[1] [1] XU H, MA Y, LIU H C, et al. Adversarial attacks and defenses in images, graphs and text: a review[J]. International Journal of Automation and Computing, 2020, 17(2): 151-178.

[2] [2] KONG Z X, XUE J F, WANG Y, et al. A survey on adversarial attack in the age of artificial intelligence[J]. Wireless Communications and Mobile Computing, 2021(1): 4907754.

[3] [3] GOYAL S, DODDAPANENI S, KHAPRA M M, et al. A survey of adversarial defenses and robustness in NLP[J]. ACM Computing Surveys, 2023, 55(14s): 1-39.

[4] [4] HAN X, ZHANG Y, WANG W, et al. Text adversarial attacks and defenses: issues, taxonomy, and perspectives[J]. Security and Communication Networks, 2022, 2022: 6458488.

[5] [5] SZEGEDY C, ZAREMBA W, SUTSKEVER I, et al. Intriguing properties of neural networks[EB/OL]. [2024-01-16]. https://arxiv.org/abs/1312.6199v4.

[6] [6] ILYAS A, SANTURKAR S, TSIPRAS D, et al. Adversarial examples are not bugs, they are features[EB/OL]. [2024-01-16]. https://arxiv.org/abs/1905.02175v4.

[7] [7] BELINKOV Y, BISK Y. Synthetic and natural noise both break neural machine translation[EB/OL]. [2024-01-16]. https://arxiv.org/abs/1711.02173v2.

[8] [8] GAO J, LANCHANTIN J, SOFFA M L, et al. Black-box generation of adversarial text sequences to evade deep learning classifiers[C]//Proceedings of the IEEE Security and Privacy Workshops (SPW). San Francisco, USA: IEEE Press, 2018: 50-56.

[9] [9] JIN D, JIN Z J, ZHOU J T, et al. Is BERT really robust? A strong baseline for natural language attack on text classification and entailment[J]. Proceedings of the AAAI Conference on Artificial Intelligence, 2020, 34(5): 8018-8025.

[10] [10] REN S H, DENG Y H, HE K, et al. Generating natural language adversarial examples through probability weighted word saliency[C]//Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics. Stroudsburg, USA: ACL, 2019: 1085-1097.

[11] [11] LI J F, JI S L, DU T Y, et al. TextBugger: generating adversarial text against real-world applications[C]//Proceedings of 2019 Network and Distributed System Security Symposium. San Diego, USA: Internet Society, 2019: 1-15.

[12] [12] ALZANTOT M, SHARMA Y, ELGOHARY A, et al. Generating natural language adversarial examples[EB/OL]. [2024-01-16]. https://arxiv.org/abs/1804.07998v2.

[13] [13] ZANG Y, QI F C, YANG C H, et al. Word-level textual adversarial attacking as combinatorial optimization[EB/OL]. [2024-01-16]. https://arxiv.org/abs/1910.12196v4.

[17] [17] LIU M X, ZHANG Z H, ZHANG Y M, et al. Automatic generation of adversarial readable Chinese texts[J]. IEEE Transactions on Dependable and Secure Computing, 2023, 20(2): 1756-1770.

[19] [19] JIN R, WU C H. WordErrorSim: an adversarial examples generation method in Chinese by erroneous knowledge[C]//Proceedings of the 5th International Conference on Compute and Data Analysis. New York, USA: ACM Press, 2021: 155-161.

[24] [24] YAN M, RICHTER E M, SHU H, et al. Readers of Chinese extract semantic information from parafoveal words[J]. Psychonomic Bulletin & Review, 2009, 16(3): 561-566.

[25] [25] CER D, YANG Y F, KONG S Y, et al. Universal sentence encoder[EB/OL]. [2024-01-16]. https://arxiv.org/abs/1803.11175v2.

[26] [26] SUN M S, CHEN X X, ZHANG K X, et al. THULAC: an efficient lexical analyzer for Chinese[EB/OL]. [2024-01-16]. https://gitcode.com/gh_mirrors/th/THULAC.