A.1 TPPE Method We present the pseudo code for TPPE in this paper, using the Insertion mode as an example. According to Alg. 1, we reduce the query time complexity from In our study, we assume the worst-case scenario of applying punctuation-level attacks. Softmax layer is adopted to predict the label of the input text. Paraphrase (TPPEP) to achieve a single-shot attack. We describe the TPPEP method as being decomposed into two parts: training and searching.

Our approach sets the new state-of-the-art for fooling rates, both under the white-box and black-box scenarios.

Modern deep neural networks(DNNs) are vulnerable to adversarial samples.

Below is a summary of main sections of the supplementary material.

Blackbox adversarial attacks can be categorized into transfer-and query-based attacks.

A.1 TPPE Method We present the pseudo code for TPPE in this paper, using the Insertion mode as an example. According to Alg. 1, we reduce the query time complexity from In our study, we assume the worst-case scenario of applying punctuation-level attacks. Softmax layer is adopted to predict the label of the input text. Paraphrase (TPPEP) to achieve a single-shot attack. We describe the TPPEP method as being decomposed into two parts: training and searching.

Our approach sets the new state-of-the-art for fooling rates, both under the white-box and black-box scenarios.