Fooling OCR Systems with Adversarial Text Images
Not on the map. Why?
Abstract (arXiv)
We demonstrate that state-of-the-art optical character recognition (OCR) based on deep learning is vulnerable to adversarial images. Minor modifications to images of printed text, which do not change the meaning of the text to a human reader, cause the OCR system to "recognize" a different text where certain words chosen by the adversary are replaced by their semantic opposites. This completely changes the meaning of the output produced by the OCR system and by the NLP applications that use OCR for preprocessing their inputs.
Key facts. Cited by 12 papers in the map (data through 7 Oct 2026). First posted on arXiv 15 Feb 2018.
Builds on
No reference list yet.
Built on by
Citing papers per year: 2021: 2; 2022: 1; 2023: 6; 2024: 0; 2025: 1; 2026: 2.
12 papers.
- 2021Simple Transparent Adversarial Examplescited by 6
- 2021Black-box Adversarial Attacks on Network-wide Multi-step Traffic State Prediction Modelscited by 6
- 2023An Image is Worth a Thousand Toxic Words: A Metamorphic Testing Framework for Content Moderation Softwarecited by 3
- 2026Physical Prompt Injection Attacks on Large Vision-Language Modelscited by 3
- 2023Evaluating Adversarial Robustness on Document Image Classificationcited by 2
- 2023Vulnerability Analysis of Transformer-based Optical Character Recognition to Adversarial Attackscited by 2
- 2023On the feasibility of attacking Thai LPR systems with adversarial examplescited by 1
- 2023Invisible Threats: Backdoor Attack in OCR Systemscited by 1
- 2025Counterfeit Answers: Adversarial Forgery against OCR-Free Document Visual Question Answeringcited by 1
- 2022Adversarial Robustness of Visual Dialogcited by 0
- 2023Universal Defensive Underpainting Patch: Making Your Text Invisible to Optical Character Recognitioncited by 0
- 2026Adversarial Attacks on Deep OCR Systemscited by 0
- 2026Adversarial Attacks on Deep OCR Systems7 Aug 2026
- 2026Physical Prompt Injection Attacks on Large Vision-Language Models24 Jan 2026
- 2025Counterfeit Answers: Adversarial Forgery against OCR-Free Document Visual Question Answering4 Dec 2025
- 2023Vulnerability Analysis of Transformer-based Optical Character Recognition to Adversarial Attacks28 Nov 2023
- 2023Invisible Threats: Backdoor Attack in OCR Systems12 Oct 2023
- 2023An Image is Worth a Thousand Toxic Words: A Metamorphic Testing Framework for Content Moderation Software18 Aug 2023
- 2023Universal Defensive Underpainting Patch: Making Your Text Invisible to Optical Character Recognition4 Aug 2023
- 2023Evaluating Adversarial Robustness on Document Image Classification24 Apr 2023
- 2023On the feasibility of attacking Thai LPR systems with adversarial examples13 Jan 2023
- 2022Adversarial Robustness of Visual Dialog6 Jul 2022
- 2021Black-box Adversarial Attacks on Network-wide Multi-step Traffic State Prediction Models17 Oct 2021
- 2021Simple Transparent Adversarial Examples20 May 2021