@Article{ sun.ea:scala:2025,
  author   = {Siqi Sun and Achim D. Brucker and Jia Hu and Xiaowei Huang
              and Wenjie Ruan},
  journal  = {IEEE Transactions on Information Forensics and Security},
  title    = {{SCALA}: Towards Imperceptible and Efficient Black-box
              Textual Adversarial Perturbations},
  year     = {2025},
  volume   = {},
  areas    = {security},
  number   = {},
  pages    = {1--1},
  keywords = {Perturbation methods;Closed box;Computational
              modeling;Semantics;Safety;Robustness;Predictive models;Hamming
              distances;Visualization;Computer vision;Model
              vulnerability;Natural Language Processing;adversarial
              attacks;black-box setting;word-level perturbations},
  doi      = {10.1109/TIFS.2025.3629604},
  abstract = {Deep learning models are intrinsically susceptible to textual
              adversarial attacks on social media, where the perturbed text
              can trigger aberrant behaviours of victim models and threaten
              security and privacy. In this paper, we present a novel
              word-level attack called SCALA: a Synonym-based desCending And
              repLace-back Ascending mechanism. Our focus is on the
              efficient production of adversarial examples, with a
              particular emphasis on minimizing human perceptibility while
              ensuring the visual resemblance and semantic correctness. The
              merits of our attacking solution lie in being: (i)
              imperceptible  it keeps a very low word perturbation rate
              based on the Hamming (L0-norm) distance, thus achieving
              heightened deceptiveness validated through human evaluations;
              (ii) efficient  our tensor-based parallelization strategy
              ensures the attacking efficiency compared with baselines;
              (iii) effective  it surpasses seven state-of-the-art
              attacks on five target models in terms of reducing
              after-attack accuracy; (iv) practical  black-box
              score-based setting ensures that the adversary only needs to
              query target models for confidence scores; and (v)
              transferable  our attack shows competitive transferability
              on the generated adversarial examples. We release our code
              SCALA via https://github.com/TrustAI/SCALA.},
}