## 3 Methodology
### The Whole Algorithm  
The overall algorithm of WordBlitz is summarized in Algorithm 1. It comprises four fundamental steps: Construct APS (lines 4-8 in Algorithm 1, detailed in Section 3.3), Adversary Initialization (lines 10-16 in Algorithm 1, detailed in Section 3.4), Perturbation Optimization (lines 18-31 in Algorithm 1, detailed in Section 3.5), and Data Augmentation (lines 33-37 in Algorithm 1, detailed in Section 3.6). ```
1:Input: Input text \(X\), target model \(f\), query budget \(T\), Population Size \(S\), maximum number of local search \(N\), attention weight \(\alpha\), similarity threshold \(\epsilon\), perturb rate threshold \(\epsilon\), the set of samples for DataAugmentation \(D_{\text{da}}\)
2:Output: Attack result and adversarial example
3:\(\triangleright\)Construct APS (line 4-8)
4:for each word \(x_{i}\) in \(X\)do
5: Construct the candidate pool \(C(x_{i})\)
6:\(Y_{\text{pre}}=f(X_{\text{pre}})\)
7: Train substitute model \(f^{\prime}\) with \(\{X_{\text{pre}},Y_{\text{pre}}\}\)
8: Initialize \(WP\) with Attention Weight at in \(f^{\prime}\); Initialize \(W^{\text{c}}\) with all 1's \(\triangleright\) Initialize APS
9:\(\triangleright\) Adversary Initialization (line 10-16)
10:\(X_{1}=X,X_{1}^{\text{adv}}\) = None
11:for\(t=1\) to \(T\)do
12:\(X_{t+1}=\textit{WordSubstitution}(X_{1},C,W^{\text{P}})\)\(\triangleright\) Detailed in Section 3.4
13:if\(f(X_{t+1})\
eq f(X)\)then
14:\(X_{\text{adv}}^{\text{adv}}=X_{t+1}\); break \(\triangleright\) Initialization succeeds
15:if\(X_{\text{adv}}\) is Nonethen
16:return False, None \(\triangleright\) Initialization fails
17:\(\triangleright\) Perturbation Optimization (line 18-31)
18:\(\triangleright\)\(\mathcal{P}^{1}=\{X_{\text{adv}}^{\text{adv}}\}\)
19:for\(i=1\) to \(S-1\)do
20:\(X_{\text{adv}}^{\text{adv}}=\textit{LocalSearch}(X_{\text{adv}}^{\text{adv}},C(x_{i}),W^{ \text{P}},W^{\text{P}})\); \(\mathcal{P}^{1}=\mathcal{P}^{1}\cup\{X_{t+1}^{\text{adv}}\}\)
21:\(t=t+S-1\); \(g=1\)
22:while\(\leq T\)do
23:\(\mathcal{P}_{S}=\mathcal{P}_{S}\cup\{\textit{Recombination}(\mathcal{P}_{S},W_{ \text{c}})\}\)\(\triangleright\) Detailed in Section 3.5.3
24:for each text \(X_{\text{adv}_{\text{adv}_{\text{adv}_{\text{adv}_{\text{adv}_{\text{adv}_{ \text{adv}_{\text{adv}_{\text{adv}_{\text{adv}_{\text{adv}_{ \text{adv}_{\text



## 4 Experiments

We conducted extensive experiments on three English datasets to validate the effectiveness of WordBlitz. In order to validate its applicability on different languages, we also conducted experiments on three Chinese datasets and additionally incorporated a language model optimized for Chinese. ### Experimental Setup

**Victim Models. ** We adopted TextCNN [26], LSTM [27], and BERT [28] as the English victim models, while adopting TextCNN, BERT, and ERNIE [29] as the Chinese victim models. In addition, to verify the attack effect of WordBlitz on LLMs, we added ChatGLM3-6B [30] as a common victim model. **Baselines. ** We used two hard-label attack methods, HLBB [5] and TextHacker [17], as our baselines. HLBB uses a population-based algorithm to generate adversarial examples, while TextHacker perturbs the text based on word importance and hybrid local search. **Evaluation Metrics. ** The evaluation metrics included two aspects, namely, attack effectiveness and perturbation cost. Attack effectiveness encompasses the attack success rate, attack stability, and attack efficiency, while perturbation cost includes the semantic similarity and perturbation ratio. We provide detailed descriptions of these metrics in the corresponding sections. **Datasets. ** We adopted three English datasets (IMDB [31], Yelp [32], and MR [33]) and three Chinese datasets (Waimai, OnlineShopping, and hotels from ChnSentiCorp) for text classification. These datasets are commonly used for sentiment classification tasks; each data point consists of a user review, and each review is labeled as either \"positive\" or \"negative\".