Intuitively, one might suppose that word-piece and character-level models would be more robust to such attacks given they can make use of the remaining context.
we find that they are the more susceptible.