For experiments in section 6, where we report the BLEU score for a vanilla model and several adversarially-trained models against different attackers, we use a decoder with a beam width of 4.
our white-box attacker uses a model with greedy decoding to compute gradients.