---
title: Chinese Character Disassembly Attack
url: https://www.emergentmind.com/topics/chinese-character-disassembly-attack
type: topic
---

# Chinese Character Disassembly Attack

Chinese character disassembly attack refers to adversarial manipulation of Chinese text through operations that exploit the internal structure or variation space of characters—such as stroke- or component-level decomposition, visually similar substitutions, homophonic or pinyin-based variants, and nearest-neighbor projections in character embedding space—so that human readers can still recover the intended meaning while NLP systems fail or degrade. The available literature suggests that the term covers several closely related, not fully identical attack formulations rather than one canonical method: a white-box embedding-guided character substitution attack against Chinese BERT classifiers, graph-mediated attacks in which character disassembling is one association rule, and defense-oriented models that treat Chinese character variation as an explicit graph [2004.03742, 2411.07843, 2404.12014].

## 1. Terminological scope and problem setting

In the most direct attack formulation, Chinese character manipulation is a **character-level adversarial attack** in which only one or a few characters are replaced, with the objective of preserving readability while forcing misclassification. The most explicit instance is **AdvChar**, a white-box attack against a Chinese **BERT-base classifier** that perturbs character embeddings slightly and then maps the perturbed embeddings back to nearby valid Chinese characters [2004.03742]. In that formulation, the attack is discrete at the text surface but continuous in the embedding space.

A broader formulation appears in later work on **chain association-based attack**, where **Characters Disassembling** is one of several association rules used to construct an adversarial search space over Chinese text. In this setting, character disassembly is not the only mechanism; it is combined with **English Translation**, **Transliteration**, **Fuzzy Matching**, **Visually Similar Characters**, **Chinese Pinyin**, **Acronym**, and **Hanzify** [2411.07843]. This suggests that “disassembly” is often operationalized as one member of a larger Chinese variation repertoire rather than as an isolated perturbation primitive.

A third line of work treats the same phenomenon from the defense side. **CHANGE** models Chinese adversarial variation as a **Chinese Character Variation Graph** whose edges encode **Pinyin**, **Visual**, and **Character-to-pinyin** relations, then integrates this graph into transformer-based PLMs during fine-tuning and graph-guided pre-training [2404.12014]. In that literature, the core issue is not merely substitution of a Unicode codepoint, but the recoverability of intended semantics from attacked surface forms.

## 2. Structural substrate in Chinese writing

Chinese character disassembly attacks are grounded in the fact that Chinese script has a layered internal organization. One line of analysis models the writing system as a four-level hierarchy: **stroke**, **radical / component**, **character**, and **compound word** [1104.4321]. The same work distinguishes **bùshou**, the traditional set of about **214 radicals** used for dictionary lookup, from **bùjiàn**, a broader set of character components. It also notes that Unicode encodes the **214 KangXi radicals** separately, that the **Unihan database** marks each encoded character as being based on one radical, and that **CHISE** provides more detailed decomposition into radicals plus strokes [1104.4321].

The semantic motivation for decomposition is equally important. The structural study reports that about **80% of the most frequent Chinese characters** are semantic-phonetic compounds, typically with one component conveying meaning and another providing partial pronunciation information [1104.4321]. This makes character manipulation unusually efficient: changing a single component, or replacing a whole character by a structurally or phonologically related neighbor, can alter the statistical cues seen by a model without making the text unintelligible to humans.

Stroke-level work makes the same point from a recognition perspective. A zero-shot Chinese character recognition model represents a character as a stroke sequence
\[
\mathbf{g} = (g_1, g_2, \ldots, g_T)
\]
over five stroke categories—**horizontal**, **vertical**, **left-falling**, **right-falling**, and **turning**—and observes that the mapping from stroke sequences to characters is not one-to-one [2106.11613]. Among **3,755 level-1 commonly used characters**, about **92.5%** of stroke sequences correspond to exactly one character, while in the worst case one stroke sequence can correspond to **7 characters** [2106.11613]. For attack analysis, this means that decomposition is highly informative but not perfectly disambiguating: it preserves enough structure for human inference, yet creates ambiguity that models may resolve incorrectly.

The same structural literature formalizes decomposition at multiple resolutions. One proposal defines a stroke-based signature
\[
\sigma(k)
\]
for a character as an equivalence class over the ordering constraints of projected stroke boundaries, with the aim of being independent of stroke order, invariant to size, robust to small bounding-box changes, automatic, and suitable for frequent pattern mining [1104.4321]. Another formalization uses **Ideographic Description Sequences (IDS)**, with operators
\[
X : (K \cup A)^2 \to K
\]
or
\[
X : (K \cup A)^3 \to K,
\]
to assemble characters from radicals and auxiliary components [1104.4321]. These decompositional views do not themselves define attacks, but they supply the representational assumptions that disassembly attacks exploit.

## 3. Embedding-guided character substitution attacks

The most concrete Chinese attack pipeline in the cited literature is **AdvChar**, which is explicitly a **white-box attack**: the attacker knows the architecture, has access to all model parameters, and can compute gradients through the classifier [2004.03742]. The target model is a Chinese **BERT-base classifier** with **12 layers**, **768 hidden units**, **12 attention heads**, and about **110M parameters**. For an input sequence with `[CLS]` prepended,
\[
\boldsymbol{x}= [\boldsymbol{x_0, x_1, ..., x_n}],
\]
the classifier outputs logits
\[
\boldsymbol{z} = f(\boldsymbol{x}) \in \mathbb{R}^{C}
\]
and predicts
\[
y = \argmax f(\boldsymbol{x}).
\]

The attack proceeds in two coupled phases. First, it moves from discrete characters into BERT’s character embedding space:
\[
[\boldsymbol{e_1, e_2, ..., e_n}] = \boldsymbol{M_e}\Big[\boldsymbol{x_0, x_1, ..., x_n}\Big].
\]
A small perturbation vector \(\boldsymbol{e^*}\) is then added,
\[
\boldsymbol{e'_i} = \boldsymbol{e_i} + \boldsymbol{e^*_i},
\]
and the attacked character is obtained by projecting back to the nearest valid embedding,
\[
\boldsymbol{x'_i} = \argmin ( [\boldsymbol{e'_i; e'_i; ..., e'_i}] - \boldsymbol{M_e}).
\]
The paper’s interpretation is that the perturbed embedding is “projected” back to the nearest valid Chinese character in the vocabulary [2004.03742].

Second, the perturbation is optimized with a Carlini-Wagner style loss,
\[
\mathcal{L}(\boldsymbol{e^*})  =  ||\boldsymbol{e^*}||_p + c \cdot g(\boldsymbol{x'}),
\]
where \(||\boldsymbol{e^*}||_p\) penalizes perturbation magnitude, \(g(\boldsymbol{x'})\) is the attack objective, and \(c\) trades off attack success against perturbation size. Optimization is iterative, using Adam in the experiments:
\[
\boldsymbol{e^*_{k+1} \leftarrow e^*_k - \alpha \nabla \mathcal{L}(\boldsymbol{e^*_k})}.
\]
The attack is evaluated in both **untargeted** and **targeted** modes, allows **character-level substitution only**, and uses **no need to insert or delete words** [2004.03742].

The reported results are severe. On Chinese news classification, the model accuracy drops from **91.8% to 0%** by manipulating less than **2 characters on average**, and human evaluation indicates that generated adversarial examples **barely affect human performance** [2004.03742]. The paper’s explanation is that Chinese BERT classifiers often exploit **spurious character-level cues**, so replacing one informative character can move the representation across the decision boundary while preserving human readability.

## 4. Graph-mediated variation and character disassembly

Later work generalizes the attack space from local embedding perturbations to explicit relational graphs. In the chain association-based framework, an **associative knowledge graph** \( \mathit{G} \) is constructed over Chinese words, characters, and related forms, with multi-hop paths representing attack chains [2411.07843]. The association rules used to build the graph are grouped by Hume-style laws. Under the **Law of Similarity**, the graph uses **English Translation**, **Transliteration**, **Fuzzy Matching**, **Visually Similar Characters**, and **Characters Disassembling**. Under the **Law of Causality**, it uses **Chinese Pinyin**, **Acronym**, and **Hanzify** [2411.07843].

Within this framework, character disassembly is explicit rather than implicit. The paper gives examples such as decomposing **幼** into **幺** + **力**, and **稚** into **禾** + **隹**, with the disassembly resource obtained by crawling a third-party character disassembly service [2411.07843]. The search space is defined over candidate adversarial sentences
\[
x^{a}=x^{a}_{1} \ldots x^{a}_{n} \ldots x^{a}_{N}, \quad x^{a}_{n} \in \mathbb{A}(x^{o}_{n}),
\]
where \(x^{o}\) is the original sentence and \(\mathbb{A}(x^{o}_{n})\) contains the original word plus its associative alternatives. Important words are identified by a **removal-effect heuristic**, and only about the **top one-third most important words** are replaced [2411.07843].

Search over this discrete space is performed by **discrete particle swarm optimization**. The attack score is
\[
score(x^{a})= \frac{1-C(x^{a})}{L(x^{o}, x^{a})},
\]
where \(C(x^a)\) is the victim model’s confidence on the true label and \(L(x^o,x^a)\) is the total number of layers in the association chains used to produce the substitutions [2411.07843]. This explicitly encodes the two desiderata that recur across the literature: reduce model confidence and keep the perturbation short enough to remain interpretable.

The defensive counterpart, **CHANGE**, treats adversarial Chinese variation as a **Chinese Character Variation Graph**
\[
\mathcal{G}={(c_0, r_0, c_1), (c_2, r_1, c_3), ..., (c_i, r_m, c_j)},
\]
where \(c_n\) is an attacked character or attack character and \(r_m\) is the attack method [2404.12014]. The graph includes **Pinyin** relations built using **pypinyin**, **Visual** relations built from the **SimilarCharacter** dataset with **cv2-based similarity**, and **Character-to-pinyin** relations also built using **pypinyin**. An **attacking path** is defined as
\[
p(n_1, r_1, n_2),
\]
namely a path from an attacked character through a relation to a candidate original character [2404.12014].

CHANGE uses this graph in two stages. During fine-tuning, **Chinese Variation Graph Integration (CVGI)** identifies suspicious tokens, reconstructs the input by appending graph-derived postfixes such as `[PIN]...[/PIN]`, `[VIS]...[/VIS]`, and `[CTY]...[/CTY]`, and constrains interaction through a custom **2D attention mask** [2404.12014]. During lightweight graph-guided pre-training on a **13–14GB** corpus from **Chinese Wikipedia**, **Baidu Baike**, and **THUCTC**, it adds three tasks: **Attack Token Prediction (ATP)**, **Attack Method Prediction (AMP)**, and **Attacked Character Prediction (ACP)** [2404.12014]. The result is a defense that attempts to recover intended character semantics from attacked forms rather than treating the surface perturbation as definitive.

## 5. Empirical effects and defensive responses

Across the reported studies, a consistent empirical pattern appears: a very small number of character-level or graph-mediated perturbations can produce large model failures, while defenses improve when they encode visual or variation structure explicitly [2004.03742, 2411.07843, 2404.12014, 2008.10356].

| Work | Setting | Reported outcome |
|---|---|---|
| AdvChar | Chinese news classification | accuracy drops from **91.8% to 0%** by changing fewer than **2 characters on average** |
| Chain association attack | Content moderation | **BaiduCensor: 0.964 → 0.252**; **AliSecurity: 0.898 → 0.366** |
| CHANGE | Attacked datasets | average improvement about **1.21%** on **Att** and **1.03%** on **Argot**; clean drop only **0.05%** |
| Visual attack defense | DBPedia under attack | **AT+VB** improves by about **35% accuracy over VB** |

The white-box Chinese BERT results are especially striking. On **THUCTC**, **Untargeted AdvChar** reaches **USR = 1.000** with average edit distance about **1.583–1.718**, while **Targeted AdvChar** reports **TSR ≈ 0.941–0.945** and **USR ≈ 0.953–0.958** with average edit distance about **2.924–3.186**. On the **Wechat Finance Dataset**, **Untargeted AdvChar** also reports **USR = 1.000**, and the targeted setting reports **TSR ≈ 0.999–1.000** and **USR ≈ 0.999–1.000** [2004.03742]. Transferability is also observed: adversarial examples generated for one BERT classifier transfer to others, with attacked accuracies such as **0.491** and **0.569** on **THUCTC**, and **0.143** and **0.552** on **Wechat**, for targeted and untargeted cases respectively [2004.03742].

The chain association results extend the same vulnerability beyond standard classifiers to commercial and large-language-model systems. Against local models, the paper reports drops such as **FastText: 0.858 → 0.184**, **TextCNN: 0.885 → 0.227**, **BiLSTM: 0.894 → 0.279**, and **BERT: 0.934 → 0.328** on **Meituan comments**; on **Amazon comments**, **BERT** drops from **0.944** to **0.532** [2411.07843]. The same work evaluates transfer-based attacks on **ERNIE Bot** and **Tongyi Qianwen**, reporting that LLMs are also vulnerable, though less so on offensive-text prompts [2411.07843].

Human studies in both lines of work emphasize the **human–machine comprehension gap**. In the Wechat evaluation for AdvChar, human accuracy changes from **0.84 ± 0.04** on clean sentences to **0.80 ± 0.06** on adversarial sentences, whereas BERT on the same data changes from **0.82** to **0.00** [2004.03742]. In the chain association study, three annotators could generally reconstruct the intended meaning; the method was harder to recover than **WordChange**, and its reported **WMD** between original and recovered text was **0.179**, compared with **0.084** for **WordChange** and **0.163** for **GreedyAttack** [2411.07843].

Defensive results point in two directions. First, **CHANGE** improves robustness while largely preserving clean performance: the paper reports average attacked-dataset gains of about **1.21%** on **Att** and **1.03%** on **Argot**, a best-case attacked improvement of **4.3%**, and a reduction of the clean-vs-attacked gap from **5.2%** to **0.9%** [2404.12014]. Second, attack-specific defenses can be effective. The chain association paper reports **adversarial training** gains even with **10% adversarial data**, and its **Associative Graph-Based Recovery (AGBR)** reports \(\Delta ADV\) improvements of **+0.378** for **FastText**, **+0.448** for **TextCNN**, **+0.437** for **BiLSTM**, **+0.568** for **BERT**, **+0.570** for **BaiduCensor**, and **+0.452** for **AliSecurity** [2411.07843].

## 6. Adjacent literature and conceptual boundaries

A common boundary in this area is the distinction between **Chinese-specific disassembly attacks** and more general **visual text attacks**. “Visual Attack and Defense on Text” defines a general **Visual Perturber**
\[
VP = VP(X, p, CES)
\]
that replaces a character \(X\) with probability \(p\) by one randomly chosen visually similar neighbor from a **character embedding space** [2008.10356]. The paper compares **ICES**, **DCES**, and its proposed **I2CES**; I2CES renders characters as centered **\(100 \times 100\)** images, trains a CNN with **8 fonts**, **2 font sizes: \(\{60, 80\}\)**, rotations from **\(-20^\circ\) to \(20^\circ\)** with step **2**, and **salt-and-pepper noise**, yielding **\(8 \times 2 \times 20 = 320\)** samples per character [2008.10356]. It also uses up to **20 nearest neighbors** and a human-validated set \(h\_set\) built from judgments by **3 volunteers** [2008.10356].

That paper is relevant but indirect for Chinese character disassembly. Its experiments are on **AG’s News**, **DBPedia**, and **Yelp Reviews**, and it explicitly does **not** include a Chinese radical decomposition rule, a disassembled Chinese glyph attack, or a formal mechanism like **“拆字”** or radical swapping [2008.10356]. What it does provide is a precursor visual-substitution framework and an explicit statement that visual attacks on languages such as **Chinese and Korean** are “frequent in real life” and should be studied [2008.10356]. In that sense, it is part of the genealogy of Chinese disassembly research, but not itself a direct instance.

A second boundary concerns decomposition research that is **not adversarial**. Stroke-level recognition models decompose Chinese characters into ordered stroke sequences and then use lexicon rectification and a Siamese matching stage to resolve one-to-many ambiguity [2106.11613]. This is structural analysis and recognition rather than attack generation. Its relevance to disassembly attack lies in the opposite direction: it demonstrates that decomposition into strokes can be operationalized effectively, which suggests that robust systems may need to reason below the character level if they are to resist attack surfaces based on disassembly, visual variation, or component substitution.

Taken together, the literature portrays Chinese character disassembly attack as an adversarial family whose effectiveness derives from the compositionality of Chinese script and from the mismatch between human semantic recovery and model token identity. The attack surface includes direct nearest-neighbor character substitution, explicit character decomposition into components, and multi-hop variation paths over pinyin, visual similarity, transliteration, and acronym-like forms. The strongest current defenses likewise move away from raw token identity, toward glyph-aware encoding, graph-guided recovery, adversarial training, and explicit modeling of Chinese character variation [2004.03742, 2411.07843, 2404.12014].

Source: https://www.emergentmind.com/topics/chinese-character-disassembly-attack