With the development of deep learning, neural networks have obtained state-ofthe-art results on many sentiment classification datasets (Kim, 2014;Dong et al., 2014;Tang et al., 2015).
despite the promising results, recent work has shown that these models easily fail in adversarial examples 2 with little perturba- * Equal Contribution.