# Fooling OCR Systems with Adversarial Text Images

arXiv: https://arxiv.org/abs/1802.05385 · HTML: https://mlsanity.com/paper/1802.05385/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Feb 2018.

## Built on by (most cited first, 12 of 12)

- [Black-box Adversarial Attacks on Network-wide Multi-step Traffic State Prediction Models](https://mlsanity.com/paper/2110.08712/) (2021)
- [Simple Transparent Adversarial Examples](https://mlsanity.com/paper/2105.09685/) (2021)
- [Physical Prompt Injection Attacks on Large Vision-Language Models](https://mlsanity.com/paper/2601.17383/) (2026)
- [An Image is Worth a Thousand Toxic Words: A Metamorphic Testing Framework for Content Moderation Software](https://mlsanity.com/paper/2308.09810/) (2023)
- [Evaluating Adversarial Robustness on Document Image Classification](https://mlsanity.com/paper/2304.12486/) (2023)
- [Vulnerability Analysis of Transformer-based Optical Character Recognition to Adversarial Attacks](https://mlsanity.com/paper/2311.17128/) (2023)
- [On the feasibility of attacking Thai LPR systems with adversarial examples](https://mlsanity.com/paper/2301.05506/) (2023)
- [Invisible Threats: Backdoor Attack in OCR Systems](https://mlsanity.com/paper/2310.08259/) (2023)
- [Counterfeit Answers: Adversarial Forgery against OCR-Free Document Visual Question Answering](https://mlsanity.com/paper/2512.04554/) (2025)
- [Adversarial Robustness of Visual Dialog](https://mlsanity.com/paper/2207.02639/) (2022)
- [Universal Defensive Underpainting Patch: Making Your Text Invisible to Optical Character Recognition](https://mlsanity.com/paper/2308.02369/) (2023)
- [Adversarial Attacks on Deep OCR Systems](https://mlsanity.com/paper/2608.07636/) (2026)

## Abstract (arXiv)

We demonstrate that state-of-the-art optical character recognition (OCR) based on deep learning is vulnerable to adversarial images. Minor modifications to images of printed text, which do not change the meaning of the text to a human reader, cause the OCR system to "recognize" a different text where certain words chosen by the adversary are replaced by their semantic opposites. This completely changes the meaning of the output produced by the OCR system and by the NLP applications that use OCR for preprocessing their inputs.