In other words, the list is used to replace a word with one of its synonyms; this process is repeated for every word in the input sentence until the target model makes an incorrect prediction.
for every sentence, we start by replacing the first word with its synonyms, each forming a new adversarial example.