We use the full test set for this experiment, and we compare HotFlip adversarial training with the white-box (supervised) adversarial training (Miyato et al., 2017) that perturbs word embeddings, which we adapt to work with character embeddings.
the adversarial noise per character is constrained by the Frobenius norm of the embedding matrix composed of the sequence of characters in the word.