# PHISH in MESH: Korean Adversarial Phonetic Substitution and Phonetic-Semantic Feature Integration Defense

arXiv: https://arxiv.org/abs/2505.21380 · HTML: https://mlsanity.com/paper/2505.21380/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 7 of its 22 references that are in the map.
- First posted on arXiv 27 May 2025.

## Builds on (most cited first, 7 of 7)

- [Leveraging Pre-trained Checkpoints for Sequence Generation Tasks](https://mlsanity.com/paper/1907.12461/) (2019)
- [KLUE: Korean Language Understanding Evaluation](https://mlsanity.com/paper/2105.09680/) (2021)
- [CharacterBERT: Reconciling ELMo and BERT for Word-Level Open-Vocabulary Representations From Characters](https://mlsanity.com/paper/2010.10392/) (2020)
- [CRYPTEXT: Database and Interactive Toolkit of Human-Written Text Perturbations in the Wild](https://mlsanity.com/paper/2301.06494/) (2023)
- [K-HATERS: A Hate Speech Detection Corpus in Korean with Target-Specific Ratings](https://mlsanity.com/paper/2310.15439/) (2023)
- [Learning the Legibility of Visual Text Perturbations](https://mlsanity.com/paper/2303.05077/) (2023)
- [BitAbuse: A Dataset of Visually Perturbed Texts for Defending Phishing Attacks](https://mlsanity.com/paper/2502.05225/) (2025)

## Abstract (arXiv)

As malicious users increasingly employ phonetic substitution to evade hate speech detection, researchers have investigated such strategies. However, two key challenges remain. First, existing studies have overlooked the Korean language, despite its vulnerability to phonetic perturbations due to its phonographic nature. Second, prior work has primarily focused on constructing datasets rather than developing architectural defenses. To address these challenges, we propose (1) PHonetic-Informed Substitution for Hangul (PHISH) that exploits the phonological characteristics of the Korean writing system, and (2) Mixed Encoding of Semantic-pHonetic features (MESH) that enhances the detector's robustness by incorporating phonetic information at the architectural level. Our experimental results demonstrate the effectiveness of our proposed methods on both perturbed and unperturbed datasets, suggesting that they not only improve detection performance but also reflect realistic adversarial behaviors employed by malicious users.