Before revision:  Empirical evaluations demonstrate that FGPM achieves similar attack performance and transferability when compared with competitive attack baselines, at the same time it is about 20 times faster than the current fastest text attack method. Such performanceenables us to incorporate FGPM with adversarial training as an effective defense method , and scale to large neural networks and datasets.
After revision:  Empirical evaluations demonstrate that FGPM achieves similar attack performance and transferability when compared with competitive attack baselines, at the same time it is about 20 times faster than existing text attack methods and could achieve similar attack performance. We then incorporate FGPM with adversarial training as an effective defense method , and scale to large neural networks and datasets.