textfooler recipe working

textattack/attack_recipes/alzantot_2018.py

@@ -10,7 +10,7 @@
 """
 
 from textattack.shared.attack import Attack
-from textattack.constraints.overlap import WordsPerturbed
+from textattack.constraints.overlap import MaxWordsPerturbed
 from textattack.constraints.grammaticality.language_models import Google1BillionWordsLanguageModel
 from textattack.constraints.semantics import WordEmbeddingDistance, RepeatModification, StopwordModification
 from textattack.goal_functions import UntargetedClassification
@@ -26,12 +26,18 @@ def Alzantot2018(model):
     # "[We] fix the hyperparameter values to S = 60, N = 8, K = 4, and δ = 0.5"
     #
     transformation = WordSwapEmbedding(max_candidates=8)
-    constraints = []
+    #
+    # Don't modify the same word twice or stopwords
+    #
+    constraints = [
+        RepeatModification(),
+        StopwordModification()
+    ]
     #
     # Maximum words perturbed percentage of 20%
     #
     constraints.append(
-            WordsPerturbed(max_percent=0.2)
+            MaxWordsPerturbed(max_percent=0.2)
     )
     #
     # Maximum word embedding euclidean distance of 0.5.
@@ -52,7 +58,6 @@ def Alzantot2018(model):
     #
     # Perform word substitution with a genetic algorithm.
     #
-    attack = GeneticAlgorithm(goal_function, constraints=constraints,
-        transformation=transformation, pop_size=60, max_iters=20)
-    
-    return attack
+    search_method = GeneticAlgorithm(pop_size=60, max_iters=20)
+
+    return Attack(goal_function, constraint, transformation, search_method)

textattack/attack_recipes/alzantot_2018_adjusted.py

@@ -9,8 +9,9 @@
     ArXiv, abs/1801.00554.
 """
 
+from textattack.shared.attack import Attack
 from textattack.constraints.grammaticality import PartOfSpeech, LanguageTool
-from textattack.constraints.semantics import WordEmbeddingDistance
+from textattack.constraints.semantics import WordEmbeddingDistance, RepeatModification, StopwordModification
 from textattack.constraints.semantics.sentence_encoders import UniversalSentenceEncoder, BERT
 from textattack.goal_functions import UntargetedClassification
 from textattack.search_methods import GeneticAlgorithm
@@ -24,7 +25,14 @@ def Alzantot2018Adjusted(model, SE_thresh=0.98, sentence_encoder='bert'):
     #
     # "[We] fix the hyperparameter values to S = 60, N = 8, K = 4, and δ = 0.5"
     #
-    transformation = WordSwapEmbedding(max_candidates=50, textfooler_stopwords=True)
+    transformation = WordSwapEmbedding(max_candidates=50)
+    #
+    # Don't modify the same word twice or stopwords
+    #
+    constraints = [
+        RepeatModification(),
+        StopwordModification()
+    ]
     #
     # Minimum word embedding cosine similarity of 0.9.
     #
@@ -55,8 +63,8 @@ def Alzantot2018Adjusted(model, SE_thresh=0.98, sentence_encoder='bert'):
     #
     goal_function = UntargetedClassification(model)
     #
-    # Greedily swap words with "Word Importance Ranking".
+    # Perform word substitution with a genetic algorithm.
     #
-    attack = GeneticAlgorithm(goal_function, transformation=transformation, 
-        constraints=constraints, pop_size=60, max_iters=20)
-    return attack
+    search_method = GeneticAlgorithm(pop_size=60, max_iters=20)
+
+    return Attack(goal_function, constraint, transformation, search_method)

textattack/attack_recipes/deepwordbug_gao_2018.py

@@ -8,6 +8,8 @@
     
 """
 
+from textattack.shared.attack import Attack
+from textattack.constraints.semantics import RepeatModification, StopwordModification
 from textattack.constraints.overlap import LevenshteinEditDistance
 from textattack.goal_functions import UntargetedClassification
 from textattack.search_methods import GreedyWordSwapWIR
@@ -39,12 +41,19 @@ def DeepWordBugGao2018(model, use_all_transformations=True):
         # (ϵ = 30).
         transformation = WordSwapRandomCharacterSubstitution()
     #
+    # Don't modify the same word twice or stopwords
+    #
+    constraints = [
+        RepeatModification(),
+        StopwordModification()
+    ]
+    #
     # In these experiments, we hold the maximum difference
     # on edit distance (ϵ) to a constant 30 for each sample.
     #
-    constraints = [
+    constraints.append(
         LevenshteinEditDistance(30)
-    ]
+    )
     #
     # Goal is untargeted classification
     #
@@ -52,7 +61,6 @@ def DeepWordBugGao2018(model, use_all_transformations=True):
     #
     # Greedily swap words with "Word Importance Ranking".
     #
-    attack = GreedyWordSwapWIR(goal_function, transformation=transformation,
-        constraints=constraints, max_depth=None)
+    search_method = GreedyWordSwapWIR()
     
-    return attack
+    return Attack(goal_function, constraints, transformation, search_method)

textattack/attack_recipes/hotflip_ebrahimi_2017.py

@@ -11,10 +11,11 @@
     paper).
 """
 
+from textattack.shared.attack import Attack
 from textattack.goal_functions import UntargetedClassification
 from textattack.constraints.grammaticality import PartOfSpeech
-from textattack.constraints.overlap import WordsPerturbed
-from textattack.constraints.semantics import WordEmbeddingDistance
+from textattack.constraints.overlap import MaxWordsPerturbed
+from textattack.constraints.semantics import WordEmbeddingDistance, RepeatModification, StopwordModification
 from textattack.search_methods import BeamSearch
 from textattack.transformations import WordSwapGradientBased
 
@@ -23,14 +24,20 @@ def HotFlipEbrahimi2017(model):
     # "HotFlip ... uses the gradient with respect to a one-hot input 
     # representation to efficiently estimate which individual change has the 
     # highest estimated loss."
-    transformation = WordSwapGradientBased(model, top_n=1, replace_stopwords=False)
-    constraints = []
+    transformation = WordSwapGradientBased(model, top_n=1)
+    #
+    # Don't modify the same word twice or stopwords
+    #
+    constraints = [
+        RepeatModification(),
+        StopwordModification()
+    ]
     #
     # 0. "We were able to create only 41 examples (2% of the correctly-
     # classified instances of the SST test set) with one or two flips."
     # 
     constraints.append(
-        WordsPerturbed(max_num_words=2)
+        MaxWordsPerturbed(max_num_words=2)
     )
     #
     # 1. "The cosine similarity between the embedding of words is bigger than a 
@@ -52,7 +59,6 @@ def HotFlipEbrahimi2017(model):
     # well together to confuse a classifier ... The adversary uses a beam size 
     # of 10."
     #
-    attack = BeamSearch(goal_function, constraints=constraints,
-        transformation=transformation, beam_width=10)
-    
-    return attack
+    search_method = BeamSearch(beam_width=10)
+
+    return Attack(goal_function, constraints, transformation, search_method)

textattack/attack_recipes/kuleshov_2017.py

@@ -7,11 +7,13 @@
     https://openreview.net/pdf?id=r1QZ3zbAZ.
 """
 
-from textattack.constraints.overlap import WordsPerturbed
+from textattack.shared.attack import Attack
+from textattack.constraints.overlap import MaxWordsPerturbed
 from textattack.constraints.grammaticality.language_models import GPT2
 from textattack.constraints.semantics.sentence_encoders import ThoughtVector
+from textattack.constraints.semantics import RepeatModification, StopwordModification
 from textattack.goal_functions import UntargetedClassification
-from textattack.search_methods import GreedyWordSwap
+from textattack.search_methods import GreedySearch
 from textattack.transformations import WordSwapEmbedding
 
 def Kuleshov2017(model):
@@ -25,11 +27,17 @@ def Kuleshov2017(model):
     #
     transformation = WordSwapEmbedding(max_candidates=15)
     #
+    # Don't modify the same word twice or stopwords
+    #
+    constraints = [
+        RepeatModification(),
+        StopwordModification()
+    ]
+    #
     # Maximum of 50% of words perturbed (δ in the paper).
     #
-    constraints = []
     constraints.append(
-            WordsPerturbed(max_percent=0.5)
+            MaxWordsPerturbed(max_percent=0.5)
     )
     #
     # Maximum thought vector Euclidean distance of λ_1 = 0.2. (eq. 4)
@@ -52,10 +60,6 @@ def Kuleshov2017(model):
     #
     # Perform word substitution with a genetic algorithm.
     #
-    attack = GreedyWordSwap(goal_function, constraints=constraints,
-        transformation=transformation)
+    search_method = GreedySearch()
     
-    return attack
-
-
-        # GPT2(max_log_prob_diff=2)
+    return Attack(goal_function, constraints, transformation, search_method)

textattack/attack_recipes/seq2sick_cheng_2018_blackbox.py

@@ -12,7 +12,9 @@
     
 """
 
+from textattack.shared.attack import Attack
 from textattack.constraints.overlap import LevenshteinEditDistance
+from textattack.constraints.semantics import WordEmbeddingDistance, RepeatModification, StopwordModification
 from textattack.goal_functions import NonOverlappingOutput
 from textattack.search_methods import GreedyWordSwapWIR
 from textattack.transformations import WordSwapEmbedding
@@ -26,13 +28,22 @@ def Seq2SickCheng2018BlackBox(model, goal_function='non_overlapping'):
     # seq2sick.
     transformation = WordSwapEmbedding(max_candidates=50)
     #
+    # Don't modify the same word twice or stopwords
+    #
+    constraints = [
+        RepeatModification(),
+        StopwordModification()
+    ]
+    #
     # In these experiments, we hold the maximum difference
     # on edit distance (ϵ) to a constant 30 for each sample.
     #
+    constraints.append(
+        LevenshteinEditDistance(30)
+    )
     #
     # Greedily swap words with "Word Importance Ranking".
     #
-    attack = GreedyWordSwapWIR(goal_function, transformation=transformation,
-        constraints=[], max_depth=10)
+    search_method = GreedyWordSwapWIR()
     
-    return attack
+    return Attack(goal_function, constraints, transformation, search_method)

textattack/attack_recipes/textfooler_jin_2019.py

@@ -27,14 +27,13 @@ def TextFoolerJin2019(model):
     # results show that it's definitely 0.5.)
     #
     transformation = WordSwapEmbedding(max_candidates=50)
-    constraints = []
     #
     # Don't modify the same word twice or stopwords
     #
-    constraints.append(
-        RepeatModfication(),
-        StopwordModification(textfooler_stopwords=True),
-    )
+    constraints = [
+        RepeatModification(),
+        StopwordModification(textfooler_stopwords=True)
+    ]
     #
     # Minimum word embedding cosine similarity of 0.5.
     #

textattack/attack_recipes/textfooler_jin_2019_adjusted.py

@@ -8,7 +8,8 @@
     
 """
 
-from textattack.constraints.semantics import WordEmbeddingDistance
+from textattack.shared.attack import Attack
+from textattack.constraints.semantics import WordEmbeddingDistance, RepeatModification, StopwordModification
 from textattack.constraints.semantics.sentence_encoders import UniversalSentenceEncoder, BERT
 from textattack.constraints.grammaticality import PartOfSpeech, LanguageTool
 from textattack.goal_functions import UntargetedClassification
@@ -25,13 +26,19 @@ def TextFoolerJin2019Adjusted(model, SE_thresh=0.98, sentence_encoder='bert'):
     # (The paper claims 0.7, but analysis of the code and some empirical
     # results show that it's definitely 0.5.)
     #
-    transformation = WordSwapEmbedding(max_candidates=50, textfooler_stopwords=True)
+    transformation = WordSwapEmbedding(max_candidates=50)
+    #
+    # Don't modify the same word twice or stopwords
+    #
+    constraints = [
+        RepeatModification(),
+        StopwordModification()
+    ]
     #
     # Minimum word embedding cosine similarity of 0.9.
     #
-    constraints = []
     constraints.append(
-            WordEmbeddingDistance(min_cos_sim=0.9)
+        WordEmbeddingDistance(min_cos_sim=0.9)
     )
     #
     # Universal Sentence Encoder with a minimum angular similarity of ε = 0.7.
@@ -49,7 +56,7 @@ def TextFoolerJin2019Adjusted(model, SE_thresh=0.98, sentence_encoder='bert'):
     # Do grammar checking
     #
     constraints.append(
-            LanguageTool(0)
+        LanguageTool(0)
     )
     
     #
@@ -60,7 +67,6 @@ def TextFoolerJin2019Adjusted(model, SE_thresh=0.98, sentence_encoder='bert'):
     #
     # Greedily swap words with "Word Importance Ranking".
     #
-    attack = GreedyWordSwapWIR(goal_function, transformation=transformation,
-        constraints=constraints, max_depth=None)
+    search_method = GreedyWordSwapWIR()
     
-    return attack
+    return Attack(goal_function, constraints, transformation, search_method)

textattack/constraints/constraint.py

@@ -24,14 +24,14 @@ class Constraint:
         compatible_x_advs = []
         for x_adv in x_adv_list:
             try:
-                if self.check_compatibility(x_adv.attack-attrs['last_transformation']):
+                if self.check_compatibility(x_adv.attack_attrs['last_transformation']):
                     compatible_x_advs.append(x_adv)
                 else:
                     incompatible_x_advs.append(x_adv)
             except KeyError:
                 raise KeyError('x_adv must have `last_transformation` attack_attr to apply GoogLM constraint')
         filtered_x_advs = self._check_constraint_many(x, compatible_x_advs, original_text=original_text)
-        return filtered_x_advs + incompatible_x_advs
+        return list(filtered_x_advs) + incompatible_x_advs
 
     def _check_constraint_many(self, x, x_adv_list, original_text=None):
         return [x_adv for x_adv in x_adv_list 

textattack/constraints/grammaticality/part_of_speech.py

@@ -3,7 +3,7 @@ import nltk
 
 from textattack.constraints import Constraint
 from textattack.shared import TokenizedText
-from textattack.transformation import WordSwap
+from textattack.transformations import WordSwap
 
 class PartOfSpeech(Constraint):
     """ Constraints word swaps to only swap words with the same part of speech.
@@ -50,7 +50,7 @@ class PartOfSpeech(Constraint):
             after_ctx = x.words[i+1:min(i+5,len(x.words))]
             cur_pos = self._get_pos(before_ctx, x_word, after_ctx)
             replace_pos = self._get_pos(before_ctx, x_adv_word, after_ctx)
-            if not self._can_replace_pos(cur_post, replace_pos)
+            if not self._can_replace_pos(cur_pos, replace_pos):
                 return False
 
         return True

textattack/constraints/modification_constraint.py

@@ -12,9 +12,9 @@ class ModificationConstraint(Constraint):
    
     def __call__(self, x, transformation):
         """ Returns the word indices in x which are able to be modified """
-        if not self.check_compatibility(self, transformation):
+        if not self.check_compatibility(transformation):
             return True
-        return _get_modifiable_indices(x)
+        return self._get_modifiable_indices(x)
 
     def _get_modifiable_indices(x):
         raise NotImplementedError()

textattack/constraints/semantics/sentence_encoders/sentence_encoder.py

@@ -93,7 +93,11 @@ class SentenceEncoder(Constraint):
             x_list_text = []
             x_adv_list_text = []
             for x_adv in x_adv_list:
-                modified_index = x_adv.attack_attrs['modified_word_index']
+                #@TODO make this work when multiple indices have been modified
+                try:
+                    modified_index = next(iter(x_adv.attack_attrs['newly_modified_indices']))
+                except KeyError:
+                    raise KeyError('Cannot apply sentence encoder constraint without `newly_modified_indices`')
                 x_list_text.append(x.text_window_around_index(modified_index, self.window_size))
                 x_adv_list_text.append(x_adv.text_window_around_index(modified_index, self.window_size))
             embeddings = self.encode(x_list_text + x_adv_list_text)

textattack/search_methods/__init__.py

@@ -1,5 +1,5 @@
+from .search_method import SearchMethod
 from .beam_search import BeamSearch
-from .greedy_word_swap import GreedyWordSwap
+from .greedy_search import GreedySearch
 from .greedy_word_swap_wir import GreedyWordSwapWIR
 from .genetic_algorithm import GeneticAlgorithm
-from .search_method import SearchMethod

textattack/search_methods/beam_search.py

@@ -1,6 +1,7 @@
-from texattack.search_methods import SearchMethod
 import numpy as np
 
+from textattack.search_methods import SearchMethod
+
 class BeamSearch(SearchMethod):
     """ 
     An attack that greedily chooses from a list of possible 
@@ -36,8 +37,7 @@ class BeamSearch(SearchMethod):
             # in descending order and filling the beam from there.
             best_indices = -scores.argsort()[:self.beam_width]
             beam = [potential_next_beam[i] for i in best_indices]
-       
-       return best_result
+        return best_result
 
     def extra_repr_keys(self):
         return ['beam_width']

textattack/search_methods/genetic_algorithm.py

@@ -27,7 +27,7 @@ class GeneticAlgorithm(SearchMethod):
         self.give_up_if_no_improvement = give_up_if_no_improvement
 
     def check_transformation_compatibility(self, transformation):
-        return transformation.instance_of(WordSwap)
+        return transformation.consists_of(WordSwap)
 
     def _replace_at_index(self, pop_member, idx):
         """

textattack/search_methods/greedy_word_swap_wir.py

@@ -1,6 +1,7 @@
 import numpy as np
 
 from textattack.search_methods import SearchMethod
+from textattack.transformations import WordSwap
 
 class GreedyWordSwapWIR(SearchMethod):
     """
@@ -23,17 +24,18 @@ class GreedyWordSwapWIR(SearchMethod):
     }
 
     def __init__(self, wir_method='unk'):
+        self.wir_method = wir_method
         try: 
             self.replacement_str = self.WIR_TO_REPLACEMENT_STR[wir_method]
         except KeyError:
             raise KeyError(f'Word Importance Ranking method {wir_method} not recognized.') 
         
     def check_transformation_compatibility(self, transformation):
-        return transformation.instance_of(WordSwap)
+        return transformation.consists_of(WordSwap)
 
     def __call__(self, initial_result):
-        original_tokenized_text = intial_result.tokenized_text
-        cur_result = intial_result
+        tokenized_text = initial_result.tokenized_text
+        cur_result = initial_result
 
         # Sort words by order of importance
         len_text = len(tokenized_text.words)
@@ -41,19 +43,19 @@ class GreedyWordSwapWIR(SearchMethod):
         leave_one_texts = \
             [tokenized_text.replace_word_at_index(i,self.replacement_str) for i in range(len_text)]
         leave_one_scores = np.array([result.score for result in \
-            self.get_goal_results(leave_one_texts, intial_result.output)])
+            self.get_goal_results(leave_one_texts, initial_result.output)])
         index_order = (-leave_one_scores).argsort()
 
         i = 0
         while i < len(index_order):
             transformed_text_candidates = self.get_transformations(
                 cur_result.tokenized_text,
-                original_text=original_tokenized_text,
+                original_text=initial_result.tokenized_text,
                 indices_to_modify=[index_order[i]])
             i += 1
             if len(transformed_text_candidates) == 0:
                 continue
-            results = sorted(self.get_goal_results(transformed_text_candidates, intial_result.output), 
+            results = sorted(self.get_goal_results(transformed_text_candidates, initial_result.output), 
                     key=lambda x: -x.score)
             # Skip swaps which don't improve the score
             if results[0].score > cur_result.score:

textattack/shared/__init__.py

@@ -2,6 +2,6 @@ from . import scripts
 from . import utils
 from . import validators
 
-from .attack import Attack
 from .tokenized_text import TokenizedText
 from .word_embedding import WordEmbedding
+from .attack import Attack

textattack/shared/attack.py

@@ -6,7 +6,7 @@ import random
 from textattack.shared import utils
 from textattack.constraints import Constraint, ModificationConstraint
 from textattack.shared import TokenizedText
-from textattack.attack_results import SkippedAttackResult, SuccessfulAttackResult, FailedAtttackResult
+from textattack.attack_results import SkippedAttackResult, SuccessfulAttackResult, FailedAttackResult
 
 class Attack:
     """
@@ -39,11 +39,7 @@ class Attack:
             else:
                 raise NameError('Cannot instantiate attack without tokenizer')
         self.transformation = transformation
-        self.is_black_box = True
-        for transformation in transformations:
-            if not transformation.is_black_box:
-                self.is_black_box = False
-                break
+        self.is_black_box = getattr(transformation, 'is_black_box', True)
 
         if not self.search_method.check_transformation_compatibility(self.transformation):
             raise ValueError('SearchMethod {self.search_method} incompatible with transformation {self.transformation}')
@@ -51,7 +47,7 @@ class Attack:
         self.constraints = []
         self.modification_constraints = []
         for constraint in constraints:
-            is isinstance(constraint, ModiifcationConstraint):
+            if isinstance(constraint, ModificationConstraint):
                 self.modification_constraints.append(constraint)
             else:
                 self.constraints.append(constraint)
@@ -138,7 +134,7 @@ class Attack:
         """
         Perturbs `tokenized_text` from initial_result until goal is reached.
         """
-        final_result = search_method(initial_result)
+        final_result = self.search_method(initial_result)
         if final_result.succeeded:
             return SuccessfulAttackResult(initial_result, final_result)
         else:

textattack/shared/scripts/run_attack_args_helper.py

@@ -107,7 +107,7 @@ CONSTRAINT_CLASS_NAMES = {
     'thought-vector':   'textattack.constraints.semantics.sentence_encoders.ThoughtVector',
     'use':              'textattack.constraints.semantics.sentence_encoders.UniversalSentenceEncoder',
     'repeat':           'textattack.constraints.semantics.RepeatModification',
-    'stopword':         'textattack.constraints.semantics.StopwordModification',.
+    'stopword':         'textattack.constraints.semantics.StopwordModification',
     #
     # Grammaticality constraints
     #
@@ -156,7 +156,7 @@ def get_args():
         choices=MODEL_CLASS_NAMES.keys(), help='The classification model to attack.')
     
     parser.add_argument('--constraints', type=str, required=False, nargs='*',
-        default=[],
+        default=['repeat', 'stopword'],
         help=('Constraints to add to the attack. Usage: "--constraints {constraint}:{arg_1}={value_1},{arg_3}={value_3}". Choices: ' + str(CONSTRAINT_CLASS_NAMES.keys())))
     
     parser.add_argument('--out-dir', type=str, required=False, default=None,

textattack/shared/tokenized_text.py

@@ -34,6 +34,8 @@ class TokenizedText:
         self.attack_attrs = attack_attrs
         if 'modified_indices' not in attack_attrs:
             attack_attrs['modified_indices'] = set()
+        if 'stopword_indices' not in attack_attrs:
+            attack_attrs['stopword_indices'] = set()
 
     def __eq__(self, other):
         return (self.text == other.text) and (self.attack_attrs == other.attack_attrs)
@@ -46,10 +48,10 @@ class TokenizedText:
         if textfooler_stopwords:
             self.stopwords = set(['a', 'about', 'above', 'across', 'after', 'afterwards', 'again', 'against', 'ain', 'all', 'almost', 'alone', 'along', 'already', 'also', 'although', 'am', 'among', 'amongst', 'an', 'and', 'another', 'any', 'anyhow', 'anyone', 'anything', 'anyway', 'anywhere', 'are', 'aren', "aren't", 'around', 'as', 'at', 'back', 'been', 'before', 'beforehand', 'behind', 'being', 'below', 'beside', 'besides', 'between', 'beyond', 'both',  'but', 'by', 'can', 'cannot', 'could', 'couldn', "couldn't", 'd', 'didn', "didn't", 'doesn', "doesn't", 'don', "don't", 'down', 'due', 'during', 'either', 'else', 'elsewhere', 'empty', 'enough', 'even', 'ever', 'everyone', 'everything', 'everywhere', 'except',  'first', 'for', 'former', 'formerly', 'from', 'hadn', "hadn't",  'hasn', "hasn't",  'haven', "haven't", 'he', 'hence', 'her', 'here', 'hereafter', 'hereby', 'herein', 'hereupon', 'hers', 'herself', 'him', 'himself', 'his', 'how', 'however', 'hundred', 'i', 'if', 'in', 'indeed', 'into', 'is', 'isn', "isn't", 'it', "it's", 'its', 'itself', 'just', 'latter', 'latterly', 'least', 'll', 'may', 'me', 'meanwhile', 'mightn', "mightn't", 'mine', 'more', 'moreover', 'most', 'mostly',  'must', 'mustn', "mustn't", 'my', 'myself', 'namely', 'needn', "needn't", 'neither', 'never', 'nevertheless', 'next', 'no', 'nobody', 'none', 'noone', 'nor', 'not', 'nothing', 'now', 'nowhere', 'o', 'of', 'off', 'on', 'once', 'one', 'only', 'onto', 'or', 'other', 'others', 'otherwise', 'our', 'ours', 'ourselves', 'out', 'over', 'per', 'please','s', 'same', 'shan', "shan't", 'she', "she's", "should've", 'shouldn', "shouldn't", 'somehow', 'something', 'sometime', 'somewhere', 'such', 't', 'than', 'that', "that'll", 'the', 'their', 'theirs', 'them', 'themselves', 'then', 'thence', 'there', 'thereafter', 'thereby', 'therefore', 'therein', 'thereupon', 'these', 'they','this', 'those', 'through', 'throughout', 'thru', 'thus', 'to', 'too','toward', 'towards', 'under', 'unless', 'until', 'up', 'upon', 'used',  've', 'was', 'wasn', "wasn't", 'we',  'were', 'weren', "weren't", 'what', 'whatever', 'when', 'whence', 'whenever', 'where', 'whereafter', 'whereas', 'whereby', 'wherein', 'whereupon', 'wherever', 'whether', 'which', 'while', 'whither', 'who', 'whoever', 'whole', 'whom', 'whose', 'why', 'with', 'within', 'without', 'won', "won't", 'would', 'wouldn', "wouldn't", 'y', 'yet', 'you', "you'd", "you'll", "you're", "you've", 'your', 'yours', 'yourself', 'yourselves'])
         
-        attack_attrs['stopword_indices'] = set()
+        self.attack_attrs['stopword_indices'] = set()
         for i, word in enumerate(self.words):
             if word.lower() in self.stopwords:
-                attack_attrs['stopword_indices'].add(i)
+                self.attack_attrs['stopword_indices'].add(i)
 
     def delete_tensors(self):
         """ Delete tensors to clear up GPU space. Only should be called

textattack/transformations/transformation.py

@@ -7,21 +7,21 @@ class Transformation:
         
     """
 
-    self.is_black_box = True
-
     def __call__(self, tokenized_text, modification_constraints=[], indices_to_modify=None):
         """ Returns a list of all possible transformations for `tokenized_text`."""
         if indices_to_modify is None:
             indices_to_modify = set(range(len(tokenized_text.words)))
+        else:
+            indices_to_modify = set(indices_to_modify)
         for constraint in modification_constraints:
             if constraint.check_compatibility(self):
                 indices_to_modify = indices_to_modify & constraint(tokenized_text, self)
-        transformed_texts = _get_transformations(tokenized_text, indices_to_modify)
+        transformed_texts = self._get_transformations(tokenized_text, indices_to_modify)
         for text in transformed_texts:
             text.attack_attrs['last_transformation'] = self
         return transformed_texts
    
-    def _get_transformations(self, tokenized_text, indices_to_modify)
+    def _get_transformations(self, tokenized_text, indices_to_modify):
         raise NotImplementedError()
 
     def extra_repr_keys(self):