LBA: Text hard-label adversarial attacks under a low query budget

The researchers propose a sampling-based adversarial attack method, LBA, for generating high-quality adversarial text in hard-label scenarios under a low query budget. In experiments covering six language models and four datasets, spanning small-scale to large-scale architectures, LBA significantly outperforms existing state-of-the-art baselines on all evaluation metrics. Existing methods mostly rely on greedy algorithms that replace one position at a time; local search may miss high-quality adversarial examples and has excessively high query cost, while exhaustively enumerating all position combinations is computationally infeasible. LBA fuses prior and posterior knowledge to construct an approximate distribution of high-quality adversarial examples and samples from it, updating the distribution with posterior knowledge as sampling proceeds to guide more effective sampling. LLM-based evaluation also shows that adversarial text generated by LBA preserves semantics better and is easier to understand.