(2018) replace words with semantically and syntactically similar adversarial examples.
moreover, DISP works better on the random attack because the embeddings of the original tokens tend to have noticeably greater Euclidean distances to randomlypicked tokens than the distances to other tokens.