We evaluated adversarial robustness with CAA, an ensemble of gradient and search attacks which was recently demonstrated as the most effective attack against a tabular model.

A.1 TPPE Method We present the pseudo code for TPPE in this paper, using the Insertion mode as an example. According to Alg. 1, we reduce the query time complexity from In our study, we assume the worst-case scenario of applying punctuation-level attacks. Softmax layer is adopted to predict the label of the input text. Paraphrase (TPPEP) to achieve a single-shot attack. We describe the TPPEP method as being decomposed into two parts: training and searching.

In this paper, departing from the existing literature on IL for MFGs, we introduce a new solution concept called the Nash imitation gap.

Findthesmallest0 (n, k, ), where (n, k, )= c1 r logn+ log ( 1/ ) k . Then, withprobabilityatleast1 , theresultingclassifiergn satisfiesthefollowing: foreverypointx 2 supp(µ), if n C adv (x) max log 1 adv (x) , log 1 thengn(x)= g (x).

Neural Information Processing Systems http://nips.cc/

The next lemma was used in the proof of Theorem 1.