Multi-task Adversarial Attacks against Black-box Model with Few-shot Queries
Authors: Wenqiang Wang, Yan XIAO, Hao Lin, Yangshijie Zhang, Xiaochun Cao
Accepted at: acl25

Multi-task Adversarial Attacks against Black-box Model with Few-shot Queries

Wenqiang Wang1, Yan Xiao1, Hao Lin1, Yangshijie Zhang2, Xiaochun Cao1,2*,
1Shenzhen Campus of Sun Yat-sen University, 2 Peng Cheng Laboratory 3Lanzhou University
wangwq69@mail2.sysu.edu.cn, xiaoy367@mail.sysu.edu.cn,
linh255@mail2.sysu.edu.cn, zhangyshj2023@lzu.edu.cn,
caoxiaochun@mail.sysu.edu.cn

Abstract

Current multi-task adversarial text attacks rely on abundant access to shared internal features and numerous queries, often limited to a single task type. As a result, these attacks are less effective against practical scenarios involving black-box feedback APIs, limited queries, or multiple task types. To bridge this gap, we propose Cluster and Ensemble Multi-task Text Adversarial Attack (CEMA), an effective black-box attack that exploits the transferability of adversarial texts across different tasks. CEMA simplifies complex multi-task scenarios by using a deep-level substitute model trained in a plug-and-play manner for text classification, enabling attacks without mimicking the victim model. This approach requires only a few queries for training, converting multi-task attacks into classification attacks and allowing attacks across various tasks. CEMA generates multiple adversarial candidates using different text classification methods and selects the one that most effectively attacks substitute models. In experiments involving multi-task models with two, three, or six tasks—spanning classification, translation, summarization, and text-to-image generation—CEMA demonstrates significant attack success with as few as 100 queries. Furthermore, CEMA can target commercial APIs (e.g., Baidu and Google Translate), large language models (e.g., ChatGPT 4o), and image-generation models (e.g., Stable Diffusion V2), showcasing its versatility and effectiveness in real-world applications.

1 Introduction

A multi-task textual adversarial attack targets multiple tasks with minimal perturbations, posing significant risks to safety-critical systems by inducing erroneous decisions (Liu et al., 2017; Lin et al., 2022; Watkins et al., 2024). Most research on multi-task adversarial examples focuses on tasks of the same type, particularly classification tasks (Liu et al., 2017). Additionally, existing adversarial attack methods generally assume that attackers have access to the model architecture and shared layer information within a unified model, requiring abundant queries to the victim model (Guo et al., 2020; Zhe et al., 2024).

However, these studies do not align well with current real-world scenarios. For instance, consider the prompt “Translate this paper into Chinese and extract its core meaning:” input into ChatGPT-4o. This creates a multi-task model with distinct tasks—translation and summarization—where the AI agent (e.g., ChatGPT-4o) is a black-box victim model that outputs only the final text. Frequent access to large language models (LLMs) during the attack process incurs significant costs and is often limited, as seen with the ChatGPT-4o model’s message limit of 50 per week (Hayawi and Shahriar, 2024). Given these constraints, it is essential to consider multi-task adversarial attacks in real-world scenarios, where the model feedback (i.e., the output text) reflects the black-box nature of the victim model. Furthermore, query limitations are a critical factor, as they optimize resource efficiency and minimize the risk of detection, making them a key consideration in practical attacks. Therefore, this paper is guided by the following challenge:

How can attackers use few-shot queries to generate adversarial examples in a black-box multi-task learning model with diverse task types?

In black-box and few-shot scenarios, a straightforward strategy is the transfer attack, where adversarial examples are generated in a substitute model without directly querying the victim model. However, this approach requires the availability of a well-trained substitute model. In the absence of such a model, attackers need to train a substitute model similar to the victim model. The transferability of adversarial examples depends on the similarity between these models, allowing adversarial
examples crafted for the substitute to also affect the victim model. Training a substitute model typically requires significant high-quality data, either from the victim model’s training set (\( \mathbf{X}_{\text{train}}, \mathbf{Y}_{\text{train}} \)) or by querying the victim model to generate predicting labels \( \hat{\mathbf{Y}}_{\text{train}} \) for \( \mathbf{X}_{\text{train}} \). However, acquiring such abundant data is often impractical, especially with query limitations in real-world settings.

Therefore, we propose the **deep-level attack hypothesis**: adversarial examples generated from a substitute model trained with deep-level labels can transfer effectively across multiple downstream tasks. For instance, in a multi-task model for bird-vs-cat images, tasks like mammal classification, flying ability, and leg count can be tackled using deep-level labels like species classification, enabling adversarial examples to transfer across these tasks. Rather than training a substitute model to match the victim model, we focus on building a model with deep-level labels that can target all tasks with minimal data and few-shot queries, bypassing the need for large auxiliary datasets or extensive victim model queries.

Specifically, we propose Cluster and Ensemble Multi-task Text Adversarial Attack (CEMA), a framework that leverages a small set of easily accessible auxiliary data, such as victim texts. To obtain the deep-level labels, CEMA first vectorizes the input texts and their corresponding outputs into vector representations, and then concatenates the input and output vectors to form final representations. A binary clustering method is then applied to these representations to generate binary cluster labels, which serve as the deep-level labels. Subsequently, CEMA uses the auxiliary data-cluster label pairs to train a binary classification model as the substitute model, transforming the multi-task attack scenario into a single-task text classification attack. During the adversarial example generation phase, adversarial candidates are produced for each victim text. Simultaneously, CEMA randomly samples the auxiliary data-cluster label pairs and repeats the training process to generate multiple substitute models. The adversarial example that successfully attacks the majority of these substitute models is then selected as the final adversarial example.

To evaluate the performance of CEMA, we focus on the text classification and translation tasks within a multi-task learning framework. Given the constraint of requiring only 100 queries, CEMA achieves a minimum improvement of 14.92% in attack success rate (ASR) over the second-best method in the classification task. In the text translation task, CEMA improves the BLEU score by at least 0.05 compared to the second-best method. With only 10 queries, CEMA still performs well, achieving an average ASR of 43.02% and an average BLEU score of 0.22. On LLMs such as ChatGPT-4o (Wang et al., 2025) and Claude 3.5 (Bae et al., 2024), CEMA achieves an average ASR of 36.15% and an average BLEU score of 0.43. When the number of tasks is increased to six, CEMA also achieves great attack results. Meanwhile, CEMA can also attack the summarization, and text-to-image generation tasks. The primary **contributions** are summarized as follows:

• We define the deep-level attack hypothesis, demonstrating that adversarial examples generated from a substitute model trained with deep-level labels can effectively transfer across multiple downstream tasks.

• We introduce CEMA, the first *plug-and-play framework* that converts a multi-task attack into a classification attack. CEMA can craft adversarial examples with very limited queries and just final text outputs (Black-box attack).

• We empirically validate the effectiveness of CEMA across various victim models and datasets, consistently achieving state-of-the-art performance.

2 Related Work

2.1 Text Classification Adversarial Attack

In text adversarial research, the predominant methods revolve around scenarios with singular output results (Waghela et al., 2024; Han et al., 2024; Zhu et al., 2024; Kang et al., 2024). These studies focus on the techniques for morphing the original text into adversarial counterparts, including the manipulation of pivotal chars (Ebrahimi et al., 2018b; Gil et al., 2019; Ebrahimi et al., 2018a; Gao et al., 2018; Ren et al., 2019; Jin et al., 2020; Li et al., 2019), words (Wang et al., 2022; Guo et al., 2021; Meng and Wattenhofer, 2020; Sato et al., 2018; Cheng et al., 2019; Lee et al., 2022; Li et al., 2020a; Hu et al., 2024; Liu et al., 2024, 2023; Li et al., 2019) and sentence. These methods are segmented into three distinct categories based on the response from the victim model, encompassing white-box attacks, soft-label black-box attacks, and hard-label black-box attacks. In white-box attacks, adversaries gain
full access to all relevant information about the victim model. Hotflip (Ebrahimi et al., 2018b) sequentially replaces key words based on their importance scores, while the FD method (Papernot et al., 2016) generates adversarial examples using model gradient information. In soft-label black-box attacks, many methods perturb words based on output probabilities (Lee et al., 2022; Maheshwary et al., 2021b; Wang et al., 2021a; Li et al., 2020a). Bert-ATTACK (Li et al., 2020a) performs word-level attacks using a fine-tuned BERT; SememePSO (Zang et al., 2020) improves the search space for generating adversarial samples; Bae (Garg and Ramakrishnan, 2020) replaces words via BERT; and DeepWordBug (DWB) (Gao et al., 2018) targets words prioritized by output probabilities. Hard-label attacks reflect more realistic conditions. HLGA (Maheshwary et al., 2021a) uses stochastic initial words and a genetic algorithm to craft adversarial examples. HQA-attack (Liu et al., 2024) restores original words as much as possible to reduce disruption, then uses synonyms for the remaining changed words to enhance the attack.

2.2 Neural Machine Translation Adversarial Attack

Neural Machine Translation (NMT) models, which automatically convert input sentences into translated output, have achieved remarkable results by employing deep neural networks like Transformers (Bahdanau, 2014; Vaswani, 2017). These models are now extensively used across various applications due to their high performance. However, erroneous outputs generated by NMT models can lead to significant risks, particularly in security-sensitive contexts. Recent studies explore adversarial attacks on NMT models to address robustness concerns. Character-level NMT models are especially vulnerable to character-level manipulations like typos or word insertion/removal in black-box settings (Belinkov and Bisk, 2017; Ebrahimi et al., 2018a). However, such manipulations are easily detectable by humans or review systems. Therefore, most attacks on NLP and NMT systems focus on word replacement. Seq2sick (Cheng et al., 2020) uses a projected gradient method with group lasso and gradient regularization to perform non-overlapping and targeted keyword attacks. Similarly, Transfool (Sadridzadeh et al., 2023) applies gradient projection with a new optimization formulation and linguistic constraints to create fluent, semantically-preserving attacks. Morphin (Tan et al., 2020) perturbs inflections in clean examples to generate plausible and semantically similar adversaries. The kNN attack (Michel et al., 2019) replaces words with their neighbors in the embedding space in a white-box, untargeted setting. RG (Zou et al., 2019) adopts reinforcement learning to generate adversarial examples that preserve semantics and produce more reasonable tokens.

2.3 Mutil-task Adversarial Attack

A Multi-task Adversarial Attack is an adversarial machine learning strategy designed to generate examples that deceive multiple models or systems simultaneously (Guo et al., 2020; Ghamizi et al., 2022), rather than just one. As far as we know, there is currently no related work on multi-task adversarial attacks in the field of text. In other fields, MTA (Guo et al., 2020) is designed to generate adversarial perturbations for all three pre-trained classifiers simultaneously by leveraging shared knowledge among tasks. There is an attack method (Sobh et al., 2021) that targets visual perception in autonomous driving, which is applied in a wide variety of multi-task visual perception deep networks in distance estimation, semantic segmentation, motion detection, and object detection. MTADV (Wang et al., 2024) is a multitask adversarial attack against facial authentication, which is effective against various facial data sets.

2.4 Transfer Attack

Transfer attacks leverage adversarial examples to target different models without requiring direct access, posing a significant security threat in black-box scenarios (Papernot et al., 2017; Dong et al., 2018). Then, in the absence of a substitute model, several studies demonstrate that auxiliary data can also facilitate successful attacks through training a substitute model and leveraging transfer attacks (Li et al., 2020c; Sun et al., 2022). Additionally, more effective loss functions have been proposed to train substitute models (Wang et al., 2021b; Li et al., 2020b; Naseer et al., 2019; Richards et al., 2021; Huan et al., 2020), as well as techniques to refine substitute models (Xiaosen et al., 2023; Yuan et al., 2021).

3 Preliminary

Transferability and multi-task learning. Transferability refers to the ability of adversarial examples, crafted for one model, to successfully attack other models (Zhang et al., 2020; Papernot et al.,
Figure 1: The Overview of CEMA. ➀ During deep-level substitute model training, CEMA vectorizes the auxiliary data and labels using pre-trained models, concatenates the vectors, and applies binary clustering to generate deep-level labels, which are used to train the substitute model \( f_s \). ➁ For candidate adversarial example generation, \( l \) text classification attack methods are used to create \( l \) examples. Examples exceeding a similarity threshold \( \epsilon \) are selected as candidates, resulting in \( u \) candidates, where \( u < l \). ➂ CEMA trains \( w \) substitute models using 80% of the data pairs from the auxiliary text-cluster labels. The adversarial example attacking the most substitute models is chosen as the final adversarial example \( \tilde{x}_i \).

2017; Mahmood et al., 2021; Zhou et al., 2020). Multi-task learning trains multiple related tasks together, enabling knowledge sharing and improving generalization (Cai et al., 2025; Pu et al., 2025).
Auxiliary data. Auxiliary data refers to additional information used to assist in generating adversarial examples. This data, which is not part of the original input, helps attackers better understand the target model’s behavior or generate more effective adversarial inputs. For instance, auxiliary data might include outputs from the victim model (Chen et al., 2024; Papernot et al., 2017).

4 Method

4.1 Observations and Motivations

We consider a multi-task scenario with bird and cat images. Task 1 identifies if the image represents a mammal. Task 2 determines if the subject can fly, and Task 3 assesses the number of legs. Adversarial attacks on this multi-task model under black-box conditions with limited queries are challenging. However, by training a substitute model for bird-cat classification and perturbing it to misclassify a cat as a non-cat, we can modify the outputs of the three downstream tasks. Birds and cats share intrinsic species characteristics that are more fundamental and “deep-level” than the tasks of identifying mammalian status, flight capability, or legs’ number. Based on this observation, we propose the deep-level attack hypothesis:

Assumption 4.1 (Deep-level Attack Hypothesis). Adversarial examples \( \tilde{x} \) of the victim text \( x^* \) crafted using a substitute model \( f_s \) trained with deep-level labels can effectively attack multiple downstream tasks in a multi-task model \( f_v \). Formally,

\[
f_s(x^*) \neq f_s(\tilde{x}), \quad \text{and} \quad f_v(x^*) \neq f_v(\tilde{x}),
\]

Based on the observations and hypothesis, we propose the Cluster and Ensemble Multi-task Text Adversarial Attack (CEMA) method, an overview of which is provided in Figure 1. CEMA uses a deep-level substitute model to convert multi-task attack scenarios—characterized by varying numbers and types of tasks—into a single-task text classification attack scenario. Furthermore, CEMA employs multiple text classification attack methods to generate candidate adversarial examples and introduces a selection mechanism to identify the final adversarial example from the pool of candidates.

4.2 Deep-level Substitute Model Training

For auxiliary texts in auxiliary data, we query the victim model to obtain their corresponding outputs. These texts, along with their task-specific outputs, are then vectorized using a method such as a pre-trained model. The resulting vector representations are concatenated to form a unified representation. A binary clustering algorithm is applied to these vectorized representations, and cluster labels are
assigned to each, which are treated as deep-level labels for both the text and its outputs. Next, we train a substitute model, denoted as \( f_s \), using the auxiliary texts and their corresponding cluster labels. This substitute model \( f_s \) enables the transformation of the black-box multi-task attack scenario into a white-box text classification attack scenario. Moreover, \( f_s \) is treated as the substitute model trained with deep-level labels (cluster labels).

4.2.1 Representation Learning

As discussed in Section 4.1, the deep-level label is derived from both the image and the outputs of three tasks: identifying whether the image represents a mammal, whether the subject can fly, and the number of legs. Thus, the deep-level label should simultaneously consider the impact of input data and the output data of the multi-task model. To achieve this, we vectorize the auxiliary texts and their outputs using a pre-trained model and concatenate them into a unified representation.

For each auxiliary text \( x_i \), we query the victim model \( f_v \) to obtain the corresponding outputs \( \{y_{i}^{1}, y_{i}^{2}, \ldots, y_{i}^{N}\} \), where \( N \) denotes the number of tasks. The pre-trained model \( f_e \) then vectorizes both \( x_i \) and its outputs, yielding vectors \( \{E_{x_i}, E_{y_i^1}, \ldots, E_{y_i^N}\} \). These vectors are concatenated to form the final vector \( E_i \), which represents \( x_i \) and its corresponding outputs. Formally:

\[
\{y_{i}^{1}, y_{i}^{2}, \ldots, y_{i}^{N}\} = f_v(x_i),
\]
\[
E_{x_i} = f_e(x_i), \quad E_{y_i^j} = f_e(y_i^j),
\]
\[
E_i = \text{Concat}(E_{x_i}, E_{y_i^1}, \ldots, E_{y_i^N}),
\]

where the Concat indicates the concatenation of the vectors \( \{E_{x_i}, E_{y_i^1}, \ldots, E_{y_i^N}\} \).

4.2.2 Cluster Number and Substitute Model

We set the number of clusters to 2, which can be interpreted as class \( C \) and its complement \( \overline{C} \). This choice ensures that the two clusters capture the most fundamental deep-level label, as the labels in three- or four-cluster configurations would ultimately merge into two. Experimental results in Section 5.3 show that CEMA achieves optimal attack performance with two clusters. Attackers then employ the binary cluster method to obtain the cluster label \( y_i^c \) for auxiliary text \( x_i \). Finally, the binary substitute model \( f_s \) is trained using pairs of auxiliary text and cluster labels. Formally:

\[
\mathbf{D} = \{(x_1, y_1^c), (x_2, y_2^c), \ldots, (x_n, y_n^c)\},
\]
\[
\theta^* = \arg\min_\theta \frac{1}{|\mathbf{D}|} \sum_{(x_i, y_i^c) \in \mathbf{D}} (y_i^c - f_s(\theta; x_i))^2,
\]

where \( y_i^c \) denotes the cluster label of \( E_i \), and \( \theta^* \) represents the model parameters of the substitute model \( f_s \).

4.3 Candidate Adversarial Examples Generation

Once the substitute model \( f_s \) is trained, adversarial examples can be generated from it using any standard text classification method to attack the victim model \( f_v \) through transferability. The perturbed text \( \tilde{x}_i \) of the victim texts \( x_i^* \) is generated by:

\[
\tilde{x}_i = \arg\max_{x_i} L(f_s(\tilde{x}_i), f_s(x_i^*)),
\]
and \( f_v(x_i^*) \neq f_v(\tilde{x}_i), \quad \text{s.t. } sim(\tilde{x}_i, x_i^*) \geq \epsilon. \)

where \( L(f(\tilde{x}_i), f(x_i)) \) is the loss function, \( f_s(\tilde{x}_i) \) represents the predictions of the substitute model for \( \tilde{x}_i \), and \( f_s(x_i^*) \) represents the predictions for \( x_i^* \). The term \( sim \) denotes the cosine similarity, which is calculated as \( \frac{f_s(x_i^*) \cdot f_s(\tilde{x}_i)}{\|f_s(x_i^*)\| \|f_s(\tilde{x}_i)\|} \). Finally, \( \epsilon \) is the similarity threshold. The condition \( sim(\tilde{x}_i, x_i^*) \geq \epsilon \) ensures that the adversarial example \( \tilde{x}_i \) maintains high similarity with \( x_i^* \) and retains its true label.

Instead of relying on one attack method, we use multiple attack methods to generate diverse examples and establish criteria to select the most effective one. This strategy is motivated by two main reasons: (1) More adversarial examples increase the probability of at least one successfully attacking the victim model. (2) Diverse methods enhance the probability of surpassing the similarity threshold \( \epsilon \) for multiple examples. We apply \( l \) attack methods to generate \( l \) examples. The examples whose similarity exceeds the similarity threshold \( \epsilon \) are identified as candidate adversarial examples (\( \{\tilde{x}_i^1, \tilde{x}_i^2, \ldots, \tilde{x}_i^u\} \)) for the victim text \( x_i^* \), with \( u \leq l \). Denote the \( p_i^u \) as the probability that \( \tilde{x}_i^u \) can successfully attack the victim model. \( A^u \) denotes the event that at least one of the \( u \) attack methods attack the victim model, with the probability termed as \( P(A^u) \). Denote \( p_{ij}^{\text{sim}} \) as the probability that the similarity of \( \tilde{x}_i^u \) and \( x_i^* \) exceed the similarity threshold \( \epsilon \). \( B^u \) denotes the event that at least one of the \( u \) adversarial examples exceed the similarity
threshold \( \epsilon \), with the probability termed as \( P(B^u) \). Reason (1) and (2) are mathematically expressed in Theorem 4.2.

**Theorem 4.2.** *P(A^u) and P(B^u) increase with u increases. Formally:*

\[
P(A^u) \leq P(A^{u+1}), P(B^u) \leq P(B^{u+1})
\]
*for all* \( u \geq 1, \)

(5)

*Proof.* Please see Section H in Appendix.

4.4 Transferability-Oriented Adversarial Example Selection

After generating additional adversarial candidates in Section 4.3, we select the one with the highest transferability. We achieve this by retraining multiple substitute models and evaluating the transferability of each candidate adversarial example based on the number of models it successfully attacks. The adversarial candidate that successfully attacks the greatest number of substitute models is selected as the final adversarial example. The detailed steps are as follows: **① Training Substitute Models:** We randomly sample 80% of the auxiliary text-cluster label pairs to form the training set for each substitute model. This process is repeated \( w \) times, resulting in \( w \) substitute models \( \{f_1^*, f_2^*, \ldots, f_w^*\} \). **② Calculating Transferability:** For each victim text \( x_i^* \) and its adversarial candidates \( \{\tilde{x}_i^1, \tilde{x}_i^2, \ldots, \tilde{x}_i^w\} \). The transferability score for \( \tilde{x}_i^j \) is computed as follows:

\[
I_{kij} = \begin{cases}
1, & \text{if } f_k^*(\tilde{x}_i^j) \neq f_k^*(x_i^*), \\
0, & \text{if } f_k^*(\tilde{x}_i^j) = f_k^*(x_i^*),
\end{cases}
\]

\( I_{ij} = \sum_{k=1}^w I_{kij} \)

(6)

where \( f_k^*(\tilde{x}_i^j) \) represents the output label of \( \tilde{x}_i^j \) produced by the substitute model \( f_k^* \), and \( f_k^*(x_i^*) \) is the output label of \( x_i^* \) from the \( f_k^* \). If \( f_k^*(\tilde{x}_i^j) \neq f_k^*(x_i^*) \), then \( \tilde{x}_i^j \) successfully attacks \( f_k^* \). Thus, \( I_{ij} \) counts the number of substitute models that \( \tilde{x}_i^j \) successfully attacks. The adversarial example attacking the most substitute models is selected as the final adversarial example of the victim text \( x_i^* \). If multiple candidate adversarial examples successfully attack the most substitute models, the candidate with the largest change in output probability from the substitute model \( f_s \) before and after the attack, is selected as the final adversarial example. Formally, this is expressed as:

\[
p_c^j = p_{\hat{y}}(x_i^*) - p_{\hat{y}}(\tilde{x}_i^j), h = \arg \max_j (I_{ij} + p_c^j), \tilde{x}_i = \tilde{x}_i^h,
\]

(7)

\( \hat{y} \) denotes the predicted label of \( x_i^* \) under \( f_s \), with \( p_{\hat{y}}(x_i^*) \) and \( p_{\hat{y}}(\tilde{x}_i^j) \) being the probabilities that \( x_i^* \) and \( \tilde{x}_i^j \) are predicted as \( \hat{y} \), respectively. Since \( p_c^j \) represents probability variation, and the generated adversarial examples succeed in attacking \( f_s \), \( p_c^j \) lies in [0,1]. When multiple adversarial examples attack the substitute model, \( h = \arg \max_j (I_{ij} + p_c^j) \) accounts for the probability variation in \( f_s \), with \( \tilde{x}_i \) being the final adversarial example.

5 Experiment

5.1 Experiment Setup

Dataset: We use the SST5 and Emotion datasets. Detailed statistics are in Appendix B, Table 4.

Victim models and baselines in LLMs: We conduct attacks on advanced LLMs, ChatGPT-4o (Pang et al., 2024) and Claude 3.5 (Bae et al., 2024). We use prompt learning to build agents on LLMs as victim models. The prompt is: “Translate the following text into French and Chinese, and predict the category label of the text, which can be one of the following: Sadness, Joy, Love, Anger, Fear, Surprise.”. As no existing research examines attacks on multi-task learning outputs of large models in a black-box setting, we adopt the approach of randomly removing the last character from 40% of the words in a sentence as a baseline for comparison, which is recorded as Random-Del.

Victim models and baselines in multi-model multi-task learning (M3TL): M3TL trains multiple models to simultaneously solve various tasks (Pineda et al., 2022; Xiang, 2024; Jin et al., 2021). Inspired by M3TL, we combine several pre-trained models to simulate multi-task learning. For classification, we employ dis-sst5, ro-sst5, dis-emotion, and ro-emotion models. For translation, we utilize the Opus-MT model for English-to-Chinese (En-Zh) task and the T5-small model for English-to-French (En-Fr) task. The model URLs are provided in Table 5 in the Appendix. To simulate a real-world attack scenario, we incorporate two commercial translation APIs: Baidu Translate (En-Fr) (He, 2015) and Ali Translate (En-Zh) (Wan et al., 2022). Three multi-task victim models are created: **Victim Model A** (dis-sst5, dis-emo, opus-mt), **Victim Model B** (ro-sst5, ro-emo, t5-small), and **Victim Model C** (Baidu and Ali Translate). Previous multi-task attack methods (Liu et al., 2017) require extensive queries and focus on white-box models with similar tasks, making them ineffective against multi-task black-box
Table 1: The attack performance of LLMs.

<table>
  <tr>
    <th rowspan="2">Data</th>
    <th rowspan="2">Models</th>
    <th colspan="3">ChatGPT-4o</th>
    <th colspan="3">Claude 3.5</th>
    <th rowspan="2">Total-Qry↓</th>
  </tr>
  <tr>
    <th>Tasks</th>
    <th>Classification</th>
    <th>En-Fr</th>
    <th>En-Zh</th>
    <th>Classification</th>
    <th>En-Fr</th>
    <th>En-Zh</th>
  </tr>
  <tr>
    <th rowspan="2">Emotion</th>
    <td>Random-Del</td>
    <td>14.20</td>
    <td>0.47</td>
    <td>0.64</td>
    <td>17.65</td>
    <td>0.44</td>
    <td>0.52</td>
    <td>0</td>
  </tr>
  <tr>
    <td>CEMA</td>
    <td><b>32.05</b></td>
    <td><b>0.39</b></td>
    <td><b>0.33</b></td>
    <td><b>36.80</b></td>
    <td><b>0.38</b></td>
    <td><b>0.35</b></td>
    <td>100</td>
  </tr>
  <tr>
    <th rowspan="2">SST5</th>
    <td>Random-Del</td>
    <td>15.33</td>
    <td>0.64</td>
    <td>0.66</td>
    <td>16.27</td>
    <td>0.62</td>
    <td>0.54</td>
    <td>0</td>
  </tr>
  <tr>
    <td>CEMA</td>
    <td><b>38.63</b></td>
    <td><b>0.32</b></td>
    <td><b>0.27</b></td>
    <td><b>37.12</b></td>
    <td><b>0.29</b></td>
    <td><b>0.25</b></td>
    <td>100</td>
  </tr>
</table>

models. In comparison, CEMA targets both classification and translation tasks with fewer queries. For single-task attacks, we compare CEMA with methods for text classification (BAE (Garg and Ramakrishnan, 2020), FD (Papernot et al., 2016), Hotflip (Ebrahimi et al., 2018b), SememePSO (Zang et al., 2020), TextBugger (Ren et al., 2019)) and translation (Hot-trans (Ebrahimi et al., 2018b), kNN (Michel et al., 2019), Morphin (Tan et al., 2020), RA (Zou et al., 2019), Seq2Sick (Cheng et al., 2020), TransFool (Sadriazadeh et al., 2023)). All methods are limited to 55 queries per victim text to ensure a fair comparison. Details are provided in Tables 7 and 8 in Appendix D.

Metrics, substitute model, clustering and vectorization methods: We evaluate the following metrics: ① ASR: A higher ASR indicates better attack efficacy. ② Total Queries (Total-Qry): Fewer queries reflect a more efficient attack. ③ BLEU: A lower BLEU score indicates a more effective attack result (Lateef et al., 2024). ④ Similarity (Sim.): A higher Sim. score indicates a more effective attack result. Details of the substitute model are provided in Section A of the Appendix. We train six substitute models on a server equipped with a 24GB NVIDIA 3090 GPU, with a training time of approximately 4 minutes per model due to limited auxiliary data. Each model has a size of 418 MB. Spectral clustering (Ng et al., 2001) is used for clustering, and mT5 (Xue, 2020) is used for vectorization.

Applied attack methods, auxiliary data, and hyperparameter: We apply a combination of attack methods, including Hotflip (Ebrahimi et al., 2018b), FD (Papernot et al., 2016), and TextBugger (Ren et al., 2019). These methods assume that the attacker has access to the victim texts during the attack, indicating that the victim texts are readily available for modification. For auxiliary data, we select 100 unlabeled victim texts. The similarity threshold \( \epsilon \) is set to 0.8.

5.2 Main Attack Results of LLMs and M3TL
As shown in Table 1, CEMA achieves substantial attack effectiveness on LLMs, with a best ASR of 38.63% and a best BLEU score of 0.25. Tables 2 and 3 highlight that CEMA achieves state-of-the-art (SOTA) performance on the SST5 and Emotion datasets across victim models A, B, and C. In a black-box setting with 100 queries, CEMA attains an ASR exceeding 59%, reaching up to 80.80% in classification tasks. For translation tasks, CEMA achieves a BLEU score below 0.16, outperforming the second-best method. Against victim model C (Baidu and Ali Translate) using only 100 auxiliary texts, CEMA exceeds Morphin and TransFool, attaining BLEU scores under 0.35 with just 100 queries.

5.3 Ablation Study
To investigate factors influencing CEMA attack performance, we conduct an ablation study on the number of clusters, attack methods, clustering, and vectorization. We experiment with two to four clusters and increase attack methods from one to three, using TextBugger alone and a combination of Hotflip, FD, and TextBugger. For clustering, we use spectral clustering as the main method, along with K-means (Krishna and Murty, 1999) and BIRCH (Zhang et al., 1996). For vectorization, we primarily use mT5 (Xue, 2020), with XLM-R (Conneau, 2019) and one-hot encoding (Rodríguez et al., 2018) as alternatives. One-hot encoding transforms categorical data into binary vectors without requiring access to any external data, preventing data leakage in pre-trained process. Given the high computational cost of utilizing large models, we primarily conduct ablation experiments on victim models A, B, and C.

Cluster number and attack method number. As shown in Figure 2, increasing the number of clusters from 2 to 4 reduces attack performance. The average ASR drops from 58.83% and 64.55% to 46.20% and 52.10%, while BLEU scores increase
Table 2: The attack performance of CEMA. Text classification tasks use the ASR(%)↑ metric, while text translation tasks use the BLEU↓ metric. Other adversarial attack methods can only be applied to their specific tasks, whereas CEMA simultaneously attacks all tasks.

<table>
  <tr>
    <th rowspan="2">Dataset</th>
    <th colspan="4">SST5</th>
    <th colspan="4">Emotion</th>
  </tr>
  <tr>
    <th colspan="2">Victim Model A</th>
    <th colspan="2">Victim Model B</th>
    <th colspan="2">Victim Model A</th>
    <th colspan="2">Victim Model B</th>
  </tr>
  <tr>
    <th>Text Classification</th>
    <th>dis-sst5 (A)</th>
    <th>ro-sst5 (B)</th>
    <th>dis-sst5 (A)</th>
    <th>ro-sst5 (B)</th>
    <th>dis-emotion (A)</th>
    <th>ro-emotion (A)</th>
    <th>dis-emotion (B)</th>
    <th>ro-emotion (B)</th>
  </tr>
  <tr>
    <th>Metric</th>
    <th>ASR(%)↑</th>
    <th>Sim.↑</th>
    <th>Total-Qry↓</th>
    <th>ASR(%)↑</th>
    <th>Sim.↑</th>
    <th>Total-Qry↓</th>
    <th>ASR(%)↑</th>
    <th>Sim.↑</th>
    <th>Total-Qry↓</th>
  </tr>
  <tr>
    <td>Bae</td><td>42.71</td><td>0.888</td><td>47360</td><td>39.14</td><td>0.887</td><td>47471</td><td>31.55</td><td>0.925</td><td>59626</td>
  </tr>
  <tr>
    <td>FD</td><td>25.20</td><td>0.929</td><td>27758</td><td>22.30</td><td>0.982</td><td>21459</td><td>47.10</td><td>0.948</td><td>66035</td>
  </tr>
  <tr>
    <td>Hotflip</td><td>41.50</td><td>0.951</td><td>25448</td><td>29.03</td><td>0.951</td><td>25945</td><td>46.85</td><td>0.942</td><td>21658</td>
  </tr>
  <tr>
    <td>PSO</td><td>48.14</td><td>0.954</td><td>24398</td><td>41.50</td><td>0.954</td><td>27360</td><td>46.05</td><td>0.945</td><td>19713</td>
  </tr>
  <tr>
    <td>TextBugger</td><td>30.36</td><td>0.978</td><td>69527</td><td>20.85</td><td>0.978</td><td>67007</td><td>35.10</td><td>0.981</td><td>25216</td>
  </tr>
  <tr>
    <td>Leap</td><td>32.55</td><td>0.953</td><td>21548</td><td>30.07</td><td>0.944</td><td>21083</td><td>26.30</td><td>0.934</td><td>15492</td>
  </tr>
  <tr>
    <td>CT-GAT</td><td>29.37</td><td>0.939</td><td>46233</td><td>24.80</td><td>0.926</td><td>82963</td><td>25.90</td><td>0.916</td><td>47338</td>
  </tr>
  <tr>
    <td>HQA</td><td>46.11</td><td>0.936</td><td>64864</td><td>39.64</td><td>0.929</td><td>64267</td><td>37.35</td><td>0.934</td><td>65725</td>
  </tr>
  <tr>
    <td>CEMA</td><td><b>73.57</b></td><td>0.934</td><td><b>100</b></td><td><b>75.66</b></td><td>0.927</td><td><b>100</b></td><td><b>80.80</b></td><td>0.926</td><td><b>100</b></td>
  </tr>
  <tr>
    <th>Text Classification</th>
    <th>dis-emotion (A)</th>
    <th>ro-emotion (B)</th>
    <th>dis-emotion (A)</th>
    <th>ro-emotion (B)</th>
    <th>dis-emotion (A)</th>
    <th>ro-emotion (A)</th>
    <th>dis-emotion (B)</th>
    <th>ro-emotion (B)</th>
  </tr>
  <tr>
    <th>Metric</th>
    <th>ASR(%)↑</th>
    <th>Sim.↑</th>
    <th>Total-Qry↓</th>
    <th>ASR(%)↑</th>
    <th>Sim.↑</th>
    <th>Total-Qry↓</th>
    <th>ASR(%)↑</th>
    <th>Sim.↑</th>
    <th>Total-Qry↓</th>
  </tr>
  <tr>
    <td>Bae</td><td>39.81</td><td>0.894</td><td>60399</td><td>14.65</td><td>0.896</td><td>62013</td><td>32.25</td><td>0.926</td><td>48266</td>
  </tr>
  <tr>
    <td>FD</td><td>35.43</td><td>0.921</td><td>64576</td><td>9.55</td><td>0.934</td><td>36553</td><td>22.30</td><td>0.932</td><td>28310</td>
  </tr>
  <tr>
    <td>Hotflip</td><td>33.39</td><td>0.943</td><td>24001</td><td>22.80</td><td>0.946</td><td>27139</td><td>29.00</td><td>0.949</td><td>31559</td>
  </tr>
  <tr>
    <td>PSO</td><td>41.90</td><td>0.968</td><td>19934</td><td>35.25</td><td>0.940</td><td>20885</td><td>39.50</td><td>0.952</td><td>26144</td>
  </tr>
  <tr>
    <td>TextBugger</td><td>30.00</td><td>0.972</td><td>25084</td><td>40.95</td><td>0.986</td><td>25084</td><td>20.85</td><td>0.978</td><td>67007</td>
  </tr>
  <tr>
    <td>Leap</td><td>21.00</td><td>0.968</td><td>15135</td><td>26.00</td><td>0.947</td><td>15492</td><td>40.55</td><td>0.926</td><td>21503</td>
  </tr>
  <tr>
    <td>CT-GAT</td><td>39.32</td><td>0.927</td><td>47206</td><td>33.45</td><td>0.924</td><td>47493</td><td>28.10</td><td>0.904</td><td>57593</td>
  </tr>
  <tr>
    <td>HQA</td><td>37.76</td><td>0.945</td><td>47382</td><td>31.95</td><td>0.931</td><td>65062</td><td>37.40</td><td>0.912</td><td>49392</td>
  </tr>
  <tr>
    <td>CEMA</td><td><b>62.27</b></td><td>0.934</td><td><b>100</b></td><td><b>64.01</b></td><td>0.927</td><td><b>100</b></td><td><b>65.40</b></td><td>0.926</td><td><b>100</b></td>
  </tr>
  <tr>
    <th>Text Translation</th>
    <th>opus-mtt(En-Zh) (A)</th>
    <th>t5-small(En-Fr) (B)</th>
    <th>opus-mtt(En-Zh) (A)</th>
    <th>t5-small(En-Fr) (B)</th>
    <th>opus-mtt(En-Zh) (A)</th>
    <th>t5-small(En-Fr) (B)</th>
    <th>opus-mtt(En-Zh) (A)</th>
    <th>t5-small(En-Fr) (B)</th>
  </tr>
  <tr>
    <th>Metric</th>
    <th>BLEU↓</th>
    <th>Sim.↑</th>
    <th>Total-Qry↓</th>
    <th>BLEU↓</th>
    <th>Sim.↑</th>
    <th>Total-Qry↓</th>
    <th>BLEU↓</th>
    <th>Sim.↑</th>
    <th>Total-Qry↓</th>
  </tr>
  <tr>
    <td>Hot-trans</td><td>0.24</td><td>0.846</td><td>21570</td><td>0.24</td><td>0.842</td><td>20885</td><td>0.20</td><td>0.859</td><td>20686</td>
  </tr>
  <tr>
    <td>KNN</td><td>0.31</td><td>0.873</td><td>13680</td><td>0.31</td><td>0.883</td><td>13680</td><td>0.61</td><td>0.935</td><td>29481</td>
  </tr>
  <tr>
    <td>Morphin</td><td>0.30</td><td>0.894</td><td>15006</td><td>0.37</td><td>0.907</td><td>24531</td><td>0.27</td><td>0.869</td><td>11183</td>
  </tr>
  <tr>
    <td>RA</td><td>0.25</td><td>0.872</td><td>7028</td><td>0.19</td><td>0.865</td><td>9415</td><td>0.23</td><td>0.852</td><td>6166</td>
  </tr>
  <tr>
    <td>Seq2sick</td><td>0.38</td><td>0.881</td><td>9835</td><td>0.46</td><td>0.926</td><td>13371</td><td>0.62</td><td>0.945</td><td>15669</td>
  </tr>
  <tr>
    <td>TransFool</td><td>0.77</td><td>0.949</td><td>7337</td><td>0.44</td><td>0.894</td><td>8641</td><td>0.81</td><td>0.962</td><td>8597</td>
  </tr>
  <tr>
    <td>CEMA</td><td><b>0.14</b></td><td>0.934</td><td><b>100</b></td><td><b>0.18</b></td><td>0.927</td><td><b>100</b></td><td><b>0.15</b></td><td>0.926</td><td><b>100</b></td>
  </tr>
</table>

Table 3: Attack performance of different methods on victim model C, which consists of two commercial closed-source translation APIs, Alibaba and Baidu Translate.

<table>
  <tr>
    <th rowspan="2">Dataset</th>
    <th colspan="4">Baidu Translate (en-fr/C)</th>
    <th colspan="4">Ali Translate (en-zh/C)</th>
  </tr>
  <tr>
    <th>Method</th>
    <th>BLEU↓</th>
    <th>Sim.↑</th>
    <th>Total-Qry↓</th>
    <th>Method</th>
    <th>BLEU↓</th>
    <th>Sim.↑</th>
    <th>Total-Qry↓</th>
  </tr>
  <tr>
    <td>SST5</td>
    <td>Morphin</td><td>0.54</td><td>0.904</td><td>89461</td><td>0.60</td><td>0.931</td><td>107075</td>
  </tr>
  <tr>
    <td></td>
    <td>TransFool</td><td>0.51</td><td>0.921</td><td>52001</td><td>0.59</td><td>0.928</td><td>68952</td>
  </tr>
  <tr>
    <td></td>
    <td>CEMA</td><td><b>0.29</b></td><td><b>0.934</b></td><td><b>100</b></td><td><b>0.15</b></td><td><b>0.934</b></td><td><b>100</b></td>
  </tr>
  <tr>
    <td>Emotion</td>
    <td>Morphin</td><td>0.40</td><td>0.897</td><td>55581</td><td>0.55</td><td>0.915</td><td>25473</td>
  </tr>
  <tr>
    <td></td>
    <td>TransFool</td><td>0.36</td><td>0.903</td><td>25416</td><td>0.49</td><td>0.923</td><td>61820</td>
  </tr>
  <tr>
    <td></td>
    <td>CEMA</td><td><b>0.35</b></td><td><b>0.931</b></td><td><b>100</b></td><td><b>0.29</b></td><td><b>0.931</b></td><td><b>100</b></td>
  </tr>
</table>

from 0.16 and 0.18 to 0.41 and 0.32. The best attack performance is achieved with two clusters. Additionally, as shown in Table 14 in the Appendix, reducing the number of attack methods lowers ASR and raises BLEU scores, as smaller adversarial spaces reduce attack effectiveness. Increasing the number of attack algorithms from one to three improves average ASR by 30.3% while decreasing BLEU by 0.16, indicating that more attack methods enhance performance.

Figure 2: The average ASR and BLUE of different clusters’ number. Fewer clusters result in the better attack results.

![Line graphs showing ASR and BLEU vs. number of clusters for SST5 and Emotion datasets](page_1092_1342_340_246.png)

Clustering and vectorization methods. As shown in Figure 3 , both clustering and vectorization methods have random effects on attack performance. The average ASR for Spectral, KMeans, and BIRCH are 67.7%, 65.2%, and 65.1%, respectively, while BLEU scores are approximately 0.21, with no method consistently outperforming the others. This indicates that the impact of clustering methods on attack results is random. Similarly, the
choice of vectorization methods leads to slight fluctuations in both classification and translation, but none achieves SOTA performance. The average ASR for mT5, XLM-R, and one-hot encoding is around 67.7%, with BLEU scores ranging from 0.21 to 0.22, indicating the random impact of vectorization methods.

In summary, clustering and vectorization methods introduce randomness, and while increasing the number of attack methods improves effectiveness, it also prolongs attack time.

5.4 Scalability of CEMA for More Numbers and Types of Tasks

CEMA is extended to six downstream tasks, comprising four classification tasks and two translation tasks, as detailed in Table 12 in the Appendix. It achieves an ASR of over 60%, with BLEU scores below 0.3, demonstrating its effectiveness in six downstream tasks. To explore CEMA’s scalability further, we apply it to a broader set of tasks using the Pokemon dataset (Pinkney, 2022) as victim data. The victim models used include Google Translate (Radford et al., 2021), distilbert-cnn (Sakhapara et al., 2022), and Stable Diffusion V2, with tasks such as translation (Kol et al., 2018), summarization, and text-to-image generation. The evaluation metrics include BLEU, ROUGE Drop Percentage (RDP) (Lin, 2004), and CLIP Drop Percentage (CDP) (Radford et al., 2021). As shown in Table 13 in the Appendix, CEMA exhibits strong performance across all tasks, suggesting its potential for extension. Specifically, the BLEU score is 0.29, with RDP and CDP scores of 47% and 56%, respectively. These results indicate that CEMA is well-suited for multi-task models involving a broader range of tasks and task types.

5.5 Few-shot and Many-shot Queries

We evaluate CEMA’s attack performance under few-shot and many-shot queries, with query numbers set to 10, 50, 100, 1000, and 2000. The results, shown in Table 15 in the Appendix, reveal that attack effectiveness improves with more queries. Notably, CEMA achieves an ASR of over 30% and a BLEU score of 0.19 with only 10 queries.

5.6 Other Results

① we collect relevant internet data as auxiliary information for the victim texts, as described in Table 11 (Appendix) and Section K. CEMA achieves strong results, showing that attackers only need the victim texts’ related information to successfully attack the multi-task system. ② Attack results under defense methods We explore defensive strategies against CEMA, including language modifiers and adversarial training. Detailed results are presented in Section E. While these defenses reduce CEMA’s effectiveness, it still maintains a significant level of attack efficacy.

6 Limitation

CEMA requires training multiple models and generating several candidate adversarial examples, which demands additional time and storage space.

7 Conclusion

We present a multi-task learning attack scenario where attackers have limited access to a model, only being able to query black-box outputs. Therefore, we propose the CEMA method, which achieves SOTA performance with just 100 queries and black-box outputs. Additionally, CEMA can integrate any text classification attack algorithm, and its performance improves as more attack methods are included. We plan to extend CEMA to multi-task models in other domains in the future.

8 Acknowledgments

This work was supported by the Fundamental Research Funds for the Central Universities, Sun Yat-sen University under Grants No. 23xjkc010, Shenzhen Science and Technology Program (No.KQTD20221101093559018), and National Natural Science Foundation of China (No. 62441619).

Figure 3: The average ASR and BLUE of CEMA under various clustering and vectorization methods.
References

Jaehyeon Bae, Seoryeong Kwon, and Seunghwan Myeong. 2024. Enhancing software code vulnerability detection using gpt-4o and claude-3.5 sonnet: A study on prompt engineering techniques. Electronics, 13(13):2657.

Dzmitry Bahdanau. 2014. Neural machine translation by jointly learning to align and translate. arXiv preprint arXiv:1409.0473.

Yonatan Belinkov and Yonatan Bisk. 2017. Synthetic and natural noise both break neural machine translation. arXiv preprint arXiv:1711.02173.

Yujian Cai, Xingguang Li, Yingyu Zhang, Jinsong Li, Fazheng Zhu, and Lin Rao. 2025. Multimodal sentiment analysis based on multi-layer feature fusion and multi-task learning. Scientific Reports, 15(1):2126.

Li Chen, Shaowei Zhu, Abel Andrew, and Zhaoxia Yin. 2024. Reversible attack based on local visible adversarial perturbation. Multimedia Tools and Applications, 83(4):11215–11227.

Minhao Cheng, Jinfeng Yi, Pin-Yu Chen, Huan Zhang, and Cho-Jui Hsieh. 2020. Seq2sick: Evaluating the robustness of sequence-to-sequence models with adversarial examples. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pages 3601–3608.

Yong Cheng, Lu Jiang, and Wolfgang Macherey. 2019. Robust neural machine translation with doubly adversarial inputs. In ACL, pages 4324–4333.

A Conneau. 2019. Unsupervised cross-lingual representation learning at scale. arXiv preprint arXiv:1911.02116.

Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. 2018. Boosting adversarial attacks with momentum. In CVPR, pages 9185–9193.

Javid Ebrahimi, Daniel Lowd, and Dejing Dou. 2018a. On adversarial examples for character-level neural machine translation. In COLING, pages 653–663.

Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018b. Hotflip: White-box adversarial examples for text classification. In ACL, pages 31–36.

Ji Gao, Jack Lanchantin, Mary Lou Soffa, and Yanjun Qi. 2018. Black-box generation of adversarial text sequences to evade deep learning classifiers. In SPW, pages 50–56.

Siddhant Garg and Goutham Ramakrishnan. 2020. Bae: Bert-based adversarial examples for text classification. In EMNLP, pages 6174–6181.

Salah Ghamizi, Maxime Cordy, Mike Papadakis, and Yves Le Traon. 2022. Adversarial robustness in multi-task learning: Promises and illusions. Proceedings of the AAAI Conference on Artificial Intelligence, 36(1):697–705.

Yotam Gil, Yoav Chai, Or Gorodissky, and Jonathan Berant. 2019. White-to-black: Efficient distillation of black-box adversarial attacks. In NAACL-HLT, pages 1373–1379.

Chuan Guo, Alexandre Sablayrolles, Hervé Jégou, and Douwe Kiela. 2021. Gradient-based adversarial attacks against text transformers. In EMNLP, pages 5747–5757.

Pengxin Guo, Yuancheng Xu, Baijiong Lin, and Yu Zhang. 2020. Multi-task adversarial attack. arXiv preprint arXiv:2011.09824.

Xu Han, Qiang Li, Hongbo Cao, Lei Han, Bin Wang, Xuhua Bao, Yufei Han, and Wei Wang. 2024. Bfs2adv: Black-box adversarial attack towards hard-to-attack short texts. CS, page 103817.

Kadhim Hayawi and Sakib Shahriar. 2024. A cross-domain performance report of open ai chatgpt o1 model.

Zhongjun He. 2015. Baidu translate: Research and products. In Proceedings of the Fourth Workshop on Hybrid Approaches to Translation (HyTra), pages 61–62.

Xiaoxue Hu, Geling Liu, Baolin Zheng, Lingchen Zhao, Qian Wang, Yufei Zhang, and Minxin Du. 2024. Fast-textlodger: Decision-based adversarial attack against black-box nlp models with extremely high efficiency. TIFS.

Zhaoxin Huan, Yulong Wang, Xiaolu Zhang, Lin Shang, Chilin Fu, and Jun Zhou. 2020. Data-free adversarial perturbations for practical black-box attack. In PAKDD, pages 127–138. Springer.

Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2020. Is bert really robust? a strong baseline for natural language attack on text classification and entailment. In AAAI, pages 8018–8025.

Yue Jin, Tianqing Zheng, Chao Gao, and Guoqiang Xu. 2021. A multi-modal and multi-task learning method for action unit and expression recognition. arXiv preprint arXiv:2107.04187.

Yan Kang, Jianjun Zhao, Xuekun Yang, Baochen Fan, and Wentao Xie. 2024. A hybrid style transfer with whale optimization algorithm model for textual adversarial attack. NCA, 36:4263–4280.

Sara Kol, Miriam Schcolnik, and Elana Spector-Cohen. 2018. Google translate in academic writing courses? The EuroCALL Review, 26(2):50–57.

K Krishna and M Narasimha Murty. 1999. Genetic k-means algorithm. IEEE Transactions on Systems, Man, and Cybernetics, Part B (Cybernetics), 29(3):433–439.

Huda Mohammed Lateef, Ahmad Muter Awaad, Diadeen Ali Hameed, Ghanim Thiab Hasa, and Tahseen Ameen Faisal. 2024. Evaluation of domain
sulfur industry for dia translator using bilingual evaluation understudy method. Bulletin of Electrical Engineering and Informatics, 13(1):370–376.

Deokjae Lee, Seungyong Moon, Junhyeok Lee, and Hyun Oh Song. 2022. Query-efficient and scalable black-box adversarial attacks on discrete sequential data via bayesian optimization. In ICML, pages 12478–12497.

J Li, S Ji, T Du, B Li, and T Wang. 2019. Textbugger: Generating adversarial text against real-world applications. In 26th Annual Network and Distributed System Security Symposium.

Linyang Li, Ruotian Ma, Qipeng Guo, Xiangyang Xue, and Xipeng Qiu. 2020a. Bert-attack: Adversarial attack against bert using bert. arXiv e-prints, pages arXiv–2004.

Maosen Li, Cheng Deng, Tengjiao Li, Junchi Yan, Xinbo Gao, and Heng Huang. 2020b. Towards transferable targeted attack. In CVPR, pages 638–646. IEEE.

Qizhang Li, Yiwen Guo, and Hao Chen. 2020c. Practiical no-box adversarial attacks against dnns. NeurIPS, 33:12849–12860.

Chin-Yew Lin. 2004. Rouge: A package for automatic evaluation of summaries. In Text summarization branches out, pages 74–81.

Nankai Lin, Sihui Fu, Xiaotian Lin, and Lianxi Wang. 2022. Multi-label emotion classification based on adversarial multi-task learning. Information Processing & Management, 59(6):103097.

Han Liu, Zhi Xu, Xiaotong Zhang, Xiaoming Xu, Feng Zhang, Fenglong Ma, Hongyang Chen, Hong Yu, and Xianchao Zhang. 2023. Sspattack: a simple and sweet paradigm for black-box hard-label textual adversarial attack. In AAAI, volume 37, pages 13228–13235.

Han Liu, Zhi Xu, Xiaotong Zhang, Feng Zhang, Fenglong Ma, Hongyang Chen, Hong Yu, and Xianchao Zhang. 2024. Hqa-attack: Toward high quality black-box hard-label adversarial attack on text. NeurIPS, 36.

Pengfei Liu, Xipeng Qiu, and Xuan-Jing Huang. 2017. Adversarial multi-task learning for text classification. In Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 1–10.

Rishabh Maheshwary, Saket Maheshwary, and Vikram Pudi. 2021a. Generating natural language attacks in a hard label black box setting. In AAAI, pages 13525–13533.

Rishabh Maheshwary, Saket Maheshwary, and Vikram Pudi. 2021b. A strong baseline for query efficient attacks in a black box setting. In EMNLP, pages 8396–8409.

Kaleel Mahmood, Deniz Gurevin, Marten van Dijk, and Phoung Ha Nguyen. 2021. Beware the black-box: On the robustness of recent defenses to adversarial examples. Entropy, 23(10):1359.

Zhao Meng and Roger Wattenhofer. 2020. A geometry-inspired attack for generating natural language adversarial examples. In ACL, pages 6679–6689.

Paul Michel, Xian Li, Graham Neubig, and Juan Miguel Pino. 2019. On evaluation of adversarial perturbations for sequence-to-sequence models. arXiv preprint arXiv:1903.06620.

Muhammad Muzammal Naseer, Salman H Khan, Muhammad Haris Khan, Fahad Shahbaz Khan, and Fatih Porikli. 2019. Cross-domain transferability of adversarial perturbations. In NeurIPS, volume 32.

Andrew Ng, Michael Jordan, and Yair Weiss. 2001. On spectral clustering: Analysis and an algorithm. Advances in neural information processing systems, 14.

Samarnh Pang, Engheang Nol, and Kimkong Heng. 2024. Chatgpt-4o for english language teaching and learning: Features, applications, and future prospects. Cambodian Journal of Educational Research, 4(1):35–56.

Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. 2017. Practical black-box attacks against machine learning. In CCS, pages 506–519.

Nicolas Papernot, Patrick McDaniel, Ananthram Swami, and Richard Harang. 2016. Crafting adversarial input sequences for recurrent neural networks. In MILCOM, pages 49–54.

Martin Pineda, Qianlong Wang, Weixian Liao, Michael McGuire, and Wei Yu. 2022. A multi-model multi-task learning system for hurricane genesis prediction. In International Conference on Software Engineering Research and Applications, pages 113–129.

Justin N.M. Pinkney. 2022. Pokemon blip captions.

Qiumei Pu, Fangli Huang, Fude Li, Jieyao Wei, and Shan Jiang. 2025. Integrating emotional features for stance detection aimed at social network security: A multi-task learning approach. Electronics, 14(1):186.

Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. 2021. Learning transferable visual models from natural language supervision. In ICML, pages 8748–8763.

Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. 2019. Generating natural language adversarial examples through probability weighted word saliency. In ACL, pages 1085–1097.
Luke E Richards, André Nguyen, Ryan Capps, Steven Forsyth, Cynthia Matuszek, and Edward Raff. 2021. Adversarial transfer attacks with unknown data and class overlap. In ACM, pages 13–24.

Pau Rodríguez, Miguel A Bautista, Jordi Gonzalez, and Sergio Escalera. 2018. Beyond one-hot encoding: Lower dimensional target embedding. Image and Vision Computing, 75:21–31.

Sahar Sadrizadeh, Ljiljana Dolamic, and Pascal Frossard. 2023. Transfool: An adversarial attack against neural machine translation models. arXiv preprint arXiv:2302.00944.

Avani Sakhapara, Dipti Pawade, Baiju Dodhia, Jigar Jain, Omkar Bhosale, and Onkar Chakrawar. 2022. Summarization of tweets related to disaster. In Proceedings of International Conference on Recent Trends in Computing: ICRTC 2021, pages 651–665. Springer.

Motoki Sato, Jun Suzuki, Hiroyuki Shindo, and Yuji Matsumoto. 2018. Interpretable adversarial perturbation in input embedding space for text. In IJCAI, pages 4323–4330.

Ibrahim Sobh, Ahmed Hamed, Varun Ravi Kumar, and Senthil Yogamani. 2021. Adversarial attacks on multi-task visual perception for autonomous driving. arXiv preprint arXiv:2107.07449.

Chenghao Sun, Yonggang Zhang, Wan Chaoqun, Qizhou Wang, Ya Li, Tongliang Liu, Bo Han, and Ximnei Tian. 2022. Towards lightweight black-box attack against deep neural networks. NeurIPS, 35:19319–19331.

Samson Tan, Shafiq Joty, Min-Yen Kan, and Richard Socher. 2020. It’s morphin’time! combating linguistic discrimination with inflectional perturbations. arXiv preprint arXiv:2005.04364.

A Vaswani. 2017. Attention is all you need. Advances in Neural Information Processing Systems.

Hetvi Waghela, Sneha Rakshit, and Jaydip Sen. 2024. A modified word saliency-based adversarial attack on text classification models. arXiv preprint arXiv:2403.11297.

Yu Wan, Keqin Bao, Dayiheng Liu, Baosong Yang, Derek F Wong, Lidia S Chao, Wenqiang Lei, and Jun Xie. 2022. Alibaba-translate china’s submission for wmt 2022 metrics shared task. arXiv preprint arXiv:2210.09683.

Boxin Wang, Chejian Xu, Xiangyu Liu, Yu Cheng, and Bo Li. 2022. Semattack: Natural textual attacks via different semantic spaces. In NAACL, pages 176–205.

Hanrui Wang, Shuo Wang, Cunjian Chen, Massimo Tistarelli, and Zhe Jin. 2024. A multi-task adversarial attack against face authentication. arXiv preprint arXiv:2408.08205.

Sunjing Wang, Ying Wang, Linlin Jiang, Yong Chang, Kun Zhao, Lu Chen, Chunzheng Gao, et al. 2025. Assessing the clinical support capabilities of chatgpt 4o and chatgpt 4o mini in managing lumbar disc herniation. European Journal of Medical Research, 30(1):1–9.

Wenqiang Wang, Chongyang Du, Tao Wang, Kaihao Zhang, Wenhan Luo, Lin Ma, Wei Liu, and Xiaochun Cao. 2023. Punctuation-level attack: Single-shot and single punctuation can fool text models. In NeurIPS.

Yuxuan Wang, Wanxiang Che, Ivan Titov, Shay B Cohen, Zhilin Lei, and Ting Liu. 2021a. A closer look into the robustness of neural dependency parsers using better adversarial examples. In ACL, pages 2344–2354.

Zhibo Wang, Hengchang Guo, Zhifei Zhang, Wenxin Liu, Zhan Qin, and Kui Ren. 2021b. Feature importance-aware transferable adversarial attacks. In ICCV, pages 7619–7628. IEEE.

Austin Watkins, Thanh Nguyen-Tang, Enayat Ullah, and Raman Arora. 2024. Adversarially robust multi-task representation learning. In The Thirty-eighth Annual Conference on Neural Information Processing Systems.

Yijun Xiang. 2024. Multi-model fusion and multi-task learning for enhanced earthquake sequence prediction using acoustic signals. In 2024 4th International Conference on Computer Systems (ICCS), pages 28–33. IEEE.

Wang Xiaosen, Kangheng Tong, and Kun He. 2023. Rethinking the backward propagation for adversarial transferability. NeurIPS, 36:1905–1922.

L Xue. 2020. mt5: A massively multilingual pretrained text-to-text transformer. arXiv preprint arXiv:2010.11934.

Zhewei Yao, Amir Gholami, Sheng Shen, Mustafa Mustafa, Kurt Keutzer, and Michael Mahoney. 2021. AdaHessian: An adaptive second order optimizer for machine learning. In proceedings of the AAAI conference on artificial intelligence, volume 35, pages 10665–10673.

Zheng Yuan, Jie Zhang, Yunpei Jia, Chuanqi Tan, Tao Xue, and Shiguang Shan. 2021. Meta gradient adversarial attack. In ICCV, pages 7728–7737. IEEE.

Yuan Zang, Fanchao Qi, Chenghao Yang, Zhiyuan Liu, Meng Zhang, Qun Liu, and Maosong Sun. 2020. Word-level textual adversarial attacking as combinatorial optimization. In ACL, pages 6066–6080.

Tian Zhang, Raghu Ramakrishnan, and Miron Livny. 1996. Birch: an efficient data clustering method for very large databases. ACM sigmod record, 25(2):103–114.
Yinghua Zhang, Yangqiu Song, Jian Liang, Kun Bai, and Qiang Yang. 2020. Two sides of the same coin: White-box and black-box attacks for transfer learning. In SIGKDD, pages 2989–2997.

Yu Zhe, Rei Nagaike, Daiki Nishiyama, Kazuto Fukuchi, and Jun Sakuma. 2024. Adversarial attacks on hidden tasks in multi-task learning. arXiv preprint arXiv:2405.15244.

Mingyi Zhou, Jing Wu, Yipeng Liu, Shuaicheng Liu, and Ce Zhu. 2020. Dast: Data-free substitute training for adversarial attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 234–243.

Hai Zhu, Qingyang Zhao, Weiwei Shang, Yuren Wu, and Kai Liu. 2024. Limeattack: Local explainable method for textual hard-label adversarial attack. In AAAI, volume 38, pages 19759–19767.

Wei Zou, Shujian Huang, Jun Xie, Xinyu Dai, and Jiajun Chen. 2019. A reinforced generation of adversarial examples for neural machine translation. arXiv preprint arXiv:1911.03677.

Overview of the Appendix

This appendix includes our supplementary materials as follows:
- More details of the substitute model in Section A
- More details of data in Section B
- Url of victim model used in Section C
- Details of baselines in Section D
- More details of defense methods in Section E
- Definition of text classification adversarial examples and NMT adversarial examples in Section F
- Experiment result for verifying independence in section G
- The proof of Theorem 4.2 in Section H
- More Explanation for the Non-Independent Case in Section I
- More Details of M3TL in Section J
- Experiment Result under Low-quality Auxiliary Data Setting in Section K
A  Substitute Model

A.1  Substitute Model Architecture
Our substitute model comprises 12 transformer blocks, each with 768 hidden units and 12 self-attention heads. Each transformer block consists of the following substructures:

• Self-Attention Layer: The hidden size of the self-attention layer is 768.

• Position-wise Feed-Forward Network: The network first projects the output of the attention layer to a 3072-dimensional space using a fully connected layer, followed by a ReLU activation for non-linearity, and finally projects the 3072-dimensional space back to a 768-dimensional space via another fully connected layer.

• Layer Normalization and Residual Connection:
  – Layer Normalization: Applied to the output of each sub-layer to stabilize training.
  – Residual Connection: Adds the normalized output to the input of the sub-layer.

A.2  Substitute Model Training
We provide a detailed description of the training of the substitute model with the transformer-based architecture. This substitute model consists of 12 hidden layers with a dimensionality of 768. The activation function “GELU” is used, The dropout rate is 0.4. The training process is optimized with the AdamW optimizer (Yao et al., 2021), with batch size set to 64 and learning rate set to \( 6e - 3 \), over 5 epochs.

A.3  Computation Overhead of the Substitute Model Training
We train six substitute models on a server equipped with a 24 GB NVIDIA 3090 GPU. The training time for a single model is approximately 4 minutes, and the size of each trained model is 418 MB.

B  Details of Datasets
The details of datasets are presented in Table 4

C  The URLs of the Victim Models
The URLs of the victim models are presented in Table 5

D  Details of Baselines
The details of baselines are presented in Table 7 and Table 8

E  Defense Method
We initiate an extensive exploration of defensive strategies to counter CEMA. In practical systems, we thoroughly investigate various defense mechanisms, including train-free adjustments(Preceding Language Modifier) and adversarial training.

E.1  Preceding Language Modifier
The victim models used in our study are after-trained models sourced from the Huggingface website, Ali Translator, and Baidu Translator. Since the training details of these pre-trained models are not publicly available, re-training them using adversarial training is infeasible. Consequently, we adopt training-free defense methods. Specifically, we implement the same approach proposed by (Wang et al., 2023) and apply prompt learning techniques to large language models (LLMs) to mitigate adversarial text inputs. For this, we provide CoEdIT-XXL (a LLM used for correcting text errors). The prompt is as follows: “Please revise the text for grammatical errors, improve the spelling, grammar, clarity, concision, and overall readability.” The results are presented in Figure 4.

“w/o” indicates the absence of a defense method, whereas “w” denotes the use of the CoEdIT-XXL model as a modifier for defense. Even after applying defense mechanisms using large language models, CEMA’s attack effectiveness decreases but still maintains a significant level of performance.

E.2  Adversarial Training
We train four classification models as victim models and conduct adversarial training to evaluate the impact of adversarial training on CEMA’s attack effectiveness. All four models are based on the BERT architecture and are labeled Bert1, Bert2, Bert3, and Bert4. Specifically, Bert1 and Bert3 are trained on the SST5 dataset, while Bert2 and Bert4 are trained on the Emotion dataset. The results are presented in Figure 5. “w/o” indicates the absence of adversarial training, while “w” represents the application of adversarial training. Although adversarial training reduces attack effectiveness, CEMA still demonstrates considerable performance.
Table 4: The statistics of datasets.

<table>
  <tr>
    <th>Dataset</th>
    <th>Classes</th>
    <th>Labels’ name</th>
  </tr>
  <tr>
    <td>SST5</td>
    <td>5</td>
    <td>Very positive, Positive, Neutral, Negative, Very negative</td>
  </tr>
  <tr>
    <td>Emotion</td>
    <td>6</td>
    <td>Sadness, Joy, Love, Anger, Fear, Surprise</td>
  </tr>
</table>

Table 5: The URL of the Victim Models

<table>
  <tr>
    <th>Model</th>
    <th>Url</th>
  </tr>
  <tr>
    <td>dis-sst5(A)</td>
    <td>https://huggingface.co/SetFit/distilbert-base-uncased__sst5__all-train</td>
  </tr>
  <tr>
    <td>dis-emotion(A)</td>
    <td>https://huggingface.co/bhadresh-savani/distilbert-base-uncased-emotion</td>
  </tr>
  <tr>
    <td>opus-mt(En-Zh)(A)</td>
    <td>https://huggingface.co/Helsinki-NLP/opus-mt-En-Zh</td>
  </tr>
  <tr>
    <td>ro-sst5(B)</td>
    <td>https://huggingface.co/Unso/roberta-large-finetuned-sst5</td>
  </tr>
  <tr>
    <td>ro-emotion(B)</td>
    <td>https://huggingface.co/SamLowe/roberta-base-go_emotions</td>
  </tr>
  <tr>
    <td>t5-small(En-Fr)(B)</td>
    <td>https://huggingface.co/Alexle/t5-small-En-Fr</td>
  </tr>
  <tr>
    <td>Baidu Translate (En-Fr) (C)</td>
    <td>https://api.fanyi.baidu.com/</td>
  </tr>
  <tr>
    <td>Ali Translate (En-Zh) (C)</td>
    <td>https://translate.alibaba.com/</td>
  </tr>
</table>

F Definition of Text Classification Adversarial Examples and NMT Adversarial Examples

F.1 Definition of NMT Adversarial Examples

We define the source language space as \( \mathcal{X} \) and the target language space as \( \mathcal{Y} \), examining two NMT systems: the source-to-victim model \( M_{x \rightarrow y} \), which maps \( \mathcal{X} \) to \( \mathcal{Y} \) to maximize \( P(y_{gt} | x) \), and the target-to-source model \( M_{y \rightarrow x} \), which performs the reverse mapping. After training, these models can reconstruct original sentences as \( \hat{x} = g(f(x)) \). We propose black-box adversarial testing for NMT using auxiliary data by selecting test sentences from \( \mathcal{T} \subset \mathcal{X} \) and generating adversarial cases \( \delta \in \Delta \) to perturb inputs \( x' = x + \delta \) such that \( f(x') \) diverges significantly from \( f(x) \).

**NMT Adversarial Example:** An NMT adversarial example is a sentence in

\[
\mathcal{A} = \{ x' \in \mathcal{X} \mid \exists x \in \mathcal{T}, \\
\text{here } \|x' - x\| < \epsilon \land S_t(y, y_{gt}) \geq \gamma \land S_t(y', y_{gt}) < \gamma' \}
\]

where function \( f \) represents the NMT model. The variables \( x \) and \( x' \) represent the original text and the adversarial test case, respectively, while \( y \) and \( y' \) stand for their respective translations. In detail, \( y = f(x) \) and \( y' = f(x') \). The function \( S_t(\cdot, \cdot) \) gauges the similarity between two sentences. Additionally, \( \gamma \) and \( \gamma' \) denote thresholds for acceptable translation quality. Translation quality is deemed unacceptable if \( \gamma' \) drops below \( \gamma \).

F.2 Definition of Text Classification Adversarial Examples

**Definition of Text Classification Adversarial Examples:** Let \( X = \{x_1, x_2, \ldots, x_n\} \) denote a set of text inputs, where each \( x_i \) is a text document (e.g., sentence or paragraph). Let \( f(\cdot) \) represent a text classification model, where:

\[
f : X \to Y
\]

is a mapping from the input space \( X \) to the label space \( Y \), with \( Y = \{y_1, y_2, \ldots, y_m\} \) representing the set of possible class labels (e.g., positive, negative, neutral).

Given an input \( x \in X \) and its corresponding true label \( y_{true} = f(x) \), an **adversarial example** \( \hat{x} \) is a perturbed version of the input \( x \) that is intentionally crafted to cause the model to misclassify it, while remaining perceptually and semantically similar to the original text. Formally, an adversarial example is defined as:

\[
\hat{x} = x + \delta
\]

where \( \delta \) is a small perturbation that satisfies:

\[
\|\delta\| \leq \epsilon
\]

Here, \( \|\delta\| \) represents the magnitude of the perturbation (e.g., measured in terms of the number of word substitutions or sentence modifications), and \( \epsilon \) is a threshold that bounds the maximum allowable perturbation.

Additionally, we impose a *semantic similarity* constraint, ensuring that the perturbation \( \delta \) does not
Table 6: The details of the methods employed in the baseline comparisons. The Perturbed Level indicates the target of the attack methods, where “word” denotes the specific words targeted for perturbation, and “char” refers to the characters within a word that are altered by the attack method.

Table 7: Information on the classification attack method used as the baseline.

<table>
  <tr>
    <th>Methods</th>
    <th>Perturbed Level</th>
    <th>Gradient</th>
    <th>Soft-labels</th>
    <th>Hard-labels</th>
    <th>Knowledge</th>
  </tr>
  <tr>
    <td>Bae</td>
    <td>Word</td>
    <td>✗</td>
    <td>✓</td>
    <td>✓</td>
    <td>black-box</td>
  </tr>
  <tr>
    <td>FD</td>
    <td>Char</td>
    <td>✓</td>
    <td>✓</td>
    <td>✓</td>
    <td>white-box</td>
  </tr>
  <tr>
    <td>Hotflip</td>
    <td>Char</td>
    <td>✓</td>
    <td>✓</td>
    <td>✓</td>
    <td>white-box</td>
  </tr>
  <tr>
    <td>PSO</td>
    <td>Word</td>
    <td>✗</td>
    <td>✓</td>
    <td>✓</td>
    <td>black-box</td>
  </tr>
  <tr>
    <td>TextBugger</td>
    <td>Char+Word</td>
    <td>✓</td>
    <td>✓</td>
    <td>✓</td>
    <td>white-box</td>
  </tr>
  <tr>
    <td>Leap</td>
    <td>Word</td>
    <td>✗</td>
    <td>✓</td>
    <td>✓</td>
    <td>black-box</td>
  </tr>
  <tr>
    <td>CT-GAT</td>
    <td>Word</td>
    <td>✗</td>
    <td>✓</td>
    <td>✓</td>
    <td>black-box</td>
  </tr>
  <tr>
    <td>HQA</td>
    <td>Word</td>
    <td>✗</td>
    <td>✓</td>
    <td>✓</td>
    <td>black-box</td>
  </tr>
  <tr>
    <td>CEMA</td>
    <td>Char+Word</td>
    <td>✗</td>
    <td>✗</td>
    <td>✓</td>
    <td>black-box</td>
  </tr>
</table>

Table 8: Information on the translation attack method used as the baseline.

<table>
  <tr>
    <th>Methods</th>
    <th>Perturbed Level</th>
    <th>Gradient</th>
    <th>Soft-labels</th>
    <th>Hard-labels</th>
    <th>Knowledge</th>
  </tr>
  <tr>
    <td>Hot-trans</td>
    <td>Char</td>
    <td>✓</td>
    <td>✗</td>
    <td>✗</td>
    <td>white-box</td>
  </tr>
  <tr>
    <td>kNN</td>
    <td>Word</td>
    <td>✓</td>
    <td>✗</td>
    <td>✗</td>
    <td>white-box</td>
  </tr>
  <tr>
    <td>Morphin</td>
    <td>Word</td>
    <td>✗</td>
    <td>✗</td>
    <td>✓</td>
    <td>black-box</td>
  </tr>
  <tr>
    <td>RA</td>
    <td>Word</td>
    <td>✓</td>
    <td>✗</td>
    <td>✗</td>
    <td>white-box</td>
  </tr>
  <tr>
    <td>Seq2Sick</td>
    <td>Word</td>
    <td>✓</td>
    <td>✗</td>
    <td>✓</td>
    <td>white-box</td>
  </tr>
  <tr>
    <td>TransFool</td>
    <td>Word</td>
    <td>✗</td>
    <td>✗</td>
    <td>✓</td>
    <td>black-box</td>
  </tr>
  <tr>
    <td>CEMA</td>
    <td>Char+Word</td>
    <td>✗</td>
    <td>✗</td>
    <td>✓</td>
    <td>black-box</td>
  </tr>
</table>

alter the meaning of the input significantly. This is formalized as:

\[
\operatorname{Sim}(x, \hat{x}) \leq \gamma
\]

where \( \operatorname{Sim}(x, \hat{x}) \) denotes a semantic similarity measure (such as cosine similarity) between the original input \( x \) and the adversarial example \( \hat{x} \), and \( \gamma \) is a predefined threshold that controls the acceptable level of semantic similarity. This ensures that the adversarial example \( \hat{x} \) remains semantically close to \( x \), while still leading to a misclassification.

The adversarial example \( \hat{x} \) causes the model to output a different class than the true label:

\[
f(\hat{x}) \neq y_{true} \quad \text{and} \quad f(x) = y_{true}
\]

Thus, the text classification adversarial example \( \hat{x} \) satisfies the following optimization problem:

\[
\hat{x} = \argmin_{x' \in X} \mathcal{L}(f(x'), y_{true})
\]

subject to \( \|x' - x\| \leq \epsilon \) and \( \operatorname{Sim}(x, x') \geq \gamma \)

where \( \mathcal{L}(\cdot) \) is the loss function used to measure the discrepancy between the predicted label \( f(x') \) and the true label \( y_{true} \).

G The Experiment for Verifying Independence

We employ the DWB, FD, TextBugger, Hotflip, and PSO methods to generate adversarial examples in the subset of the test dataset. Since the exact success probabilities of each method’s attacks are unavailable, we estimate these probabilities based on the observed frequency of successful attacks. In the table, we report the frequency \( P(AB) \) of both methods successfully attacking, as well as the individual success frequencies \( P(A) \) for Method A and \( P(B) \) for Method B. Our findings indicate that \( P(AB) \) closely approximates \( P(A) \times P(B) \), with the average deviation \( P(A) \times P(B) - P(AB) \)
Table 9: Experiment results with improving the similarity threshold and adding attack methods for victim model A

<table>
  <tr>
    <th>Similarity Threshold</th>
    <th>Method Number</th>
    <th>ASR(%)↑</th>
    <th>ASR(%)↑</th>
    <th>BLEU↓</th>
    <th>Similarity↑</th>
  </tr>
  <tr>
    <td>0.8</td>
    <td>3</td>
    <td>73.57</td>
    <td>62.27</td>
    <td>0.14</td>
    <td>0.93</td>
  </tr>
  <tr>
    <td>0.9</td>
    <td>6</td>
    <td>67.16</td>
    <td>58.89</td>
    <td>0.16</td>
    <td>0.95</td>
  </tr>
  <tr>
    <td>0.8</td>
    <td>3</td>
    <td>80.80</td>
    <td>65.40</td>
    <td>0.15</td>
    <td>0.93</td>
  </tr>
  <tr>
    <td>0.9</td>
    <td>6</td>
    <td>78.25</td>
    <td>61.15</td>
    <td>0.16</td>
    <td>0.94</td>
  </tr>
</table>

Table 10: The experimental results for verifying independence.

<table>
  <tr>
    <th>Method A</th>
    <th>Method B</th>
    <th>P(A)</th>
    <th>P(B)</th>
    <th>P(A)*P(B)</th>
    <th>P(AB)</th>
    <th>P(A)*P(B)-P(AB)</th>
  </tr>
  <tr>
    <td>DWB</td>
    <td>FD</td>
    <td>52.50%</td>
    <td>40.50%</td>
    <td>21.26%</td>
    <td>19.00%</td>
    <td>2.26%</td>
  </tr>
  <tr>
    <td>DWB</td>
    <td>Textbugger</td>
    <td>52.50%</td>
    <td>72.50%</td>
    <td>38.06%</td>
    <td>35.50%</td>
    <td>2.56%</td>
  </tr>
  <tr>
    <td>DWB</td>
    <td>Hotflip</td>
    <td>52.50%</td>
    <td>72.50%</td>
    <td>38.06%</td>
    <td>37.00%</td>
    <td>1.06%</td>
  </tr>
  <tr>
    <td>DWB</td>
    <td>PSO</td>
    <td>52.50%</td>
    <td>76.50%</td>
    <td>40.16%</td>
    <td>35.00%</td>
    <td>5.16%</td>
  </tr>
  <tr>
    <td>FD</td>
    <td>Textbugger</td>
    <td>40.50%</td>
    <td>72.50%</td>
    <td>29.36%</td>
    <td>31.00%</td>
    <td>-1.64%</td>
  </tr>
  <tr>
    <td>FD</td>
    <td>Hotflip</td>
    <td>40.50%</td>
    <td>72.50%</td>
    <td>29.36%</td>
    <td>31.50%</td>
    <td>-2.14%</td>
  </tr>
  <tr>
    <td>FD</td>
    <td>PSO</td>
    <td>40.50%</td>
    <td>76.50%</td>
    <td>30.98%</td>
    <td>30.50%</td>
    <td>0.48%</td>
  </tr>
  <tr>
    <td>Textbugger</td>
    <td>Hotflip</td>
    <td>72.50%</td>
    <td>72.50%</td>
    <td>52.56%</td>
    <td>57.50%</td>
    <td>-4.94%</td>
  </tr>
  <tr>
    <td>Textbugger</td>
    <td>PSO</td>
    <td>72.50%</td>
    <td>76.50%</td>
    <td>55.46%</td>
    <td>54.00%</td>
    <td>1.46%</td>
  </tr>
  <tr>
    <td>Hotflip</td>
    <td>PSO</td>
    <td>72.50%</td>
    <td>76.50%</td>
    <td>55.46%</td>
    <td>58.00%</td>
    <td>-2.54%</td>
  </tr>
  <tr>
    <td>Average</td>
    <td></td>
    <td></td>
    <td></td>
    <td>39.07%</td>
    <td>38.90%</td>
    <td>0.17%</td>
  </tr>
</table>

being just 0.17%. The detailed experimental results are provided in Table 10. Event independence is defined as the occurrence of event A having no effect on the occurrence of event B. Therefore, we assume that the success of adversarial examples generated by Method A does not influence the success of those generated by Method B.

H  The Proof of Theorem 4.2

We aim to prove that the probability of at least one successful attack, denoted as \( P(A^u) \), increases as the number of attack methods \( u \) increases. Specifically, we want to show that:

\[
P(A^u) \leq P(A^{u+1}), \quad \text{for all} \quad u \geq 1,
\]

where \( A^u \) represents the event that at least one of the \( u \) attack methods succeeds, and \( A^{u+1} \) represents the event that at least one of the \( u + 1 \) attack methods succeeds.

**Definitions**
1. Success Probability of Attack Methods: - Let \( p_j^i \) be the success probability of the \( j \)-th attack method of the victim text \( x_i^* \).
2. Event \( A^u \): - \( A^u \) denotes the event that at least one of the \( u \) attack methods succeeds, i.e.,

\[
A^u = A_1 \cup A_2 \cup \cdots \cup A_u,
\]

where \( A_i \) is the event that the \( i \)-th attack method succeeds.
3. Event \( \overline{A^u} \): - \( \overline{A^u} \) denotes the event where none of the \( u \) attack methods succeeds, i.e.,

\[
\overline{A^u} = \overline{A_1} \cap \overline{A_2} \cap \cdots \cap \overline{A_u}.
\]

Therefore, the probability of at least one success is:

\[
P(A^u) = 1 - P(\overline{A^u}).
\]

4. Event \( A^{u+1} \): - Similarly, for \( u + 1 \) attack methods, \( A^{u+1} \) is defined as:

\[
A^{u+1} = A_1 \cup A_2 \cup \cdots \cup A_{u+1},
\]

and \( \overline{A^{u+1}} \) represents the event where none of the \( u + 1 \) attack methods succeeds:

\[
\overline{A^{u+1}} = \overline{A_1} \cap \overline{A_2} \cap \cdots \cap \overline{A_{u+1}}.
\]

Therefore, the probability of at least one success with \( u + 1 \) attack methods is:

\[
P(A^{u+1}) = 1 - P(\overline{A^{u+1}}).
\]

**Goal**
Figure 4: The results of Preceding Language Modifier

Figure 5: The results of adversarial training.

We want to prove that

\[
P(A^u) \leq P(A^{u+1}),
\]

i.e., the probability of at least one success increases as the number of attack methods \( u \) increases.

**Proof Process**
Step 1: Probability of Failure with \( u \) Attack Methods

Methods
The probability of failure with \( u \) attack methods is given by:

\[
P(\overline{A^u}) = P(\overline{A_1} \cap \overline{A_2} \cap \cdots \cap \overline{A_u}).
\] (17)

- Independent Events: If the attack methods are independent, the failure probability is:

\[
P(\overline{A^u}) = \prod_{j=1}^u (1 - p_i^j).
\] (18)

- Dependent Events: If the attack methods are not independent, we have:

\[
P(\overline{A^u}) \leq \prod_{j=1}^u (1 - p_i^j).
\] (19)

Step 2: Probability of Failure with \( u + 1 \) Attack Methods
The probability of failure with \( u + 1 \) attack methods is:
\[
P(A^{u+1}) = P(\overline{A_1} \cap \overline{A_2} \cap \cdots \cap \overline{A_{u+1}}).
\] (20)

- Independent Events: If the attack methods are independent, the failure probability is:

\[
P(\overline{A^{u+1}}) = \prod_{j=1}^{u+1} (1 - p_i^j).
\] (21)

- Dependent Events: If the attack methods are dependent, we have:

\[
P(\overline{A^{u+1}}) \leq \prod_{j=1}^{u+1} (1 - p_i^j).
\] (22)

Step 3: Comparing \(P(A^u)\) and \(P(A^{u+1})\)
We know:
\[
P(A^u) = 1 - P(\overline{A^u}),
\] (23)
\[
P(A^{u+1}) = 1 - P(\overline{A^{u+1}}).
\] (24)

- Independent Events:
\[
P(A^u) = 1 - \prod_{j=1}^u (1 - p_i^j),
\] (25)
\[
P(A^{u+1}) = 1 - \prod_{j=1}^{u+1} (1 - p_i^j).
\] (26)

Since \( \prod_{j=1}^{u+1} (1 - p_i^j) \leq \prod_{j=1}^u (1 - p_i^j) \), we have:
\[
P(A^{u+1}) \geq P(A^u).
\] (27)

- Dependent Events:
Similarly, since \(P(A^{u+1}) \leq \prod_{j=1}^{u+1} (1 - p_i^j)\) and \(P(\overline{A^u}) \leq \prod_{j=1}^u (1 - p_i^j)\), we conclude that:
\[
P(A^{u+1}) \geq P(A^u).
\] (28)

Conclusion
Thus, we have proven that:
\[
P(A^u) \leq P(A^{u+1}),
\] (29)
i.e., the probability of at least one success increases as the number of attack methods \(u\) increases.

Condition for Equality
Equality \(P(A^u) = P(A^{u+1})\) holds under the following conditions:
- The attack methods are completely independent and have identical success probabilities \(p_i^j = p_{u+1}^s\) for all \(i\), in which case adding an attack method does not change the overall failure probability.
- The newly added attack method does not contribute any additional success probability. This occurs when the new attack method is redundant or has no distinct contribution to the attack success.

Discussion of Small Probability Events
When the success probability of each attack method \(p_i^j\) is small (i.e., the attack methods have low success rates), in most cases, adding more attack methods leads to a significant increase in the probability of at least one success. This is because each additional attack method provides another opportunity for success, which, even with low individual probabilities, results in a cumulative increase in the overall success probability.

Therefore, in practical scenarios where each attack method has a small success probability, adding more methods increases the likelihood of at least one successful attack. This cumulative effect ensures that \(P(A^u)\) grows as \(u\) increases.

Remark In Section I of the appendix, we examine the case of non-independence. We find that, in the non-independent scenario, using more methods to generate adversarial examples increases the likelihood of successfully attacking the victim model.

Similarly, we can also prove \(P(B^u) \leq P(B^{u+1})\)

I Supplementary Explanation for the Non-Independent Case in Section Candidate Adversarial Example Generation

The probability of successfully attacking the victim model using adversarial examples generated by methods 1, 2, ..., \(n\) is greater than or equal to the probability of successfully attacking the victim model using adversarial examples generated by method 1 alone. This is because, when only method 1 is used, there is only one candidate adversarial example per victim text. In contrast, when \(n\) methods are employed, there are \(n\) candidate adversarial examples for each victim text, including the one generated by method 1. Therefore, the probability of successfully attacking the victim model using adversarial examples generated by \(n\) methods is greater than or equal to the probability of successfully attacking the victim model using adversarial examples from method 1 alone. The probabilities are equal only when method 1 achieves the maximum success rate for all victim texts. However, the SST5 and Emotion datasets contain 2,210 and
2,000 victim texts, respectively, making it unlikely that method 1 will achieve the maximum success rate across all victim texts. Thus, we conclude that, in most cases, the probability of successfully attacking the victim model using adversarial examples generated by \( n \) methods is greater than when using adversarial examples generated by method 1 alone.

Furthermore, based on this property, we can deduce that, in most cases, the probability of successfully attacking the victim model using adversarial examples generated by methods 1, 2, ..., \( n \) is greater than when using adversarial examples generated by methods 1, 2, ..., \( m \), where \( n > m \). In other words, employing more methods to generate adversarial examples increases the likelihood of a successful attack on the victim model.

J Multi-model Multi-task Learning (M3TL)

Multi-model Multi-task Learning (M3TL) is a machine learning method that combines multiple learning models with multiple tasks. It is a combination of Multi-task Learning (MTL) and Multi-model Learning, aiming to improve model performance by jointly optimizing multiple tasks, especially when dealing with multiple related tasks.

J.1 Key Concepts

J.1.1 Multi-task Learning (MTL)

In traditional machine learning, each model typically handles a single task. In contrast, Multi-task Learning (MTL) involves jointly training multiple related tasks with a shared model. The goal is to allow the model to simultaneously optimize multiple objectives by sharing representations, knowledge, or parameters. Common applications include sentiment analysis and text classification, where the same features can be used for multiple tasks (e.g., predicting sentiment labels and classifying news articles). For instance, training a neural network to simultaneously perform two tasks: image classification and object detection.

J.1.2 Multi-model Learning

Unlike traditional single-model approaches, Multi-model Learning uses multiple independent or combined models to solve a problem. Each model may focus on different aspects of the problem or apply different algorithms to address the same task. For example, using multiple models such as neural networks, decision trees, and support vector machines to handle the same task, thereby leveraging the strengths of each model.

J.1.3 Multi-model Multi-task Learning (M3TL)

M3TL is a method that combines Multi-task Learning and Multi-model Learning. The core idea is to use multiple models (e.g., neural networks, decision trees, support vector machines, etc.) to learn multiple related tasks, with these models sharing some information or parameters. This means that during training, M3TL models handle multiple tasks and models simultaneously, enabling each model to learn across multiple tasks while sharing representations and knowledge between tasks.

K Low-quality Auxiliary Data

Initially, we treated the victim texts as auxiliary data. Now, we assume that the attacker cannot access the victim texts directly but can gather victim texts’ relevant information and collect relevant internet data as the auxiliary data. For example, the SST5 and Emotion datasets, both related to sentiment analysis but differing in label space and distribution. We use 100 unlabeled texts from the Emotion validation set as auxiliary data for the SST5 attack, and vice versa. The results in Table 11 show that despite limited auxiliary data and distribution differences, CEMA achieved a 66.45% attack success rate and a BLEU score of 0.27. This demonstrates that an attacker only needs partial knowledge of the victim’s data and can collect relevant information from the web to successfully attack the multi-task system using CEMA.
Table 11: Attack performance of Low-quality Auxiliary Data.

<table>
  <tr>
    <th rowspan="2">Victim Data</th>
    <th rowspan="2">Access Data</th>
    <th colspan="3">Victim Model A</th>
    <th colspan="3">Victim Model B</th>
    <th colspan="3">Victim Model C</th>
  </tr>
  <tr>
    <th>dis-sst5</th>
    <th>dis-emotion</th>
    <th>opus-mt (en-zh) (A)</th>
    <th>ro-sst5 (A)</th>
    <th>ro-emotion (A)</th>
    <th>t5-small (en-fr)</th>
    <th>Baidu Translate (en-fr)</th>
    <th>Ali Translate (en-zh)</th>
    <th>BLEU↓</th>
    <th>BLEU↓</th>
  </tr>
  <tr>
    <td>SST5</td>
    <td>SST5</td>
    <td>73.6</td>
    <td>62.3</td>
    <td>0.14</td>
    <td>75.7</td>
    <td>64.0</td>
    <td>0.18</td>
    <td>0.29</td>
    <td>0.15</td>
  </tr>
  <tr>
    <td>Emotion</td>
    <td>Emotion</td>
    <td>64.0</td>
    <td>60.8</td>
    <td>0.18</td>
    <td>59.2</td>
    <td>52.0</td>
    <td>0.22</td>
    <td>0.36</td>
    <td>0.27</td>
  </tr>
  <tr>
    <td>Emotion</td>
    <td>SST5</td>
    <td>80.8</td>
    <td>65.4</td>
    <td>0.15</td>
    <td>60.4</td>
    <td>59.6</td>
    <td>0.23</td>
    <td>0.35</td>
    <td>0.29</td>
  </tr>
  <tr>
    <td>Emotion</td>
    <td>SST5</td>
    <td>66.4</td>
    <td>36.0</td>
    <td>0.21</td>
    <td>48.8</td>
    <td>46.4</td>
    <td>0.36</td>
    <td>0.44</td>
    <td>0.42</td>
  </tr>
</table>

Table 12: The results of six tasks

<table>
  <tr>
    <th rowspan="2">Data</th>
    <th colspan="4">ASR(%)</th>
    <th colspan="2">BLEU</th>
  </tr>
  <tr>
    <th>dis-emotion</th>
    <th>ro-emotion</th>
    <th>dis-sst5</th>
    <th>ro-sst5</th>
    <th>opus-mt</th>
    <th>t5-small</th>
  </tr>
  <tr>
    <td>SST5</td>
    <td>75.91</td>
    <td>74.90</td>
    <td>67.04</td>
    <td>62.82</td>
    <td>0.18</td>
    <td>0.22</td>
  </tr>
  <tr>
    <td>Emotion</td>
    <td>83.25</td>
    <td>66.85</td>
    <td>71.35</td>
    <td>68.40</td>
    <td>0.17</td>
    <td>0.27</td>
  </tr>
</table>

Table 13: The results of translation, summary, and text-to-image tasks.

<table>
  <tr>
    <th>Data</th>
    <th>Task</th>
    <th>Metric</th>
    <th>Score</th>
  </tr>
  <tr>
    <td rowspan="3">Pokemon</td>
    <td>Translation</td>
    <td>BLEU</td>
    <td>0.29</td>
  </tr>
  <tr>
    <td>Summary</td>
    <td>RDP</td>
    <td>47%</td>
  </tr>
  <tr>
    <td>Text to Image</td>
    <td>CDP</td>
    <td>56%</td>
  </tr>
</table>

Table 14: Performance of CEMA under different number setting of candidate adversarial examples.

<table>
  <tr>
    <th rowspan="2">Data</th>
    <th rowspan="2">Example Number</th>
    <th colspan="4">Victim Model A</th>
    <th colspan="4">Victim Model B</th>
  </tr>
  <tr>
    <th>dis-sst5 (A)</th>
    <th>dis-emoton (A)</th>
    <th>opumt(En-Zh) (A)</th>
    <th>ro-sst5 (B)</th>
    <th>ro-emotion (B)</th>
    <th>t5-small(En-Fr) (B)</th>
    <th>BLEU↓</th>
    <th>BLEU↓</th>
  </tr>
  <tr>
    <td rowspan="2">SST5</td>
    <td>3</td>
    <td>73.6</td>
    <td>62.3</td>
    <td>0.14</td>
    <td>75.7</td>
    <td>64.0</td>
    <td>0.18</td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>1</td>
    <td>50.4</td>
    <td>29.2</td>
    <td>0.30</td>
    <td>43.8</td>
    <td>24.7</td>
    <td>0.35</td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td rowspan="2">Emotion</td>
    <td>3</td>
    <td>80.8</td>
    <td>65.4</td>
    <td>0.15</td>
    <td>60.4</td>
    <td>59.6</td>
    <td>0.23</td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>1</td>
    <td>29.2</td>
    <td>34.8</td>
    <td>0.31</td>
    <td>39.2</td>
    <td>47.2</td>
    <td>0.39</td>
    <td></td>
    <td></td>
  </tr>
</table>

Table 15: The results of few-shot and many-shot queries

<table>
  <tr>
    <th rowspan="2">Model</th>
    <th colspan="5">Victim Model A</th>
    <th colspan="5">Victim Model B</th>
  </tr>
  <tr>
    <th>dis-sst5</th>
    <th>dis-emotion</th>
    <th>opus-mt</th>
    <th>dis-sst5</th>
    <th>dis-emotion</th>
    <th>opus-mt</th>
    <th>ro-sst5</th>
    <th>ro-emotion</th>
    <th>t5-small</th>
    <th>ro-sst5</th>
    <th>t5-small</th>
    <th>BLEU↓</th>
    <th>BLEU↓</th>
  </tr>
  <tr>
    <td rowspan="2">Data</td>
    <td>SST5</td>
    <td></td>
    <td></td>
    <td>Emotion</td>
    <td></td>
    <td></td>
    <td>SST5</td>
    <td></td>
    <td></td>
    <td>Emotion</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>Shot-Size</td>
    <td>ASR(%)↑</td>
    <td>ASR(%)↑</td>
    <td>BLEU↓</td>
    <td>ASR(%)↑</td>
    <td>ASR(%)↑</td>
    <td>BLEU↓</td>
    <td>ASR(%)↑</td>
    <td>ASR(%)↑</td>
    <td>BLEU↓</td>
    <td>ASR(%)↑</td>
    <td>ASR(%)↑</td>
    <td>BLEU↓</td>
    <td>BLEU↓</td>
  </tr>
  <tr>
    <td>2000</td>
    <td>87.56</td>
    <td>83.27</td>
    <td>0.1</td>
    <td>91.7</td>
    <td>81.45</td>
    <td>0.1</td>
    <td>86.46</td>
    <td>78.47</td>
    <td>0.15</td>
    <td>67.45</td>
    <td>69.55</td>
    <td>0.16</td>
    <td></td>
  </tr>
  <tr>
    <td>1000</td>
    <td>83.04</td>
    <td>76.76</td>
    <td>0.11</td>
    <td>88.25</td>
    <td>76.15</td>
    <td>0.12</td>
    <td>84.16</td>
    <td>73.49</td>
    <td>0.16</td>
    <td>66.35</td>
    <td>67.05</td>
    <td>0.17</td>
    <td></td>
  </tr>
  <tr>
    <td><b>100</b></td>
    <td>73.57</td>
    <td>62.27</td>
    <td>0.14</td>
    <td>80.8</td>
    <td>65.4</td>
    <td>0.15</td>
    <td>75.66</td>
    <td>64.01</td>
    <td>0.18</td>
    <td>60.4</td>
    <td>59.60</td>
    <td>0.23</td>
    <td></td>
  </tr>
  <tr>
    <td>50</td>
    <td>63.71</td>
    <td>45.64</td>
    <td>0.15</td>
    <td>71.05</td>
    <td>53.55</td>
    <td>0.18</td>
    <td>71.69</td>
    <td>59.38</td>
    <td>0.19</td>
    <td>58.65</td>
    <td>57.9</td>
    <td>0.24</td>
    <td></td>
  </tr>
  <tr>
    <td>10</td>
    <td>38.38</td>
    <td>32.06</td>
    <td>0.19</td>
    <td>43.35</td>
    <td>37.7</td>
    <td>0.21</td>
    <td>59.28</td>
    <td>46.51</td>
    <td>0.21</td>
    <td>46.15</td>
    <td>41.75</td>
    <td>0.27</td>
    <td></td>
  </tr>
</table>

Reviewer paper summaries: This paper presents an approach to attack black-box, multi-task victim models with a few shots (all the assumptions are important to identify comparable baselines).

Very in brief, the key idea of the approach is to attack intermediate-level representations rather than the downstream tasks. To this aim, the authors use the victim model to generate a task output for a given text, vectorize the text jointly with the output, cluster the vectors with an existing binary clustering algorithm, and create a “substitute model” that classifies the text into its binary label. Then, adversarial attacks are identified over the substitute model (eq. 4). This is made more robust by choosing the majority attack over multiple substitute models.

The attacks are evaluated against two LLMs, which are natural multi-task models, and three specifically-assembled multi-task models (nicknamed A, B and C in the paper).

The paper introduces CEMA (Cluster and Ensemble Multi-task Adversarial Attack), a black-box attack framework that trains multiple substitute models using deep-level labels derived from clustering representations of input-output pairs from victim models. Adversarial examples are then generated by applying various existing attack methods to these substitute models. The adversarial example with the highest transferability is selected based on its success rate across the ensemble of substitute models. CEMA is evaluated on a wide range of tasks and demonstrates strong performance against black-box commercial APIs compared with baselines.
Summary of strengths: •	The idea is very thoughtful, and the results give evidence to its effectiveness.

•	The approach doesn’t require any query of the victim models at run time (only a tiny number for training the substitute models).

•	A very ample ablation has been conducted (Section 5.3) and the Appendix is very rich.

1. The authors propose the concept of deep-level attacks, which aim to capture general semantic features across tasks. In the context of text-based adversarial attacks, they implement binary clustering to create pseudo-labels, significantly reducing the need for extensive queries to obtain multi-task annotations for substitute model training. This makes adversarial attacks more feasible and efficient in black-box settings.
2. Experimental results show that the proposed CEMA framework achieves state-of-the-art attack success rates with as few as 100 queries, and maintains strong performance even with just 10 queries, which are far fewer than required by most existing black-box attack methods.
3. The use of multiple substitute models to evaluate the transferability of adversarial examples is a compelling strategy. While it implicitly assumes that transferability from deep-level label classification generalizes to other tasks, the ensemble approach adds robustness and increases the likelihood of effective cross-task attacks.
Summary of weaknesses: •	The baseline for the LLM experiments is just a notional baseline. Something more serious could have been tested.

•	Two datasets for the evaluation is a bit scant; however, many other dimensions have been explored (victim models, attack approaches etc).

•	Was the ASR computed at a level of 0.8 similarity? Was that sufficient to ensure substantial label preservation, or there are many successful attacks which are instead correct classifications? A discussion is in order.

•	The paper says that the number of query per samples was limited to 30. SST5 has 2210 test samples, so Total-Qry should be capped to 66300. Some tables report larger values. Ditto for Emotion.

1. The connection between the binary clustering strategy and the concept of deep-level labels illustrated by the cat/bird image classification example is somewhat vague. It is not entirely clear why the resulting cluster labels should be considered deep-level, especially compared to the downstream tasks. A more formal or theoretical definition of what constitutes a deep-level label would enhance clarity and strengthen the conceptual foundation.
2. In Section 4.1 (Observations and Motivations), the example based on image classification appears to be purely hypothetical. It would be helpful to clarify whether this example is grounded in empirical observation or merely a motivating intuition, and ideally support it with data or references that demonstrate the claimed transferability across tasks.
3. While the experiments show that using two clusters leads to better performance, the reasoning behind this result is not well explained. It remains unclear whether this is due to the nature of the tasks, the datasets used, or some inherent advantage of binary clustering. A deeper analysis or ablation study across different datasets could help clarify this point.
Comments, suggestions and typos: •	Typo in (4): the argument to f_s has to be x_i, not \tilde(x_i) (the variable, not the argmax).

•	There are three empty sections in the Appendix (E, F, G). In addition, there are references to the wrong tables. The Appendix needs to be revised carefully.

•	Can you explain more clearly which actual attack approaches have been used to attack the substitute models?

Typo: line 227, x -> x*

Suggestions:
1. It would significantly improve clarity to include more rigorous or mathematically grounded definitions of core ideas—especially deep-level labels, which are central to the method but currently lack a precise formal description.
2. If applying adversarial training to the substitute models, which could improve their robustness, would it benefit the final adversarial attack capabilities of CEMA?
Overall assessment scores: 4

4
Metareview score: 3.5
Metareview: The paper explores how attackers can use few-shot queries to generate adversarial examples in a black-box multi-task learning model with diverse task types. The task is quite interesting and useful in current LLM applications. The method is illustrated and the concerns are well-explained during the rebuttal period.
Summary of reasons to publish: The paper studies an interesting topic and the experiments on GPT-4o and Claude make the method more practical.