Jin, D.; Jin, Z.; Zhou, J. T.; Szolovits, P. Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailment. AAAI 2020, 34, 8018-8025.