# Attacking Optical Character Recognition (OCR) Systems with Adversarial Watermarks

arXiv: https://arxiv.org/abs/2002.03095 · HTML: https://mlsanity.com/paper/2002.03095/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 Feb 2020.

## Built on by (most cited first, 7 of 7)

- [Simple Transparent Adversarial Examples](https://mlsanity.com/paper/2105.09685/) (2021)
- [An Image is Worth a Thousand Toxic Words: A Metamorphic Testing Framework for Content Moderation Software](https://mlsanity.com/paper/2308.09810/) (2023)
- [Captcha Attack: Turning Captchas Against Humanity](https://mlsanity.com/paper/2201.04014/) (2022)
- [On the feasibility of attacking Thai LPR systems with adversarial examples](https://mlsanity.com/paper/2301.05506/) (2023)
- [Invisible Threats: Backdoor Attack in OCR Systems](https://mlsanity.com/paper/2310.08259/) (2023)
- [Universal Defensive Underpainting Patch: Making Your Text Invisible to Optical Character Recognition](https://mlsanity.com/paper/2308.02369/) (2023)
- [Adversarial Attacks on Deep OCR Systems](https://mlsanity.com/paper/2608.07636/) (2026)

## Abstract (arXiv)

Optical character recognition (OCR) is widely applied in real applications serving as a key preprocessing tool. The adoption of deep neural network (DNN) in OCR results in the vulnerability against adversarial examples which are crafted to mislead the output of the threat model. Different from vanilla colorful images, images of printed text have clear backgrounds usually. However, adversarial examples generated by most of the existing adversarial attacks are unnatural and pollute the background severely. To address this issue, we propose a watermark attack method to produce natural distortion that is in the disguise of watermarks and evade human eyes' detection. Experimental results show that watermark attacks can yield a set of natural adversarial examples attached with watermarks and attain similar attack performance to the state-of-the-art methods in different attack scenarios.