💬 NLP

SEP-Attack: A Simple and Effective Paradigm for Transfer-Based Textual Adversarial Attack

The paper proposes SEP-Attack, a novel transfer-based textual adversarial attack paradigm that leverages Determinantal Point Processes to generate diverse surrogate ensemble weights for accurately estimating word importance and selecting highly transferable adversarial examples, significantly outperforming state-of-the-art baselines across multiple datasets and real-world APIs.

Original authors: Han Liu, Zhi Xu, Xiaotong Zhang, Feng Zhang, Xiaoming Xu, Wei Wang, Fenglong Ma, Hong Yu

Published 2026-05-26

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Han Liu, Zhi Xu, Xiaotong Zhang, Feng Zhang, Xiaoming Xu, Wei Wang, Fenglong Ma, Hong Yu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very smart, high-tech security guard (a computer model) that checks every piece of mail entering a building. Its job is to decide if a letter is "safe" or "spam." Usually, it does a great job. But, just like a human guard can be tricked by a clever disguise, these computer models can be fooled by "adversarial attacks"—tiny, sneaky changes to the text that make the model make a mistake.

The problem is, in the real world, you often can't see inside the guard's brain (the model's code). You don't know how it thinks. This is called a "black-box" scenario.

The paper introduces a new method called SEP-Attack (Simple and Effective Paradigm). Think of it as a master thief who doesn't need to see the guard's brain to trick him. Instead, the thief uses a team of "practice guards" (surrogate models) to figure out the best disguise.

Here is how SEP-Attack works, broken down into three simple steps:

1. The "Diverse Team" Strategy (The DPP)

Usually, when people try to trick a model, they ask a bunch of practice guards for advice and just average their answers. It's like asking five people for directions and taking the middle path. But what if some of those practice guards are bad at giving directions?

SEP-Attack uses a special mathematical tool called a Determinantal Point Process (DPP). Imagine you are picking a team for a heist. Instead of picking five people who all think alike, you use a special rule to ensure your team is diverse. You pick a mix of experts who look at the problem from different angles.

Why? This ensures the thief gets a wide variety of "disguise ideas" rather than just one repetitive idea. It makes the final trick much harder for the real guard to predict.

2. The "Edit and Prune" Dance

Once the diverse team of practice guards gives their advice, the thief needs to actually change the text.

The Problem: If you just delete words to see what happens, the sentence might lose its meaning (like taking a wheel off a car to see if it still drives). This gives bad advice on which words are important.
The SEP-Attack Solution: The method does a two-step dance:
1. Over-edit: It temporarily swaps important words for synonyms (like changing "happy" to "joyful") and even allows the sentence to get a little messy or long, just to see which changes confuse the practice guards the most.
2. Prune: Once it finds the confusing changes, it goes back and carefully removes the unnecessary edits, putting the original words back in if they weren't actually needed to fool the model.
The Result: It finds the exact tiny change needed to break the model without ruining the sentence's meaning.

3. The "Stability Test" (Selecting the Best Disguise)

The thief might have generated 100 different versions of the disguised letter. Which one should they use?

Some versions might only fool the practice guards because they are in a weird, unstable spot. If you wiggle them slightly, they stop working.
SEP-Attack tests each candidate by making tiny, harmless tweaks to it (like swapping a synonym for a very similar one).
The Rule: If the disguise still works even after these tiny tweaks, it's a "stable" disguise. If it breaks, it's thrown away.
The thief picks the most stable disguise to send to the real security guard.

Why is this a big deal?

The paper tested this method on four different datasets (like different types of mail) and even against real-world services from big companies like Alibaba Cloud and Google Cloud.

Efficiency: Other methods often have to ask the real guard thousands of questions ("Is this safe? No. Is this safe? No...") to find a trick. SEP-Attack asks very few questions (only about 10) because it does all the hard work on its practice team first.
Success Rate: It fooled the models much more often than previous methods. In some tests, it succeeded nearly 100% of the time, whereas other methods only succeeded about 50% of the time.
Beating Defenses: Even when the security guard was trained specifically to catch these tricks (using defense mechanisms like "HotFlip" or "SHIELD"), SEP-Attack was still able to sneak past them.

In short: SEP-Attack is a smarter, more efficient way to trick AI text models. Instead of brute-forcing its way in, it uses a diverse team of practice models to find the perfect, stable, and minimal change needed to fool the real system, all while asking very few questions.

Technical Summary: SEP-Attack

Problem Statement

Deep neural networks (DNNs) and large language models (LLMs) are increasingly deployed in web applications but remain vulnerable to adversarial attacks. While white-box attacks are well-studied, black-box attacks are more realistic in practical scenarios. Among black-box methods, transfer-based attacks are particularly concerning because they generate adversarial examples using surrogate models without accessing the victim model's internal parameters or querying it directly.

However, transfer-based attacks in the text domain are under-explored and face unique challenges compared to computer vision:

Discrete Nature: Text cannot be perturbed via continuous gradient descent; it requires discrete token replacements.
Tokenization Variations: Different models use different tokenization algorithms, complicating the transfer of adversarial examples.
Suboptimal Existing Methods: Current approaches often treat all submodels in an ensemble equally or rely on inaccurate word importance estimation (e.g., by simply removing words, which alters context and leads to poor importance scores). These limitations result in suboptimal attack success rates (ASR).

Methodology: SEP-Attack

The authors propose SEP-Attack (Simple yet Effective Paradigm for transfer-based textual adversarial Attack), a framework designed to generate highly transferable adversarial text examples. The method consists of three primary stages, as illustrated in Figure 1 of the paper:

1. Generating Diversity-Based Surrogate Ensemble Weights

Instead of treating all submodels in a surrogate ensemble equally, SEP-Attack employs the Determinantal Point Process (DPP) to generate diverse weights.

Mechanism: A random weight space is generated, and a weight kernel matrix is computed. The DPP samples a subset of weights that maximizes diversity and representativeness.
Goal: This ensures that the ensemble captures varying levels of transferability among submodels, rather than averaging them out, which helps in generating more robust adversarial candidates.

2. Generating Adversarial Examples via the Surrogate Ensemble

The framework generates candidates by iteratively updating words based on a weighted confidence score.

Confidence Score ( $\delta$ ): A new metric is introduced to evaluate prediction confidence, weighted by the diverse ensemble weights derived in Step 1. The goal is to minimize this score to reduce model confidence.
Word Importance & Replacement Order: Unlike methods that remove words (which disrupts context), SEP-Attack calculates importance by measuring the drop in confidence when a word is removed ( $X \setminus x_i$ ). It then uses a sampling method (Eq. 5) that amplifies differences in importance scores to determine a replacement order.
Two-Step Optimization:
1. Updating: Important words are replaced with synonyms that minimize the confidence score, allowing the perturbation distance to temporarily exceed the strict budget ( $\eta > \epsilon$ ) to explore the search space.
2. Removing: Less important words (those that were changed but are not critical to the attack) are reverted to their original form to ensure the final example satisfies the strict perturbation budget ( $\epsilon$ ).

3. Selecting Transferable Adversarial Examples

Given a large pool of generated candidates, the framework selects the most transferable ones without querying the victim model.

Transferability Score ( $\tau$ ): Inspired by the observation that ideal adversarial examples should reside in "flat" regions of the loss landscape (low loss in the neighborhood), the method computes the average confidence score of an example's neighbors (generated by swapping words with semantically closest synonyms).
Selection: Candidates with lower average neighborhood confidence scores (indicating robustness against local variations) are ranked and selected as the final transferable adversarial examples.

Key Contributions

A Simple and Effective Paradigm: The authors introduce SEP-Attack, which addresses the specific challenges of text-based transfer attacks through a straightforward yet powerful workflow.
DPP-Based Weighting: The novel application of Determinantal Point Processes to generate diverse surrogate ensemble weights, moving beyond equal-weight ensembles to better represent submodel transferability.
Improved Importance Estimation: A strategy that updates important words and removes unimportant ones, avoiding the semantic disruption caused by simple word removal methods used in prior work (e.g., TextFooler).
Transferability Quantification: A metric to select the best candidates based on neighborhood flatness, improving the efficiency of the attack by reducing the need for victim model queries.

Experimental Results

The authors evaluated SEP-Attack on four benchmark datasets (MR, AG, Yelp, IMDB) and against various victim models (BERT, LSTM, TextCNN, and LLMs like Llama and Mistral).

Performance vs. Baselines: SEP-Attack significantly outperformed state-of-the-art baselines, including query-based methods (TextFooler, DeepWordBug, BBA, LeapAttack, HQA-Attack) and other transfer-based methods (Ensemble, HAWR).
- On the IMDB dataset attacking BERT, SEP-Attack achieved an ASR of 99.1%, compared to 45.4% for the next best method (BBA).
- On the AG dataset, it achieved 58.8% ASR against BERT, a significant improvement over the second-best (40.5%).
Query Efficiency: The method operates with a very low query budget (10 queries for ensemble-based selection vs. 100 for query-based methods), yet still achieves superior success rates.
Robustness Against Defenses: The attack successfully bypassed defense mechanisms, including models trained with HotFlip and SHIELD. For instance, against SHIELD on the IMDB dataset, SEP-Attack achieved a 97.9% ASR.
Real-World APIs: When tested against Alibaba Cloud and Google Cloud APIs, SEP-Attack achieved the highest ASR (64.1% and 75.3% respectively) compared to other methods.
Large Language Models: The method demonstrated superior performance against LLMs (Llama-3, Mistral, GPT-3.5), achieving ASRs up to 72.9% on Yelp against Mistral, significantly outperforming other transfer methods.

Significance and Claims

The paper claims that SEP-Attack provides a simple yet effective solution to the under-explored problem of transfer-based textual adversarial attacks. By addressing the issues of submodel diversity and inaccurate importance estimation, the method achieves significantly higher attack success rates with minimal query costs.

The authors emphasize that their work highlights the need to consider submodel diversity and reliable importance estimation when evaluating the security of web-facing language models. The results suggest that current defenses may be insufficient against such transfer-based paradigms, underscoring the necessity for building safer and more trustworthy Web AI systems. The paper concludes by noting that future work will explore the theoretical foundations of the method and extend it to other modalities.