Evaluation Method: One of the major metrics is Completion Rate, the percentage of two bots successfully finishing the task.
a pure-model-agnostic adversary, such as works by Jia and Liang (2017) and Belinkov and Bisk (2018), does not have any access to the model outputs when creating adversarial inputs, and is thus more generalizable across models/tasks.