When Vision Fails: Text Attacks Against ViT and OCR

Understand

Text-based machine learning models are vulnerable to an emerging class of Unicode-based adversarial examples capable of tricking a model into misreading text with potentially disastrous effects.

• The primary existing defense against these attacks is to preprocess potentially malicious text inputs using optical character recognition (OCR).
• In theory, OCR models will ignore any malicious Unicode characters and will extract the visually correct input to be fed to the model.
• In this work, we show that these visual defenses fail to prevent this type of attack.