arXiv:2606.09700: Typographic attacks bypass AI moderation systems with less than 1% detection

Researchers from the University of Tennessee, IBM Research, and the University of Illinois presented the paper arXiv:2606.09700, v1 from June 8, 2026, defining a new class of attacks on content moderation systems. The method — accepted at USENIX Security 2026 — relies exclusively on typographic text manipulation, without changing the semantic message and without access to the internal parameters of the moderation model.

What are HPAA attacks?

HPAA (Human-Perceptible Adversarial Attacks) are attacks that use spacing, emphasis, and spatial text layout — visible typographic elements — to hide harmful content from automated detectors while remaining easily readable to humans. Unlike classic adversarial perturbations at the pixel level or hidden Unicode tokens, HPAA manipulations are clearly perceptual: a reader decodes the message effortlessly, while the moderation system classifies the content as safe.

Test results: 13 systems, 86%, less than 1%

The authors — Qin Yang, Lu Malloy, Joshua Lee, Xiaohan Chang, Meisam Mohammady, Doowon Kim, and Yuan Hong — tested the method on 13 commercial and open-source content moderation systems:

• >86% human recognition — evaluator panels correctly identify harmful content even in typographically modified form
• <1% detection rate — automated moderators practically fail to recognize the attack
• Only 3 queries to the detector — black-box approach with no gradient information

The comparison is striking: the same text that an algorithm declares safe is recognized as harmful by a human in more than 86 out of 100 cases. The gap between machine detection and human perception has not previously been quantified with this level of precision.

Why do AI moderators ‘not see’ manipulated typography?

The cause lies in the architectural asymmetry between LLMs and the human visual system. LLM tokenization breaks text into subsequences according to static rules and has no visual perception layer through which the brain automatically reconstructs the intended meaning of manipulated text. A space or unexpected line break inserted by an attacker between letters does not change the semantics for the reader, but disrupts the tokenization pattern the moderator uses for detection.

The authors conclude that fine-tuning existing moderators alone is not sufficient: a lasting solution requires a visual pre-processing layer or tokenization schemes robust to typographic noise.