# SilverSpeak: Evading AI-Generated Text Detectors using Homoglyphs

arXiv: https://arxiv.org/abs/2406.11239 · HTML: https://mlsanity.com/paper/2406.11239/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- Builds on 21 of its 44 references that are in the map.
- First posted on arXiv 17 Jun 2024.

## Builds on (most cited first, 21 of 21)

- [PyTorch: An Imperative Style, High-Performance Deep Learning Library](https://mlsanity.com/paper/1912.01703/) (2019)
- [Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformer](https://mlsanity.com/paper/1910.10683/) (2019)
- [Neural Machine Translation of Rare Words with Subword Units](https://mlsanity.com/paper/1508.07909/) (2015)
- [UMAP: Uniform Manifold Approximation and Projection for Dimension Reduction](https://mlsanity.com/paper/1802.03426/) (2018)
- [HuggingFace's Transformers: State-of-the-art Natural Language Processing](https://mlsanity.com/paper/1910.03771/) (2019)
- [Release Strategies and the Social Impacts of Language Models](https://mlsanity.com/paper/1908.09203/) (2019)
- [GLTR: Statistical Detection and Visualization of Generated Text](https://mlsanity.com/paper/1906.04043/) (2019)
- [Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense](https://mlsanity.com/paper/2303.13408/) (2023)
- [Can AI-Generated Text be Reliably Detected?](https://mlsanity.com/paper/2303.11156/) (2023)
- [Fast-DetectGPT: Efficient Zero-Shot Detection of Machine-Generated Text via Conditional Probability Curvature](https://mlsanity.com/paper/2310.05130/) (2023)
- [Spotting LLMs With Binoculars: Zero-Shot Detection of Machine-Generated Text](https://mlsanity.com/paper/2401.12070/) (2024)
- [DetectLLM: Leveraging Log Rank Information for Zero-Shot Detection of Machine-Generated Text](https://mlsanity.com/paper/2306.05540/) (2023)
- [GPT detectors are biased against non-native English writers](https://mlsanity.com/paper/2304.02819/) (2023)
- [Ghostbuster: Detecting Text Ghostwritten by Large Language Models](https://mlsanity.com/paper/2305.15047/) (2023)
- [WaterMax: breaking the LLM watermark detectability-robustness-quality trade-off](https://mlsanity.com/paper/2403.04808/) (2024)
- [Large Language Models can be Guided to Evade AI-Generated Text Detection](https://mlsanity.com/paper/2305.10847/) (2023)
- [ArguGPT: evaluating, understanding and identifying argumentative essays generated by GPT models](https://mlsanity.com/paper/2304.07666/) (2023)
- [Is ChatGPT Transforming Academics' Writing Style?](https://mlsanity.com/paper/2404.08627/) (2024)
- [Evade ChatGPT Detectors via A Single Space](https://mlsanity.com/paper/2307.02599/) (2023)
- [Hidding the Ghostwriters: An Adversarial Evaluation of AI-Generated Student Essay Detection](https://mlsanity.com/paper/2402.00412/) (2024)
- [Detecting Homoglyph Attacks with a Siamese Neural Network](https://mlsanity.com/paper/1805.09738/) (2018)

## Built on by (most cited first, 13 of 13)

- [Character-Level Perturbations Disrupt LLM Watermarks](https://mlsanity.com/paper/2509.09112/) (2025)
- [StealthRL: Reinforcement Learning Paraphrase Attacks for Multi-Detector Evasion of AI-Text Detectors](https://mlsanity.com/paper/2602.08934/) (2026)
- [Imperceptible Jailbreaking against Large Language Models](https://mlsanity.com/paper/2510.05025/) (2025)
- [Base Models Look Human To AI Detectors](https://mlsanity.com/paper/2605.19516/) (2026)
- [Attacks on Machine-Text Detectors Retain Stylistic Fingerprints](https://mlsanity.com/paper/2505.14608/) (2025)
- [Complete Evasion, Zero Modification: PDF Attacks on AI Text Detection](https://mlsanity.com/paper/2508.01887/) (2025)
- [MELD: Multi-Task Equilibrated Learning Detector for AI-Generated Text](https://mlsanity.com/paper/2605.06903/) (2026)
- [Large Language Models and Forensic Linguistics: Navigating Opportunities and Threats in the Age of Generative AI](https://mlsanity.com/paper/2512.06922/) (2025)
- [Hijacking Text Heritage: Hiding the Human Signature through Homoglyphic Substitution](https://mlsanity.com/paper/2604.10271/) (2026)
- [Homoglyph-based Adversarial Perturbation of Introductory Computer Science Theory Problems](https://mlsanity.com/paper/2605.16286/) (2026)
- [Show, Don't TELL: Explainable AI-Generated Text Detection](https://mlsanity.com/paper/2605.27921/) (2026)
- [Unchecked or Falsely Accused? Evaluating AI-Generated Text Detectors on Kazakh](https://mlsanity.com/paper/2610.15870/) (2026)
- [Attacking Only Half the Data: Two-Sided Evaluation of AI-Text Detector Robustness](https://mlsanity.com/paper/2610.18151/) (2026)

## Abstract (arXiv)

The advent of Large Language Models (LLMs) has enabled the generation of text that increasingly exhibits human-like characteristics. As the detection of such content is of significant importance, substantial research has been conducted with the objective of developing reliable AI-generated text detectors. These detectors have demonstrated promising results on test data, but recent research has revealed that they can be circumvented by employing different techniques. In this paper, we present homoglyph-based attacks (A rightarrow Cyrillic A) as a means of circumventing existing detectors. We conduct a comprehensive evaluation to assess the effectiveness of these attacks on seven detectors, including ArguGPT, Binoculars, DetectGPT, Fast-DetectGPT, Ghostbuster, OpenAI's detector, and watermarking techniques, on five different datasets. Our findings demonstrate that homoglyph-based attacks can effectively circumvent state-of-the-art detectors, leading them to classify all texts as either AI-generated or human-written (decreasing the average Matthews Correlation Coefficient from 0.64 to -0.01). Through further examination, we extract the technical justification underlying the success of the attacks, which varies across detectors. Finally, we discuss the implications of these findings and potential defenses against such attacks.