We conjecture that self-attentive models rely heavily on attention scores, and changing the word with the highest or lowest attention score could substantially undermine the model's prediction.
this attack method exploits and also investigates the attention scores as a potential source of vulnerability.