## 3 Methodology
### The Whole Algorithm
### Efficiency Evaluation

In practice, the victim model can easily defend attacks based on their anomalous access frequency, which challenges the efficiency of attack methods. It is obvious that the query budget of the victim model is highly related to the efficiency. Hence, we validated the efficiency of the three methods using different query budgets, taking attacks on the IMDB and Waimai datasets with BERT model as an example. Figure 3 shows the results. It can be observed that the success rate of all three attack methods decreases with decreasing query budget, with the change from 1500 to 1000 being more obvious. Taking the IMDB dataset as an example, HLBB exhibits the highest deterioration in attack success rate, reaching up to 7.7%. This can be attributed to its reliance on extensive random substitutions for searching adversarial examples instead of memorizing word importance. Consequently, it is only suitable for scenarios with loose query restrictions. TextHacker experiences a lower decline of 3.1% due to its ability to remember word importance using a weight table. However, because the weight table is randomly initialized, its accuracy decreases significantly when the query budget is strictly limited. WordBlitz demonstrates the most consistent performance, with only a marginal decrease of 1.9% in attack success rate compared to the other methods. Even under the strictly limited query budget (\(\leq\)1000), \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Attack**} & \multicolumn{3}{c}{**English:Yelp**} & \multicolumn{3}{c}{**Chinese:Hotel**} \\ \cline{2-7}  & \(\mathbf{\gamma\) (Succ.)} & \(\mathbf{\gamma\) (Pert.)} & \(\mathbf{\gamma\) (Sim.)} & \(\mathbf{\gamma\) (Succ.)} & \(\mathbf{\gamma\) (Pert.)} & \(\mathbf{\gamma\) (Sim.)} \\ \hline HLBB & 0.0195 & 0.0259 & 0.0075 & 0.0307 & 0.0298 & 0.0093 \\ TextHacker & 0.0092 & 0.0188 & 0.0057 & 0.0175 & 0.0274 & 0.0071 \\ WordBlitz & **0.0050** & **0.0152** & **0.0042** & **0.0117** & **0.0226** & **0.0056** \\ \hline \hline \end{tabular} The bold number denotes the best performance value for each dataset.

\end{table} 
Table 4: Stability evaluation with the BERT model. Figure 3: Efficiency evaluation with the BERT model. it is able to achieves a remarkable success rate of 79.2%, which is due to the improvement in adversarial transferability with data augmentation. The experimental results on the Chinese Waimai dataset are similar, with the gap between the three methods being even more significant due to the broader search space of Chinese candidate pool, which requires high efficiency. ### Ablation Study

To verify the influence of the DataAugment (DA) components in WordBlitz, we conducted an ablation study on BERT using the Waimai dataset with a query budget of 2000. We removed the DA component to validate its contribution. The results are shown in Table 5. The ablation experiment demonstrates that WordBlitz with DA has better performance than the version without DA. This shows the superiority of the DataAugment component, which learn more knowledge of the target model from history and enhances the adversarial transferability. ### Case Study

Table 6 shows adversarial sample cases generated by WordBlitz when attacking BERT. When attacking English texts, we used synonyms to replace the key words 'brilliant' and'moving'. When attacking Chinese texts, we used homophones to replace the key word '\(\
ot{E}\)'. By perturbing a small number of key words, WordBlitz was able to successfully change the output labels. ## 5 Conclusions

This paper proposes an efficient hard-label attack method called WordBlitz for generating high-quality adversarial samples with a strictly limited query budget. WordBlitz uses an Attack Parameter Set (APS) to remember word importance, which is initialized with a substitute model based on adversarial transferability. Then, adversarial examples are generated and optimized with the APS. Meanwhile, the APS is updated based on the attack results.