Different AI tools such as ChatGPT, Gemini, and Claude are becoming very popular. Although they are helpful for many day-to-day tasks, they can be used in unexpected ways. For example, the learning objectives of a course may not be achieved if students use these tools to solve their homework problems. This paper proposes a simple method to address this issue in the lazy student model. The method uses homoglyph-based adversarial perturbation to first modify the question without changing the semantic meaning of the question. Then a few characters are perturbed by their homoglyphs. Our experimental result shows the theoretical problems of introductory computer science courses can be effectively perturbed. We also propose an interactive tool to conveniently use our method.
Figures & tables
Figure 1: Despite the fact that several parts of the question are perturbed, as shown in this figure, most popular LLMs, including ChatGPT and Gemini, can answer the question without any difficulty. This observation indicates the robustness of modern LLMs.
Figure 2: A common type of response from popular LLM models, including ChatGPT and Gemini, indicating the biases of the models towards the pretrained dataset. An important adjective “rational” is missing in the prompt and the model easily adds back the missing word since it is familiar with the question from the training dataset. This observation is later used in our method.
Figure 3: Illustrating possible modifications of a question without changing the semantic meaning. The first prompt is the original questions. The variables x and y are introduced in the second prompt without changing the semantic meaning. The third prompt is slightly different: 7x is used instead of x .
Figure 4: Illustrating different homoglyphs of the numeric character “7”. Some homoglyphs are readable by humans and others are not.
Figure 5: Illustrating the unrecognizability of a homoglyph of numeric character “7”. This particular example is a response from Gemini.
Figure 6: Illustrating an example where we added a perturbation of “7” as the coefficient of “x”. The model does not recognize the perturbed character and uses “x” instead of “7x” since it has seen the usage of “x” in this context in the dataset based on which the model is trained on. This particular example is a response from GhatGPT.
Figure 7: Illustrating the distribution of the number of characters across the 164 questions considered.
Figure 8: Illustrating the distribution of the number of attempts to fool the models across the 164 questions considered.
Figure 9: Illustrating the distribution of the number of perturbed characters to fool the models across the 164 questions considered.
Figure 10: Illustrating the unrecognizability of a homoglyph of numeric character “6”. This particular example is a response from Gemini.
Figure 11: Illustrating the observation that the more perturbations can become less effective. Here we perturb four characters, all of them are homoglyphs of “7”. Although the model considered the homoglyph as π , however, it can now take that as a common factor and do the rest of the analysis, see Figure 12 where we can fool the model by just perturbing one character. This particular example is a response from ChatGPT.
Figure 12: Illustrating the observation that less perturbations can become more effective. Here we perturb only one character, it is the homoglyphs of “7”. The model considered the homoglyph as 1 , and solved a different problem. This particular example is a response from ChatGPT.
Figure 13: Illustrating the observation that not always perturbing numeric characters are effective; in this question the numeric character “7” just represents a symbol. To effectively perturb we need to select characters that are involved with arithmetic, see Figure 14 . This particular example is a response from ChatGPT.
Figure 14: Illustrating the observation that perturbing numeric characters are effective. In this question we perturb the numeric character “7” which is involved with arithmetic. This particular example is a response from ChatGPT.