This makes it possible to evaluate the effectiveness of adversarial attacks or defenses either using goldstandard human evaluation, or approximations that can be calculated without human intervention.
for a word-based translation model M 6 , and given an input sentence w 1 , .