# FAWA: Fast Adversarial Watermark Attack on Optical Character Recognition (OCR) Systems

arXiv: https://arxiv.org/abs/2012.08096 · HTML: https://mlsanity.com/paper/2012.08096/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Dec 2020.

## Built on by (most cited first, 8 of 8)

- [TRAPDOC: Deceiving LLM Users by Injecting Imperceptible Phantom Tokens into Documents](https://mlsanity.com/paper/2506.00089/) (2025)
- [When Vision Fails: Text Attacks Against ViT and OCR](https://mlsanity.com/paper/2306.07033/) (2023)
- [Seeing is Deceiving: Exploitation of Visual Pathways in Multi-Modal Language Models](https://mlsanity.com/paper/2411.05056/) (2024)
- [Captcha Attack: Turning Captchas Against Humanity](https://mlsanity.com/paper/2201.04014/) (2022)
- [Efficient Meshy Neural Fields for Animatable Human Avatars](https://mlsanity.com/paper/2303.12965/) (2023)
- [TopoReformer: Mitigating Adversarial Attacks Using Topological Purification in OCR Models](https://mlsanity.com/paper/2511.15807/) (2025)
- [Threats to Arabic Handwriting Recognition: Investigating Black-Box Adversarial Attacks on embedded ConvNet models](https://mlsanity.com/paper/2605.18058/) (2026)
- [Visually Legible but Adversarial: Watermark-Constrained Attacks on End-to-End VLMs for Document Understanding](https://mlsanity.com/paper/2610.15728/) (2026)

## Abstract (arXiv)

Deep neural networks (DNNs) significantly improved the accuracy of optical character recognition (OCR) and inspired many important applications. Unfortunately, OCRs also inherit the vulnerabilities of DNNs under adversarial examples. Different from colorful vanilla images, text images usually have clear backgrounds. Adversarial examples generated by most existing adversarial attacks are unnatural and pollute the background severely. To address this issue, we propose the Fast Adversarial Watermark Attack (FAWA) against sequence-based OCR models in the white-box manner. By disguising the perturbations as watermarks, we can make the resulting adversarial images appear natural to human eyes and achieve a perfect attack success rate. FAWA works with either gradient-based or optimization-based perturbation generation. In both letter-level and word-level attacks, our experiments show that in addition to natural appearance, FAWA achieves a 100% attack success rate with 60% less perturbations and 78% fewer iterations on average. In addition, we further extend FAWA to support full-color watermarks, other languages, and even the OCR accuracy-enhancing mechanism.