The Typography That Survives the Machine
HPAA turns the rendering gap into a structured search problem: which combinations of text granularity, spatial placement, and visual style keep harmful meaning available to a human while weakening an automated detector's view? This chapter explains those three choices and the paper's decision to separate human-perceptibility research from online black-box testing. The result is a causal model of the attack surface, not a catalogue of formatting tricks.
Three choices define the configuration
The paper represents a typographic configuration as H = {M, L, S}. The notation names three dimensions that answer different questions about the same underlying content:
- Granularity (
L) asks how the harmful expression is divided before it is embedded. It may remain at the level of complete words, be decomposed into token-sized units, or use a mixed token-and-character division. - Placement (
M) asks where those units appear in the surrounding benign text. The studied layouts include vertical, diagonal, and randomized arrangements. - Style (
S) asks how selected characters or tokens look. The paper studies ordinary formatting or character transformations such as capitalization changes, cloze-like masking, precomposed Unicode forms, bold, color, and highlighting.
These dimensions are not interchangeable. Granularity changes the size of the pieces that a person and a detector must reconstruct. Placement changes the spatial relationships among pieces. Style changes visual salience: a reader may notice an emphasized region or a regular arrangement before consciously reading every adjacent word. Combining the dimensions creates a configuration with a particular human view and a particular detector-facing representation.
The distinction between the dimensions matters because a single transformation does not explain every outcome. Splitting a phrase into small units may make its sequential form less coherent, but it can also make human reconstruction harder. A regular layout may give a person a clue that scattered fragments belong together, while a detector still processes them in sequence. A visual treatment may draw human attention to the relevant pieces, but only if the platform preserves that treatment and the recipient's device renders it in a recognizable way.
The paper's full design space contains 108 combinations: six placement modes, three granularity levels, and six stylistic transformations. That number describes the candidate space used for systematic study, not a universal inventory of typography. The authors explicitly frame it as a representative subset motivated by common platform capabilities and say that other transformations can be incorporated into the same framework. The relevant security property is therefore compositional. A new formatting feature becomes an HPAA-relevant question when it changes what people can infer without changing the detector's input in an equivalent way.
There is also a basic trade-off built into the design. HPAA must optimize two objectives that point in opposite directions. It wants the automated system to regard a sample as benign, but it also wants human readers to recognize the harmful content. More concealment may reduce machine detectability while reducing human recognition. More visual salience may improve recognition while giving a detector a stronger or more regular signal. The attack is successful only in the region where those objectives overlap.
That overlap is not a fixed property of a configuration name. It depends on the underlying content, the carrier text, the detector, the platform's formatting rules, and the reader's context. A configuration that is highly legible in a study may be unavailable on a platform that strips color. A layout that works on a large screen may be less apparent on a phone, or may be interpreted differently by assistive technology. A detector that preserves styling metadata may respond differently from one that receives only a flattened text sequence. HPAA's configuration model keeps these dependencies visible instead of treating “typographic attack” as one uniform category.
The most important design choice is therefore not any individual style. It is the separation of human recognition from machine detection as two measurements. Without that separation, a low detector score could be mistaken for a meaningful exposure risk even when a person would not understand the content. Conversely, a readable manipulation could be dismissed as harmless if an evaluation records only whether a model classified it correctly.
Human refinement comes before detector search
Because the configuration space is combinatorial, HPAA does not ask people to judge every online trial. It uses a two-stage framework. The first stage estimates which configurations preserve human recognition. The second uses that refined set while interacting with a target moderation system as a black box. This division makes the human study an amortized input to later tests: once a configuration has demonstrated perceptual effectiveness under the study conditions, detector queries can focus on whether a platform notices it.
Round I is a relative-ranking exercise. Participants compare presentations of the same underlying harmful content and indicate which is easier to recognize. Holding the content and benign context fixed while varying the typographic configuration helps isolate the contribution of the presentation itself. The paper begins with the full set of 108 candidates and retains the top 21 configurations as H1.
A relative comparison is useful here because people do not all use the same internal scale for readability. One participant might call a passage “very clear,” while another uses that phrase for a different level of clarity. Pairwise judgments ask the narrower question: which of these two presentations makes the relevant content easier to recognize? Aggregating those choices produces a ranking without requiring everyone to agree on an absolute score.
Round II changes the question from relative preference to recognition frequency. The retained configurations are tested under controlled conditions across five topic domains: hotel, movie, restaurant, music, and product content. Participants are asked whether they can fully recognize harmful content, recognize some of it, or find none, and they can identify the words or phrases they noticed. The paper uses these responses, together with semantic similarity, lexical overlap, and manual inspection, to distinguish actual recognition from an over- or under-confident self-report.
The second round produces H2, a final set of 10 configurations that meet the paper's stated high-recognition criterion. Several of the visually salient styles perform well, while cloze variants that intentionally obscure lexical content tend to be less recognizable. Word-level granularity and a regular placement strategy generally help people reconstruct the embedded meaning. These results do not establish a permanent ranking of all typography. They establish a study-derived prior for which configurations are worth carrying into detector evaluation.
The separation can be represented as a lifecycle:
The state model captures an important ownership boundary. The human study owns the evidence about perceptibility. The platform filter owns whether a configuration can actually be expressed through the target interface. The online detector interaction owns the evidence about moderation outcomes. A result from one state cannot silently substitute for a result from another. A configuration can be easy for people to recognize but unavailable on a particular platform; it can be deployable but fail to evade a particular detector; or it can evade a detector while failing the human-recognition requirement.
This design also limits a common form of overclaiming. If a study demonstrates that a configuration is recognizable, it does not follow that the configuration will evade a detector. If a black-box trial returns a safe decision, it does not follow that a human understood the embedded meaning. HPAA's two stages preserve both conditions and make the attack's success conjunctive rather than one-dimensional.
Online search uses outcomes, not model internals
Once the refined and platform-admissible set is available, the second stage treats the moderation system as a black box. Conceptually, it takes a harmful input, a benign carrier, and one selected configuration, then submits the resulting presentation to the target system. The system returns an outcome such as safe or unsafe, or a score that the platform uses to make that decision. HPAA uses the outcome as a lightweight signal for choosing among already screened configurations.
The framework does not require the detector's architecture, parameters, training data, or gradients. It does not need to know why one configuration received a different response from another. It only needs an observable distinction and a limited opportunity to test alternatives. If a candidate is not accepted as safe, the search can move through other configurations in the refined set; if a candidate is accepted, the online attempt can stop. The important idea is the reuse of human evidence, not a particular implementation of the search.
The paper measures this process with a k-shot evasion rate. For a budget of k, the attacker may evaluate up to k ranked configurations, and a sample counts as successful if any of those attempts receives a safe decision. One-shot results describe a single-submission condition. Three-shot results describe the additional leverage of a small number of adaptive attempts. This distinction connects the mechanism to platform operations: repeated submissions may encounter rate limits, account restrictions, or human review, so query count changes the meaning of an apparent bypass.
The online stage is also where platform admissibility becomes decisive. The paper grounds stylistic choices in formatting capabilities available to ordinary users across major platforms. A feature that exists in an editor but is stripped by the submission interface is not part of the deployable configuration set for that service. A platform that preserves only some forms of emphasis, imposes character limits, or normalizes special characters can change the available search space. The same HPAA framework can therefore produce different results on different services without contradicting itself.
A defender should read this workflow as a warning about hidden dependencies. The human ranking is not just a usability result; it becomes an input to the online search. The platform's rendering behavior is not just a front-end choice; it determines whether the detector and recipient receive comparable information. The detector's feedback is not just a benchmark output; it can reveal whether a small set of presentation choices crosses the platform's decision boundary. These dependencies create a chain in which a local formatting feature can influence user exposure, model behavior, and attacker feedback at once.
The chain also has clear failure conditions. If no configuration preserves enough human recognition, the HPAA objective is not met. If the platform removes the relevant presentation cue, the studied channel may disappear before release. If the detector analyzes a representation that includes the cue, its sensitivity may improve. If the platform gives no useful outcome feedback or restricts attempts, the small-query search may lose its practical advantage. None of these conditions makes the conceptual vulnerability meaningless; they determine whether this particular mechanism transfers to the deployment.
The paper's contribution is consequently best understood as a method for finding and measuring a class of mismatches. It does not say that all typography is dangerous, that all machine representations are inadequate, or that every visual cue should be stripped. It shows how to ask, under controlled conditions, whether a human-recognizable meaning survives a transformation that the automated moderator does not model with equal fidelity.
Before the reported numbers can be interpreted, four questions must remain separate: how many people recognize the content, how often the detector flags it, how many attempts were allowed, and whether the platform can actually express the configuration. Those criteria turn an evocative example into a testable moderation claim. They also provide the basis for judging whether a low detector score represents a genuine exposure risk or only a machine-centric benchmark result.