Chinese Character Disassembly Attack

• Chinese character disassembly attack is an adversarial technique that manipulates stroke, radical, and component structures of Chinese script to fool NLP models.
• It employs methods like embedding-guided character substitution and graph-mediated variation to maintain human readability while causing model misclassification.
• Empirical results show drastic drops in classification accuracy with minimal character changes, emphasizing vulnerabilities in BERT-based and similar models.

Chinese character disassembly attack refers to adversarial manipulation of Chinese text through operations that exploit the internal structure or variation space of characters—such as stroke- or component-level decomposition, visually similar substitutions, homophonic or pinyin-based variants, and nearest-neighbor projections in character embedding space—so that human readers can still recover the intended meaning while NLP systems fail or degrade. The available literature suggests that the term covers several closely related, not fully identical attack formulations rather than one canonical method: a white-box embedding-guided character substitution attack against Chinese BERT classifiers, graph-mediated attacks in which character disassembling is one association rule, and defense-oriented models that treat Chinese character variation as an explicit graph (Wang et al., 2020, Huang et al., 2024, Xiong et al., 2024).

1. Terminological scope and problem setting

In the most direct attack formulation, Chinese character manipulation is a character-level adversarial attack in which only one or a few characters are replaced, with the objective of preserving readability while forcing misclassification. The most explicit instance is AdvChar, a white-box attack against a Chinese BERT-base classifier that perturbs character embeddings slightly and then maps the perturbed embeddings back to nearby valid Chinese characters (Wang et al., 2020). In that formulation, the attack is discrete at the text surface but continuous in the embedding space.

A broader formulation appears in later work on chain association-based attack, where Characters Disassembling is one of several association rules used to construct an adversarial search space over Chinese text. In this setting, character disassembly is not the only mechanism; it is combined with English Translation, Transliteration, Fuzzy Matching, Visually Similar Characters, Chinese Pinyin, Acronym, and Hanzify (Huang et al., 2024). This suggests that “disassembly” is often operationalized as one member of a larger Chinese variation repertoire rather than as an isolated perturbation primitive.

A third line of work treats the same phenomenon from the defense side. CHANGE models Chinese adversarial variation as a Chinese Character Variation Graph whose edges encode Pinyin, Visual, and Character-to-pinyin relations, then integrates this graph into transformer-based PLMs during fine-tuning and graph-guided pre-training (Xiong et al., 2024). In that literature, the core issue is not merely substitution of a Unicode codepoint, but the recoverability of intended semantics from attacked surface forms.

2. Structural substrate in Chinese writing

Chinese character disassembly attacks are grounded in the fact that Chinese script has a layered internal organization. One line of analysis models the writing system as a four-level hierarchy: stroke, radical / component, character, and compound word (Haralambous, 2011). The same work distinguishes bùshou, the traditional set of about 214 radicals used for dictionary lookup, from bùjiàn, a broader set of character components. It also notes that Unicode encodes the 214 KangXi radicals separately, that the Unihan database marks each encoded character as being based on one radical, and that CHISE provides more detailed decomposition into radicals plus strokes (Haralambous, 2011).

The semantic motivation for decomposition is equally important. The structural study reports that about 80% of the most frequent Chinese characters are semantic-phonetic compounds, typically with one component conveying meaning and another providing partial pronunciation information (Haralambous, 2011). This makes character manipulation unusually efficient: changing a single component, or replacing a whole character by a structurally or phonologically related neighbor, can alter the statistical cues seen by a model without making the text unintelligible to humans.

Stroke-level work makes the same point from a recognition perspective. A zero-shot Chinese character recognition model represents a character as a stroke sequence

$\mathbf{g} = (g_1, g_2, \ldots, g_T)$

over five stroke categories—horizontal, vertical, left-falling, right-falling, and turning—and observes that the mapping from stroke sequences to characters is not one-to-one (Chen et al., 2021). Among 3,755 level-1 commonly used characters, about 92.5% of stroke sequences correspond to exactly one character, while in the worst case one stroke sequence can correspond to 7 characters (Chen et al., 2021). For attack analysis, this means that decomposition is highly informative but not perfectly disambiguating: it preserves enough structure for human inference, yet creates ambiguity that models may resolve incorrectly.

The same structural literature formalizes decomposition at multiple resolutions. One proposal defines a stroke-based signature

$\sigma(k)$

for a character as an equivalence class over the ordering constraints of projected stroke boundaries, with the aim of being independent of stroke order, invariant to size, robust to small bounding-box changes, automatic, and suitable for frequent pattern mining (Haralambous, 2011). Another formalization uses Ideographic Description Sequences (IDS), with operators

$X : (K \cup A)^2 \to K$

or

$X : (K \cup A)^3 \to K,$

to assemble characters from radicals and auxiliary components (Haralambous, 2011). These decompositional views do not themselves define attacks, but they supply the representational assumptions that disassembly attacks exploit.

3. Embedding-guided character substitution attacks

The most concrete Chinese attack pipeline in the cited literature is AdvChar, which is explicitly a white-box attack: the attacker knows the architecture, has access to all model parameters, and can compute gradients through the classifier (Wang et al., 2020). The target model is a Chinese BERT-base classifier with 12 layers, 768 hidden units, 12 attention heads, and about 110M parameters. For an input sequence with [CLS] prepended,

$\boldsymbol{x}= [\boldsymbol{x_0, x_1, ..., x_n}],$

the classifier outputs logits

$$\boldsymbol{z} = f(\boldsymbol{x}) \in \mathbb{R}^{C}$$

and predicts

$y = \argmax f(\boldsymbol{x}).$

The attack proceeds in two coupled phases. First, it moves from discrete characters into BERT’s character embedding space: $$[\boldsymbol{e_1, e_2, ..., e_n}] = \boldsymbol{M_e}\Big[\boldsymbol{x_0, x_1, ..., x_n}\Big].$$ A small perturbation vector $\boldsymbol{e^*}$ is then added,

$$\boldsymbol{e'_i} = \boldsymbol{e_i} + \boldsymbol{e^*_i},$$

and the attacked character is obtained by projecting back to the nearest valid embedding,

$\sigma(k)$0

The paper’s interpretation is that the perturbed embedding is “projected” back to the nearest valid Chinese character in the vocabulary (Wang et al., 2020).

Second, the perturbation is optimized with a Carlini-Wagner style loss,

$\sigma(k)$1

where $\sigma(k)$2 penalizes perturbation magnitude, $\sigma(k)$3 is the attack objective, and $\sigma(k)$4 trades off attack success against perturbation size. Optimization is iterative, using Adam in the experiments: $\sigma(k)$5 The attack is evaluated in both untargeted and targeted modes, allows character-level substitution only, and uses no need to insert or delete words (Wang et al., 2020).

The reported results are severe. On Chinese news classification, the model accuracy drops from 91.8% to 0% by manipulating less than 2 characters on average, and human evaluation indicates that generated adversarial examples barely affect human performance (Wang et al., 2020). The paper’s explanation is that Chinese BERT classifiers often exploit spurious character-level cues, so replacing one informative character can move the representation across the decision boundary while preserving human readability.

4. Graph-mediated variation and character disassembly

Later work generalizes the attack space from local embedding perturbations to explicit relational graphs. In the chain association-based framework, an associative knowledge graph $\sigma(k)$6 is constructed over Chinese words, characters, and related forms, with multi-hop paths representing attack chains (Huang et al., 2024). The association rules used to build the graph are grouped by Hume-style laws. Under the Law of Similarity, the graph uses English Translation, Transliteration, Fuzzy Matching, Visually Similar Characters, and Characters Disassembling. Under the Law of Causality, it uses Chinese Pinyin, Acronym, and Hanzify (Huang et al., 2024).

Within this framework, character disassembly is explicit rather than implicit. The paper gives examples such as decomposing 幼 into 幺 + 力, and 稚 into 禾 + 隹, with the disassembly resource obtained by crawling a third-party character disassembly service (Huang et al., 2024). The search space is defined over candidate adversarial sentences

$\sigma(k)$7

where $\sigma(k)$8 is the original sentence and $\sigma(k)$9 contains the original word plus its associative alternatives. Important words are identified by a removal-effect heuristic, and only about the top one-third most important words are replaced (Huang et al., 2024).

Search over this discrete space is performed by discrete particle swarm optimization. The attack score is

$X : (K \cup A)^2 \to K$0

where $X : (K \cup A)^2 \to K$1 is the victim model’s confidence on the true label and $X : (K \cup A)^2 \to K$2 is the total number of layers in the association chains used to produce the substitutions (Huang et al., 2024). This explicitly encodes the two desiderata that recur across the literature: reduce model confidence and keep the perturbation short enough to remain interpretable.

The defensive counterpart, CHANGE, treats adversarial Chinese variation as a Chinese Character Variation Graph

$X : (K \cup A)^2 \to K$3

where $X : (K \cup A)^2 \to K$4 is an attacked character or attack character and $X : (K \cup A)^2 \to K$5 is the attack method (Xiong et al., 2024). The graph includes Pinyin relations built using pypinyin, Visual relations built from the SimilarCharacter dataset with cv2-based similarity, and Character-to-pinyin relations also built using pypinyin. An attacking path is defined as

$X : (K \cup A)^2 \to K$6

namely a path from an attacked character through a relation to a candidate original character (Xiong et al., 2024).

CHANGE uses this graph in two stages. During fine-tuning, Chinese Variation Graph Integration (CVGI) identifies suspicious tokens, reconstructs the input by appending graph-derived postfixes such as [PIN]...[/PIN], [VIS]...[/VIS], and [CTY]...[/CTY], and constrains interaction through a custom 2D attention mask (Xiong et al., 2024). During lightweight graph-guided pre-training on a 13–14GB corpus from Chinese Wikipedia, Baidu Baike, and THUCTC, it adds three tasks: Attack Token Prediction (ATP), Attack Method Prediction (AMP), and Attacked Character Prediction (ACP) (Xiong et al., 2024). The result is a defense that attempts to recover intended character semantics from attacked forms rather than treating the surface perturbation as definitive.

5. Empirical effects and defensive responses

Across the reported studies, a consistent empirical pattern appears: a very small number of character-level or graph-mediated perturbations can produce large model failures, while defenses improve when they encode visual or variation structure explicitly (Wang et al., 2020, Huang et al., 2024, Xiong et al., 2024, Liu et al., 2020).

Work	Setting	Reported outcome
AdvChar	Chinese news classification	accuracy drops from 91.8% to 0% by changing fewer than 2 characters on average
Chain association attack	Content moderation	BaiduCensor: 0.964 → 0.252; AliSecurity: 0.898 → 0.366
CHANGE	Attacked datasets	average improvement about 1.21% on Att and 1.03% on Argot; clean drop only 0.05%
Visual attack defense	DBPedia under attack	AT+VB improves by about 35% accuracy over VB

The white-box Chinese BERT results are especially striking. On THUCTC, Untargeted AdvChar reaches USR = 1.000 with average edit distance about 1.583–1.718, while Targeted AdvChar reports TSR ≈ 0.941–0.945 and USR ≈ 0.953–0.958 with average edit distance about 2.924–3.186. On the Wechat Finance Dataset, Untargeted AdvChar also reports USR = 1.000, and the targeted setting reports TSR ≈ 0.999–1.000 and USR ≈ 0.999–1.000 (Wang et al., 2020). Transferability is also observed: adversarial examples generated for one BERT classifier transfer to others, with attacked accuracies such as 0.491 and 0.569 on THUCTC, and 0.143 and 0.552 on Wechat, for targeted and untargeted cases respectively (Wang et al., 2020).

The chain association results extend the same vulnerability beyond standard classifiers to commercial and large-language-model systems. Against local models, the paper reports drops such as FastText: 0.858 → 0.184, TextCNN: 0.885 → 0.227, BiLSTM: 0.894 → 0.279, and BERT: 0.934 → 0.328 on Meituan comments; on Amazon comments, BERT drops from 0.944 to 0.532 (Huang et al., 2024). The same work evaluates transfer-based attacks on ERNIE Bot and Tongyi Qianwen, reporting that LLMs are also vulnerable, though less so on offensive-text prompts (Huang et al., 2024).

Human studies in both lines of work emphasize the human–machine comprehension gap. In the Wechat evaluation for AdvChar, human accuracy changes from 0.84 ± 0.04 on clean sentences to 0.80 ± 0.06 on adversarial sentences, whereas BERT on the same data changes from 0.82 to 0.00 (Wang et al., 2020). In the chain association study, three annotators could generally reconstruct the intended meaning; the method was harder to recover than WordChange, and its reported WMD between original and recovered text was 0.179, compared with 0.084 for WordChange and 0.163 for GreedyAttack (Huang et al., 2024).

Defensive results point in two directions. First, CHANGE improves robustness while largely preserving clean performance: the paper reports average attacked-dataset gains of about 1.21% on Att and 1.03% on Argot, a best-case attacked improvement of 4.3%, and a reduction of the clean-vs-attacked gap from 5.2% to 0.9% (Xiong et al., 2024). Second, attack-specific defenses can be effective. The chain association paper reports adversarial training gains even with 10% adversarial data, and its Associative Graph-Based Recovery (AGBR) reports $X : (K \cup A)^2 \to K$7 improvements of +0.378 for FastText, +0.448 for TextCNN, +0.437 for BiLSTM, +0.568 for BERT, +0.570 for BaiduCensor, and +0.452 for AliSecurity (Huang et al., 2024).

6. Adjacent literature and conceptual boundaries

A common boundary in this area is the distinction between Chinese-specific disassembly attacks and more general visual text attacks. “Visual Attack and Defense on Text” defines a general Visual Perturber

$X : (K \cup A)^2 \to K$8

that replaces a character $X : (K \cup A)^2 \to K$9 with probability $X : (K \cup A)^3 \to K,$0 by one randomly chosen visually similar neighbor from a character embedding space (Liu et al., 2020). The paper compares ICES, DCES, and its proposed I2CES; I2CES renders characters as centered $X : (K \cup A)^3 \to K,$1 images, trains a CNN with 8 fonts, 2 font sizes: $X : (K \cup A)^3 \to K,$2, rotations from $X : (K \cup A)^3 \to K,$3 to $X : (K \cup A)^3 \to K,$4 with step 2, and salt-and-pepper noise, yielding $X : (K \cup A)^3 \to K,$5 samples per character (Liu et al., 2020). It also uses up to 20 nearest neighbors and a human-validated set $X : (K \cup A)^3 \to K,$6 built from judgments by 3 volunteers (Liu et al., 2020).

That paper is relevant but indirect for Chinese character disassembly. Its experiments are on AG’s News, DBPedia, and Yelp Reviews, and it explicitly does not include a Chinese radical decomposition rule, a disassembled Chinese glyph attack, or a formal mechanism like “拆字” or radical swapping (Liu et al., 2020). What it does provide is a precursor visual-substitution framework and an explicit statement that visual attacks on languages such as Chinese and Korean are “frequent in real life” and should be studied (Liu et al., 2020). In that sense, it is part of the genealogy of Chinese disassembly research, but not itself a direct instance.

A second boundary concerns decomposition research that is not adversarial. Stroke-level recognition models decompose Chinese characters into ordered stroke sequences and then use lexicon rectification and a Siamese matching stage to resolve one-to-many ambiguity (Chen et al., 2021). This is structural analysis and recognition rather than attack generation. Its relevance to disassembly attack lies in the opposite direction: it demonstrates that decomposition into strokes can be operationalized effectively, which suggests that robust systems may need to reason below the character level if they are to resist attack surfaces based on disassembly, visual variation, or component substitution.

Taken together, the literature portrays Chinese character disassembly attack as an adversarial family whose effectiveness derives from the compositionality of Chinese script and from the mismatch between human semantic recovery and model token identity. The attack surface includes direct nearest-neighbor character substitution, explicit character decomposition into components, and multi-hop variation paths over pinyin, visual similarity, transliteration, and acronym-like forms. The strongest current defenses likewise move away from raw token identity, toward glyph-aware encoding, graph-guided recovery, adversarial training, and explicit modeling of Chinese character variation (Wang et al., 2020, Huang et al., 2024, Xiong et al., 2024).