Conference Open access

TinyAttack: Exploring Stylistic Vulnerabilities in Large Language Models

M. Mamta B. Grecu O. Cocarascu

2026 · Annual Meeting of the Association for Computational Linguistics · pp. 39933-39962 · 0 citations · 43 references

Computer Science

TL;DR

This work proposes TinyAttack, a novel adversarial attack framework designed to exploit vulnerabilities in LLMs through Unicode-based stylistic transformations, which utilises five Unicode variants to modify the visual rendering of text without altering its underlying semantic or syntactic structure.

Abstract

Large Language Models (LLMs) have demonstrated impressive results in natural language processing (NLP) tasks, however, their brittle-ness against subtle input perturbations continues to pose a significant challenge. Existing research on robustness has predominantly focused on standard text-based perturbations and the use of invisible characters and homoglyphs, while overlooking the impact of stylized characters increasingly prevalent on social media. To address this, we propose TinyAttack , a novel adversarial attack framework designed to exploit vulnerabilities in LLMs through Unicode-based stylistic transformations. TinyAttack utilises five Unicode variants to modify the visual rendering of text without altering its underlying semantic or syntactic structure. Our comprehensive evaluation on both open-source (Llama, Mistral, Gemma, Qwen) and closed-source LLMs (Gemini, GPT) demonstrates their susceptibility to these stylized inputs, with performance drops ranging from 29-92% and 6-88.5%, respectively, across all tasks. Our code is available at https://github.com/ TRAI-group/TinyAttack .

DOI Semantic Scholar

Read PDF

Similar papers

Open access Jul 2026

Beyond The Surface: Characterizing Adversarial Boundaries in Synthetic Text Attribution Across Heterogeneous Domains

A hybrid detection framework which combines semantically deep embeddings from the RoBERTa transformer with a set of carefully designed language statistics and linguistic statistics and shows excellent resistance to the surface-level adversarial paraphrasing strategy.

Anita Rani, Suman · International Journal of Sci... · 0 citations

Sep 2026

IC-GCG: Jailbreaking Large Language Models via Intermediate Consistency Optimization

Recent jailbreak attacks demonstrate that large language models (LLMs) can be manipulated to generate harmful outputs through adversarial prompts even after robust alignment. However, prevailing methods typically focus on forcing a desired response at the output layer—a surface-level strategy that is brittle and often...

Zichu Ren, Donghai Zhu, Haibo Hong et al. · IEEE Internet of Things Jour... · 0 citations

Preprint Jul 2026

TextCloak: Thwarting Unauthorized LLM Exploitation via RL-Driven Unlearnable Text

Comprehensive experiments demonstrate that TextCloak consistently impairs unauthorized fine-tuning while maintaining text utility for legitimate use, highlighting its broad applicability as a practical defense against unauthorized LLM exploitation.

Chengshuai Zhao, Pingchuan Ma, Dawei Li et al. · 0 citations

Preprint Jul 2026

The Effect of Multi-Lingual and Keyword Adversarial Injection on LLM Relevance Judgment

This work investigates the impact of cross-lingual prompt injection attacks on LLM-based relevance judgments using TREC Deep Learning collections and two open-weight models under established prompting frameworks, and demonstrates that multilingual query-based injections are highly effective in inflating relevance score...

Nguyen-Thanh-Thao Vo, Duy Duong Tuong, Oleg Zendel et al. · 0 citations

Conference Open access 2026

NaturalSloth: Revisiting Denial-of-Service Attacks on Large Language Models

This work introduces NaturalSloth, an adversarial dataset of natural, instruction-based DoS prompts, and designs a multi-agent synthesis framework to scale the dataset while preserving malicious intent and increasing semantic diversity.

Yiming Chen, Zexin Li, Xianghu Yue et al. · Annual Meeting of the Associ... · 0 citations

2026

Random Character-Level Perturbations Amplify LLM Jailbreak Attacks

This work finds that models cannot reliably reconstruct the original meaning and layer-wise probe classifiers fail to detect the harmful intent of perturbed prompts, and perturbations can occasionally reduce attack success by inducing off-topic or incoherent responses.

Shuyi Yu, Zhe Cao, Kohei Tsuji et al. · Trans. Mach. Learn. Res. · 1 citation