mlsanityData to 14 Oct 2026

Text Processing Like Humans Do: Visually Attacking and Shielding NLP Systems

arXiv 1903.11508 ↗First posted 27 Mar 2019cs.CL cs.CR cs.CVcited by 101

Not on the map. Why?

Abstract (arXiv)

Visual modifications to text are often used to obfuscate offensive comments in social media (e.g., "!d10t") or as a writing style ("1337" in "leet speak"), among other scenarios. We consider this as a new type of adversarial attack in NLP, a setting to which humans are very robust, as our experiments with both simple and more difficult visual input perturbations demonstrate. We then investigate the impact of visual adversarial attacks on current NLP systems on character-, word-, and sentence-level tasks, showing that both neural and non-neural models are, in contrast to humans, extremely sensitive to such attacks, suffering performance decreases of up to 82%. We then explore three shielding methods---visual character embeddings, adversarial training, and rule-based recovery---which substantially improve the robustness of the models. However, the shielding methods still fall behind performances achieved in non-attack scenarios, which demonstrates the difficulty of dealing with visual attacks.

Key facts. Cited by 101 papers in the map (data through 14 Oct 2026). First posted on arXiv 27 Mar 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 20; 2022: 23; 2023: 22; 2024: 21; 2025: 12; 2026: 3.

101 papers.

Sort:

By area:

  1. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfercited by 158
  2. 2024Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplificationcited by 81
  3. 2021NL-Augmenter: A Framework for Task-Sensitive Natural Language Augmentationcited by 73
  4. 2021Towards Robustness Against Natural Language Word Substitutionscited by 69
  5. 2024Typos that Broke the RAG's Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbationscited by 65
  6. 2021Certified Robustness to Text Adversarial Attacks by Randomized [MASK]cited by 57
  7. 2021How Should Pre-Trained Language Models Be Fine-Tuned Towards Adversarial Robustness?cited by 49
  8. 2021Robust Open-Vocabulary Translation from Visual Text Representationscited by 47
  9. 2023On Robustness of Prompt-based Semantic Parsing with Large Pre-trained Language Model: An Empirical Study on Codexcited by 41
  10. 2023In ChatGPT We Trust? Measuring and Characterizing the Reliability of ChatGPTcited by 37
  11. 2023SurrogatePrompt: Bypassing the Safety Filter of Text-to-Image Models via Substitutioncited by 34
  12. 2023Assessing Hidden Risks of LLMs: An Empirical Study on Robustness, Consistency, and Credibilitycited by 30
38 more
  1. 2023The Trickle-down Impact of Reward (In-)consistency on RLHFcited by 29
  2. 2024Stumbling Blocks: Stress Testing the Robustness of Machine-Generated Text Detectors Under Attackscited by 26
  3. 2021Global Explainability of BERT-Based Evaluation Metrics by Disentangling along Linguistic Factorscited by 25
  4. 2022"That Is a Suspicious Reaction!": Interpreting Logits Variation to Detect NLP Adversarial Attackscited by 24
  5. 2022Certified Robustness Against Natural Language Attacks by Causal Interventioncited by 24
  6. 2023Evaluating the Robustness of Text-to-image Diffusion Models against Real-world Attackscited by 24
  7. 2024Benchmarking Large Multimodal Models against Common Corruptionscited by 24
  8. 2023MTTM: Metamorphic Testing for Textual Content Moderation Softwarecited by 22
  9. 2021Multi-granularity Textual Adversarial Attack with Behavior Cloningcited by 21
  10. 2021BERT-Defense: A Probabilistic Model Based on BERT to Combat Cognitively Inspired Orthographic Adversarial Attackscited by 17
  11. 2021Efficient Combinatorial Optimization for Word-level Adversarial Textual Attackcited by 17
  12. 2021Interpreting the Robustness of Neural NLP Models to Textual Perturbationscited by 17
  13. 2024PIXAR: Auto-Regressive Language Modeling in Pixel Spacecited by 16
  14. 2021Adversarial Reinforced Instruction Attacker for Robust Vision-Language Navigationcited by 15
  15. 2022On Robust Prefix-Tuning for Text Classificationcited by 15
  16. 2022Towards Explainable Evaluation Metrics for Natural Language Generationcited by 15
  17. 2024A Novel Evaluation Framework for Assessing Resilience Against Prompt Injection Attacks in Large Language Modelscited by 15
  18. 2021Adversarial Stylometry in the Wild: Transferable Lexical Substitution Attacks on Author Profilingcited by 13
  19. 2022Perturbations in the Wild: Leveraging Human-Written Text Perturbations for Realistic Adversarial Attack and Defensecited by 13
  20. 2024Legilimens: Practical and Unified Content Moderation for Large Language Model Servicescited by 13
  21. 2025Tokenization is Sensitive to Language Variationcited by 13
  22. 2021Token-Modification Adversarial Attacks for Natural Language Processing: A Surveycited by 12
  23. 2023Generating Valid and Natural Adversarial Examples with Large Language Modelscited by 12
  24. 2022Robust Natural Language Processing: Recent Advances, Challenges, and Future Directionscited by 11
  25. 2022What do we Really Know about State of the Art NER?cited by 10
  26. 2022Layer or Representation Space: What makes BERT-based Evaluation Metrics Robust?cited by 10
  27. 2021A Differentiable Language Model Adversarial Attack on Text Classifierscited by 9
  28. 2025See the Text: From Tokenization to Visual Readingcited by 9
  29. 2022On The Robustness of Offensive Language Classifierscited by 8
  30. 2023TextShield: Beyond Successfully Detecting Adversarial Sentences in Text Classificationcited by 8
  31. 2023Verifying the Robustness of Automatic Credibility Assessmentcited by 8
  32. 2023No more Reviewer #2: Subverting Automatic Paper-Reviewer Assignment using Adversarial Learningcited by 7
  33. 2024Probing the Robustness of Vision-Language Pretrained Models: A Multimodal Adversarial Attack Approachcited by 7
  34. 2023CRYPTEXT: Database and Interactive Toolkit of Human-Written Text Perturbations in the Wildcited by 6
  35. 2023LEAP: Efficient and Automated Test Method for NLP Softwarecited by 6
  36. 2023CT-GAT: Cross-Task Generative Adversarial Attack based on Transferabilitycited by 6
  37. 2021Effective and Imperceptible Adversarial Textual Attack via Multi-objectivizationcited by 5
  38. 2021Understanding and Measuring Robustness of Multimodal Learningcited by 5

50 most cited of 101 All 101 (JSON)