Table 6: BLEU score of models on clean and adversarial examples, using a decoder with beam size of 4.
as can be seen in Table 3, targeted attacks are much more difficult with a much lower success rate for the adversary.