📄 Homograph Attacks on Maghreb Sentiment Analyzers

Summary

The paper tests how fragile fine-tuned sentiment classifiers for North-African (Maghreb) Arabic dialects are when input text contains Unicode look-alike characters. Maghreb dialects are low-resource. They are often written in Latin script ("Arabizi") and mix languages, so many inputs contain Latin letters that can be swapped for visually identical but differently encoded characters.

The authors fine-tuned four dialect-aware BERT models on five sentiment datasets: MDMD, its Latin-only subset MDMD[DAL], TUNIZI, TSAC and AlgD. Training data stayed clean. At test time, 90% of the Latin characters in each example were replaced with homographs.

Every configuration lost performance. The worst case was TunBERT on TUNIZI, where F1 fell from 0.95 to 0.33, a 65.3% drop. Datasets written entirely in Arabizi suffered most, because every sample was affected. Even the mildest case, a mixed-script corpus, lost about a quarter of its F1.

The work argues that models consuming raw, unfiltered text are easy to sabotage. It proposes, as future work, an input layer that detects suspicious Unicode characters and restores them before classification.

Key points

• Models: DarijaBERT-mix, DarijaBERT-arabizi, TunBERT and DziriBERT, each fine-tuned for 3 epochs with learning rate 2e-5.
• Data split: each dataset was divided 80/10/10 for train, validation and test. TUNIZI and TSAC were also merged under a shared label2id mapping.
• Dataset sizes:
  • MDMD: 42,000 examples, 3 classes.
  • MDMD[DAL]: 18,184 examples.
  • TUNIZI: 3,000 examples, binary and balanced.
  • TSAC: 11,871 examples.
  • AlgD: 11,760 examples.
  • Texts are short, roughly 5 to 19 tokens on average.
• F1 before → after attack:
  • TunBERT/TUNIZI: 0.95 → 0.33 (−65.3%).
  • DarijaBERT-arabizi/MDMD[DAL]: 0.75 → 0.30 (−60%).
  • TunBERT/TUNIZI+TSAC: 0.78 → 0.51 (−34.6%).
  • DziriBERT/AlgD: 0.86 → 0.57 (−33.7%).
  • DarijaBERT-mix/MDMD: 0.77 → 0.58 (−24.7%).
• ChatGPT 3.5 test: given a homograph-perturbed prompt, it failed to answer meaningfully and asked the user to rephrase.

Interesting ideas

• I1. Keep training data clean and perturb only the test set. Any accuracy gap then measures robustness alone, with no adaptation to the noise mixed in.
• I2. Defend by reversing the attack at the input: find characters that only look like Latin letters and map them back to canonical forms before any model sees the text.
• I3. Read the damage against the share of input the attack can reach. All-Latin corpora collapsed while mixed-script ones degraded less, so exposure explains much of the variation.
• I4. When pooling datasets with different label conventions, first build one shared label-to-id mapping so the labels stay consistent.

For Mova

How these ideas could serve Mova, our small open language model — its files, stages and tests:

• I1 (learn): Add homograph-perturbed copies of the school tests and parser test sets as negative controls. A drop in scores would reveal hidden dependence on exact byte forms.
• I2 (tokens): Put a confusable-character normalizer in front of the crate en tokenizer. Log each substitution so the repair stays traceable in the explanation chain.
• I3 (learn): When evaluating robustness, report scores by the fraction of tokens perturbed. This separates genuine model weakness from simple exposure.
• I4 (tree): Apply the same discipline when merging treebanks or converting UD dialects. Fix a single canonical relation and feature inventory before combining, so silent label clashes cannot corrupt training.