Overview
This series explains how HPAA can preserve harmful meaning for human readers while weakening automated moderation when rendered and detector representations diverge. It connects moderation flow, typographic search, human and detector evidence, and UTS #39's bounded defenses, then outlines render-aware controls and their limits.
Learning outcomes
- HPAA exploits a gap between the rendered message a person sees and the representation an automated detector analyzes.
- An HPAA claim requires human recognition, detector behavior, query budget, and platform admissibility to be reported together.
- Under the paper's evaluated conditions, small-query attacks sharply reduced detection while preserving high reported human recognition.
- UTS #39 can reduce identifier ambiguity, but it does not replace render-aware semantic moderation or human review.
- Defenses should compare accepted, detector-facing, and rendered forms while preserving legitimate language and tracking versions.
Keywords
Preview every chapter · Unlock full text, audio, and video from chapter 4
PlansFAQ
What is HPAA?
HPAA, or Human-Perceptible Adversarial Attacks, is a framework for studying harmful meaning that remains recognizable to people while becoming harder for automated moderation to detect.
Why can people understand a message that automated moderation misses?
People can use spacing, grouping, emphasis, or placement that remain visible in the rendered message even when the detector receives a flattened or weaker representation.
What makes an HPAA result meaningful?
An HPAA result is meaningful only when human recognition, detector behavior, query budget, and platform admissibility are measured under stated conditions. A safe detector response alone is insufficient.
Can UTS #39 prevent HPAA?
UTS #39 can reduce some Unicode and identifier ambiguity, but it cannot by itself detect harmful meaning in rendered prose or layout. It complements, rather than replaces, semantic moderation.
How should platforms defend against HPAA?
Platforms should compare accepted, detector-facing, and rendered forms, expose material mismatches to policy or review, and preserve legitimate language.