Homoglyph-Based Attacks: Circumventing LLM Detectors
summary
Homoglyph substitution (e.g., 5% character substitution) reliably flips state‑of‑the‑art detectors — classifiers shift embeddings, perplexity drops, and watermarks break — so many detectors mark generated text as human after substitution. Experiments on curated human/AI sets and the C4 multilingual corpus show simple substitutions defeat most tools; a proof‑of‑concept detector uses tokenization ratio and perplexity ratio checks, with tokenization (fast, Rust tokenizers) giving the best, practical defense while naive checks fail and Mandarin needs tuned thresholds.
AI-written summary · about
chapters (14)
- 0:00Homoglyph-based attacks intro
- 1:31How the presentation will work
- 5:47Homoglyph history
- 7:13How LLM detectors work
- 15:06Live demo: bypassing detectors
- 21:02Attack impact analysis
- 23:58Implications and accessibility
- 25:03Safeguards against homoglyphs
- 32:09Advanced detection techniques
- 38:12Live demo: tokenization ratios
- 45:03Detection methods comparison
- 46:52Bingo challenge recap
- 47:58Summary
- 50:10Q&A
related talks
01h 04mRobust Generalization in the Era of LLMs: Jailbreaking Attacks and Defenses
10mSelf-interpreting Adversarial Images
34mTerrible tokenizer troubles in large language models
25mTricking Neural Networks : Explore Adversarial Attacks
44mComputers are Stupid: Protecting "AI" from Itself
33mTrojan Source: Bad Characters Are Coming for Your Code
25mPDF Mirage: Content Masking Attack Against Information-Based Online Services
20mMachine Learning Attacks – A New Era of Security Epidemic