A word that achieves minimal loss after swapping with P AD is then selected as the word to be replaced.
furthermore, by iterative adversarial training using our black-box RL agent, we can significantly improve the robustness of the dialogue system.