FlagThis

Abstract

Large language model (LLM)-powered content moderation systems primarily operate on tokenized text, largely ignoring the visual cues that humans use to interpret content. This research introduces Human-Perceptible Adversarial Attacks (HPAA), which utilize typographic manipulations—such as spacing, visual emphasis, and spatial arrangement—to embed harmful expressions into benign text. These manipulations allow content to remain easily recognizable to humans while becoming effectively invisible to automated moderation systems. Evaluations across ten widely deployed systems reveal that these attacks can achieve over 86% human recognition while maintaining detection rates below 1%.