Before revision:  For text classification, however, the discrete property of the text input space makes it hard to adapt the gradient-based adversarial methods from the image domain. Existing text attack methods, moreover, are effective but not efficient enough to be incorporated into practical text adversarial training.
After revision:  For text classification, however, existing synonym substitution based adversarial attacks are effective but not efficient enough to be incorporated into practical text adversarial training.