Recent studies on adversarial examples expose vulnerabilities of natural
language processing (NLP) models. Existing techniques for generating
adversarial examples are typically driven by deterministic hierarchical rules
that are agnostic to the optimal adversarial examples, a strategy that often
results in adversarial samples with a suboptimal balance between magnitudes of
changes and attack successes. To this end, in this research we propose two
algorithms, Reversible Jump Attack (RJA) and Metropolis-Hasting Modification
Reduction (MMR), to generate highly effective adversarial examples and to
improve the imperceptibility of the examples, respectively. RJA utilizes a
novel randomization mechanism to enlarge the search space and efficiently
adapts to a number of perturbed words for adversarial examples. With these
generated adversarial examples, MMR applies the Metropolis-Hasting sampler to
enhance the imperceptibility of adversarial examples. Extensive experiments
demonstrate that RJA-MMR outperforms current state-of-the-art methods in attack
performance, imperceptibility, fluency and grammar correctness.

提出了两种算法（RJA 和 MMR）来生成高效的对抗样本并提高样本的不可察觉性，并通过广泛实验表明，RJA-MMR 在攻击性能、不可察觉性、流畅性和语法正确性等方面优于当前最先进的方法。