# A Hybrid Adversarial Attack for Different Application Scenarios +
## 4 Experiments
### Evaluation
#### 4.2.2 White-Box Attack with the Coefficient of Variation
The following human evaluation also shows this conclusion. The example output generated by black-box attack is shown in Table 3.  
Because greedy attack may make the word modification position close and result in poor readability, global search improves this situation to some extent, but it does not have the ability to effectively control the dispersion of word modification positions because the modified word is selected from big to small according to the gradient magnitude. We propose a method to control the dispersion of the modified position by adding the coefficient of variation, and control the dispersion degree of the modified position by the weight of CV. We introduced the CV factor into the global search with a combining metric. Finally, we use global attack with the combined metric and set the cosine distance threshold to 0.9848 to maintain the word's high similarity, and compare the attack success rate under different CV weight. We select 500 comments used by greedy attacks and calculate the attack success rate under different CV weight(\(\lambda\)). \begin{table}
\begin{tabular}{l} \hline Original Text, Prediction = **Negative**. \\ \hline The Pallbearer is a disappointment and at times extremely boring with a love story that just doesn’t work partly with the casting of [PERSON] ([PERSON]). [PERSON] walks through the entire film with a confused look on her face and its hard to tell what [PERSON] even sees in her. \\ However The Pallbearer at times is funny particularly the church scene and the group scenes with his friends are a laugh but that’s basically it. Watch the Pallbearer for those scenes only and fast \\ forward the rest. Trust me you aren’t missing much. \\ \hline Greedy Attack Text, Prediction = **Positive**. \\ \hline on despite has given tempered well outside well surprisingly boring with a love story that just doesn’t work partly with the casting of [PERSON] ([PERSON]). [PERSON] walks through the entire film with a confused look on her face and its hard to tell what [PERSON] even sees in her. \\ However The Pallbearer at times is funny particularly the church scene and the group scenes with \\ his friends are a laugh but that’s basically it. Watch the Pallbearer for those scenes only and fast \\ forward the rest. Trust me you aren’t missing much. \\ \hline Global Attack Text, Prediction = **Positive**. \\ \hline The Pallbearer is a artist and at times extremely boring with affection love story that just doesn’t work partly with the american of [PERSON] ([PERSON]). [PERSON] walks through the entire film with a confused look on her face and its hard to tell what [PERSON] even sees in her. \\ However The Pallbearer at times is funny particularly the church scene and the group scenes with \\ his friends are a laugh but that’s basically it. Watch the Pallbearer for those scenes only and fast \\ forward the rest. Trust me you aren’t missing much. \\ \hline Global Attack Text with CV, Prediction = **Positive**. \\ \hline The Pallbearer is affection artist and at times extremely boring with a love story that just doesn’t work partly with the casting of [PERSON] ([PERSON]). [PERSON] walks through the entire film with a confused look on her face and its hard to tell what [PERSON] even sees in her. \\ However The Pallbearer at times is funny particularly the church scene and the group scenes with \\ his friends are a laugh but that’s basically it. Watch the Pallbearer for those scenes only and fast \\ forward the rest. Trust me you aren’t missing much. \\ \hline \end{tabular}
\end{table} 
Table 3: Original text and three adversarial examples of white-box attack. In order to prove the validity of adding the CV factor when determining the modification order, we select 50 comments that are correctly classified by the classifier and the algorithm attack is successful, and calculate the CV value of the adversarial examples under different \(\lambda\). When the CV weight value is 0, our method becomes the global search attack [9].