Black-box attacks often rely on heuristic methods to create adversarial examples.
(2016) for language modeling, and later adapted by Costa-Jussa and Fonollosa (2016) for translation, and is also used by Belinkov and Bisk (2018) for their adversarially-trained models.