Elamur Research⌕
☰
home / papers / 2026 / TinyAttack: Exploring Stylistic Vulnerabilities in Large Language Models

TinyAttack: Exploring Stylistic Vulnerabilities in Large Language Models

Paper · 2026 · Mamta Mamta, Bogdan Grecu and Oana Cocarascu

Summary

Large language models can be fooled by small input changes, but robustness research has mostly studied ordinary character, word and sentence edits, invisible characters and homoglyphs. It has largely ignored the decorative Unicode lettering common on social media. The authors introduce TinyAttack, a black-box adversarial framework with three parts. First, it ranks words by importance. For open-source models it uses Feature Ablation, which masks each word and measures the drop in true-label probability. For API-only models it uses LLM Self-Attribution, where the model scores word importance itself in two queries. Second, it restyles the top-ranked words one at a time with Unicode variants until the model's prediction changes. Third, it attacks the target model. The meaning and syntax of the text stay the same. Across more than 500 experiments, six LLMs on five NLU/NLI datasets lost substantial accuracy in zero- and few-shot settings. Few-shot prompting with adversarial examples did not help, and Unicode normalization only partly helped. The study shows that stylized text is a realistic way to slip past LLM-based moderation and fact-checking.

Key points

  • Perturbations: five Unicode styles were tested: superscript, subscript, a mixed super-sub form, a diacritic-heavy "squiggle" style, and a "ransom note" mix of fonts.
  • Models: the targets were Llama-3-8B, Mistral-7B, Gemma-3-12B, Qwen2-7B, GPT-3.5 Turbo and Gemini 2.0 Flash.
  • Performance drops: open-source models lost 29–92% of their performance and closed-source models lost 6–88.5%, depending on the task.
  • Normalization defenses:
    • LLM-based normalization partly helps against superscript and subscript attacks. It fails for Llama and Mistral, and only Gemini gains against every attack type.
    • NFKC normalization neutralizes superscript and subscript but not squiggle or ransom styles. For example, Llama's sentiment drop remains about 86% under squiggle, compared with about 19% for superscript.
  • Scope: experiments are English-only, and the code is released at github.com/TRAI-group/TinyAttack.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓King's College LondonLondon · United Kingdom42 works · 1,617 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 works

🧭 Topics 1Research subjects and languages the work is about.Language models & pretraining · 3,320 works

Cite

Cite as Mamta Mamta, Bogdan Grecu and Oana Cocarascu. 2026. TinyAttack: Exploring Stylistic Vulnerabilities in Large Language Models. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.1987

@inproceedings{mamta2026tinyattack,
  title = {{TinyAttack: Exploring Stylistic Vulnerabilities in Large Language Models}},
  author = {Mamta Mamta, Bogdan Grecu and Oana Cocarascu},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.1987},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.1987}
}

References

49 references, 18 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Sahar Abdelnabi and Mario Fritz. 2023. Fact-saboteurs: A taxonomy of evidence manipulation attacks against fact-verification systems. In 32nd USENIX Security Symposium, USENIX Security 2023, Anaheim, CA, USA, August 9-11, 2023, pages 6719–6736. USENIX Association. find
  2. Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, and Kai-Wei Chang. 2018. Generating natural language adversarial examples. In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pages 2890–2896, Brussels, Belgium. Association for Comp…
  3. Rohan Anil, Sebastian Borgeaud, Yonghui Wu, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M. Dai, Anja Hauth, Katie Millican, David Silver, Slav Petrov, Melvin Johnson, Ioannis Antonoglou, Julian Schrittwieser, Amelia Glaese, Jilin Chen, Emily Pitler, Timothy P. Lillicrap,… — Gemini: A Family of Highly Capable Multimodal Models
  4. Jinze Bai, Shuai Bai, Yunfei Chu, Zeyu Cui, Kai Dang, Xiaodong Deng, Yang Fan, Wenbin Ge, Yu Han, Fei Huang, and 1 others. 2023. Qwen technical report. arXiv preprint arXiv:2309.16609.
  5. Yang Bai, Ge Pei, Jindong Gu, Yong Yang, and Xingjun Ma. 2024. Special characters attack: Toward scalable training data extraction from large language models. arXiv preprint arXiv:2405.05990. — [arXiv:2405.05990](https://arxiv.org/abs/2405.05990) find
  6. Nicholas Boucher, Jenny Blessing, Ilia Shumailov, Ross Anderson, and Nicolas Papernot. 2023. When vision fails: Text attacks against vit and ocr. arXiv preprint arXiv:2306.07033. — [arXiv:2306.07033](https://arxiv.org/abs/2306.07033) find
  7. Nicholas Boucher, Ilia Shumailov, Ross Anderson, and Nicolas Papernot. 2022. Bad characters: Imperceptible nlp attacks. In 2022 IEEE Symposium on Security and Privacy (SP), pages 1987–2004. IEEE. find
  8. Samuel R. Bowman, Gabor Angeli, Christopher Potts, and Christopher D. Manning. 2015. A large annotated corpus for learning natural language inference. In Proceedings of the 2015 Conference on Empirical Methods in Natural Language Processing, pages 632–642, Lisbon, Portugal. Association for Computati…
  9. Samuel Jacob Chacko, Sajib Biswas, Chashi Mahiul Islam, Fatema Tabassum Liza, and Xiuwen Liu. 2024. Adversarial attacks on large language models using regularized relaxation. arXiv preprint arXiv:2410.19160. — [arXiv:2410.19160](https://arxiv.org/abs/2410.19160) find
  10. Portia Cooper, Eduardo Blanco, and Mihai Surdeanu. 2025. The lies characters tell: Utilizing large language models to normalize adversarial Unicode perturbations. In Findings of the Association for Computational Linguistics: ACL 2025, pages 18932–18944, Vienna, Austria. Association for Computational… find
  11. Johan S Daniel and Anand Pal. 2024. Impact of non-standard unicode characters on security and comprehension in large language models. arXiv preprint arXiv:2405.14490. — [arXiv:2405.14490](https://arxiv.org/abs/2405.14490) find
  12. Thomas Davidson, Dana Warmsley, Michael Macy, and Ingmar Weber. 2017. Automated hate speech detection and the problem of offensive language. In Proceedings of the international AAAI conference on web and social media, volume 11, pages 512–515.
  13. Thomas Diggelmann, Jordan L. Boyd-Graber, Jannis Bulian, Massimiliano Ciaramita, and Markus Leippold. 2020. CLIMATE-FEVER: A dataset for verification of real-world climate claims. CoRR, abs/2012.00614.
  14. Antreas Dionysiou and Elias Athanasopoulos. 2021. Unicode evil: Evading nlp systems using visual similarities of text characters. In Proceedings of the 14th ACM Workshop on Artificial Intelligence and Security, pages 1–12. find
  15. Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, Anirudh Goyal, Anthony Hartshorn, Aobo Yang, Archi Mitra, Archie Sravankumar, Artem Korenev, Arthur Hinsvark, Arun Rao, Aston Zhang, and 82 others. 2024… — The Llama 3 Herd of Models
  16. Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018. HotFlip: White-box adversarial examples for text classification. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pages 31–36, Melbourne, Australia. Association for Comput…
  17. Brian Formento, Chuan-Sheng Foo, and See-Kiong Ng. 2025. Confidence elicitation: A new attack vector for large language models. In The Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, April 24-28, 2025. OpenReview.net. find
  18. Simon Geisler, Tom Wollschlager, MHI Abdalla, Johannes Gasteiger, and Stephan Gunnemann. Attacking large language models with projected gradient descent. In ICML 2024 Next Generation of AI Safety Workshop. find
  19. Shreya Goyal, Sumanth Doddapaneni, Mitesh M. Khapra, and Balaraman Ravindran. 2023. A survey of adversarial defenses and robustness in NLP. ACM Comput. Surv., 55(14s):332:1–332:39. find
  20. Ashim Gupta, Rishanth Rajendhran, Nathan Stringham, Vivek Srikumar, and Ana Marasovic. 2024. Whispers of doubt amidst echoes of triumph in NLP robustness. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies… find
  21. Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de Las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix,… find
  22. Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2020. Is bert really robust? a strong baseline for natural language attack on text classification and entailment. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pages 8018–8025.
  23. Aishwarya Kamath, Johan Ferret, Shreya Pathak, Nino Vieillard, Ramona Merhej, Sarah Perrin, Tatiana Matejovicova, Alexandre Ramé, Morgane Rivière, Louis Rouillard, Thomas Mesnard, Geoffrey Cideron, Jean-Bastien Grill, Sabela Ramos, Edouard Yvinec, Michelle Casbon, Etienne Pot, Ivo Penchev, Gaël Liu,… find
  24. Douwe Kiela, Max Bartolo, Yixin Nie, Divyansh Kaushik, Atticus Geiger, Zhengxuan Wu, Bertie Vidgen, Grusha Prasad, Amanpreet Singh, Pratik Ringshia, Zhiyi Ma, Tristan Thrush, Sebastian Riedel, Zeerak Waseem, Pontus Stenetorp, Robin Jia, Mohit Bansal, Christopher Potts, and Adina Williams. 2021. Dyna… find
  25. Dianqi Li, Yizhe Zhang, Hao Peng, Liqun Chen, Chris Brockett, Ming-Ting Sun, and Bill Dolan. 2021. Contextualized perturbation for textual adversarial attack. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technolo…
  26. Yufei Li, Zexin Li, Yingfan Gao, and Cong Liu. 2023. White-box multi-objective adversarial attack on dialogue generation. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 1778–1792, Toronto, Canada. Association for Computationa… find
  27. Bill Yuchen Lin, Wenyang Gao, Jun Yan, Ryan Moreno, and Xiang Ren. 2021. RockNER: A simple method to create adversarial examples for evaluating the robustness of named entity recognition models. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 3728– 37… find
  28. Hanyu Liu, Chengyuan Cai, and Yanjun Qi. 2023. Expanding scope: Adapting English adversarial attacks to Chinese. In Proceedings of the 3rd Workshop on Trustworthy Natural Language Processing (TrustNLP 2023), pages 276–286, Toronto, Canada. Association for Computational Linguistics. find
  29. Mamta and Oana Cocarascu. 2025a. Facteval: Evaluating the robustness of fact verification systems in the era of large language models. In 2025 Annual Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics. find
  30. Mamta and Oana Cocarascu. 2025b. I-GUARD: Interpretability-guided parameter optimization for adversarial defense. In Findings of the Association for Computational Linguistics: EMNLP 2025, pages 22173–22188, Suzhou, China. Association for Computational Linguistics. find
  31. Mamta and Asif Ekbal. 2022. Adversarial sample generation for aspect based sentiment classification. In Findings of the Association for Computational Linguistics: AACL-IJCNLP 2022, pages 478–492. find
  32. Tobias Mayer, Santiago Marro, Elena Cabrio, and Serena Villata. 2020. Generating adversarial examples for topic-dependent argument classification 1. In Computational Models of Argument, pages 33–44. IOS Press. find
  33. Thomas Mesnard, Cassidy Hardin, Robert Dadashi, Surya Bhupatiraju, Shreya Pathak, Laurent Sifre, Morgane Rivière, Mihir Sanjay Kale, Juliette Love, Pouya Tafti, Léonard Hussenot, Aakanksha Chowdhery, Adam Roberts, Aditya Barua, Alex Botev, Alex Castro-Ros, Ambrose Slone, Amélie Héliou, Andrea Tacche… find
  34. John Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, Di Jin, and Yanjun Qi. 2020. Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pa…
  35. Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. 2019. Universal adversarial triggers for attacking and analyzing nlp. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Proce… find
  36. Pavan Kalyan Reddy Neerudu, Subba Oota, Mounika Marreddy, Venkateswara Kagita, and Manish Gupta. 2023. On robustness of finetuned transformer-based NLP models. In Findings of the Association for Computational Linguistics: EMNLP 2023, pages 7180– 7195, Singapore. Association for Computational Linguis… find
  37. Xiao Wang, Qin Liu, Tao Gui, Qi Zhang, Yicheng Zou, Xin Zhou, Jiacheng Ye, Yongxin Zhang, Rui Zheng, Zexiong Pang, and 1 others. 2021. Textflint: Unified multilingual robustness evaluation toolkit for natural language processing. In Proceedings of the 59th Annual Meeting of the Association for Compu…
  38. Ananya B Sai, Tanay Dixit, Dev Yashpal Sheth, Sreyas Mohan, and Mitesh M Khapra. 2021. Perturbation checklists for evaluating nlg evaluation metrics. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 7219–7234. find
  39. Ananya B Sai, Akash Kumar Mohankumar, Siddhartha Arora, and Mitesh M Khapra. 2020. Improving dialog evaluation with a multi-reference adversarial dataset and large scale pretraining. Transactions of the Association for Computational Linguistics, 8:810– 827. find
  40. Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Y Ng, and Christopher Potts. 2013. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 conference on empirical methods in natural language processing, pages 1631…
  41. Mehmet Sofi, Matteo Fortier, and Oana Cocarascu. 2022. A robustness evaluation framework for argument mining. In Proceedings of the 9th Workshop on Argument Mining, pages 171–180. find
  42. Christian Stab, Tristan Miller, Benjamin Schiller, Pranav Rai, and Iryna Gurevych. 2018. Cross-topic argument mining from heterogeneous sources. In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pages 3664– 3674.
  43. James Thorne, Andreas Vlachos, Christos Christodoulopoulos, and Arpit Mittal. 2019. Evaluating adversarial attacks against multiple fact verification systems. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natur… find
  44. José Valle-Aguilera, Alberto J Gutiérrez-Megías, Salud María Jiménez-Zafra, L Alfonso Ureña-López, and Eugenio Martínez-Cámara. 2024. Sinai at checkthat! 2024: Stealthy character-level adversarial attacks using homoglyphs and iterative search. In CLEF (Working Notes). find
  45. Xuezhi Wang, Haohan Wang, and Diyi Yang. 2022a. Measure and improve robustness in nlp models: A survey. In Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 4569–4586.
  46. Xuezhi Wang, Haohan Wang, and Diyi Yang. 2022b. Measure and improve robustness in NLP models: A survey. In Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 4569–4586, Seattle, United States. Associat…
  47. Tongshuang Wu, Marco Tulio Ribeiro, Jeffrey Heer, and Daniel S Weld. 2021. Polyjuice: Generating counterfactuals for explaining, evaluating, and improving models. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on…
  48. Lifan Yuan, Yangyi Chen, Ganqu Cui, Hongcheng Gao, Fangyuan Zou, Xingyi Cheng, Heng Ji, Zhiyuan Liu, and Maosong Sun. 2023. Revisiting out-of-distribution robustness in NLP: benchmarks, analysis, and llms evaluations. In Advances in Neural Information Processing Systems 36: Annual Conference on Neur… find
  49. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043.

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/mamta-2026-tinyattack-exploring-stylistic-vulnerabilities-large/