Abstract
With social media growth, users employ stylistic fonts and font-like emoji to express individuality, creating visually appealing text that remains human-readable. However, these fonts introduce hidden vulnerabilities in NLP models: while humans easily read stylistic text, models process these characters as distinct tokens, causing interference. We identify this human-model perception gap and propose a style-based attack, Style Attack Disguise (SAD). We design two sizes: light for query efficiency and strong for superior attack performance. Experiments on sentiment classification and machine translation across traditional models, LLMs, and commercial services demonstrate SAD's strong attack performance. We also show SAD's potential threats to multimodal tasks including text-to-image and text-to-speech generation.
Abstract (translated)
随着社交媒体的发展，用户开始使用风格化的字体和类似表情符号的字符来表达个性，创造出既美观又易于人类阅读的文字。然而，这些风格化文本引入了自然语言处理（NLP）模型中的隐秘漏洞：虽然人类可以轻松读取风格化文字，但模型会将这些特殊字符视为独立的标记进行处理，从而导致干扰。我们识别出这种人机感知差距，并提出了一种基于样式的攻击方法——样式攻击伪装（SAD）。我们设计了两种版本：一种轻量级用于查询效率，另一种强力版则在攻击性能上更胜一筹。 实验表明，在传统的模型、大型语言模型和商业服务上的情感分类及机器翻译任务中，SAD展现出了强大的攻击效果。此外，我们也展示了SAD对多模态任务（如文本到图像生成和文本到语音合成）潜在威胁的证据。
URL
https://arxiv.org/abs/2510.19641
