Adaptive Compound Character-Level Attack

• Adaptive compound character-level attack is an adversarial method that iteratively applies minimal character edits based on model or explanation feedback.
• It leverages diverse operations—substitution, insertion, deletion, and more—with tokenization awareness to subtly disrupt NLP models without compromising text coherence.
• Empirical studies show these attacks achieve high misclassification rates with very low edit budgets across classification, machine translation, watermark removal, and safety filters.

Searching arXiv for the cited papers and closely related work to ground the article. {"query":"id:(Abdukhamidov et al., 22 Jul 2025) OR id:(Wang et al., 2020) OR id:(Liu et al., 2022) OR id:(Rocamora et al., 2024) OR id:(Zou et al., 21 Jan 2025) OR id:(Zhang et al., 11 Sep 2025) OR id:(Ebrahimi et al., 2018) OR id:(Keller et al., 2021) OR id:(Khan et al., 2022) OR id:(Cui et al., 3 May 2026) OR id:(Sarabamoun, 12 Aug 2025)","max_results":10} Adaptive Compound Character-Level Attack denotes a class of adversarial procedures that operate on characters rather than lexical substitutions, select perturbation sites using model- or explanation-derived feedback, and compose multiple small edits until a target condition is met. Across NLP classifiers, neural machine translation, watermark removal, and safety-oriented prompt manipulation, these attacks are characterized by low edit budgets, tokenization awareness, and an emphasis on preserving readability, semantics, or even explanation similarity while still inducing a large behavioral change in the target system (Abdukhamidov et al., 22 Jul 2025, Rocamora et al., 2024, Zou et al., 21 Jan 2025, Zhang et al., 11 Sep 2025).

1. Definition and distinguishing properties

In the literature, adaptive and compound have stable technical meanings. Charmer defines adaptive behavior as model-query-driven and feedback-guided, with repeated querying of the victim model to measure the loss change caused by candidate character edits, selection of promising positions and operations, and re-optimization after each accepted perturbation; it defines compound behavior as the composition of multiple character-level edit operations per example, typically up to a maximum edit distance $k$ (Rocamora et al., 2024). AdvChar for interpretable NLP systems uses the same distinction in a different setting: it adaptively chooses where to perturb from interpreter-derived token importance and compounds multiple small character changes across tokens so that the classifier flips while the interpretation remains similar to the benign input (Abdukhamidov et al., 22 Jul 2025).

A central reason these attacks are effective is that character edits do not merely alter surface form. They often alter tokenization, subword segmentation, or embedding lookup. This is explicit in CWBA, where attachable subword substitutions are used as a differentiable surrogate for character edits against transformer tokenizers, and in watermark removal, where a single character-level perturbation can influence multiple tokens simultaneously by disrupting tokenization and therefore changing both local scores and downstream key computation (Liu et al., 2022, Zhang et al., 11 Sep 2025).

The compound property is not limited to repeated substitutions. Depending on the system, it may include insertion, deletion, substitution, swap, zero-width insertion, homoglyph substitution, keyboard typos, or tokenizer-aware edits that induce UNK or rare subword fragments. This suggests that the term names a design pattern rather than a single algorithm: a character-level attack is “adaptive compound” when it uses iterative system feedback to choose edits and accumulates multiple low-level perturbations under an explicit or implicit budget.

2. Objectives, constraints, and threat models

The underlying optimization problems vary by application, but they share a constrained perturbation structure. In interpretable classification, AdvChar seeks an adversarial text $x'$ with minimal perceptibility, preserved interpretation, and misclassification:

$$\min_{x'} \; d(x, x') \;+\; \lambda \, D\!\big(I(x), I(x')\big) \quad \text{s.t.} \quad F(x') \neq F(x),$$

with a targeted variant replacing the constraint by $F(x') = c^\star$. Here $d(\cdot)$ is implemented at character level, $I(x)$ is the interpretation vector, and $D(\cdot,\cdot)$ measures interpretation divergence (Abdukhamidov et al., 22 Jul 2025).

For black-box character attacks on classifiers, Charmer formulates untargeted misclassification over the $k$-edit ball:

$\max_{S'\in \mathcal{S}_{k}(S,\Gamma)} \mathcal{L}\big(\bm{f}(S'), y\big), \quad \text{subject to } d_{\text{lev}(S,S') \le k,$

using the Carlini–Wagner margin loss

$$\mathcal{L}(\bm{f}(S), y)=\max_{\hat{y}\neq y}\, f(S)_{\hat{y}} - f(S)_{y}.$$

The allowed operations are substitution, insertion, and deletion, with $x'$0 controlling the perturbation budget (Rocamora et al., 2024).

In watermark removal, the objective changes from misclassification to detector evasion:

$x'$1

The global watermark score may be computed by a one-sided z-test,

$x'$2

or as an accumulated token-level score, depending on the watermark family (Zhang et al., 11 Sep 2025).

Threat models span black-box and white-box regimes. AdvChar for INLPS is black-box with query access to both classifier and interpreter, but no access to internal parameters or gradients (Abdukhamidov et al., 22 Jul 2025). Chinese AdvChar is white-box: it freezes a fine-tuned Chinese BERT classifier and updates only a continuous embedding perturbation via gradient descent, followed by nearest-neighbor projection back to characters (Wang et al., 2020). Classical character-level NMT work is likewise white-box, using directional derivatives of discrete edit operations to rank flips, insertions, deletions, and swaps (Ebrahimi et al., 2018). DexChar for NMT is black-box with respect to the target NMT but white-box with respect to the auxiliary semantic discriminator trained inside the RL environment (Zou et al., 21 Jan 2025).

3. Attack construction and optimization

Site selection is the first adaptive stage. In AdvChar, the attack computes a benign interpretation $x'$3, converts it into normalized token importance scores $x'$4, sorts tokens in descending order, and perturbs them sequentially while monitoring both prediction and interpretation similarity (Abdukhamidov et al., 22 Jul 2025). In Charmer, candidate locations are scored by replacing each potential position with a test character and measuring the resulting loss; the top-$x'$5 positions are retained, and importance is recomputed after every accepted edit (Rocamora et al., 2024). In the German hate-speech setting, attention scores rather than gradients are used to rank tokens before heuristic character edits are applied inside the most important tokens (Khan et al., 2022).

Edit generation is equally system-dependent. Chinese AdvChar optimizes a continuous perturbation $x'$6 in embedding space, defines $x'$7, and maps each perturbed embedding $x'$8 back to a discrete character $x'$9 by nearest-neighbor search in the BERT embedding matrix; if $$\min_{x'} \; d(x, x') \;+\; \lambda \, D\!\big(I(x), I(x')\big) \quad \text{s.t.} \quad F(x') \neq F(x),$$0 is small, only a few characters flip to semantically nearby neighbors (Wang et al., 2020). CWBA replaces vulnerable words by an adversarial tokenization into $$\min_{x'} \; d(x, x') \;+\; \lambda \, D\!\big(I(x), I(x')\big) \quad \text{s.t.} \quad F(x') \neq F(x),$$1 subtokens, keeps start and end fixed, and optimizes only the middle attachable subtokens with a Gumbel-softmax relaxation, a visual constraint, and a length constraint (Liu et al., 2022).

Composition is achieved by iterative search. Charmer uses greedy acceptance over the neighborhood

$$\min_{x'} \; d(x, x') \;+\; \lambda \, D\!\big(I(x), I(x')\big) \quad \text{s.t.} \quad F(x') \neq F(x),$$2

where $$\min_{x'} \; d(x, x') \;+\; \lambda \, D\!\big(I(x), I(x')\big) \quad \text{s.t.} \quad F(x') \neq F(x),$$3 inserts a special symbol $$\min_{x'} \; d(x, x') \;+\; \lambda \, D\!\big(I(x), I(x')\big) \quad \text{s.t.} \quad F(x') \neq F(x),$$4 in all positions and $$\min_{x'} \; d(x, x') \;+\; \lambda \, D\!\big(I(x), I(x')\big) \quad \text{s.t.} \quad F(x') \neq F(x),$$5 removes it; this unifies substitution, insertion, and deletion (Rocamora et al., 2024). Early character-level NMT attacks use one-shot, greedy, or beam search strategies, with edit ranking based on directional derivatives such as

$$\min_{x'} \; d(x, x') \;+\; \lambda \, D\!\big(I(x), I(x')\big) \quad \text{s.t.} \quad F(x') \neq F(x),$$6

for a character flip from $$\min_{x'} \; d(x, x') \;+\; \lambda \, D\!\big(I(x), I(x')\big) \quad \text{s.t.} \quad F(x') \neq F(x),$$7 to $$\min_{x'} \; d(x, x') \;+\; \lambda \, D\!\big(I(x), I(x')\big) \quad \text{s.t.} \quad F(x') \neq F(x),$$8 (Ebrahimi et al., 2018). DexChar instead frames composition as an RL policy over skip, token substitution, and UNK-inducing character edits; the agent maximizes an episodic reward that trades off translation degradation against semantic preservation, while a discriminator rejects semantically destructive edits early (Zou et al., 21 Jan 2025).

Tokenizer awareness is a recurring design principle. DexChar explicitly targets low-frequency outcomes and re-segmentation by adding an UNK candidate and then chaining Swap, Ins, and Sub until UNK or rare fragmentation is induced (Zou et al., 21 Jan 2025). The watermark-removal literature formalizes a related intuition as attack range: a character-level edit can split a token into multiple subword pieces and also alter the next $$\min_{x'} \; d(x, x') \;+\; \lambda \, D\!\big(I(x), I(x')\big) \quad \text{s.t.} \quad F(x') \neq F(x),$$9 positions through key changes, giving it a larger effective radius than a token-level edit (Zhang et al., 11 Sep 2025).

4. Major instantiations across NLP systems

AdvChar for interpretable NLP systems is a black-box attack tailored for systems that pair a classifier $F(x') = c^\star$0 with a post hoc interpreter $F(x') = c^\star$1. Its distinctive feature is not merely misclassification, but preservation of the interpreter’s “story”: the adversarial input $F(x') = c^\star$2 is required to satisfy $F(x') = c^\star$3 while keeping $F(x') = c^\star$4, with stability enforced by a rank-order divergence constraint and evaluated by IoU between benign and adversarial explanations (Abdukhamidov et al., 22 Jul 2025).

In Chinese text classification, AdvChar is an embedding-space white-box attack against fine-tuned Chinese BERT classifiers. It operates entirely at the character level, uses a Carlini–Wagner-style margin, and projects optimized embedding perturbations back to discrete characters by nearest-neighbor search in the embedding table. Because Mandarin has a large character inventory and ambiguous word boundaries, the method avoids insertions and deletions and relies on substitutions only (Wang et al., 2020).

Against transformer classifiers more broadly, CWBA exploits the fact that tokenizers decompose words into start subtokens and attachable subtokens. By fixing start and end pieces and optimizing only middle attachable subtokens, it emulates character replacements, insertions, deletions, and swaps while remaining inside the differentiable embedding pipeline. The optimization objective combines an adversarial margin loss with visual and length penalties (Liu et al., 2022).

Charmer generalizes the adaptive compound pattern to black-box attacks on both small and LLMs. It assumes only input-output access, uses softmax scores for standard classifiers and next-token probabilities for LLMs, and composes insertions, deletions, and substitutions within a Levenshtein budget. It does not explicitly constrain semantic similarity during search, but it evaluates semantic preservation post hoc via USE cosine similarity (Rocamora et al., 2024).

In NMT, two distinct lines are visible. The earlier character-level NMT attack literature develops white-box differentiable ranking of string edits for untargeted BLEU degradation, controlled word removal, and targeted word replacement (Ebrahimi et al., 2018). DexChar extends later RL-based NMT attacks to versatile tokenization by introducing character perturbations that induce UNK or rare subword fragments, coupled with a self-supervised semantic discriminator made robust to character noise by noisy augmentation (Zou et al., 21 Jan 2025).

In LLM security and watermarking, adaptive compound character-level attacks target safety filters, Unicode-sensitive tokenizers, and watermark detectors. Special-character attack studies organize the space into Unicode control and formatting characters, homoglyph and script confusion, structural perturbations, and encoding obfuscation, all under a black-box threat model (Sarabamoun, 12 Aug 2025). Watermark removal extends this further with defense-aware compound perturbations selected by a genetic algorithm and guided by a learned reference detector (Zhang et al., 11 Sep 2025). A related but non-attack perspective appears in RAG forensics, where poisoned payloads may be short fabricated claims, trigger phrases, or hidden instructions embedded inside otherwise benign retrieved chunks, and character-level localization becomes necessary for remediation (Cui et al., 3 May 2026).

5. Empirical behavior and comparative results

Empirically, adaptive compound character-level attacks are notable for combining high success with small perturbation budgets. In AdvChar for interpretable NLP, experiments over seven NLP models and three interpretation models show that the method can significantly reduce the prediction accuracy of current deep learning models by altering just two characters on average in input samples. Its interpretation similarity is also high: IoU is often $F(x') = c^\star$5 on SST-2 and AG and can reach $F(x') = c^\star$6 under LIME, far above TextBugger’s $F(x') = c^\star$7–$F(x') = c^\star$8 range (Abdukhamidov et al., 22 Jul 2025).

Chinese AdvChar reports an even more extreme failure mode for the attacked classifier: on a Chinese news dataset, classification accuracy drops from $F(x') = c^\star$9 to $d(\cdot)$0 by manipulating less than $d(\cdot)$1 characters on average, while human evaluation shows only a small change from $d(\cdot)$2 accuracy on clean samples to $d(\cdot)$3 on adversarial samples (Wang et al., 2020).

Charmer shows that black-box character-level attacks need not be weak or semantically crude. On SST-2 with BERT, it reaches ASR $d(\cdot)$4, $d(\cdot)$5, and USE similarity $d(\cdot)$6; on AG-News with BERT, it reaches ASR $d(\cdot)$7, $d(\cdot)$8, and similarity $d(\cdot)$9 (Rocamora et al., 2024). CWBA reports similarly strong white-box results across sentence- and token-level tasks, including AG News Adv.Acc. $I(x)$0 with edit distance $I(x)$1 and queries $I(x)$2, and OntoNotes Adv.F1 $I(x)$3 with success rate $I(x)$4, edit distance $I(x)$5, and queries $I(x)$6 (Liu et al., 2022).

DexChar demonstrates that tokenizer-sensitive character attacks remain effective in sequence generation. On en–de shared-emb, a setting described as hard for gradient-substitution baselines, GS attains $I(x)$7, $I(x)$8, and $I(x)$9, whereas DexChar reaches $D(\cdot,\cdot)$0, $D(\cdot,\cdot)$1, and $D(\cdot,\cdot)$2 (Zou et al., 21 Jan 2025). In watermark removal, character-level attacks outperform token-level removal at equal editing rate, and the adaptive compound GA remains effective even after preprocessing defenses; for example, against $D(\cdot,\cdot)$3, ASR is $D(\cdot,\cdot)$4 on DIP and $D(\cdot,\cdot)$5 on Unbias (Zhang et al., 11 Sep 2025).

System	Setting	Reported outcome
AdvChar (Abdukhamidov et al., 22 Jul 2025)	Interpretable NLP, black-box	Misclassification with explanation preservation; just two characters on average
Chinese AdvChar (Wang et al., 2020)	Chinese BERT, white-box	Accuracy drops from $D(\cdot,\cdot)$6 to $D(\cdot,\cdot)$7; less than $D(\cdot,\cdot)$8 characters on average
Charmer (Rocamora et al., 2024)	BERT SST-2, black-box	ASR $D(\cdot,\cdot)$9, $k$0, USE $k$1
DexChar (Zou et al., 21 Jan 2025)	en–de shared-emb NMT	$k$2, $k$3, $k$4
Adaptive GA (Zhang et al., 11 Sep 2025)	Watermark removal with defenses	Effective after $k$5; DIP $k$6, Unbias $k$7 ASR

A plausible implication is that the empirical signature of this attack family is not simply high error induction, but high error induction per visible edit. That pattern recurs across classification, translation, and watermarking when the attack is allowed to exploit tokenization boundaries, subword instability, or explanation-guided site selection.

6. Defenses, forensics, and open problems

A persistent misconception in NLP was that character-level attacks are comparatively easy to defend. Multiple studies argue against that view. Charmer explicitly challenges the belief that character-level attacks cannot easily adopt strong optimization methods and are easy to defend (Rocamora et al., 2024). BERT-Defense shows that both a standard spellchecker and the Pruthi et al. defense perform poorly on the Zéroe benchmark, particularly under visual, phonetic, segmentation, and compound mixtures, and proposes an iterative probabilistic correction pipeline that combines a character-level channel model, BERT MLM refinement, and LM-based hypothesis selection (Keller et al., 2021).

Defense strategies divide into normalization, training-time robustness, and abstention or correction layers. In the German hate-speech setting, an explicit character-level defense repurposes Sentence-BERT at word-pair level and normalizes tokens whose cosine similarity to the vocabulary lies in $k$8, while an implicit defense adds an ABSTAIN class and trains on clean plus adversarial examples; these reduce character-level attack success to $k$9 and $\max_{S'\in \mathcal{S}_{k}(S,\Gamma)} \mathcal{L}\big(\bm{f}(S'), y\big), \quad \text{subject to } d_{\text{lev}(S,S') \le k,$0, respectively, on HASOC, and to $\max_{S'\in \mathcal{S}_{k}(S,\Gamma)} \mathcal{L}\big(\bm{f}(S'), y\big), \quad \text{subject to } d_{\text{lev}(S,S') \le k,$1 and $\max_{S'\in \mathcal{S}_{k}(S,\Gamma)} \mathcal{L}\big(\bm{f}(S'), y\big), \quad \text{subject to } d_{\text{lev}(S,S') \le k,$2 on GermEval (Khan et al., 2022). For AdvChar on INLPS, adversarial training with symbols reduces ASR on SST-2 to $\max_{S'\in \mathcal{S}_{k}(S,\Gamma)} \mathcal{L}\big(\bm{f}(S'), y\big), \quad \text{subject to } d_{\text{lev}(S,S') \le k,$3–$\max_{S'\in \mathcal{S}_{k}(S,\Gamma)} \mathcal{L}\big(\bm{f}(S'), y\big), \quad \text{subject to } d_{\text{lev}(S,S') \le k,$4 for GPT-2, BERT, and DistilBERT, though the attack is not eliminated (Abdukhamidov et al., 22 Jul 2025). For Charmer, TRADES-based adversarial training reduces ASR-Char from $\max_{S'\in \mathcal{S}_{k}(S,\Gamma)} \mathcal{L}\big(\bm{f}(S'), y\big), \quad \text{subject to } d_{\text{lev}(S,S') \le k,$5 to $\max_{S'\in \mathcal{S}_{k}(S,\Gamma)} \mathcal{L}\big(\bm{f}(S'), y\big), \quad \text{subject to } d_{\text{lev}(S,S') \le k,$6 while keeping clean accuracy at $\max_{S'\in \mathcal{S}_{k}(S,\Gamma)} \mathcal{L}\big(\bm{f}(S'), y\big), \quad \text{subject to } d_{\text{lev}(S,S') \le k,$7 (Rocamora et al., 2024).

Fixed preprocessing defenses remain vulnerable to adaptive compounding. The watermark-removal literature formulates this as an adversarial dilemma: for any fixed defense, there exists an effective perturbation strategy that can bypass it, because compound character-level perturbations introduce distortions that hinder accurate recovery of the original token even if suspicious artifacts are removed (Zhang et al., 11 Sep 2025). Special-character attack studies therefore recommend multi-layer defenses: NFC/NFKC canonicalization, control-character stripping, mixed-script detection, encoded-content validation, and security-aware training (Sarabamoun, 12 Aug 2025).

For systems already compromised at the data layer, post-incident forensics becomes necessary. RAGCharacter addresses this by localizing the responsible retrieved span for a concrete misgeneration event through prompt-conditioned, black-box counterfactual masking and replay, achieving high character-level localization fidelity with low over-attribution (Cui et al., 3 May 2026). This suggests that robust response to adaptive compound character-level attacks may require both prevention and fine-grained traceback, especially when the effective payload is a sparse fabricated claim, trigger phrase, or hidden instruction inside an otherwise benign chunk.

Adaptive compound character-level attack therefore designates a mature adversarial paradigm rather than a narrow corner case. Its core mechanisms—feedback-guided site selection, tokenizer-sensitive perturbation, and accumulation of minimal edits—have proved effective under black-box and white-box regimes, across classifiers, translation systems, explanation interfaces, watermark detectors, and safety filters. The recurrent open problems are equally clear: robustness to tokenization disruption, defense-aware evaluation, stronger semantic constraints during attack generation, and incident-response tooling that can operate at the same granularity as the attacks themselves.