Hypoglyphs: Emergent Symbols & Unicode Attacks

• Hypoglyphs are glyph phenomena defined by communication constraints rather than imitation, manifesting as novel symbol designs or subtle Unicode alterations.
• In neural glyph experiments, a differentiable renderer and classifier jointly optimize symbol creation, producing handwriting-like variations without human exemplars.
• In O-RAN security, hypoglyphs exploit visually similar Unicode substitutions to bypass human detection while triggering failures in traditional anomaly detectors.

Hypoglyphs are treated in recent literature as glyphic phenomena whose behavior is determined by the structure of a communication system rather than by direct copying of an established script. In "Generating Novel Glyph without Human Data by Learning to Communicate" (Park, 2020), the idea is relevant to glyph-like forms that emerge when a generator and a classifier are trained only to communicate through rendered symbols, with no human glyph corpus. In "Robust Anomaly Detection in O-RAN: Leveraging LLMs against Data Manipulation Attacks" (Dayaratne et al., 11 Aug 2025), hypoglyphs are Unicode-wise alterations that are visually similar but textually distinct, allowing a message to appear unchanged to a human reader while differing at the code-point level. These usages are technically distinct, but both center symbol formation or symbol manipulation on the constraints of transmission, recognition, and decoding.

1. Terminological scope

Within the cited literature, the term appears in two distinct senses. One concerns the emergence of novel glyph-like forms under communicative pressure; the other concerns adversarial insertion of visually similar Unicode variants into operational message streams.

Usage	Mechanism	Research setting
Emergent hypoglyph-like forms	End-to-end communication through rendered symbols	Neural Glyph (Park, 2020)
Hypoglyphs as Unicode alterations	Visually similar, distinct Unicode variations	O-RAN SDL security (Dayaratne et al., 11 Aug 2025)

The first sense is not framed as imitation of human writing. Neural Glyph asks whether a system that must invent symbols purely for communication, and that sees no examples of human writing at all, will nonetheless produce a glyph set that resembles human-made writing (Park, 2020). The second sense is explicitly adversarial: a malicious xApp replaces one or more characters with homoglyph-like Unicode characters that look nearly identical to a human reader but are different code points to software (Dayaratne et al., 11 Aug 2025).

A separate but adjacent line of work concerns damaged-script recovery rather than hypoglyphs proper. "HieroLM: Egyptian Hieroglyph Recovery with Next Word Prediction LLM" models hieroglyph recovery as next-word prediction in transliterated Egyptian text, addressing blurry or missing hieroglyphs through contextual inference rather than Unicode substitution or symbol invention (Cai et al., 6 Mar 2025).

2. Communication-driven emergence of novel glyphs

Neural Glyph formulates symbol invention as a communication problem in the Shannon–Weaver sense. The task is to generate a set of $N$ distinct symbols, where each symbol is not defined by a human dataset but by a learned internal code. The sender is the generator, the channel is a differentiable neural painter, and the receiver is a classifier (Park, 2020).

The generator is an embedding lookup table of size $N$, with one learned embedding per symbol class. A two-layer MLP maps the embedding into a sequence of action-space parameters that define brushstrokes. The action space includes parameters such as pressure, control_x, control_y, end_x, end_y, start_x, start_y, and entry_pressure. Random noise is injected into this MLP to simulate the stochasticity of human handwriting, so that each symbol class can retain internal variation while remaining recognizable as the same class (Park, 2020).

Trainability depends on a differentiable renderer. The system uses a pretrained GAN-based neural painter to convert stroke parameters into an image, and this renderer is frozen during training. The classifier predicts which symbol class the rendered image corresponds to, and the system is optimized only through the classification objective

$$\mathcal{L}_{\text{cls}} = - \log p_\theta(m \mid x).$$

Because the rendered image $x$ is produced through the differentiable neural painter, gradients propagate back to the generator, allowing it to learn stroke parameters that make each class easy for the classifier to recognize. The training is classification-driven and end-to-end; there is no reconstruction loss, no glyph dataset, and no adversarial loss over human examples (Park, 2020).

The classifier is built on a pretrained MobileNet V2 backbone with the last fully connected layer replaced by a randomly initialized projection layer producing logits for the $N$ classes. A key practical observation is that the system fails to generate distinctive symbols if the classifier is trained from scratch or if the MobileNet V2 weights are frozen. The classifier must therefore be both strong and adaptable enough to provide a useful communication signal (Park, 2020).

3. Structural regularities, controllability, and inventory size

Neural Glyph imposes constraints intended to force genuine symbol design rather than trivial separability. Brushstroke thickness and color are fixed to constant values—black strokes with zero brush size variation—by setting those action parameters to constants. This requires the model to express class differences through shape, stroke placement, and stroke geometry instead of cues such as color (Park, 2020).

The learned symbols do not converge to a single canonical appearance for each class. Each class can yield multiple visually distinct but still class-consistent variants, and a temperature parameter applied to the noise magnitude at inference time controls this variability: higher temperature produces more stochastic variation, while lower temperature yields more stable forms. The paper describes the resulting outputs as having a family resemblance across samples, much as handwriting varies while remaining legible (Park, 2020).

The main empirical finding is that the symbols often resemble forms found in real writing systems. The reported outputs often contain curves, dots, hooks, strokes, and compact shapes that look script-like, and the paper encourages comparison with Omniglot. The authors interpret this as evidence that some visual properties of glyphs may emerge from the constraints of efficient communication itself rather than from imitation of existing scripts (Park, 2020).

Inventory size matters. As $N$ increases, classification becomes harder because more distinctions must be packed into a limited action space. The appendix reports that top-1 classifier accuracy declines from about $99.80\%$ at $N=4$ to about $87.84\%\pm18.47\%$ at $N=512$. This supports the view that the size of a symbol inventory constrains how visually separable the resulting glyphs must be, which in turn influences their appearance (Park, 2020).

The implementation details reinforce the communication-first formulation. The generator is trained with Adam at learning rate $N$0, batch size $N$1, for $N$2 steps. The stroke sequence length is $N$3, the symbol embedding dimension is $N$4, the noise dimension is $N$5, and the generator MLP width is $N$6. Input batches are constructed from random symbol indices rather than from a dataset loader, and training should be stopped at the right time because the symbol set does not necessarily converge to a single stable visual style; if training runs too long, redundant symbols may appear (Park, 2020).

A common misconception is that the network merely invents random drawings. The paper’s interpretation is narrower and more technical: the system invents symbols optimized to be communicative, and the differentiable rendering bottleneck biases those symbols toward compact, distinct, handwriting-like forms (Park, 2020).

4. Hypoglyphs as a Unicode attack primitive in O-RAN

In the O-RAN security literature, hypoglyphs are defined as Unicode-wise alterations that are visually similar but textually distinct. An attacker replaces one or more characters in a message with visually similar Unicode characters that look nearly identical to a human reader but correspond to different code points for software processing (Dayaratne et al., 11 Aug 2025).

The paper gives an illustrative manipulation of an RRCSetupRequest message. It cites replacement of Latin C (U+0043) with Cyrillic C (U+0421), Latin e (U+0065) with Cyrillic e (U+0435), and Latin q (U+0071) with a visually similar Armenian character (U+055B). The important point is that the message can appear “exactly same” to a human while differing at the Unicode level (Dayaratne et al., 11 Aug 2025).

The attack surface is the Shared Data Layer used by xApps in the Near-RT RIC. The paper argues that SDL is vulnerable because it is not yet fully standardized and because the O-RAN ecosystem currently lacks robust database-level authentication and authorization. A malicious xApp with read/write SDL access can therefore tamper with the data used by other xApps (Dayaratne et al., 11 Aug 2025).

The attack workflow is software-layer and operationally simple. A malicious xApp is deployed on the Near-RT RIC, gains SDL read/write access, intercepts or rewrites stored Layer-3 messages such as RRC and NAS, inserts hypoglyphs instead of obviously corrupting the messages, and leaves a manipulated stream for a downstream anomaly-detection xApp to consume. The goal is either to evade detection or to cause the detector to malfunction. The paper explicitly presents this as a realistic, low-cost threat relative to attacks such as jamming or fake nodes (Dayaratne et al., 11 Aug 2025).

5. Detector failure modes and LLM robustness

The O-RAN study evaluates an existing traditional ML anomaly detector based on an AutoEncoder from prior work (6G-XSec). On the normal dataset, the AutoEncoder achieves reasonable performance, and the paper states that F1 remains over $N$7 for most window sizes. However, when the same AutoEncoder models are tested on a dataset containing $N$8 hypoglyphed messages, all $N$9 models immediately fail or crash upon the first hypoglyphed message (Dayaratne et al., 11 Aug 2025).

The paper attributes this failure to the AutoEncoder’s feature extraction, encoding, and dependence on a fixed set of normal, well-formed message patterns. Because the novel Unicode characters are unseen by the preprocessing and encoding pipeline, the result is not merely misclassification but operational failure. The paper notes that a skipped-message fallback would still be a serious weakness, because anomaly detection would continue without analyzing the manipulated message (Dayaratne et al., 11 Aug 2025).

The experimental setup is concrete. The base dataset comes from prior work and includes data from a physical testbed with four 5G smartphone models plus data from the COLOSSEUM wireless network emulator. The enhanced dataset contains $$\mathcal{L}_{\text{cls}} = - \log p_\theta(m \mid x).$$0 RRC and NAS messages and $$\mathcal{L}_{\text{cls}} = - \log p_\theta(m \mid x).$$1 Blind DoS attack scenarios. Since the original dataset had only $$\mathcal{L}_{\text{cls}} = - \log p_\theta(m \mid x).$$2 Blind DoS attacks, the authors augmented it with $$\mathcal{L}_{\text{cls}} = - \log p_\theta(m \mid x).$$3 additional Blind DoS attack instances by injecting $$\mathcal{L}_{\text{cls}} = - \log p_\theta(m \mid x).$$4 RRCSetupRequest messages with preselected existing TMSI values and random RNTI values. They then manipulated $$\mathcal{L}_{\text{cls}} = - \log p_\theta(m \mid x).$$5 messages using Unicode-wise alteration: $$\mathcal{L}_{\text{cls}} = - \log p_\theta(m \mid x).$$6 Blind DoS attack instances and $$\mathcal{L}_{\text{cls}} = - \log p_\theta(m \mid x).$$7 normal messages. Evaluation uses overlapping window sizes from $$\mathcal{L}_{\text{cls}} = - \log p_\theta(m \mid x).$$8 through $$\mathcal{L}_{\text{cls}} = - \log p_\theta(m \mid x).$$9, with only one new incoming message at a time to mimic streaming detection in the Near-RT RIC (Dayaratne et al., 11 Aug 2025).

The LLM-based xApp is built with Meta Llama-3.1-8B-Instruct via vLLM on an NVIDIA A100 GPU (80GB), with no pre-training or fine-tuning and with temperature = 0 for deterministic outputs. Unlike the AutoEncoder, it processes all $x$0 messages, including all $x$1 hypoglyphed messages, with no system crashes and no early terminations (Dayaratne et al., 11 Aug 2025).

The paper is careful to separate robustness from classification quality. The LLM-based xApp does not crash on manipulated input, but its initial detection quality is weak, with F1-scores ranging from about $x$2 to $x$3 across window sizes. The authors therefore present prompt engineering, rather than retraining, as the main future direction for improving detection quality while retaining robustness (Dayaratne et al., 11 Aug 2025).

Average per-message detection times are reported as follows:

Window Size	Average Time (seconds)
1	0.030
2	0.046
3	0.056
4	0.052
5	0.054
6	0.056
7	0.056
8	0.067
9	0.069
10	0.070

Latency increases modestly with window size, but all values remain below $x$4 seconds and well under the stated Near-RT RIC real-time constraint of $x$5 second. The evaluation metrics include Accuracy, Precision, Recall, F1 score, False Positive Rate, and False Negative Rate, but for the hypoglyph study the emphasized outcomes are AutoEncoder crash, LLM F1 in the range $x$6–$x$7, and LLM latency in the range $x$8–$x$9 seconds (Dayaratne et al., 11 Aug 2025).

A common misconception is that LLM robustness here implies strong anomaly detection. The paper explicitly does not make that claim: operational continuity is strong, but baseline detection accuracy remains preliminary (Dayaratne et al., 11 Aug 2025).

6. Relation to hieroglyph recovery and contextual language modeling

HieroLM addresses a different problem: recovery of blurry, eroded, partially broken, or missing Egyptian hieroglyphs from context rather than generation of novel scripts or Unicode-level attack manipulation. The paper argues that prior CNN-based approaches model hieroglyph recovery as image classification and therefore cannot handle severely damaged or completely missing hieroglyphs, while also ignoring contextual and grammatical information (Cai et al., 6 Mar 2025).

The proposed reformulation is next-word prediction over transliterated hieroglyphic text. Given previous words in a sequence, the model predicts the next word, allowing it to recover blurry glyphs through context and to infer missing words even when no visual input is available. The authors compare several architectures and choose LSTM for HieroLM because of the strong local affinity of semantics in Egyptian hieroglyph texts, the formulaic character of the inscriptions, and the small-data setting (Cai et al., 6 Mar 2025).

The reported results are specific. HieroLM achieves over $N$0 accuracy, outperforms NPLM, RNN, and Transformer baselines on AES, Ramses, and Mixed datasets, and maintains over $N$1 accuracy when predicting $N$2 words in a row in the multi-shot setting. The paper also states that language modeling can significantly reduce perplexity in recognizing blurry hieroglyphs when combined with CV-based evidence (Cai et al., 6 Mar 2025).

This neighboring literature clarifies what hypoglyphs are not. In HieroLM, the central issue is contextual restoration of damaged historical writing. In Neural Glyph, the central issue is emergence of distinctive symbols without human glyph data. In O-RAN security, the central issue is adversarial Unicode substitution in a live software stack. A plausible implication is that these lines of work occupy a common methodological space—symbolic sequences constrained by recognition and decoding—while remaining distinct in ontology, data modality, and threat model.

7. Conceptual significance

The cited work supports two distinct but related claims about the role of communication constraints in shaping glyphic phenomena. Neural Glyph suggests that some visual properties of existing glyphs may be attributable to the constraints of communication via writing: when symbols must be easy to produce, distinguish, and decode under a restricted rendering process, curves, hooks, dots, and compact stroke patterns can emerge even without human exemplars (Park, 2020).

The O-RAN security study shows the inverse possibility: the same separation between visual appearance and machine-readable representation can be exploited adversarially. Here, the message preserves its apparent meaning to a human observer while its raw Unicode structure is altered so that traditional ML pipelines break at the preprocessing or encoding stage (Dayaratne et al., 11 Aug 2025).

Taken together, these results indicate that glyph-like behavior cannot be reduced either to image appearance alone or to textual identity alone. In one case, communicative optimization yields forms that look script-like without a human dataset; in the other, minimal code-point changes preserve appearance while undermining machine interpretation. This suggests that hypoglyphs, across their current usages, are best understood as artifacts of the interface between symbol shape, symbol encoding, and the operational constraints of a communication channel.