Style Attack Disguise: When Fonts Become a Camouflage for Adversarial Intent
Not on the map. Why?
Abstract (arXiv)
With social media growth, users employ stylistic fonts and font-like emoji to express individuality, creating visually appealing text that remains human-readable. However, these fonts introduce hidden vulnerabilities in NLP models: while humans easily read stylistic text, models process these characters as distinct tokens, causing interference. We identify this human-model perception gap and propose a style-based attack, Style Attack Disguise (SAD). We design two sizes: light for query efficiency and strong for superior attack performance. Experiments on sentiment classification and machine translation across traditional models, LLMs, and commercial services demonstrate SAD's strong attack performance. We also show SAD's potential threats to multimodal tasks including text-to-image and text-to-speech generation.
Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 28 of its 38 references that are in the map. First posted on arXiv 22 Oct 2025.
Builds on
28 of 38 references.
References · 28
- 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
- 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,049
- 2025Qwen3 Technical Reportcited by 8,195
- 2019DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lightercited by 4,243
- 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 663
- 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
- 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 488
- 2018TextBugger: Generating Adversarial Text Against Real-world Applicationscited by 376
- 2018Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifierscited by 341
- 2017Synthetic and Natural Noise Both Break Neural Machine Translationcited by 304
- 2020Improving Massively Multilingual Neural Machine Translation and Zero-Shot Translationcited by 277
- 2021Measure and Improve Robustness in NLP Models: A Surveycited by 107
16 more
- 2021Evaluating the Robustness of Neural Language Models to Input Perturbationscited by 87
- 2022Democratizing Neural Machine Translation with OPUS-MTcited by 57
- 2021Generating Syntactically Controlled Paraphrases without Using Annotated Parallel Pairscited by 45
- 2021Using Adversarial Attacks to Reveal the Statistical Bias in Machine Reading Comprehension Modelscited by 29
- 2025Llama-3.1-FoundationAI-SecurityLLM-Base-8B Technical Reportcited by 28
- 2024AttriBoT: A Bag of Tricks for Efficiently Approximating Leave-One-Out Context Attributioncited by 23
- 2024HQA-Attack: Toward High Quality Black-Box Hard-Label Adversarial Attack on Textcited by 16
- 2025Broken Tokens? Your Language Model can Secretly Handle Non-Canonical Tokenizationscited by 16
- 2022A Word is Worth A Thousand Dollars: Adversarial Attack on Tweets Fools Stock Predictionscited by 15
- 2022Out-of-Vocabulary Challenge Reportcited by 11
- 2023LimeAttack: Local Explainable Method for Textual Hard-Label Adversarial Attackcited by 9
- 2024Problematic Tokens: Tokenizer Bias in Large Language Modelscited by 8
- 2024Approximate Attributions for Off-the-Shelf Siamese Transformerscited by 7
- 2025Confidence Elicitation: A New Attack Vector for Large Language Modelscited by 4
- 2025Special-Character Adversarial Attacks on Open-Source Language Modelcited by 4
- 2025Multi-task Adversarial Attacks against Black-box Model with Few-shot Queriescited by 1
Built on by
Citing papers per year: 2026: 2.
2 papers.