{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,25]],"date-time":"2026-07-25T15:58:32Z","timestamp":1784995112121,"version":"3.55.0"},"publisher-location":"New York, NY, USA","reference-count":28,"publisher":"ACM","license":[{"start":{"date-parts":[[2022,8,14]],"date-time":"2022-08-14T00:00:00Z","timestamp":1660435200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["1953893, 1951729, 2119331"],"award-info":[{"award-number":["1953893, 1951729, 2119331"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2022,8,14]]},"DOI":"10.1145\/3534678.3539357","type":"proceedings-article","created":{"date-parts":[[2022,8,12]],"date-time":"2022-08-12T19:06:41Z","timestamp":1660331201000},"page":"2307-2315","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":15,"title":["LeapAttack: Hard-Label Adversarial Attack on Text via Gradient-Based Optimization"],"prefix":"10.1145","author":[{"given":"Muchao","family":"Ye","sequence":"first","affiliation":[{"name":"The Pennsylvania State University, University Park, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jinghui","family":"Chen","sequence":"additional","affiliation":[{"name":"The Pennsylvania State University, University Park, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chenglin","family":"Miao","sequence":"additional","affiliation":[{"name":"University of Georgia, Athens, GA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ting","family":"Wang","sequence":"additional","affiliation":[{"name":"The Pennsylvania State University, University Park, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Fenglong","family":"Ma","sequence":"additional","affiliation":[{"name":"The Pennsylvania State University, University Park, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2022,8,14]]},"reference":[{"key":"e_1_3_2_2_1_1","volume-title":"Manning","author":"Bowman Samuel R.","year":"2015","unstructured":"Samuel R. Bowman, Gabor Angeli, Christopher Potts, and Christopher D. Manning. 2015. A large annotated corpus for learning natural language inference. In EMNLP. The Association for Computational Linguistics, 632--642."},{"key":"e_1_3_2_2_2_1","unstructured":"Wieland Brendel Jonas Rauber and Matthias Bethge. 2018. Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models. In ICLR. OpenReview.net."},{"key":"e_1_3_2_2_3_1","volume-title":"Wagner","author":"Carlini Nicholas","year":"2017","unstructured":"Nicholas Carlini and David A. Wagner. 2017. Towards Evaluating the Robustness of Neural Networks. In S&P. IEEE Computer Society, 39--57."},{"key":"e_1_3_2_2_4_1","volume-title":"Noah Constant, Mario Guajardo-C\u00e9spedes, Steve Yuan, Chris Tar, et al.","author":"Cer Daniel","year":"2018","unstructured":"Daniel Cer, Yinfei Yang, Sheng-yi Kong, Nan Hua, Nicole Limtiaco, Rhomni St John, Noah Constant, Mario Guajardo-C\u00e9spedes, Steve Yuan, Chris Tar, et al. 2018. Universal sentence encoder. arXiv preprint arXiv:1803.11175 (2018)."},{"key":"e_1_3_2_2_5_1","volume-title":"Wainwright","author":"Chen Jianbo","year":"2020","unstructured":"Jianbo Chen, Michael I. Jordan, and Martin J. Wainwright. 2020. HopSkipJumpAttack: A Query-Efficient Decision-Based Attack. In S&P. IEEE, 1277--1294."},{"key":"e_1_3_2_2_6_1","unstructured":"Minhao Cheng Thong Le Pin-Yu Chen Huan Zhang Jinfeng Yi and Cho-Jui Hsieh. 2019. Query-Efficient Hard-label Black-box Attack: An Optimization-based Approach. In ICLR. OpenReview.net."},{"key":"e_1_3_2_2_7_1","volume-title":"Sign-OPT: A Query-Efficient Hard-label Adversarial Attack. In International Conference on Learning Representations.","author":"Cheng Minhao","year":"2020","unstructured":"Minhao Cheng, Simranjit Singh, Patrick H. Chen, Pin-Yu Chen, Sijia Liu, and Cho-Jui Hsieh. 2020. Sign-OPT: A Query-Efficient Hard-label Adversarial Attack. In International Conference on Learning Representations."},{"key":"e_1_3_2_2_8_1","volume-title":"BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding","author":"Devlin Jacob","year":"2019","unstructured":"Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. In NAACL-HLT. Association for Computational Linguistics, 4171--4186."},{"key":"e_1_3_2_2_9_1","volume-title":"HotFlip: White- Box Adversarial Examples for Text Classification","author":"Ebrahimi Javid","unstructured":"Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018. HotFlip: White- Box Adversarial Examples for Text Classification. In ACL. Association for Computational Linguistics, 31--36."},{"key":"e_1_3_2_2_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00016"},{"key":"e_1_3_2_2_11_1","unstructured":"Ian J. Goodfellow Jonathon Shlens and Christian Szegedy. 2015. Explaining and Harnessing Adversarial Examples. In ICLR."},{"key":"e_1_3_2_2_12_1","doi-asserted-by":"publisher","DOI":"10.1162\/neco.1997.9.8.1735"},{"key":"e_1_3_2_2_13_1","volume-title":"Joey Tianyi Zhou, and Peter Szolovits","author":"Jin Di","year":"2020","unstructured":"Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2020. Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailment. In AAAI. AAAI Press, 8018--8025."},{"key":"e_1_3_2_2_14_1","doi-asserted-by":"crossref","unstructured":"Yoon Kim. 2014. Convolutional Neural Networks for Sentence Classification. In EMNLP. ACL 1746--1751.","DOI":"10.3115\/v1\/D14-1181"},{"key":"e_1_3_2_2_15_1","doi-asserted-by":"crossref","unstructured":"Alexey Kurakin Ian J. Goodfellow and Samy Bengio. 2017. Adversarial examples in the physical world. In ICLR. OpenReview.net.","DOI":"10.1201\/9781351251389-8"},{"key":"e_1_3_2_2_16_1","unstructured":"Jinfeng Li Shouling Ji Tianyu Du Bo Li and Ting Wang. 2019. TextBugger: Generating Adversarial Text Against Real-world Applications. In NDSS."},{"key":"e_1_3_2_2_17_1","volume-title":"Learning Word Vectors for Sentiment Analysis","author":"Maas Andrew L.","unstructured":"Andrew L. Maas, Raymond E. Daly, Peter T. Pham, Dan Huang, Andrew Y. Ng, and Christopher Potts. 2011. Learning Word Vectors for Sentiment Analysis. In ACL. The Association for Computer Linguistics, 142--150."},{"key":"e_1_3_2_2_18_1","doi-asserted-by":"crossref","unstructured":"Rishabh Maheshwary Saket Maheshwary and Vikram Pudi. 2021. Generating Natural Language Attacks in a Hard Label Black Box Setting. In AAAI.","DOI":"10.1609\/aaai.v35i15.17595"},{"key":"e_1_3_2_2_19_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/N19-1314"},{"key":"e_1_3_2_2_20_1","first-page":"1","article-title":"Monte Carlo Gradient Estimation in Machine Learning","volume":"21","author":"Mohamed Shakir","year":"2020","unstructured":"Shakir Mohamed, Mihaela Rosca, Michael Figurnov, and Andriy Mnih. 2020. Monte Carlo Gradient Estimation in Machine Learning. J. Mach. Learn. Res. 21, 132 (2020), 1--62.","journal-title":"J. Mach. Learn. Res."},{"key":"e_1_3_2_2_21_1","volume-title":"Pei-Hao Su, David Vandyke, Tsung-Hsien Wen, and Steve J. Young.","author":"Mrksic Nikola","year":"2016","unstructured":"Nikola Mrksic, Diarmuid \u00d3 S\u00e9aghdha, Blaise Thomson, Milica Gasic, Lina Maria Rojas-Barahona, Pei-Hao Su, David Vandyke, Tsung-Hsien Wen, and Steve J. Young. 2016. Counter-fitting Word Vectors to Linguistic Constraints. In NAACL HLT 2016. The Association for Computational Linguistics, 142--148."},{"key":"e_1_3_2_2_22_1","volume-title":"Seeing Stars: Exploiting Class Relationships for Sentiment Categorization with Respect to Rating Scales","author":"Pang Bo","year":"2005","unstructured":"Bo Pang and Lillian Lee. 2005. Seeing Stars: Exploiting Class Relationships for Sentiment Categorization with Respect to Rating Scales. In ACL. The Association for Computer Linguistics, 115--124."},{"key":"e_1_3_2_2_23_1","volume-title":"Generating Natural Language Adversarial Examples through Probability Weighted Word Saliency","author":"Ren Shuhuai","unstructured":"Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. 2019. Generating Natural Language Adversarial Examples through Probability Weighted Word Saliency. In ACL. Association for Computational Linguistics, 1085--1097."},{"key":"e_1_3_2_2_24_1","volume-title":"Bowman","author":"Williams Adina","year":"2018","unstructured":"Adina Williams, Nikita Nangia, and Samuel R. Bowman. 2018. A Broad-Coverage Challenge Corpus for Sentence Understanding through Inference. In NAACL-HLT. Association for Computational Linguistics, 1112--1122."},{"key":"e_1_3_2_2_25_1","volume-title":"TextHoaxer: Budgeted Hard-Label Adversarial Attacks on Text. AAAI","author":"Ye Muchao","year":"2022","unstructured":"Muchao Ye, Chenglin Miao, Ting Wang, and Fenglong Ma. 2022. TextHoaxer: Budgeted Hard-Label Adversarial Attacks on Text. AAAI (2022)."},{"key":"e_1_3_2_2_26_1","volume-title":"Junbo Jake Zhao, and Yann LeCun","author":"Zhang Xiang","year":"2015","unstructured":"Xiang Zhang, Junbo Jake Zhao, and Yann LeCun. 2015. Character-level Convolutional Networks for Text Classification. In NeurIPS. 649--657."},{"key":"e_1_3_2_2_27_1","volume-title":"Adversarial Robustness through Bias Variance Decomposition: A New Perspective for Federated Learning. arXiv preprint arXiv:2009.09026","author":"Zhou Yao","year":"2020","unstructured":"Yao Zhou, Jun Wu, Haixun Wang, and Jingrui He. 2020. Adversarial Robustness through Bias Variance Decomposition: A New Perspective for Federated Learning. arXiv preprint arXiv:2009.09026 (2020)."},{"key":"e_1_3_2_2_28_1","doi-asserted-by":"crossref","unstructured":"Yi Zhou Xiaoqing Zheng Cho-Jui Hsieh Kai-Wei Chang and Xuanjing Huang. 2021. Defense against Synonym Substitution-based Adversarial Attacks via Dirichlet Neighborhood Ensemble. In ACL. Online.","DOI":"10.18653\/v1\/2021.acl-long.426"}],"event":{"name":"KDD '22: The 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining","location":"Washington DC USA","acronym":"KDD '22","sponsor":["SIGMOD ACM Special Interest Group on Management of Data","SIGKDD ACM Special Interest Group on Knowledge Discovery in Data"]},"container-title":["Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3534678.3539357","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3534678.3539357","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3534678.3539357","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T19:02:47Z","timestamp":1750186967000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3534678.3539357"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,8,14]]},"references-count":28,"alternative-id":["10.1145\/3534678.3539357","10.1145\/3534678"],"URL":"https:\/\/doi.org\/10.1145\/3534678.3539357","relation":{},"subject":[],"published":{"date-parts":[[2022,8,14]]},"assertion":[{"value":"2022-08-14","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}