---
title: 'TextFooler: Adversarial Synonym Attack'
url: https://www.emergentmind.com/topics/textfooler
type: topic
---

# TextFooler: Adversarial Synonym Attack

Searching arXiv for recent and foundational papers on TextFooler and closely related evaluations/defenses.
TextFooler is a black-box, query-based, word-level adversarial attack for NLP systems that seeks to flip a model’s prediction by making minimal, semantics-preserving word substitutions. Introduced as a “simple but strong baseline” for natural language attack on text classification and textual entailment, it became a standard reference point for evaluating the robustness of BERT, CNN, LSTM, and related models because it combines token-importance ranking, synonym retrieval, syntactic filtering, and sentence-level semantic constraints in a greedy search procedure [1907.11932].

## 1. Definition, scope, and threat model

TextFooler operates in the black-box setting: the attacker does not require access to model parameters or architecture, but can query the victim model and observe its outputs. The goal is to produce an adversarial text $x_{\text{adv}}$ such that the predicted label changes while the perturbation remains constrained by a semantic or perceptual distance condition. A generic formulation used in later analyses is
$$
\arg\max_c f(x_{\text{adv}})\neq \arg\max_c f(x), \quad \text{subject to } d(x_{\text{adv}}-x)\le \sigma,
$$
where $d(\cdot)$ captures bounded substitution or semantic-dissimilarity constraints [2310.01452].

The attack is fundamentally lexical rather than character-level or gradient-based. It assumes that many NLP classifiers depend strongly on a small set of salient words and that carefully chosen synonym substitutions can alter the model’s decision while remaining acceptable to human readers. In the original study, this threat model was applied to text classification datasets such as AG’s News, Fake News, MR, IMDB, and Yelp, and to textual entailment datasets such as SNLI and MultiNLI, with attack evaluation performed on 1,000 sampled test examples per dataset [1907.11932].

Later work has continued to treat TextFooler as a canonical synonym-substitution attack. Defensive papers frame it as one of the “most widely used word-substitution adversarial attacks,” and evaluation studies routinely use it as a baseline alongside TextBugger, PWWS, BERT-Attack, Genetic, BAE, SememePSO, and CLARE [2203.14207].

## 2. Core algorithm and constraint system

TextFooler first ranks words by importance to the current prediction. In the original formulation, for an input sentence $X=\{w_1,\dots,w_n\}$ and predicted label $Y$, the importance of token $w_i$ is computed by deleting that token and measuring the change in model confidence:
$$
I_{w_i}=
\begin{cases}
F_Y(X)-F_Y(X\setminus w_i), & F(X)=F(X\setminus w_i)=Y,\\
\left[F_Y(X)-F_Y(X\setminus w_i)\right]+\left[F_{\bar Y}(X\setminus w_i)-F_{\bar Y}(X)\right], & F(X)=Y,\ F(X\setminus w_i)=\bar Y.
\end{cases}
$$
Tokens are then sorted by descending importance, and stopwords are filtered out before editing [1907.11932].

Substitution candidates are retrieved from counter-fitted word embeddings by cosine similarity. The original paper uses the top $N=50$ nearest neighbors with minimum cosine similarity $\delta=0.7$, then filters those candidates by part-of-speech consistency using spaCy. Sentence-level semantic preservation is enforced with the Universal Sentence Encoder, requiring cosine similarity between the original and perturbed sentences to exceed a preset threshold $\epsilon$ [1907.11932].

The replacement step is greedy. For a candidate pool that satisfies the lexical, POS, and sentence-similarity filters, TextFooler chooses the candidate that either immediately flips the prediction and maximizes sentence similarity, or, if no candidate flips the label, minimizes the confidence assigned to the current label:
$$
c^*=\arg\min_{c\in \text{FinCandidates}} F_Y(X').
$$
It then applies the chosen substitution and proceeds to the next ranked token until the label changes or the search space is exhausted [1907.11932].

Many later implementations preserve this structure while simplifying the saliency computation to a deletion- or masking-based score
$$
I_{\tilde x}=f_y(x)-f_y(\tilde x),
$$
where $\tilde x$ is obtained by removing or masking a candidate word. TextAttack-based configurations described in later benchmarking studies commonly cap the synonym set at $K_{\max}=50$, bound the fraction of modified words by $\rho_{\max}$, and define a black-box query budget $Q_{\max}=K_{\max}\cdot L$ for a length-$L$ input [2310.01452].

## 3. Empirical behavior, effectiveness, and query cost

The original paper reported that TextFooler can reduce model accuracy to very low levels across both classification and entailment. For BERT, after-attack accuracy fell from $90.9$ to $13.6$ on IMDB with perturbation rate $6.1\%$, sentence similarity $0.86$, and $1134$ queries; from $94.2$ to $12.5$ on AG with perturbation rate $22.0\%$, sentence similarity $0.57$, and $357$ queries; and from $89.4$ to $4.0$ on SNLI with perturbation rate $18.5\%$, sentence similarity $0.45$, and $60$ queries [1907.11932]. The same study emphasized that, with fixed top-$N$ candidate retrieval and a single deletion-based importance pass, the query count grows roughly linearly with text length, with empirical query-to-length ratio in $(2,8)$ [1907.11932].

Subsequent benchmark studies confirm that the attack remains strong against standard fine-tuned transformers, though the exact magnitude depends on dataset, model, and implementation. In a TextAttack evaluation on AGNEWS and IMDB, TextFooler achieved attack success rates of $60.93\%$ and $87.16\%$ against BERT-base baselines, and $56.15\%$ and $87.79\%$ against RoBERTa-base baselines, with average query counts between $317.27$ and $456.35$ [2310.01452]. In a PromptBench-style evaluation on SST-2, BERT-Base was reported as highly vulnerable, with pre-attack accuracy $48\%$, attack success rate $93.75\%$, adversarial accuracy $3\%$, average perturbed word percentage $21.93\%$, and roughly $1.98$ token changes per successful attack; in the same study, Flan-T5 and RoBERTa-Base were reported at $0\%$ TextFooler attack success rate on the tested splits [2509.09706].

Human-in-the-loop comparison on IMDb produced an even sharper contrast between attack strength and cost. On 170 attack sequences against a RoBERTa-base sentiment model, TextFooler achieved attack success rate $99.4\%$, with successful examples using on average $8.4$ substitutions and $515.2$ model queries. Humans in the same study produced successful attacks with only $10.9$ queries on average, showing that TextFooler is highly effective but far from query-minimal [2109.04385].

Query cost also varies substantially across domains. In a credibility-assessment benchmark using OpenAttack, TextFooler’s confusion score, interpreted there as attack success rate, ranged from $0.41$ on rumour detection with BERT to $0.92$ on style-based bias assessment with BERT, while average queries per example ranged from $28.49$ on COVID-19 misinformation detection to $660.52$ on style-based bias assessment [2409.02649].

## 4. Semantic validity, grammaticality, and the central controversy

A persistent controversy around TextFooler concerns what counts as a valid natural-language adversarial example. The original paper argued that its adversarial texts preserve semantic content and grammaticality, and its human evaluation reported only small drops in Likert grammaticality scores: on MR with a WordLSTM target, original and adversarial texts scored $4.22$ and $4.01$; on SNLI with a BERT target, they scored $4.50$ and $4.27$. Human semantic-similarity judgments were also high, at $0.91$ for MR and $0.86$ for SNLI [1907.11932].

Later reevaluation challenged the adequacy of TextFooler’s default constraints. A unified framework for NLP adversarial examples argued that successful attacks must both fool the model and satisfy explicit linguistic constraints on semantics, grammaticality, overlap, and non-suspicion. Under TextFooler’s original settings, semantic preservation averaged only $3.28$ on a 1–5 Likert scale, grammar checkers detected more errors in perturbed than original text for $50\%$ of TextFooler examples, and stricter human-aligned thresholds caused attack success to collapse: on BERT targets, IMDB fell from $85.0\%$ to $13.9\%$, Yelp from $93.2\%$ to $5.3\%$, MR from $86.6\%$ to $10.6\%$, SNLI from $94.5\%$ to $7.2\%$, and MNLI from $95.1\%$ to $14.8\%$ when the attack was adjusted to use $\tau_w=0.9$, $\tau_s=0.98$, and grammar checking [2004.14174].

A complementary human-comparison study reached a more mixed conclusion. On IMDb, TextFooler had the highest sentiment-label consistency among successful attacks, with $93\%$ match and mean sentiment shift $\Delta S=0.28$, and the authors reported no broad statistically significant differences between human and machine attacks on naturalness for successful examples. At the same time, TextFooler introduced more grammatical errors than the original in $56.5\%$ of adversarial examples, and its naturalness degradation $\Delta_{\text{comb}}=0.68$ was worse than the human condition’s $0.27$ [2109.04385].

These results make clear that TextFooler’s reported success rates depend strongly on how semantic preservation and grammaticality are operationalized. A high attack success rate under lenient embedding and sentence-similarity thresholds does not automatically imply that human readers would regard the perturbation as meaning-preserving.

## 5. Defensive responses and robustness benchmarks

Because TextFooler is black-box and query-based, many defenses target either the stability of the model’s outputs under repeated queries or the model’s sensitivity to synonym substitutions. AdvFooler is an inference-time defense that injects Gaussian noise into latent representations in order to destabilize word-importance estimates and synonym evaluation. Against TextFooler on IMDB, it raised RoBERTa-base accuracy under attack from $11.40\%$ to $63.70\%$, reduced attack success rate from $87.79\%$ to $32.02\%$, and increased average queries from $456.35$ to $3255.35$; on AGNEWS with BERT-base, it raised accuracy under attack from $36.80\%$ to $50.10\%$ while roughly doubling queries from $317.27$ to $701.05$, with reported inference overhead of only $+2.6\%$ on IMDB [2310.01452].

Other defenses attempt to harden the model or purify the input. FireBERT introduces diversification and co-tuning against TextFooler-style perturbations: its FACT variant reached adversarial accuracy $0.800$ on pre-manufactured MNLI adversarials with clean accuracy $0.827$, and adversarial accuracy $0.872$ on IMDB with clean accuracy $0.900$; in active attack on MNLI, FACT raised under-attack accuracy from $0.127$ for the TextFooler baseline to $0.316$, while FIVE on top of FACT reached $0.545$ [2008.04203]. Text adversarial purification instead uses masked language models to mask and reconstruct the input multiple times. On IMDB with TextFooler candidate size $K=50$, purification increased BERT after-attack accuracy from $2.8$ to $51.0$ and RoBERTa after-attack accuracy to $54.3$; on AG’s News at the same attack strength, it raised BERT after-attack accuracy from $19.4$ to $34.9$ [2203.14207].

Several deployment-oriented defenses avoid retraining. Dynamic 8-bit post-training quantization raised BERT’s TextFooler after-attack accuracy from $5.99\%$ to $27.00\%$ on SST-2, from $2.00\%$ to $19.90\%$ on Emotion, and from $5.25\%$ to $41.65\%$ on MR, with average clean-accuracy drop reported as $0.98\%$ and no extra computational overhead during training [2403.05365]. ProTransformer replaces the standard attention aggregation with a robust reweighting layer and, without fine-tuning, improved AGNEWS accuracy under TextFooler from $19.7\%$ to $39.2\%$ for BERT, from $20.6\%$ to $48.9\%$ for ALBERT, from $13.2\%$ to $29.3\%$ for DistilBERT, and from $13.0\%$ to $24.4\%$ for RoBERTa [2410.23182].

Architectural changes can also make TextFooler ineffective by depriving it of smooth confidence gradients. In ensembles of $0$–$1$ loss sign-activation networks attacked via vote-fraction probabilities, adversarial accuracy on IMDB was $51.0$ for the sign-activation MLP baseline versus $0.0$ for a sigmoid CNN, and a sign-activation CNN with positive-count pooling achieved $67.9$ adversarial accuracy on IMDB and $66.7$ on AG, with much higher query counts than conventional CNN baselines [2402.07347]. Collectively, these results show that TextFooler functions not only as an attack, but also as a standardized stress test for robustness mechanisms.

## 6. Variants, comparative studies, and domain- or language-specific behavior

TextFooler is frequently used as a baseline for comparing search procedures and substitution strategies. Under TextAttack defaults on IMDb, it outperformed Genetic and BAE in attack success and matched SememePSO at the top end: TextFooler reached $99.4\%$ attack success on 170 sequences, compared with $38.2\%$ for Genetic and $43.0\%$ for BAE, while SememePSO reached $100.0\%$ [2109.04385]. However, when the linguistic constraints are held constant, TextFooler’s greedy search is not obviously superior to more expensive alternatives: under the stricter TFAdjusted setting on MR, greedy TextFooler achieved $10.6\%$ success with about $27$ model queries, while Genetic achieved $12.0\%$ success with about $4431$ queries, indicating that much of TextFooler’s headline advantage stems from more permissive constraints rather than a strictly better search algorithm [2004.14174].

The method has also been adapted to settings beyond English sentiment and news classification. In genre classification with XLM-RoBERTa, untargeted TextFooler achieved English attack success rates of $32.9\%$, $34.7\%$, and $35.8\%$ for $k=15,30,50$, and Russian rates of $47.4\%$, $49.6\%$, and $51.4\%$, with the Universal Sentence Encoder threshold having little effect on attack success in that task [2107.02246]. A later study on inflectional languages reported that TextFooler caused the largest accuracy drops among the compared attacks across English, Polish, and Czech datasets, including $\Delta$ accuracy $19.69\%$ on IMDB, $9.72\%$ on MultiEmo, and $22.62\%$ on CSFD, while still maintaining semantic-similarity scores above $97\%$ in most cases [2505.07856].

In benchmark competitions, TextFooler often serves as a strong but no longer dominant baseline. On CheckThat! 2024 Task 6, its BODEGA scores and semantic scores were generally below CLARE and below hybrid pipelines such as GSWSE→TextFooler, though its confusion score remained high on easier datasets, such as $0.92$ on style-based bias assessment with BERT [2409.02649]. Reinforcement-learning-based attacks have also been positioned explicitly against it: ReinforceBug reported being, on average, $10\%$ more successful than TextFooler while producing adversarial examples with semantic similarity $83.38\%$ and avoiding functional-semantic violations such as URL perturbation [2103.08306].

TextFooler’s enduring importance lies in this dual role. It is at once a concrete algorithm for black-box synonym substitution and a reference point around which the field has clarified definitions of adversarial validity, built robustness benchmarks, and developed plug-and-play, training-time, and architecture-level defenses. The literature collectively suggests that TextFooler is highly effective under standard automatic constraints, but that its practical meaning depends on how aggressively semantic preservation, grammaticality, and query cost are enforced.

Source: https://www.emergentmind.com/topics/textfooler