In this approach, adversarial examples are constructed through an optimization process that uses gradient descent to search for input examples that maximally change the predictions of a model.
developing attacks with only black-box access to a model (no access to gradients) is still under-explored in NLP.