## 3 Methodology
### The Whole Algorithm
\begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Model**} & \multirow{2}{*}{**Attack**} & \multicolumn{3}{c}{**IMDB**} & \multicolumn{3}{c}{**Yelp**} & \multicolumn{3}{c}{**MR**} \\ \cline{3-10}  & & **Succ.** & **Pert.** & **Sim.** & **Succ.** & **Pert.** & **Sim.** & **Succ.** & **Pert.** & **Sim.** \\ \hline \multirow{3}{*}{TextCNN} & HLBB & 74.0 & 4.2 & 85.3 & 67.1 & 7.6 & 86.2 & 71.1 & 13.2 & **84.3** \\  & TextHacker & 77.8 & **3.0** & 85.6 & 75.4 & 6.4 & 82.5 & 78.3 & **11.1** & 82.1 \\  & WordBlitz & **78.3** & 3.1 & **87.1** & **75.9** & **6.3** & **86.4** & **78.9** & 11.8 & 84.0 \\ \hline \multirow{3}{*}{LSTM} & HLBB & 72.1 & 4.1 & 86.4 & 61 & 6.6 & 85.3 & 68.3 & 11.2 & 83.5 \\  & TextHacker & 76.2 & 3 & 84.9 & 65.4 & 5.5 & 84.8 & 75.2 & 11.2 & 82.9 \\  & WordBlitz & **76.9** & **3** & **86.8** & **66** & **5.3** & **86.6** & **75.5** & **10.7** & **84.8** \\ \hline \multirow{3}{*}{BERT} & HLBB & 77 & 4.8 & 84.1 & 57.1 & 8.2 & 84.6 & 65.8 & 11.6 & 85.2 \\  & TextHacker & 81.5 & 3.4 & 83.1 & 63.2 & 6.7 & 82.2 & 73.1 & 11.4 & 83.6 \\  & WordBlitz & **81.9** & **3.3** & **85.7** & **63.5** & **6.5** & **85.2** & **73.7** & **10.9** & **85.4** \\ \hline \multirow{3}{*}{ChatGLM3} & HLBB & 36.4 & 7.1 & 83.6 & 35.2 & 8.4 & 86 & 35.6 & 12.2 & 81.7 \\  & TextHacker & 37.3 & 6.2 & 84.2 & 35.9 & 7.3 & 83.4 & 36.1 & **11.3** & 82.3 \\ \cline{1-1}  & WordBlitz & **40.4** & **5.9** & **85.1** & **39.8** & **7** & **86.1** & **37.9** & 11.5 & **83.6** \\ \hline \hline \end{tabular} The bold number denotes the best performance value for each dataset.

\end{table} 
Table 2: Evaluation on attack effectiveness on English datasets. \begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Model**} & \multirow{2}{*}{**Attack**} & \multicolumn{3}{c}{**OnlineShopping**} & \multicolumn{3}{c}{**Waimai**} & \multicolumn{3}{c}{**Hotel**} \\ \cline{3-10}  & & **Succ.** & **Pert.** & **Sim.** & **Succ.** & **Pert.** & **Sim.** & **Succ.** & **Pert.** & **Sim.** \\ \hline \multirow{3}{*}{TextCNN} & HLBB & 43.5 & 20.7 & 79.2 & 46.1 & 19.5 & 81.3 & 47.2 & 20.4 & **81.0** \\  & TextHacker & 52.3 & **19.1** & 80.4 & 54.2 & **18.1** & 79.9 & 55.8 & **19.4** & 79.1 \\  & WordBlitz & **59.8** & **18.5** & **81.5** & **60.4** & **18.3** & **83.2** & **62.1** & **18.5** & **82.4** \\ \hline \multirow{3}{*}{BERT} & HLBB & 39.4 & 18 & 81.9 & 43.9 & 19.2 & 81.7 & 41.5 & 19.1 & 81.6 \\  & TextHacker & 50.2 & 17.9 & 81.1 & 52.6 & 19.9 & 81.3 & 53.2 & 18.3 & 80.3 \\  & WordBlitz & **60.1** & **17.4** & **83** & **60.3** & **18.9** & **83.8** & **59.6** & **17.6** & **81.9** \\ \hline \multirow{3}{*}{ERNIE} & HLBB & 41.6 & 19.2 & 80.8 & 42.5 & 20.3 & 82.6 & 44 & 18.9 & 81.7 \\  & TextHacker & 50.4 & 18.6 & 80.2 & 51.8 & 19.6 & 81 & 54.1 & 18.6 & 81.2 \\ \cline{1-1}  & WordBlitz & **58.9** & **18.3** & **82.5** & **59.4** & **19.4** & **82.9** & **60.4** & **17.8** & **83.3** \\ \hline \multirow{3}{*}{ChatGLM3} & HLBB & 32.5 & 18.9 & 79.3 & 33.7 & 18.4 & 81.2 & 31.8 & 17.6 & 81.4 \\ \cline{1-1}  & TextHacker & 32.7 & 18.3 & 81.6 & 35.1 & 19.7 & 79.4 & 34.3 & **18** & 80.2 \\ \cline{1-1}  & WordBlitz & **34.3** & **17** & **82.4** & **35.7** & **18.1** & **81.5** & **36.8** & **17.4** & **83** \\ \hline \hline \end{tabular} The bold number denotes the best performance value for each dataset.

\end{table} 
Table 3: Evaluation of attack effectiveness on Chinese datasets. BERT model. For the stability evaluation, we used the coefficient of variation \(\gamma\), which can be formulated as

\[\text{s}=\sqrt{\frac{1}{N-1}\sum_{i=1}^{N}(z_{i}-z)^{2}}, \tag{14}\]

\[\gamma=\frac{S}{z}, \tag{15}\]

where \(s\) is the standard deviation, \(z_{i}\) represents each value in the sample, \(N\) is the size of sample, \(z\) is the mean of the sample, and \(\gamma\) describes the relative stability. A lower \(\gamma\) indicates greater stability of the data. Table 4 illustrates the results, showing that WordBlitz has best attack stability on both the English and Chinese datasets.