# A Survey of Adversarial Attacks: An Open Issue for Deep Learning Sentiment Analysis Models
## 3 Adversarial Attacks on Sentiment Analysis
### White Box Adversarial Attacks
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Work** & \begin{tabular}{c} **Sentiment** \\ **Analysis Level** \\ \end{tabular} & \begin{tabular}{c} **Model** \\ **Knowledge** \\ \end{tabular} & \begin{tabular}{c} **Modification** \\ **Granularity** \\ \end{tabular} & \begin{tabular}{c} **Select Elements to** \\ **Re Modified via** \\ \end{tabular} & \
\begin{tabular}{c} **Modification** \\ **Strategy** \\ \end{tabular} &
\begin{tabular}{c} **Modification Control** \\ \end{tabular} \\ \hline
[25] & - & \multicolumn{4}{c}{\begin{tabular}{c} Character/ \\ Sentence \\ \end{tabular} } & \multicolumn{2}{c}{\
\begin{tabular}{c} Word Importance on \\ final prediction \\ \end{tabular} } & \multicolumn{2}{c}{
\begin{tabular}{c} Substitution \\ Edit. Reconstruct the \\ sentences via nearest \\ semantic neighborly term \\ \end{tabular} } \\
[16] & - & \multicolumn{4}{c}{\
\begin{tabular}{c} Term \\ \end{tabular} } & - & - &
\begin{tabular}{c} Left distance, Jaccard \\ similarity, Euclidean distance \\ and Semantic similarity \\ Semantic Similarity \\ Euclidean Distance \\ Semantic similarity \\ Semantic similarity \\ Semantic similarity \\ \end{tabular} \\
[35] & - & \multicolumn{4}{c}{\
\begin{tabular}{c} Term \\ \end{tabular} } & - & - &
\begin{tabular}{c} Left distance, Jaccard \\ similarity, Euclidean distance \\ and Semantic similarity \\ Semantic Similarity \\ Euclidean Distance \\ Semantic similarity \\ \end{tabular} \\
[64] & - & \multicolumn{4}{c}{\begin{tabular}{c} Character/ \\ \end{tabular} } & \multicolumn{2}{c}{\
\begin{tabular}{c} Word Importance on \\ final prediction \\ \end{tabular} } & \multicolumn{2}{c}{
\begin{tabular}{c} Edit. Structure \\ similarity, Euclidean distance \\ and Semantic similarity \\ Semantic Similarity \\ Euclidean Distance \\ Semantic similarity \\ \end{tabular} } \\
[37] & - & \multicolumn{4}{c}{\
\begin{tabular}{c} Term \\ \end{tabular} } & - &
\begin{tabular}{c} Left distance, Jaccard \\ similarity, Euclidean distance \\ and Semantic similarity \\ Semantic Similarity \\ Euclidean Distance \\ Semantic Similarity \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Reviewed adversarial attacks on sentiment analysis models. adversarial examples, the proposed method first finds important words by computing the Jacobian matrix for the given input text to find the confidence value of each word, then finds the important words that have a significant impact on the classifier's outputs. By finding the most significant words, adversarial examples are generated by five kinds of modifications at the character or word level: (i) inserting a space into the word; (ii) deleting a random character of the word (except for the first and the last character); (iii) randomly swapping two adjacent letters; (iv) Substitute-C (Sub-C), in which characters are replaced with visually similar characters; and (v) Substitute-W (Sub-W), in which a word is replaced with its \(top_{k}\) nearest neighbors. For character-level perturbations, the authors deliberately misspelled important words to convert these important words to \"unknown\" words. For word-level perturbations, they used a semantic-preserving technique, i.e., replacing the word with its \(top_{k}\) nearest neighbors in a context-aware word vector space. In addition, the authors presented the application of their method under a black box setting while making word-level modifications. The process of generating adversarial examples contained three steps: (i) finding important sentences that contribute most to the final prediction results; (ii) using a scoring function to determine the importance of each word to the classification result and ranking the words based on their scores; and (iii) making modifications to selected words, similar to the white box approach. The attack methods were evaluated on CNN and LSTM architectures. * [PERSON] et al. (2017) presented an untargeted method called _Greedy Search_. Given a text input, this method considers the \(k\) nearest neighbors of each word in the space of _embeddings_.