{"id":"https://openalex.org/W3176393001","doi":"https://doi.org/10.1109/sp46214.2022.9833641","title":"Bad Characters: Imperceptible NLP Attacks","display_name":"Bad Characters: Imperceptible NLP Attacks","publication_year":2022,"publication_date":"2022-05-01","ids":{"openalex":"https://openalex.org/W3176393001","doi":"https://doi.org/10.1109/sp46214.2022.9833641","mag":"3176393001"},"language":"en","primary_location":{"id":"doi:10.1109/sp46214.2022.9833641","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46214.2022.9833641","pdf_url":null,"source":{"id":"https://openalex.org/S4363606603","display_name":"2022 IEEE Symposium on Security and Privacy (SP)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://www.research.ed.ac.uk/files/287726702/Bad_Characters_BOUCHER_DOA01052022_AFV.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5058523704","display_name":"Nicholas Boucher","orcid":"https://orcid.org/0000-0002-5674-3730"},"institutions":[{"id":"https://openalex.org/I241749","display_name":"University of Cambridge","ror":"https://ror.org/013meh722","country_code":"GB","type":"education","lineage":["https://openalex.org/I241749"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Nicholas Boucher","raw_affiliation_strings":["University of Cambridgem, Computer Science & Technology"],"affiliations":[{"raw_affiliation_string":"University of Cambridgem, Computer Science & Technology","institution_ids":["https://openalex.org/I241749"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5069844959","display_name":"Ilia Shumailov","orcid":"https://orcid.org/0000-0003-3100-0727"},"institutions":[{"id":"https://openalex.org/I241749","display_name":"University of Cambridge","ror":"https://ror.org/013meh722","country_code":"GB","type":"education","lineage":["https://openalex.org/I241749"]},{"id":"https://openalex.org/I4210127509","display_name":"Vector Institute","ror":"https://ror.org/03kqdja62","country_code":"CA","type":"facility","lineage":["https://openalex.org/I4210127509"]}],"countries":["CA","GB"],"is_corresponding":false,"raw_author_name":"Ilia Shumailov","raw_affiliation_strings":["University of Cambridge and Vector Institute"],"affiliations":[{"raw_affiliation_string":"University of Cambridge and Vector Institute","institution_ids":["https://openalex.org/I4210127509","https://openalex.org/I241749"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5046983053","display_name":"Ross Anderson","orcid":"https://orcid.org/0000-0001-8697-5682"},"institutions":[{"id":"https://openalex.org/I98677209","display_name":"University of Edinburgh","ror":"https://ror.org/01nrxwf90","country_code":"GB","type":"education","lineage":["https://openalex.org/I98677209"]},{"id":"https://openalex.org/I241749","display_name":"University of Cambridge","ror":"https://ror.org/013meh722","country_code":"GB","type":"education","lineage":["https://openalex.org/I241749"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Ross Anderson","raw_affiliation_strings":["University of Cambridge and University of Edinburgh"],"affiliations":[{"raw_affiliation_string":"University of Cambridge and University of Edinburgh","institution_ids":["https://openalex.org/I98677209","https://openalex.org/I241749"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5018809423","display_name":"Nicolas Papernot","orcid":"https://orcid.org/0000-0001-5078-7233"},"institutions":[{"id":"https://openalex.org/I241749","display_name":"University of Cambridge","ror":"https://ror.org/013meh722","country_code":"GB","type":"education","lineage":["https://openalex.org/I241749"]},{"id":"https://openalex.org/I4210127509","display_name":"Vector Institute","ror":"https://ror.org/03kqdja62","country_code":"CA","type":"facility","lineage":["https://openalex.org/I4210127509"]}],"countries":["CA","GB"],"is_corresponding":false,"raw_author_name":"Nicolas Papernot","raw_affiliation_strings":["University of Cambridge and Vector Institute"],"affiliations":[{"raw_affiliation_string":"University of Cambridge and Vector Institute","institution_ids":["https://openalex.org/I4210127509","https://openalex.org/I241749"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5058523704"],"corresponding_institution_ids":["https://openalex.org/I241749"],"apc_list":null,"apc_paid":null,"fwci":8.0349,"has_fulltext":true,"cited_by_count":82,"citation_normalized_percentile":{"value":0.98187599,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"1987","last_page":"2004"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9754999876022339,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.9656000137329102,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8318755626678467},{"id":"https://openalex.org/keywords/machine-translation","display_name":"Machine translation","score":0.6587974429130554},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.6438940763473511},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.6073618531227112},{"id":"https://openalex.org/keywords/language-model","display_name":"Language model","score":0.4838341772556305},{"id":"https://openalex.org/keywords/ibm","display_name":"IBM","score":0.4593423306941986},{"id":"https://openalex.org/keywords/encoding","display_name":"Encoding (memory)","score":0.4356820583343506},{"id":"https://openalex.org/keywords/natural-language-processing","display_name":"Natural language processing","score":0.43129363656044006},{"id":"https://openalex.org/keywords/perception","display_name":"Perception","score":0.425920695066452},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.39315521717071533}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8318755626678467},{"id":"https://openalex.org/C203005215","wikidata":"https://www.wikidata.org/wiki/Q79798","display_name":"Machine translation","level":2,"score":0.6587974429130554},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.6438940763473511},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.6073618531227112},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.4838341772556305},{"id":"https://openalex.org/C70388272","wikidata":"https://www.wikidata.org/wiki/Q5968558","display_name":"IBM","level":2,"score":0.4593423306941986},{"id":"https://openalex.org/C125411270","wikidata":"https://www.wikidata.org/wiki/Q18653","display_name":"Encoding (memory)","level":2,"score":0.4356820583343506},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.43129363656044006},{"id":"https://openalex.org/C26760741","wikidata":"https://www.wikidata.org/wiki/Q160402","display_name":"Perception","level":2,"score":0.425920695066452},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.39315521717071533},{"id":"https://openalex.org/C192562407","wikidata":"https://www.wikidata.org/wiki/Q228736","display_name":"Materials science","level":0,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C169760540","wikidata":"https://www.wikidata.org/wiki/Q207011","display_name":"Neuroscience","level":1,"score":0.0},{"id":"https://openalex.org/C171250308","wikidata":"https://www.wikidata.org/wiki/Q11468","display_name":"Nanotechnology","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/sp46214.2022.9833641","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46214.2022.9833641","pdf_url":null,"source":{"id":"https://openalex.org/S4363606603","display_name":"2022 IEEE Symposium on Security and Privacy (SP)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"},{"id":"pmh:oai:pure.ed.ac.uk:openaire/eae2499e-4a74-43b5-8926-c855c9eb0be2","is_oa":true,"landing_page_url":"https://www.research.ed.ac.uk/en/publications/eae2499e-4a74-43b5-8926-c855c9eb0be2","pdf_url":"https://www.research.ed.ac.uk/files/287726702/Bad_Characters_BOUCHER_DOA01052022_AFV.pdf","source":{"id":"https://openalex.org/S4306400321","display_name":"Edinburgh Research Explorer (University of Edinburgh)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I98677209","host_organization_name":"University of Edinburgh","host_organization_lineage":["https://openalex.org/I98677209"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Boucher, N, Shumailov, I, Anderson, R & Papernot, N 2022, Bad Characters: Imperceptible NLP Attacks. in Proceedings of the 43rd IEEE Symposium on Security and Privacy, SP 2022. 2022 IEEE Symposium on Security and Privacy (SP), Institute of Electrical and Electronics Engineers, pp. 1987-2004, 43rd IEEE Symposium on Security and Privacy, San Francisco, California, United States, 23/05/22. https://doi.org/DOI: 10.1109/SP46214.2022.9833641","raw_type":"contributionToPeriodical"}],"best_oa_location":{"id":"pmh:oai:pure.ed.ac.uk:openaire/eae2499e-4a74-43b5-8926-c855c9eb0be2","is_oa":true,"landing_page_url":"https://www.research.ed.ac.uk/en/publications/eae2499e-4a74-43b5-8926-c855c9eb0be2","pdf_url":"https://www.research.ed.ac.uk/files/287726702/Bad_Characters_BOUCHER_DOA01052022_AFV.pdf","source":{"id":"https://openalex.org/S4306400321","display_name":"Edinburgh Research Explorer (University of Edinburgh)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I98677209","host_organization_name":"University of Edinburgh","host_organization_lineage":["https://openalex.org/I98677209"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Boucher, N, Shumailov, I, Anderson, R & Papernot, N 2022, Bad Characters: Imperceptible NLP Attacks. in Proceedings of the 43rd IEEE Symposium on Security and Privacy, SP 2022. 2022 IEEE Symposium on Security and Privacy (SP), Institute of Electrical and Electronics Engineers, pp. 1987-2004, 43rd IEEE Symposium on Security and Privacy, San Francisco, California, United States, 23/05/22. https://doi.org/DOI: 10.1109/SP46214.2022.9833641","raw_type":"contributionToPeriodical"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1304196372","display_name":null,"funder_award_id":"Program","funder_id":"https://openalex.org/F4320334593","funder_display_name":"Natural Sciences and Engineering Research Council of Canada"},{"id":"https://openalex.org/G2165548363","display_name":null,"funder_award_id":"Canada","funder_id":"https://openalex.org/F4320334593","funder_display_name":"Natural Sciences and Engineering Research Council of Canada"},{"id":"https://openalex.org/G3033334534","display_name":null,"funder_award_id":"AI Chair","funder_id":"https://openalex.org/F4320309949","funder_display_name":"Canadian Institute for Advanced Research"},{"id":"https://openalex.org/G5784215521","display_name":null,"funder_award_id":"Chair","funder_id":"https://openalex.org/F4320334593","funder_display_name":"Natural Sciences and Engineering Research Council of Canada"}],"funders":[{"id":"https://openalex.org/F4320309949","display_name":"Canadian Institute for Advanced Research","ror":"https://ror.org/01sdtdd95"},{"id":"https://openalex.org/F4320319558","display_name":"Bosch-Forschungsstiftung","ror":null},{"id":"https://openalex.org/F4320332180","display_name":"Defense Advanced Research Projects Agency","ror":"https://ror.org/02caytj08"},{"id":"https://openalex.org/F4320334593","display_name":"Natural Sciences and Engineering Research Council of Canada","ror":"https://ror.org/01h531d29"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3176393001.pdf","grobid_xml":"https://content.openalex.org/works/W3176393001.grobid-xml"},"referenced_works_count":98,"referenced_works":["https://openalex.org/W9657784","https://openalex.org/W1501503468","https://openalex.org/W1595159159","https://openalex.org/W1673923490","https://openalex.org/W1686810756","https://openalex.org/W1753482797","https://openalex.org/W1760821052","https://openalex.org/W1816313093","https://openalex.org/W1945616565","https://openalex.org/W2001642682","https://openalex.org/W2083055907","https://openalex.org/W2099278641","https://openalex.org/W2124807415","https://openalex.org/W2130942839","https://openalex.org/W2144578941","https://openalex.org/W2148036569","https://openalex.org/W2157331557","https://openalex.org/W2162552722","https://openalex.org/W2525778437","https://openalex.org/W2582311786","https://openalex.org/W2603766943","https://openalex.org/W2740168486","https://openalex.org/W2746600820","https://openalex.org/W2766108848","https://openalex.org/W2767899794","https://openalex.org/W2773446523","https://openalex.org/W2799194071","https://openalex.org/W2891575196","https://openalex.org/W2896457183","https://openalex.org/W2905526464","https://openalex.org/W2922293812","https://openalex.org/W2933138175","https://openalex.org/W2948811271","https://openalex.org/W2949128310","https://openalex.org/W2962713901","https://openalex.org/W2962718684","https://openalex.org/W2962763344","https://openalex.org/W2962784628","https://openalex.org/W2962818281","https://openalex.org/W2962835968","https://openalex.org/W2963001247","https://openalex.org/W2963126845","https://openalex.org/W2963207607","https://openalex.org/W2963403868","https://openalex.org/W2963661177","https://openalex.org/W2963807318","https://openalex.org/W2963834268","https://openalex.org/W2963846996","https://openalex.org/W2963859254","https://openalex.org/W2964153729","https://openalex.org/W2964253222","https://openalex.org/W2964923388","https://openalex.org/W2965373594","https://openalex.org/W2970078867","https://openalex.org/W2978017171","https://openalex.org/W2979826702","https://openalex.org/W2980676478","https://openalex.org/W2982669769","https://openalex.org/W2998704965","https://openalex.org/W3034397670","https://openalex.org/W3044324512","https://openalex.org/W3046102592","https://openalex.org/W3103940881","https://openalex.org/W3105604018","https://openalex.org/W3106412272","https://openalex.org/W3170901302","https://openalex.org/W3184003609","https://openalex.org/W3213748123","https://openalex.org/W4243754476","https://openalex.org/W4247200422","https://openalex.org/W4285719527","https://openalex.org/W4319301723","https://openalex.org/W4385245566","https://openalex.org/W4394644156","https://openalex.org/W6600428322","https://openalex.org/W6629960637","https://openalex.org/W6637162671","https://openalex.org/W6637373629","https://openalex.org/W6637698695","https://openalex.org/W6637852936","https://openalex.org/W6638575559","https://openalex.org/W6640425456","https://openalex.org/W6679436768","https://openalex.org/W6680532216","https://openalex.org/W6683258052","https://openalex.org/W6684011098","https://openalex.org/W6739868092","https://openalex.org/W6739901393","https://openalex.org/W6745847742","https://openalex.org/W6746141323","https://openalex.org/W6755207826","https://openalex.org/W6763559720","https://openalex.org/W6766673545","https://openalex.org/W6768851824","https://openalex.org/W6822696232","https://openalex.org/W6863890897","https://openalex.org/W6864546407","https://openalex.org/W6898505805"],"related_works":["https://openalex.org/W2502115930","https://openalex.org/W3126131865","https://openalex.org/W2482350142","https://openalex.org/W4246396837","https://openalex.org/W3126451824","https://openalex.org/W1561927205","https://openalex.org/W3191453585","https://openalex.org/W4297672492","https://openalex.org/W4253186488","https://openalex.org/W4310988119"],"abstract_inverted_index":{"Several":[0],"years":[1],"of":[2,64,102,106,146,188,244],"research":[3],"have":[4,24,40],"shown":[5],"that":[6,67,91,122,217,230],"machine-learning":[7],"systems":[8,111,203,220,233],"are":[9,92,234],"vulnerable":[10,147],"to":[11,50,71,85,94,98,116,175,194],"adversarial":[12,45,65],"examples,":[13,46],"both":[14],"in":[15,18,75,173,204],"theory":[16],"and":[17,34,54,149,171,183,229,246],"practice.":[19],"Until":[20],"now,":[21],"such":[22,47,232],"attacks":[23,48,160,189],"primarily":[25],"targeted":[26,206],"visual":[27,83],"models,":[28,148],"exploiting":[29],"the":[30,95,100,144,212,241],"gap":[31],"between":[32],"human":[33,96],"machine":[35],"perception.":[36],"Although":[37],"text-based":[38,73,218],"models":[39,74,154,178],"also":[41],"been":[42],"attacked":[43],"with":[44,123,150],"struggled":[49],"preserve":[51],"semantic":[52],"meaning":[53],"indistinguishability.":[55],"In":[56],"this":[57],"paper,":[58],"we":[59],"explore":[60],"a":[61,76,103,124,191,205],"large":[62],"class":[63],"examples":[66],"can":[68,141,155,201],"be":[69,156],"used":[70],"attack":[72],"black-box":[77],"setting":[78],"without":[79,208],"making":[80],"any":[81,209],"human-perceptible":[82],"modification":[84],"inputs.":[86],"We":[87,120,215],"use":[88],"encoding-specific":[89],"perturbations":[90],"imperceptible":[93,126],"eye":[97],"manipulate":[99],"outputs":[101],"wide":[104],"range":[105],"Natural":[107],"Language":[108],"Processing":[109],"(NLP)":[110],"from":[112],"neural":[113],"machine-translation":[114],"pipelines":[115],"web":[117],"search":[118],"engines.":[119],"find":[121],"single":[125],"encoding":[127],"injection":[128],"\u2013":[129,138],"representing":[130],"one":[131],"invisible":[132],"character,":[133],"homoglyph,":[134],"reordering,":[135],"or":[136],"deletion":[137],"an":[139,199],"attacker":[140,200],"significantly":[142],"reduce":[143],"performance":[145],"three":[151],"injections":[152],"most":[153],"functionally":[157],"broken.":[158],"Our":[159],"work":[161],"against":[162],"currently-deployed":[163],"commercial":[164],"systems,":[165],"including":[166],"those":[167],"produced":[168],"by":[169,180],"Microsoft":[170],"Google,":[172],"addition":[174],"open":[176],"source":[177],"published":[179],"Facebook,":[181],"IBM,":[182],"HuggingFace.":[184],"This":[185],"novel":[186],"series":[187],"presents":[190],"significant":[192],"threat":[193],"many":[195],"language":[196],"processing":[197],"systems:":[198],"affect":[202],"manner":[207],"assumptions":[210],"about":[211],"underlying":[213],"model.":[214],"conclude":[216],"NLP":[219],"require":[221],"careful":[222],"input":[223],"sanitization,":[224],"just":[225],"like":[226],"conventional":[227],"applications,":[228],"given":[231],"now":[235],"being":[236],"deployed":[237],"rapidly":[238],"at":[239],"scale,":[240],"urgent":[242],"attention":[243],"architects":[245],"operators":[247],"is":[248],"required.":[249]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":24},{"year":2024,"cited_by_count":17},{"year":2023,"cited_by_count":28},{"year":2022,"cited_by_count":8},{"year":2021,"cited_by_count":4}],"updated_date":"2026-04-12T07:58:50.170612","created_date":"2025-10-10T00:00:00"}