SlowGuess/NAACL_2021_OCR huggingface dataset:
We include the results of DBpedia ontology dataset (DBpedia; Zhang et al., 2015, Stanford sentiment treebank (SST-2; Socher et al., 2013), Microsoft Research Paraphrase Corpus (MRPC; Dolan and Brockett, 2005), and Quora Question Pairs (QQP) from the GLUE benchmark in this section. Table 9 summarizes come statistics of these datasets. The results of different models on these datasets are summarized Table 10. Compared with all baselines, CLARE achieves the best performance on attack success rate, perplexity, grammaticality, and similarity. It is consistent with our observation in §3.3.
A.3 Human Evaluation Details
For each human evaluation on AG News dataset, we randomly sampled 300 sentences from the test set combining the corresponding adversarial examples from CLARE and TextFooler (We only consider sentences can be attacked by both models). In order to make the task less abstract, we pair the adversarial examples by the two models, and present them to the participants along with the original input and its gold label. We ask them which one they prefer in terms of (1) having more similar a meaning to the original input (similarity), and (2) being more fluent and grammatical (fluency and grammaticality). We also provide them with a neutral option, when the participants consider the two
10https://github.com/huggingface/ transformers 11https://github.com/jindl1/TextFollower 12https://github.com/LinyangLee/ BERT-Attack
SST-2 (PPL = 99.5)	DBpedia (PPL = 37.3)
Model	A-rate↑	Mod↓	PPL↓	GErr↓	Sim↑	A-rate↑	Mod↓	PPL↓	GErr↓	Sim↑
TextFooler	89.8	14.9	227.7	0.53	0.69	56.2	24.9	182.5	1.88	0.68
+ LM	51.7	18.3	137.5	0.50	0.69	20.1	22.4	84.0	1.22	0.70
BERTAttack	87.8	8.1	142.9	0.03	0.67	60.7	9.1	57.8	0.20	0.69
CLARE	97.8	7.5	137.4	0.01	0.75	65.8	7.0	53.3	-0.03	0.73
QQP (PPL = 56.2)	MRPC (PPL = 42.9)
Model	A-rate↑	Mod↓	PPL↓	GErr↓	Sim↑	A-rate↑	Mod↓	PPL↓	GErr↓	Sim↑
TextFooler	16.2	12.7	145.2	0.61	0.74	24.5	10.6	118.8	0.35	0.75
+ LM	7.8	12.9	78.8	0.21	0.77	12.9	9.5	71.0	0.29	0.79
BERTAttack	24.2	11.3	78.0	0.25	0.71	29.7	13.5	74.6	0.05	0.79
CLARE	27.7	10.2	74.8	0.14	0.76	34.8	9.1	69.5	0.02	0.83
Table 10: Adversarial example generation performance in attack success rate (A-rate), modification rate (Mod), perplexity (PPL), number of increased grammar errors (GErr), and text similarity (Sim). The perplexity of the original inputs is indicated in parentheses for each dataset. Bold indicates the best performance on each metric.
indistinguishable. Additionally, we ask the participants to annotate the adversarial examples, and compare their annotations against the gold labels (label consistency). Higher label consistency indicates the model is better at causing the victim model to make errors while preserving human predictions.
Each pair of system outputs was randomly presented to 5 crowd-sourced judges, who indicated their preference for similarity, fluency, and grammaticality using the form shown in Figure 3. The labelling task is illustrated in Figure 4. To minimize the impact of spamming, we employed the top-ranked  $30\%$  of U.S. workers provided by the crowdsourcing service. Detailed task descriptions and examples were also provided to guide the judges. We calculate  $p$ -value based on  $95\%$  confidence intervals by using 10K paired bootstrap replications, implemented using the R Boot statistical package.
A.4 Qualitative Samples
We include generated adversarial examples by CLARE and TextFooler on AG News, DBpeida, Yelp, MNLI, and QNLI datasets in Table 11 and Table 12.
Table 11: Adversarial examples produced by different models. The gold label of the original is shown below the (bolded) dataset name. Replace, Insert and Merge are highlighted in italic red, bold blue and sans serif yellow, respectively. (Best viewed in color).
Table 12: Adversarial examples produced by different models. The gold label of the original is shown below the (bolded) dataset name. Replace, Insert and Merge are highlighted in italic red, bold blue and sans serif yellow, respectively. (Best viewed in color).
Below are three short snippets of text. One of them is the REFERENCE TEXT. Determine the extent to which TEXT #1 and TEXT #2 "mean the same thing" as the REFERENCE TEXT.
Then determine which of TEXT #1 or TEXT #2 is better in terms of grammaticality and fluency.
We would like you to focus on whether the events or state of affairs described in the two texts are the same or different. In other words, are the texts saying similar things about the entities or not? And to what extent are they similar or different?
Please ignore punctuation, spacing, and other minor formatting issues.
REFERENCE TEXT: N. B. truck driver accused in heist of 50,000 cans of Moosehead beer (Canadian Press). Canadian Press-FREDERICTON (CP)-A New Brunswick truck driver arrested in Ontario this week has been accused by police of stealing 50,000 cans of Moosehead beer.
TEXT #1: N. B. automobiles driver culprit in burglaries of 50, 000 pitchers of Moosehead beer (Canada Pulsar). Toronto Press-FREDERICTON (CP)-A New Brunswick truck drivers interned in Simcoe this weeks has been perp by police of burglaries 50, 000 coffers of Moosehead drinkin.
TEXT #2: Winding through rural China, train of medicine restores sight. Impatiently, Gopur Samat constituted at the prepared as disemboweled ocular his the and healing from a physicians toward a steered his entitled attention charts 20 legs externally.
Meaning Preservation: IIGNORING NAMES OF ENTITIES AND NUMBERS, which of the two texts better preserves the meaning of the REFERENCE?
$\odot$  Definitely Text #1.
$\bigcirc$  Maybe Text #1.
Both equally well/badly.
$\bigcirc$  Maybe Text #2.
$\bigcirc$  Definitely Text #2.
Grammaticality and Fluency: Which of the two texts is more fluent and grammatical?
- TEXT #1 is clearly better.
$\bigcirc$  TEXT#1 may be better.
$\bigcirc$  BOTH are equally bad/good.
$\bigcirc$  TEXT#2 may be better.
$\bigcirc$  TEXT#2isclearlybetter.
You may make a comment in this box if you wish.
Submit
Figure 3: Pair-wise comparison in terms of text similarity and fluency & grammaticality on human evaluation.
Figure 4: Label consistency task on human evaluation.