BERTAttack: Contextual Adversarial Attack

• BERTAttack is a word-substitution adversarial text attack that uses BERT’s bidirectional masked-token predictions to generate context-aware replacements.
• It employs top-k candidate selection, semantic similarity filtering, and greedy replacement to perturb inputs until model predictions shift.
• Empirical evaluations show varied success rates across models and tasks, sparking debates on its ability to preserve original semantics.

Searching arXiv for papers on BERTAttack and related robustness evaluations. arXiv search query: BERTAttack adversarial text attack sentence embeddings robustness BERTAttack is a word-substitution adversarial text attack that uses BERT’s bidirectional masked-token predictions to generate context-aware replacement candidates, filters those candidates for semantic similarity, and then greedily substitutes important tokens until the model prediction changes or a replacement budget is exhausted (Gidatkar et al., 5 Sep 2025). In subsequent robustness literature, it is treated as a particularly strong adversary because its substitutions are fluent and context-sensitive, especially in comparison with methods based primarily on embedding-neighbor lookup or lexical resources (Asl et al., 2024). At the same time, its status as a genuinely semantic-preserving attack is contested: one line of work treats it as a realistic stress test, whereas another argues that many of its successful perturbations alter meaning and therefore overstate model brittleness (Hauser et al., 2021).

1. Attack formulation and operating procedure

A later technical characterization describes BERTAttack as a word-substitution adversarial attack that “leverages the bidirectional context from BERT to generate substitution candidates” (Gidatkar et al., 5 Sep 2025). Its core masked-token proposal step is written as

$$P(w' \mid w_1, \ldots, w_{i-1}, [MASK], w_{i+1}, \ldots, w_n).$$

The attack pipeline is reported as follows. For each token position $i$, the token $w_i$ is masked; BERT predicts replacement candidates from context; the attack retains the top-k candidates with highest probability; those candidates are filtered for semantic similarity; and tokens are then greedily replaced in order of importance until either the prediction changes or a maximum number of replacements is reached (Gidatkar et al., 5 Sep 2025). In another description, BERTAttack is presented as a two-stage attack that first identifies vulnerable words or sub-words and then uses a BERT masked LLM to propose semantic-preserving substitutes for those vulnerable tokens (Asl et al., 2024).

This combination of masked-token generation and greedy replacement distinguishes BERTAttack from attacks whose candidate generation relies on static embedding proximity or WordNet-style synonym lookup. The literature summarized here repeatedly emphasizes that BERTAttack’s substitutes are intended to be contextually plausible rather than merely lexically related.

2. Constraints, candidate spaces, and replacement budgets

The precise constraints attached to BERTAttack depend on the evaluation setup. In one detailed analysis of synonym- and MLM-based attacks on fine-tuned BERT, the BERT-Attack candidate set is defined as the top 48 predictions from a BERT masked LLM, with the sentence-level constraint

$cos_{use}(s, s_{pert}) \ge 0.2$

and the additional restriction that at most 40\% of words may be replaced (Hauser et al., 2021). In a separate robustness study, the same attack is summarized more generally as using top-k candidate selection, semantic similarity filtering, and greedy token replacement, but without reporting the exact value of $k$, the similarity threshold, the replacement budget, or the exact token-ranking heuristic beyond the statement that replacements are made “in order of importance” (Gidatkar et al., 5 Sep 2025).

These reported constraints matter because BERTAttack is often discussed as a semantic-preserving attack. The later critical literature argues that contextual fit alone is insufficient: a word may fit the surrounding syntax or topic while still changing the proposition expressed by the sentence (Hauser et al., 2021). That critique is sharpened by the observation that sentence-level similarity checks can be permissive, and that in the original BERT-Attack implementation analyzed there, similarity is checked between the current perturbed sentence and the previous perturbed sentence rather than always against the original sentence (Hauser et al., 2021).

3. Function as an evaluation attack in robustness research

In sentence-embedding research, BERTAttack is explicitly positioned as an evaluation attack rather than part of the training method itself. The RobustSentEmbed study describes it as one of the main black-box word-substitution attacks used to test whether a sentence embedding model is truly robust, alongside other TextAttack-style perturbation methods (Asl et al., 2024). In that framing, BERTAttack is valuable precisely because its substitutions are fluent and context-aware, making it a stringent probe of whether an encoder preserves semantic structure under adversarial edits.

RobustSentEmbed addresses this evaluation setting by training sentence encoders with adversarial perturbations at both the token level and the sentence level, together with a robust contrastive objective and an adversarial replaced token detection objective (Asl et al., 2024). The encoder $f_\theta(\cdot)$ is initialized from a PLM checkpoint, and the $[CLS]$ representation is used as the sentence embedding. The paper’s central claim is that standard sentence embeddings, including contrastive baselines such as SimCSE and USCAL, remain vulnerable to attacks such as BERTAttack, whereas adversarial self-supervised training materially reduces that vulnerability (Asl et al., 2024).

This use of BERTAttack is methodologically important. Rather than treating transfer accuracy or semantic textual similarity alone as sufficient, the study uses BERTAttack to expose a concrete failure mode: semantically useful embeddings may still be unstable under meaning-preserving-looking substitutions.

4. Reported empirical behavior across model families and tasks

The published results summarized here show that BERTAttack’s effectiveness varies sharply across architectures, tasks, and evaluation protocols. In the RobustSentEmbed benchmark on seven downstream classification and NLI tasks, the average BERTAttack success rates are reported as 75.51\% for SimCSE-BERT$_{base}$, 58.62\% for USCAL-BERT$_{base}$, and 38.81\% for RobustSentEmbed-BERT$_{base}$ (Asl et al., 2024). In adversarial STS evaluation, the corresponding BERTAttack averages are 32.23\%, 27.26\%, and 12.80\% (Asl et al., 2024). The same paper reports that BERTAttack is one of the strongest attacks in its benchmark, yet RobustSentEmbed still reduces its success substantially and also reports gains of 1.59\% on STS and 0.23\% on transfer tasks (Asl et al., 2024).

A different study evaluates BERT-base, RoBERTa-base, and Flan-T5 with PromptBench on SST-2 and SQuAD v2, using metrics including Original Accuracy, Accuracy Under Attack, Attack Success Rate, Average Perturbed Word Percentage, Average Queries, and a derived robustness score (Gidatkar et al., 5 Sep 2025). There, the most detailed BERTAttack table is for RoBERTa-Base, which is reported to maintain 35.00\% accuracy under attack with 0.00\% attack success rate and 239.71 average queries. The summary table in the same paper reports BERTAttack on BERT with Original Accuracy 35.00\%, Accuracy Under Attack 0.00\%, Attack Success Rate 100.00\%, Average Perturbed Word Percentage 27.56\%, Average Words per Input 8.7, and Average Queries 59.57 (Gidatkar et al., 5 Sep 2025). The same summary states that Flan-T5 also has 0\% attack success rate overall, although the excerpted material does not provide a standalone BERTAttack-specific numeric breakdown for Flan-T5 (Gidatkar et al., 5 Sep 2025).

Study/setup	System	Reported BERTAttack outcome
RobustSentEmbed, downstream classification/NLI	SimCSE-BERT$i$0, USCAL-BERT$i$1, RobustSentEmbed-BERT$i$2	ASR: 75.51%, 58.62%, 38.81%
RobustSentEmbed, adversarial STS	SimCSE-BERT$i$3, USCAL-BERT$i$4, RobustSentEmbed-BERT$i$5	ASR: 32.23%, 27.26%, 12.80%
PromptBench evaluation	BERT-base	35.00% to 0.00% accuracy, ASR 100.00%, 27.56% perturbed words, 59.57 queries
PromptBench evaluation	RoBERTa-base	35.00% to 35.00% accuracy, ASR 0.00%, 239.71 queries

Taken together, these findings support a narrow but important conclusion: BERTAttack is not uniformly easy or uniformly hard. Its observed success depends on the attacked model class, the task definition, and the evaluation protocol under which the attack is instantiated.

5. Dispute over semantic preservation and attack validity

The strongest controversy surrounding BERTAttack concerns whether its successful substitutions are genuinely semantic-preserving. One paper argues that BERT is substantially more robust than attack papers suggest, because most successful word-substitution attacks do not preserve semantics under human judgment (Hauser et al., 2021). Across four attacks—TextFooler, PWWS, BERT-Attack, and BAE—the authors report that 96\%–99\% of the analyzed successful attacks fail a human notion of semantic preservation (Hauser et al., 2021).

For BERT-Attack specifically, that study fine-tunes bert-base-uncased on AG News and Yelp, with clean accuracies of 94.57\% and 97.31\% respectively, and reports attack success rates of 79.43\% on AG News and 93.47\% on Yelp (Hauser et al., 2021). It then subjects individual substitutions to human evaluation using both isolated word-pair judgments and contextual fragment judgments. For BERT-Attack, the reported averages are 2.27 / 4\% / 4\% in the word similarity setting and 2.55 / 7\% / 3\% in the text similarity setting, where the three numbers denote average human score, percentage above 5, and percentage above 6 on a 7-point Likert scale (Hauser et al., 2021).

The same paper formalizes a valid perturbation by the condition

$i$6

with sensible thresholds stated as

$i$7

A valid attack is one in which all perturbations are valid (Hauser et al., 2021). Under the natural threshold $i$8, the estimated share of successful BERT-Attack examples that are valid is reported as below 2\% (Hauser et al., 2021). This line of work therefore rejects the equation of contextual plausibility with semantic equivalence, and specifically identifies BERT-Attack and BAE as performing especially poorly by human semantic criteria (Hauser et al., 2021).

A plausible implication is that BERTAttack measures two partly different phenomena at once: a model’s sensitivity to fluent lexical variation, and the looseness or strictness of the semantic constraints imposed during attack generation.

6. Defensive responses and methodological implications

The literature summarized here presents two major defensive responses to BERTAttack-style perturbations. One response is explicit robustness training for sentence encoders. RobustSentEmbed combines token-level and sentence-level adversarial perturbation generation with a robust contrastive objective and adversarial replaced token detection, and reports that the BERTAttack success rate is reduced from 75.51\% to 38.81\% in classification/NLI evaluation and from 32.23\% to 12.80\% in adversarial STS evaluation (Asl et al., 2024). In that work, BERTAttack functions as a benchmark adversary demonstrating that robustness and utility need not be in direct conflict, since the same framework also reports gains on non-adversarial STS and transfer tasks (Asl et al., 2024).

A second response is to challenge the attack’s semantic assumptions while defending against the corresponding perturbation neighborhood. The study on BERT robustness proposes a two-step defense consisting of data augmentation during training and randomized inference-time smoothing (Hauser et al., 2021). In the data-augmentation stage, the method computes gradients, selects the top $i$9 most important words, removes stop-words, constructs a candidate set $w_i$0, samples replacements with probability biased toward lower cosine similarity, and concatenates the perturbed and original batches. The reported setting uses $w_i$1 (Hauser et al., 2021). In the post-processing stage, the method generates $w_i$2 perturbed versions of each input, replaces $w_i$3 of non-stop words with random candidate substitutions from $w_i$4, and sums logits across versions with

$w_i$5

using $w_i$6 and $w_i$7 (Hauser et al., 2021).

Under this defense, the reported BERT-Attack success rates fall to 3.73\% \pm 0.29 on AG News and 4.86\% \pm 0.33 on Yelp, and the paper states that combining data augmentation with post-processing reduces attack success to below 5\% for all attacks in the main setting (Hauser et al., 2021). The same study also reports substantially lower training cost for its data augmentation than for on-the-fly adversarial training: Normal training takes 0:19 on AG News and 0:32 on Yelp, DA takes 5:33 and 9:08, and ADV takes 160:15 and 107:56 (Hauser et al., 2021).

Across these studies, BERTAttack serves less as a settled benchmark than as a focal point for a broader methodological dispute. One camp uses it as a stringent, context-aware evaluation attack and designs training objectives to withstand it; another argues that many of its successful perturbations are semantically defective and that robustness claims should be conditioned on stronger validity criteria. What is consistent across both views is that BERTAttack has become a central instrument for probing how transformer models respond to fluent lexical perturbations, and for distinguishing nominal task performance from stability under adversarial variation.