TextAttack: A Framework for Adversarial Attacks, Data Augmentation, and Adversarial Training in NLP

By John X. Morris, Eli Lifland, Jin Yong Yoo, J. Grigsby, Di Jin, Yanjun Qi. 2020

949 citations recorded by the source corpus.

While there has been substantial research using adversarial attacks to analyze NLP models, each attack is implemented in its own code repository. It remains challenging to develop NLP attacks and utilize them to improve model performance. This paper introduces TextAttack, a Python framework for adversarial attacks, data augmentation, and adversarial training in NLP. TextAttack builds attacks from four components: a goal function, a set of constraints, a transformation, and a search method. TextAttack’s modular design enables researchers to easily construct attacks from combinations of novel and existing components. TextAttack provides implementations of 16 adversarial attacks from the literature and supports a variety of models and datasets, including BERT and other transformers, and all GLUE tasks. TextAttack also includes data augmentation and adversarial training modules for using components of adversarial attacks to improve model accuracy and robustness.TextAttack is democratizing NLP: anyone can try data augmentation and adversarial training on any model or dataset, with just a few lines of code. Code and tutorials are available at https://github.com/QData/TextAttack.

Subfields: Natural Language Processing, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Natural Language Processing

In Safety, Robustness & Interpretability

Citations in the corpus

Polyjuice: Generating Counterfactuals for Explaining, Evaluating, and Improving Models (2021, methodology): “The generated x̂ should also be (2) fluent, i.e., grammatically correct (Morris et al., 2020) and semantically meaningful (e.g.,“Colorless green ideas sleep furiously” is not meaningful (Chomsky, 2002)).”
RoMe: A Robust Metric for Evaluating Natural Language Generation (2022, methodology): “We randomly choose 2500 sentence pairs342 from the KELM dataset and generate 2500 more343 negative samples by randomly augmenting the sen-344 tences using TextAttack (Morris et al., 2020) and345 TextFooler (Jin et al., 2020).”
Mix and Match: Learning-free Controllable Text Generationusing Energy Language Models (2022, methodology): “To have a fair comparison, we report accuracy us-ing external classiﬁers from Huggingface ( textattack/bert-base-uncased-yelp-polarity (Morris et al., 2020) for sentiment and cointegrated/roberta-base-formality for formality).”
PromptRobust: Towards Evaluating the Robustness of Large Language Models on Adversarial Prompts (2023, positive): “The majority of our prompt attacks have been developed by adapting and revising strategies from TextAttack 4 (Morris et al., 2020).”
The rise and potential of large language model based agents: a survey (2025, positive): “To address these issues, researchers can employ traditional techniques such as adversarial training [500, 508], adversarial data augmentation [529,530], and adversarial sample detection [531,532] to enhance the robustness of LLM-based agents.”
Data Augmentation Approaches in Natural Language Processing: A Survey (2021, methodology): “Moreover, the generative model of GANS is applied as a DA method in some scenes like [61, 118, 94, 67, 108, 115], and have demonstrated to be eﬀective for data augmentation purposes.”
BAE: BERT-based Adversarial Examples for Text Classification (2020, methodology): “BAE is implemented1 in TextAttack (Morris et al., 2020), a popular suite of NLP adversarial attacks.”
NL-Augmenter: A Framework for Task-Sensitive Natural Language Augmentation (2021, background): “For example, the augmentation library nlpaug (Ma, 2019) and the adversarial attack library TextAttack (Morris et al., 2020) include contextual perturbation methods.”
Do Language Models Plagiarize? (2022, methodology): “Specifically, a RoBERTa-based paraphrase identification model (Morris et al., 2020) and NER4 are applied to potentially paraphrased segments identified by the open source.”
Ignore Previous Prompt: Attack Techniques For Language Models (2022, neutral): “…to refer to either the user or the model itself [17, 24], and even the injection of a smaller secret sub-prompt which contains information sensitive to the prompt – such as special instructions to the model, verboten subjects and/or themes, or contextual enhancers – referred to as a private value .”
AugLy: Data Augmentations for Robustness (2022, methodology): “Most augmentations in nlpaug and TextAttack are semantic (e.g. words being swapped for synonyms or antonyms), or a few simple syntactic ones (e.g. deleting/adding characters, replacing characters with nearby ones on the keyboard).”
Contextualized Perturbation for Textual Adversarial Attack (2020, methodology): “Despite some empirical success, rule-based methods are agnostic to context, limiting their ability to produce natural, fluent, and grammatical outputs (Wang et al., 2019c; Morris et al., 2020; Kurita et al., 2020, inter alia).”
Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Models (2021, methodology): “( i ) Evaluation toolkits, including OpenAttack [58], TextAttack [35], TextFlint [17] and Robustness Gym [15], integrate various ad hoc input transformations for different tasks and provide programmable APIs to dynamically test model performance.”
An Empirical Survey of Data Augmentation for Limited Data Learning in NLP (2021, background): “These generated adversarial examples (Morris et al., 2020; Zeng et al., 2020) could be leveraged in adversarial training (Goodfellow et al.”
Baseline Defenses for Adversarial Attacks Against Aligned Language Models (2023, background): “Finally, note that attacks on (non-generative) text classifiers have existed for some time (Gao et al., 2018; Li et al., 2018; Ebrahimi et al., 2018; Li et al., 2020; Morris et al., 2020; Guo et al., 2021), and were developed in parallel to attacks on image classifiers.”
Perturbation Augmentation for Fairer NLP (2022, background): “Counterfactual data augmentation approaches are heavily inspired by recent work in the domain of robustness (Ribeiro et al., 2019; Morris et al., 2020; Khashabi et al., 2020; Balashankar et al., 2021; Liu et al., 2021; Zhang et al., 2021; Sen et al., 2021; Papakipos and Bitton, 2022).”
Large Language Models Can Be Easily Distracted by Irrelevant Context (2023, methodology): “…input perturbations for natural language tasks, including model-agnostic input transformations (Liang et al., 2022; Ravichan-der et al., 2022, inter alia ) and adversarial example generation against individual models (Jia & Liang, 2017; Shi et al., 2018; Morris et al., 2020; Wang et al., 2021).”