What the Experiments Actually Show

The paper's central methodological choice is to measure both audiences of an HPAA sample: people who may recognize its harmful meaning and automated systems that may fail to flag it. This chapter interprets the human study and detector evaluations together, separating recognition, detection, evasion, query budget, and deployment scope. That separation is what turns a striking moderation failure into evidence that can be weighed rather than a headline number that can be repeated without context.

Human recognition was measured, not assumed

HPAA cannot be defined by detector failure alone. If a typographic manipulation makes a message unreadable to people, it may be an adversarial input for a classifier, but it does not demonstrate the human–machine mismatch the paper is studying. The researchers therefore made human perception part of both construction and evaluation through two online study rounds.

The first round started with the full set of 108 typographic configurations. Participants compared two presentations of the same underlying harmful content and judged which made the content easier to recognize. The survey was run in smartphone and computer versions, with the computer participants kept separate from the smartphone group to limit learning effects. Pairwise comparison was an important choice: it asks which presentation is more recognizable without requiring every participant to use the same absolute scale for clarity.

Round I produced a relative ranking and retained 21 configurations as H1. The paper then used a second round to ask a different question: how often can participants recognize the embedded content under a particular configuration? Round II covered five ordinary content domains—hotel, movie, restaurant, music, and product material—with 50 valid responses per domain, for 250 participants in total. The main analysis focused on meaningful sentences in the smartphone condition, a choice intended to resemble common social-media and review consumption more closely than random word sequences would.

The two rounds therefore have complementary roles. Pairwise comparison is efficient for screening a large design space. Recognition frequency is more directly interpretable as a measure of how many people can recover the intended content. The paper retains full and partial recognition separately, asks participants to identify the words or phrases they noticed, and compares their answers with the embedded reference. It uses semantic similarity, lexical overlap, and manual inspection to correct cases in which a participant's self-description did not match the response label they selected.

That validation step matters because self-report and demonstrated recognition are not identical. A participant may say they recognized only some of the harmful content while reproducing the full intended phrase. Another may say they recognized it fully but provide only a salient fragment. Still another may repeat words from the surrounding survey prompt rather than anything embedded in the sample. Treating these as the same observation would inflate or obscure the human side of the result. The paper's experimenter-verified measure is an attempt to keep the claim tied to what the participant actually identified.

Across both rounds, the study included 370 valid participants: 120 in the first round and 250 in the second. Participants were adults comfortable completing the survey in English and were recruited through Prolific.