What It Takes to Moderate What People See

Human-Perceptible Adversarial Attacks (HPAA) answer the series' central question with a qualified yes: typography can become an adversarial channel against LLM moderation when a platform preserves human-salient presentation cues while the detector receives a weaker or different representation. This final synthesis connects the mechanism, human evidence, black-box results, and Unicode comparison into one judgment. It also identifies what a responsible defense can address, what it cannot assume, and which residual risks require measurement rather than confidence.

Typography becomes a security channel at a system boundary

The important word in the conclusion is when. Typography is not inherently an attack, and a model is not automatically vulnerable merely because a message contains emphasis, spacing, or unusual characters. The channel appears when four conditions meet. The platform accepts a presentation that a person can interpret. The detector receives a representation that does not carry the same cues with comparable strength. The automated decision controls access to the human recipient. And the harmful meaning remains sufficiently recognizable to that recipient.

HPAA makes those conditions testable. Its configuration space varies granularity, placement, and style, but the point of those dimensions is not to discover a magic formatting operation. They vary the relationship between the human view and the detector view. Granularity changes how the relevant content is divided. Placement changes which fragments a reader groups together. Style changes which features become salient. The combination succeeds only if it remains perceptible to a person while weakening the detector's judgment under the platform's own constraints.

The two-stage workflow completes the causal model. Human studies first identify configurations that preserve recognition. Black-box detector interaction then asks whether those configurations receive benign outcomes from a target moderation system. This separation prevents a machine-only benchmark from confusing unreadable content with a meaningful exposure risk, and it prevents a human-recognition study from being misread as proof that a detector will fail. Human evidence establishes accessibility to the recipient; detector evidence establishes a moderation gap; platform support and query budget establish practical scope.

The paper's results show why the distinction matters. In the one-shot setting, its strongest highlighted configuration is reported with 92% human recognition, while the one-shot result is summarized as up to 83.33% evasion. Table 2 shows large detection reductions across five studied harmful categories for the ten named systems displayed there, with some post-attack rates at or near zero; the comparatively stronger systems in that table still show post-attack rates below 17% across the listed categories. With three attempts, the paper reports up to 100% evasion at an 86% minimum recognition rate for the full refined set, and the abstract summarizes more than 86% human recognition with detection rates below 1% across the evaluated systems.

Those figures are strong evidence for a persistent mismatch under the evaluated conditions. They are not interchangeable measurements. Recognition is not evasion. A one-shot result is not a three-shot result. A table of named systems is not necessarily the full system count stated elsewhere. And a study participant who is warned to look for harmful language is not the same as an unprimed person encountering a message in an ordinary feed.

The human study makes the recipient side concrete. It reports 370 valid participants across two rounds, with 120 in the first and 250 in the second. The first round used pairwise comparisons across the 108 candidate configurations. The second measured full, partial, or absent recognition across five topic domains, with 50 valid responses per domain. The researchers used semantic similarity, lexical overlap, and manual review to correct cases where self-reported recognition did not match the text participants supplied. Benign-only baselines produced low false-positive rates, but the paper acknowledges that warnings and task framing may have primed participants to be unusually attentive.

The detector side is equally conditional. The experiments use selected datasets, selected moderation systems, selected platform-compatible transformations, and research queries. The paper compares original and transformed content and measures one-shot and three-shot behavior.