Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Style Attack Disguise: When Fonts Become a Camouflage for Adversarial Intent

Yangshijie Zhang, Xinda Wang, Jialin Liu, Wenqiang Wang, Zhicong Ma, Xingxing Jia

TL;DR

A style-based attack, Style Attack Disguise (SAD), designed two sizes: light for query efficiency and strong for superior attack performance, which shows SAD's potential threats to multimodal tasks including text-to-image and text-to-speech generation.

Abstract

With social media growth, users employ stylistic fonts and font-like emoji to express individuality, creating visually appealing text that remains human-readable. However, these fonts introduce hidden vulnerabilities in NLP models: while humans easily read stylistic text, models process these characters as distinct tokens, causing interference. We identify this human-model perception gap and propose a style-based attack, Style Attack Disguise (SAD). We design two sizes: light for query efficiency and strong for superior attack performance. Experiments on sentiment classification and machine translation across traditional models, LLMs, and commercial services demonstrate SAD's strong attack performance. We also show SAD's potential threats to multimodal tasks including text-to-image and text-to-speech generation.

Style Attack Disguise: When Fonts Become a Camouflage for Adversarial Intent

TL;DR

A style-based attack, Style Attack Disguise (SAD), designed two sizes: light for query efficiency and strong for superior attack performance, which shows SAD's potential threats to multimodal tasks including text-to-image and text-to-speech generation.

Abstract

With social media growth, users employ stylistic fonts and font-like emoji to express individuality, creating visually appealing text that remains human-readable. However, these fonts introduce hidden vulnerabilities in NLP models: while humans easily read stylistic text, models process these characters as distinct tokens, causing interference. We identify this human-model perception gap and propose a style-based attack, Style Attack Disguise (SAD). We design two sizes: light for query efficiency and strong for superior attack performance. Experiments on sentiment classification and machine translation across traditional models, LLMs, and commercial services demonstrate SAD's strong attack performance. We also show SAD's potential threats to multimodal tasks including text-to-image and text-to-speech generation.
Paper Structure (11 sections, 5 equations, 5 figures, 3 tables)

This paper contains 11 sections, 5 equations, 5 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Method
  4. Font-based Perturbation
  5. Word Importance Ranking
  6. Attack Mechanism Analysis
  7. Experiment
  8. Experimental Setting
  9. Main Results
  10. Discussion
  11. Conclusion

Figures (5)

  • Figure 1: On Twitter (X), a user decorate display names with stylized fonts and use special font-like emoji in tweets to highlight key words and express individuality.
  • Figure 2: SAD first ranks words by semantic importance (AIS) and tokenization instability (TIS) to establish attack priority, then iteratively apply font-based perturbations to candidate words until successful. Here, we replace "DAYS" with "" and "WEEK" with "", keeping text readable for humans but confusing for models.
  • Figure 3: Attack performance on large language models.
  • Figure 4: Attack performance under defense.
  • Figure 5: For text-to-image task, replacing "cat" with "" causes Qwen-Image to generate flag-related content instead of cats. For text-to-speech task, CosyVoice produces severely distorted audio that even affects surrounding words, making the generated speech difficult to understand.