{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,2]],"date-time":"2026-06-02T12:00:29Z","timestamp":1780401629117,"version":"3.54.1"},"reference-count":76,"publisher":"Association for Computing Machinery (ACM)","issue":"4","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Intell. Syst. Technol."],"published-print":{"date-parts":[[2025,8,31]]},"abstract":"<jats:p>Deep Neural Networks (DNNs) are widely used in Natural Language Processing (NLP). However, adversarial samples attack benign inputs to readily fool the DNN models. The detection of these samples is a significant challenge that has received little attention in textual domains. Existing defense strategies either assume prior knowledge of specific threats or do not perform well on complex models. In this article, we provide a new framework, namely TADD for detecting textual adversarial samples by leveraging the interpretability of DNNs. In particular, we distinguish between the adversarial distribution and the benign distribution for the decision boundary of the victim models. Our method applies to NLP tasks and does not require re-training victim models and prior knowledge of adversarial attack methods. We evaluate our detector against the state-of-the-art attack methods on various real-world datasets. As demonstrated in the extensive experiments, our approach effectively discriminates between adversarial and benign samples. Additionally, our method is competitive against unseen attacks, reflecting its ability to discover new adversarial samples generated by future attack methods.<\/jats:p>","DOI":"10.1145\/3729235","type":"journal-article","created":{"date-parts":[[2025,4,15]],"date-time":"2025-04-15T13:18:26Z","timestamp":1744723106000},"page":"1-24","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":3,"title":["Can Interpretability of Deep Learning Models Detect Textual Adversarial Distribution?"],"prefix":"10.1145","volume":"16","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3471-8753","authenticated-orcid":false,"given":"Ahoud","family":"Alhazmi","sequence":"first","affiliation":[{"name":"Umm Al-Qura University, Makkah, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8704-3625","authenticated-orcid":false,"given":"Abdulwahab","family":"Aljubairy","sequence":"additional","affiliation":[{"name":"Umm Al-Qura University, Makkah, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0406-5974","authenticated-orcid":false,"given":"Wei Emma","family":"Zhang","sequence":"additional","affiliation":[{"name":"The University of Adelaide, Adelaide, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3326-4147","authenticated-orcid":false,"given":"Quan Z.","family":"Sheng","sequence":"additional","affiliation":[{"name":"Macquarie University, Sydney, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-3550-3898","authenticated-orcid":false,"given":"Elaf","family":"Alhazmi","sequence":"additional","affiliation":[{"name":"Umm Al-Qura University, Makkah, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2025,7,22]]},"reference":[{"key":"e_1_3_2_2_2","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN48605.2020.9207000"},{"key":"e_1_3_2_3_2","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN48605.2020.9207665"},{"key":"e_1_3_2_4_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D18-1307"},{"key":"e_1_3_2_5_2","first-page":"1","volume-title":"Proceedings of the 6th International Conference on Learning Representations (ICLR)","author":"Belinkov Yonatan","year":"2018","unstructured":"Yonatan Belinkov and Yonatan Bisk. 2018. Synthetic and natural noise both break neural machine translation. In Proceedings of the 6th International Conference on Learning Representations (ICLR), 1\u201313."},{"key":"e_1_3_2_6_2","unstructured":"Arjun Nitin Bhagoji Daniel Cullina and Prateek Mittal. 2017. Dimensionality Reduction as a defense against evasion attacks on machine learning classifiers. arXiv:1704.02654. Retrieved from https:\/\/arxiv.org\/abs\/1704.02654"},{"key":"e_1_3_2_7_2","first-page":"882","article-title":"Learning to explain: An information-theoretic perspective on model interpretation","volume":"80","author":"Chen Jianbo","year":"2018","unstructured":"Jianbo Chen, Le Song, Martin J. Wainwright, and Michael I. Jordan. 2018. Learning to explain: An information-theoretic perspective on model interpretation. In Proceedings of the 35th International Conference on Machine Learning (ICML), Proceedings of Machine Learning Research, Vol. 80, 882\u2013891.","journal-title":"Proceedings of the 35th International Conference on Machine Learning (ICML)"},{"key":"e_1_3_2_8_2","first-page":"177","volume-title":"Machine Learning Challenges Workshop","author":"Dagan Ido","year":"2005","unstructured":"Ido Dagan, Oren Glickman, and Bernardo Magnini. 2005. The PASCAL recognising textual entailment challenge. In Machine Learning Challenges Workshop, 177\u2013190."},{"key":"e_1_3_2_9_2","first-page":"4171","volume-title":"Proceedings of the Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL-HLT)","author":"Devlin Jacob","year":"2019","unstructured":"Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL-HLT), 4171\u20134186."},{"key":"e_1_3_2_10_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P17-1106"},{"key":"e_1_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P18-2006"},{"key":"e_1_3_2_12_2","first-page":"1186","volume-title":"Proceedings of the Advances in Neural Information Processing Systems 31 (NeurIPS)","author":"Fawzi Alhussein","year":"2018","unstructured":"Alhussein Fawzi, Hamza Fawzi, and Omar Fawzi. 2018. Adversarial vulnerability for any classifier. In Proceedings of the Advances in Neural Information Processing Systems 31 (NeurIPS), 1186\u20131195."},{"key":"e_1_3_2_13_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-017-5663-3"},{"key":"e_1_3_2_14_2","first-page":"1624","volume-title":"Proceedings of the Advances in Neural Information Processing Systems 29 (NeurIPS)","author":"Fawzi Alhussein","year":"2016","unstructured":"Alhussein Fawzi, Seyed-Mohsen Moosavi-Dezfooli, and Pascal Frossard. 2016. Robustness of classifiers: From adversarial to random noise. In Proceedings of the Advances in Neural Information Processing Systems 29 (NeurIPS), 1624\u20131632."},{"key":"e_1_3_2_15_2","unstructured":"Reuben Feinman Ryan R. Curtin Saurabh Shintre and Andrew B. Gardner. 2017. Detecting adversarial samples from artifacts. arXiv:1703.00410. Retrieved from https:\/\/arxiv.org\/abs\/1703.00410"},{"key":"e_1_3_2_16_2","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00016"},{"key":"e_1_3_2_17_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.emnlp-main.498"},{"key":"e_1_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.5555\/1654536.1654538"},{"key":"e_1_3_2_19_2","unstructured":"Zhitao Gong Wenlu Wang and Wei-Shinn Ku. 2017. Adversarial and clean data are not twins. arXiv:1704.04960. Retrieved from https:\/\/arxiv.org\/abs\/1704.04960"},{"key":"e_1_3_2_20_2","first-page":"1","volume-title":"Proceedings of the 3rd International Conference on Learning Representations (ICLR)","author":"Goodfellow Ian J.","year":"2015","unstructured":"Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and harnessing adversarial examples. In Proceedings of the 3rd International Conference on Learning Representations (ICLR), 1\u201311."},{"key":"e_1_3_2_21_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-66399-9_4"},{"key":"e_1_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.1145\/3236009"},{"key":"e_1_3_2_23_2","volume-title":"Proceedings of the 5th International Conference on Learning Representations (ICLR)","author":"Hendrycks Dan","year":"2017","unstructured":"Dan Hendrycks and Kevin Gimpel. 2017. Early methods for detecting adversarial images. In Proceedings of the 5th International Conference on Learning Representations (ICLR)."},{"key":"e_1_3_2_24_2","doi-asserted-by":"publisher","DOI":"10.1162\/neco.1997.9.8.1735"},{"key":"e_1_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.279"},{"key":"e_1_3_2_26_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1419"},{"key":"e_1_3_2_27_2","first-page":"125","volume-title":"Proceedings of the Advances in Neural Information Processing Systems (NeurIPS)","volume":"32","author":"Ilyas Andrew","year":"2019","unstructured":"Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. 2019. Adversarial examples are not bugs, they are features. In Proceedings of the Advances in Neural Information Processing Systems (NeurIPS), Vol. 32, 125\u2013136."},{"key":"e_1_3_2_28_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.5845"},{"key":"e_1_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D17-1215"},{"key":"e_1_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1423"},{"key":"e_1_3_2_31_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i05.6311"},{"key":"e_1_3_2_32_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.245"},{"key":"e_1_3_2_33_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P18-1225"},{"key":"e_1_3_2_34_2","doi-asserted-by":"publisher","DOI":"10.3115\/v1\/D14-1181"},{"key":"e_1_3_2_35_2","volume-title":"Proceedings of the 5th International Conference on Learning Representations (ICLR)","author":"Kurakin Alexey","year":"2017","unstructured":"Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. 2017. Adversarial examples in the physical world. In Proceedings of the 5th International Conference on Learning Representations (ICLR)."},{"key":"e_1_3_2_36_2","first-page":"7167","volume-title":"Proceedings of the Advances in Neural Information Processing Systems (NeurIPS)","volume":"31","author":"Lee Kimin","year":"2018","unstructured":"Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. 2018. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. In Proceedings of the Advances in Neural Information Processing Systems (NeurIPS), Vol. 31, 7167\u20137177."},{"key":"e_1_3_2_37_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23138"},{"key":"e_1_3_2_38_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.615"},{"key":"e_1_3_2_39_2","first-page":"4765","volume-title":"Proceedings of the Advances in Neural Information Processing Systems 30 (NeurIPS)","author":"Lundberg Scott M.","year":"2017","unstructured":"Scott M. Lundberg and Su-In Lee. 2017. A unified approach to interpreting model predictions. In Proceedings of the Advances in Neural Information Processing Systems 30 (NeurIPS), 4765\u20134774."},{"key":"e_1_3_2_40_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations (ICLR)","author":"Ma Xingjun","year":"2018","unstructured":"Xingjun Ma, Bo Li, Yisen Wang, Sarah M. Erfani, Sudanthi N. R. Wijewickrema, Grant Schoenebeck, Dawn Song, Michael E. Houle, and James Bailey. 2018. Characterizing adversarial subspaces using local intrinsic dimensionality. In Proceedings of the 6th International Conference on Learning Representations (ICLR)."},{"key":"e_1_3_2_41_2","volume-title":"Proceedings of the 5th International Conference on Learning Representations (ICLR)","author":"Hendrik Metzen Jan","year":"2017","unstructured":"Jan Hendrik Metzen, Tim Genewein, Volker Fischer, and Bastian Bischoff. 2017. On detecting adversarial perturbations. In Proceedings of the 5th International Conference on Learning Representations (ICLR)."},{"key":"e_1_3_2_42_2","volume-title":"Proceedings of the 5th International Conference on Learning Representations (ICLR)","author":"Miyato Takeru","year":"2017","unstructured":"Takeru Miyato, Andrew M. Dai, and Ian J. Goodfellow. 2017. Adversarial training methods for semi-supervised text classification. In Proceedings of the 5th International Conference on Learning Representations (ICLR)."},{"key":"e_1_3_2_43_2","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2018.2858821"},{"key":"e_1_3_2_44_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"e_1_3_2_45_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.emnlp-demos.16"},{"key":"e_1_3_2_46_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.eacl-main.13"},{"key":"e_1_3_2_47_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P18-1176"},{"key":"e_1_3_2_48_2","doi-asserted-by":"publisher","DOI":"10.3115\/1219840.1219855"},{"key":"e_1_3_2_49_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"e_1_3_2_50_2","doi-asserted-by":"publisher","DOI":"10.3115\/v1\/D14-1162"},{"key":"e_1_3_2_51_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P19-1561"},{"key":"e_1_3_2_52_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P19-1103"},{"key":"e_1_3_2_53_2","first-page":"1135","volume-title":"Proceedings of the 22nd International Conference on Knowledge Discovery and Data Mining (SIGKDD)","author":"Ribeiro Marco T\u00falio","year":"2016","unstructured":"Marco T\u00falio Ribeiro, Sameer Singh, and Carlos Guestrin. 2016. \u201cWhy Should I Trust You?\u201d: Explaining the predictions of any classifier. In Proceedings of the 22nd International Conference on Knowledge Discovery and Data Mining (SIGKDD), 1135\u20131144."},{"key":"e_1_3_2_54_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v32i1.11491"},{"key":"e_1_3_2_55_2","doi-asserted-by":"publisher","DOI":"10.3758\/PBR.16.2.225"},{"key":"e_1_3_2_56_2","first-page":"4323","volume-title":"Proceedings of the 27th International Joint Conference on Artificial Intelligence (IJCAI)","volume":"31","author":"Sato Motoki","year":"2018","unstructured":"Motoki Sato, Jun Suzuki, Hiroyuki Shindo, and Yuji Matsumoto. 2018. Interpretable adversarial perturbation in input embedding space for text. In Proceedings of the 27th International Joint Conference on Artificial Intelligence (IJCAI), Vol. 31, 4323\u20134330."},{"key":"e_1_3_2_57_2","first-page":"5019","volume-title":"Proceedings of the Advances in Neural Information Processing Systems (NeurIPS)","author":"Schmidt Ludwig","year":"2018","unstructured":"Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. 2018. Adversarially robust generalization requires more data. In Proceedings of the Advances in Neural Information Processing Systems (NeurIPS), 5019\u20135031."},{"key":"e_1_3_2_58_2","unstructured":"Avanti Shrikumar Peyton Greenside and Anshul Kundaje. 2017. Learning important features through propagating activation differences. In Proceedings of the 34th International Conference on Machine Learning (ICML) Vol. 70 3145\u20133153."},{"key":"e_1_3_2_59_2","unstructured":"Mukund Sundararajan Ankur Taly and Qiqi Yan. 2017. Axiomatic attribution for deep networks. In Proceedings of the 34th International Conference on Machine Learning (ICML) Vol. 70 3319\u20133328."},{"key":"e_1_3_2_60_2","volume-title":"Proceedings of the 2nd International Conference on Learning Representations (ICLR)","author":"Szegedy Christian","year":"2014","unstructured":"Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2014. Intriguing properties of neural networks. In Proceedings of the 2nd International Conference on Learning Representations (ICLR)."},{"key":"e_1_3_2_61_2","unstructured":"Thomas Tanay and Lewis D. Griffin. 2016. A boundary tilting persepective on the phenomenon of adversarial examples. arXiv:1608.07690. Retrieved from https:\/\/arxiv.org\/abs\/1608.07690"},{"key":"e_1_3_2_62_2","first-page":"7728","volume-title":"Proceedings of the Advances in Neural Information Processing Systems (NeurIPS)","volume":"31","author":"Tao Guanhong","year":"2018","unstructured":"Guanhong Tao, Shiqing Ma, Yingqi Liu, and Xiangyu Zhang. 2018. Attacks meet interpretability: Attribute-steered detection of adversarial samples. In Proceedings of the Advances in Neural Information Processing Systems (NeurIPS), Vol. 31, 7728\u20137739."},{"key":"e_1_3_2_63_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i11.17187"},{"key":"e_1_3_2_64_2","unstructured":"Dimitris Tsipras Shibani Santurkar Logan Engstrom Alexander Turner and Aleksander Madry. 2018. There is no free lunch in adversarial robustness (but there are unexpected benefits). arXiv:1805.12152. Retrieved from https:\/\/arxiv.org\/abs\/1805.12152"},{"key":"e_1_3_2_65_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/N18-2091"},{"key":"e_1_3_2_66_2","first-page":"823","volume-title":"Proceedings of the 37th Conference on Uncertainty in Artificial Intelligence (UAI), Virtual Event","author":"Wang Xiaosen","year":"2021","unstructured":"Xiaosen Wang, Jin Hao, Yichen Yang, and Kun He. 2021. Natural language adversarial defense through synonym encoding. In Proceedings of the 37th Conference on Uncertainty in Artificial Intelligence (UAI), Virtual Event, July 27-30. 823\u2013833."},{"key":"e_1_3_2_67_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D17-1187"},{"key":"e_1_3_2_68_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.blackboxnlp-1.6"},{"key":"e_1_3_2_69_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23198"},{"key":"e_1_3_2_70_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.37"},{"key":"e_1_3_2_71_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.6140"},{"key":"e_1_3_2_72_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/N18-1089"},{"key":"e_1_3_2_73_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.540"},{"issue":"3","key":"e_1_3_2_74_2","first-page":"24:1","article-title":"Adversarial attacks on deep-learning models in natural language processing: A survey","volume":"11","author":"Zhang Wei Emma","year":"2020","unstructured":"Wei Emma Zhang, Quan Z. Sheng, Ahoud Abdulrahmn F. Alhazmi, and Chenliang Li. 2020. Adversarial attacks on deep-learning models in natural language processing: A survey. ACM Transaction on Intelligent Systems and Technology 11, 3 (2020), 24:1\u201324:41.","journal-title":"ACM Transaction on Intelligent Systems and Technology"},{"key":"e_1_3_2_75_2","first-page":"649","volume-title":"Proceedings of the Advances in Neural Information Processing Systems (NeurIPS)","volume":"28","author":"Zhang Xiang","year":"2015","unstructured":"Xiang Zhang, Junbo Jake Zhao, and Yann LeCun. 2015. Character-level convolutional networks for text classification. In Proceedings of the Advances in Neural Information Processing Systems (NeurIPS), Vol. 28, 649\u2013657."},{"key":"e_1_3_2_76_2","first-page":"1","volume-title":"Proceedings of the 6th International Conference on Learning Representations (ICLR)","author":"Zhao Zhengli","year":"2018","unstructured":"Zhengli Zhao, Dheeru Dua, and Sameer Singh. 2018. Generating natural adversarial examples. In Proceedings of the 6th International Conference on Learning Representations (ICLR), 1\u201311."},{"key":"e_1_3_2_77_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1496"}],"container-title":["ACM Transactions on Intelligent Systems and Technology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3729235","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,7,22]],"date-time":"2025-07-22T23:24:12Z","timestamp":1753226652000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3729235"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,7,22]]},"references-count":76,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2025,8,31]]}},"alternative-id":["10.1145\/3729235"],"URL":"https:\/\/doi.org\/10.1145\/3729235","relation":{},"ISSN":["2157-6904","2157-6912"],"issn-type":[{"value":"2157-6904","type":"print"},{"value":"2157-6912","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,7,22]]},"assertion":[{"value":"2022-06-05","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-03-21","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-07-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}