNET.2024.106461, https://doi.org/10.1016/j.neunet.2024.106461 19. Maheshwary, R., Maheshwary, S., Pudi, V.: Generating natural language attacks in a hard label black box setting. In: Thirty-Fifth AAAI Conference on Artificial Intelligence, AAAI 2021, Thirty-Third Conference on Innovative Applications of Artificial Intelligence, IAAI 2021, The Eleventh Symposium on Educational Advances in Artificial Intelligence, EAAI 2021, Virtual Event, February 2-9, 2021. pp. 13525–13533. AAAI Press (2021). https://doi.org/10.1609/AAAI.V35I15.17595, https://doi.org/10.1609/aaai.v35i15.17595 20. Meng, Z., Wattenhofer, R.: A geometry-inspired attack for generating natural language adversarial examples. In: Scott, D., Bel, N., Zong, C. (eds.) Proceedings of the 28th International Conference on Computational Linguistics, COLING 2020, Barcelona, Spain (Online), December 8-13, 2020. pp. 6679–6689. International Committee on Computational Linguistics (2020). https://doi.org/10.18653/V1/2020.COLING-MAIN.585, https://doi.org/ 10.18653/v1/2020.coling-main.585 21. Miller, G.A.: Wordnet: A lexical database for english. Commun. ACM 38(11), 39–41 (1995). https://doi.org/ 10.1145/219717.219748, https://doi.org/10.1145/219717.219748 22. Morris, J.X., Lifland, E., Yoo, J.Y., Grigsby, J., Jin, D., Qi, Y.: Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in NLP. In: Liu, Q., Schlangen, D. (eds.) Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, EMNLP 2020 Demos, Online, November 16-20, 2020. pp. 119–126. Association for Computational Linguistics (2020). https: //doi.org/10.18653/V1/2020.EMNLP-DEMOS.16, https://doi.org/10.18653/v1/2020.emnlp-demos.16 23. Mrkšić, N., Ó Séaghdha, D., Thomson, B., Gašić, M., Rojas-Barahona, L.M., Su, P.H., Vandyke, D., Wen, T.H., Young, S.: Counter-fitting word vectors to linguistic constraints. In: NAACL-HLT. pp. 142–148 (2016), https://aclanthology.org/N16-1018 24. Pang, B., Lee, L.: Seeing stars: Exploiting class relationships for sentiment categorization with respect to rating scales. In: ACL (2005), https://aclanthology.org/P05-1015/ 25. Ren, S., Deng, Y., He, K., Che, W.: Generating natural language adversarial examples through probability weighted word saliency. In: Korhonen, A., Traum, D., Màrquez, L. (eds.) Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics. pp. 1085–1097. Association for Computational Linguistics, Florence, Italy (Jul 2019). https://doi.org/10.18653/v1/P19-1103, https://aclanthology.org/P19-1103/ 26. Ribeiro, M.T., Singh, S., Guestrin, C.: Anchors: High-precision model-agnostic explanations. In: McIlraith, S.A., Weinberger, K.Q. (eds.) Proceedings of the Thirty-Second AAAI Conference on Artificial Intelligence, (AAAI18), the 30th innovative Applications of Artificial Intelligence (IAAI-18), and the 8th AAAI Symposium on Educational Advances in Artificial Intelligence (EAAI-18), New Orleans, Louisiana, USA, February 2-7, 2018. pp. 1527–1535. AAAI Press (2018). https://doi.org/10.1609/AAAI.V32I1.11491, https://doi.org/10.1609/ aaai.v32i1.11491 27. Socher, R., Perelygin, A., Wu, J., Chuang, J., Manning, C.D., Ng, A.Y., Potts, C.: Recursive deep models for semantic compositionality over a sentiment treebank. In: EMNLP (2013), https://aclanthology.org/D13-1170/ 28. Wang, B., Xu, C., Liu, X., Cheng, Y., Li, B.: Semattack: Natural textual attacks via different semantic spaces. In: Carpuat, M., de Marneffe, M., Ruı́z, I.V.M. (eds.) Findings of the Association for Computational Linguistics: NAACL 2022, Seattle, WA, United States, July 10-15, 2022. pp. 176–205. Association for Computational Linguistics (2022). https://doi.org/10.18653/V1/2022.FINDINGS-NAACL.14, https://doi.org/10.18653/v1/ 2022.findings-naacl.14 29. Ye, M., Chen, J., Miao, C., Wang, T., Ma, F.: Leapattack: Hard-label adversarial attack on text via gradientbased optimization. In: Zhang, A., Rangwala, H. (eds.) KDD ’22: The 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Washington, DC, USA, August 14 - 18, 2022. pp. 2307–2315. ACM (2022). https://doi.org/10.1145/3534678.3539357, https://doi.org/10.1145/3534678.3539357 30. Ye, M., Miao, C., Wang, T., Ma, F.: Texthoaxer: Budgeted hard-label adversarial attacks on text. In: AAAI (2022), https://ojs.aaai.org/index.php/AAAI/article/view/21479 31. Yu, Z., Wang, X., Che, W., He, K.: Texthacker: Learning based hybrid local search algorithm for text hard-label adversarial attack. In: Goldberg, Y., Kozareva, Z., Zhang, Y. (eds.) Findings of the Association for Computational Linguistics: EMNLP 2022, Abu Dhabi, United Arab Emirates, December 7-11, 2022. pp. 622–637. Association for Computational Linguistics (2022). https://doi.org/10.18653/V1/2022.FINDINGS-EMNLP.44, https://doi. org/10.18653/v1/2022.findings-emnlp.44

OASIS

15

32. Zang, Y., Qi, F., Yang, C., Liu, Z., Zhang, M., Liu, Q., Sun, M.: Word-level textual adversarial attacking as combinatorial optimization. In: Jurafsky, D., Chai, J., Schluter, N., Tetreault, J.R. (eds.) Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, ACL 2020, Online, July 5-10, 2020. pp. 6066– 6080. Association for Computational Linguistics (2020). https://doi.org/10.18653/V1/2020.ACL-MAIN.540, https://doi.org/10.18653/v1/2020.acl-main.540 33. Zhang, H., Wang, J., Gao, H., Zhang, X., Wang, H., Li, W.: Viwhard: Text adversarial attacks based on importantword discriminator in the hard-label black-box setting. Neurocomputing 616, 128917 (2025). https://doi.org/ 10.1016/J.NEUCOM.2024.128917, https://doi.org/10.1016/j.neucom.2024.128917 34. Zhang, X., Zhao, J., LeCun, Y.: Character-level convolutional networks for text classification. In: NeurIPS (2015), https://arxiv.org/abs/1509.01626 35. Zhu, H., Zhao, Q., Shang, W., Wu, Y., Liu, K.: Limeattack: Local explainable method for textual hard-label adversarial attack. In: Wooldridge, M.J., Dy, J.G., Natarajan, S. (eds.) Thirty-Eighth AAAI Conference on Artificial Intelligence, AAAI 2024, Thirty-Sixth Conference on Innovative Applications of Artificial Intelligence, IAAI 2024, Fourteenth Symposium on Educational Advances in Artificial Intelligence, EAAI 2014, February 20-27, 2024, Vancouver, Canada. pp. 19759–19767. AAAI Press (2024). https://doi.org/10.1609/AAAI.V38I17.29950, https://doi.org/10.1609/aaai.v38i17.29950

Related documents

• OASIS: Optimizing Attacker Sequences for Hard-Label Black-Box Text Attacks#819485
• OASIS: Optimizing Attacker Sequences for Hard-Label Black-Box Text Attacks#809489
• Accelerating Targeted Hard-Label Adversarial Attacks in Low-Query Black-Box Settings#158718
• Discard the Dross and Select the Essential: Pre-query Sample Selection for Black-box Membership Inference Attacks#321749
• Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection#1110332