# Emoti-Attack: Zero-Perturbation Adversarial Attacks on NLP Systems via Emoji Sequences

arXiv: https://arxiv.org/abs/2502.17392 · HTML: https://mlsanity.com/paper/2502.17392/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 13 references that are in the map.
- First posted on arXiv 24 Feb 2025.

## Builds on (most cited first, 6 of 6)

- [Neural Machine Translation by Jointly Learning to Align and Translate](https://mlsanity.com/paper/1409.0473/) (2014)
- [Sequence to Sequence Learning with Neural Networks](https://mlsanity.com/paper/1409.3215/) (2014)
- [Regret-Optimal Model-Free Reinforcement Learning for Discounted MDPs with Short Burn-In Time](https://mlsanity.com/paper/2305.15546/) (2023)
- [DreamSmooth: Improving Model-based Reinforcement Learning via Reward Smoothing](https://mlsanity.com/paper/2311.01450/) (2023)
- [Improved Reinforcement Learning through Imitation Learning Pretraining Towards Image-based Autonomous Driving](https://mlsanity.com/paper/1907.06838/) (2019)
- [Semantic-Preserving Adversarial Text Attacks](https://mlsanity.com/paper/2108.10015/) (2021)

## Built on by (most cited first, 5 of 5)

- [Who's Asking? Evaluating LLM Robustness to Inquiry Personas in Factual Question Answering](https://mlsanity.com/paper/2510.12925/) (2025)
- [Text Adversarial Attacks with Dynamic Outputs](https://mlsanity.com/paper/2509.22393/) (2025)
- [Obfuscation Rules for Detecting and Detoxifying Korean Toxicity](https://mlsanity.com/paper/2510.10961/) (2025)
- [Emoji-Based Jailbreaking of Large Language Models](https://mlsanity.com/paper/2601.00936/) (2026)
- [Are LLMs Safe Beyond Text: Do Emojis Expose Gaps in Safety Evaluation](https://mlsanity.com/paper/2608.18164/) (2026)

## Abstract (arXiv)

Deep neural networks (DNNs) have achieved remarkable success in the field of natural language processing (NLP), leading to widely recognized applications such as ChatGPT. However, the vulnerability of these models to adversarial attacks remains a significant concern. Unlike continuous domains like images, text exists in a discrete space, making even minor alterations at the sentence, word, or character level easily perceptible to humans. This inherent discreteness also complicates the use of conventional optimization techniques, as text is non-differentiable. Previous research on adversarial attacks in text has focused on character-level, word-level, sentence-level, and multi-level approaches, all of which suffer from inefficiency or perceptibility issues due to the need for multiple queries or significant semantic shifts. In this work, we introduce a novel adversarial attack method, Emoji-Attack, which leverages the manipulation of emojis to create subtle, yet effective, perturbations. Unlike character- and word-level strategies, Emoji-Attack targets emojis as a distinct layer of attack, resulting in less noticeable changes with minimal disruption to the text. This approach has been largely unexplored in previous research, which typically focuses on emoji insertion as an extension of character-level attacks. Our experiments demonstrate that Emoji-Attack achieves strong attack performance on both large and small models, making it a promising technique for enhancing adversarial robustness in NLP systems.