Synonym and Paraphrase Chains

Replaces restricted terms with chains of progressively more distant synonyms until no individual token triggers the classifier. TextAttack automates adversarial synonym perturbation at scale. Effectiveness depends on whether the classifier operates on tokens (evadable) or semantic meaning (resistant).

• Semantic similarity classifiers (classify meaning, not tokens)

Chains with T2-AT-001 (Euphemism). TextAttack automates at scale.