8 The impact on performance is fairly small indicating the robustness of both models.
after only two epochs of optimizing the selected words in the added sentence, the performance drops markedly under all variants of the sentence-level black-box attacks as displayed in the two bottom rows of  and incorrect answers (AddQA) is most detrimental and causes both models to perform at or even below chance level.