How to guarantee the semantic preservation of the adversarial examples

[zhujiangang]

For example, if the gold function is untargeted classification, this means that we need to search adversarial examples (x') that satisfy F(x') != F(x). Is it correct? If so, how can you guarantee the semantic preservation of x', I mean how can you guarantee that x' has the same label with x? If we can guarantee this, why need after-attack accuracy? The more the adversarial examples are generated, the lower the after-attack accuracy will be.

Thanks.

[qiyanjun]

@zhujiangang Please read this: https://textattack.readthedocs.io/en/latest/2notebook/2_Constraints.html

https://textattack.readthedocs.io/en/latest/1start/attacks4Components.html#constraints