Hidden in Plain Sight: Advancing Harmful Content Understanding via Perception-Aware Adversarial Self-Play

Yisong Xiao; Benlei Cui; Haiwen Hong; Shiji Zhao; Zonghao Ying; Yaoyuan Zhang; Longtao Huang; Aishan Liu

cs.AIOct 11, 2026

Hidden in Plain Sight: Advancing Harmful Content Understanding via Perception-Aware Adversarial Self-Play

Authors: Yisong Xiao, Benlei Cui, Haiwen Hong, Shiji Zhao, Zonghao Ying, Yaoyuan Zhang, Longtao Huang, Aishan Liu,

Organizations: SKLCCSE, Beihang University · Yuvion Team, Alibaba Group

Abstract

Despite significant advances in language understanding, Large Language Models (LLMs) can still miss meaning hidden in plain sight, failing to identify harmful intent in expressions readily understood by humans. Malicious users exploit this gap by strategically disguising harmful content to evade automated moderation, posing a serious threat to online platform safety. The vulnerability reflects a fundamental cognitive asymmetry between human readers, who integrate contextual, phonetic, and visual cues to decipher the intent behind deliberate obfuscation, and text-based LLMs, which rely primarily on token sequences and have limited exposure to evolving evasions. To bridge this asymmetry, we propose PASP (Perception-Aware Adversarial Self-Play), which combines multi-perceptual views with adversarial self-play to improve understanding of harmful intent as evasions evolve. Specifically, PASP constructs textual, phonetic, and visual views of each input, preserving its original context while exposing pronunciation and glyph cues obscured in token space. During adversarial self-play, an attacker uses defender feedback to generate intent-preserving evasions, while the defender is trained using an intent-invariance reward to understand harmful intent across changing surface forms. Extensive experiments show that PASP reduces adaptive attack success rates by up to 73.71% and 74.49% on ChineseHarm-Bench and EvoHarmBench, respectively, preserves model capabilities with minimal degradation, and effectively interprets real-world evasive expressions in e-commerce.

Figures & tables

Figure 1: Human–LLM cognitive asymmetry: Cyrillic glyph, emoji, and phonetic substitutions hide sexual intent from the LLM but not humans.

Figure 2: Overview of PASP. The attacker combines strategies from a library and uses defender feedback to generate adversarial expressions preserving harmful intent. The defender integrates textual, phonetic, and visual cues to understand intent and is optimized through intent-invariant learning. Their interaction exposes blind spots and improves robustness to evolving evasions.

Method	ChineseHarm-Bench							EvoHarmBench
Method	Gambling	Porn.	Abuse	Fraud	Illicit Ads	Benign	Macro-F1	Porn.	Traffic Div.	Abuse	Gamb.&Fraud	Benign	Macro-F1
Qwen3.5-9B	85.19	74.39	70.51	40.57	67.30	82.43	70.07	53.50	43.67	84.08	84.41	57.75	64.68
+ SFT	88.13	80.08	81.40	70.08	76.37	86.41	80.41	91.22	88.34	91.08	91.66	77.94	88.05
+ Off. A.T.	88.76	78.37	81.10	76.89	76.26	79.70	80.18	90.51	84.01	91.29	92.61	78.85	87.45
+ PICL	85.77	72.84	82.29	77.79	80.25	88.09	81.17	90.27	87.11	90.07	90.83	79.30	87.52
+ PASP	87.79	81.34	85.97	73.52	79.04	88.23	82.65	90.94	87.48	91.45	90.21	82.49	88.51

Table 1: Category-wise F1 and Macro-F1 (%) on ChineseHarm-Bench and EvoHarmBench. The best and second-best results are shown in bold and underlined , respectively.

Method	ChineseHarm-Bench (ASR $\downarrow$ )						EvoHarmBench (ASR $\downarrow$ )
Method	Gambling	Porn.	Abuse	Fraud	Illicit Ads	Avg.	Porn.	Traffic Div.	Abuse	Gamb.&Fraud	Avg.
Qwen3.5-9B	64.44	57.03	76.60	96.00	46.05	68.02	94.59	90.91	67.12	53.01	76.41
+ SFT	21.74	50.63	72.60	76.67	38.89	52.11	54.19	59.56	27.57	38.41	44.93
+ Off. A.T.	24.73	44.44	61.23	41.67	34.67	41.35	22.73	51.35	31.18	36.56	35.46
+ PICL	13.68	30.12	43.65	34.72	20.78	28.59	18.77	42.78	18.95	22.99	25.87
+ PASP	4.35	13.04	35.53	23.29	5.63	16.37	6.38	23.53	4.17	11.76	11.46

Table 2: Category-wise ASR (%) under adaptive evaluation on ChineseHarm-Bench and EvoHarmBench. The best and second-best results are shown in bold and underlined , respectively.

Method	Qwen3.5-9B		GLM-4.6V-Flash
Method	Chi.Harm	EvoHarm	Chi.Harm	EvoHarm
Base	3.37	1.05	1.01	0.00
SFT	1.00	7.89	2.00	5.88
Off. A.T.	1.02	6.74	1.02	7.69
PICL	1.05	9.18	2.04	4.65
PASP	1.11	8.14	1.01	8.05

Table 3: FPR (%) on rewritten benign inputs.

Method	Qwen3.5-9B					GLM-4.6V-Flash
Method	HellaSwag	ARC-C	MMLU	CMMLU	Avg.	HellaSwag	ARC-C	MMLU	CMMLU	Avg.
Base	88.69	94.97	85.79	85.35	88.70	84.62	92.58	79.26	77.70	83.54
+ SFT	88.19	94.28	85.51	84.80	88.20	85.63	91.98	79.12	77.35	83.52
+ Off. A.T.	88.03	94.54	85.10	83.75	87.86	86.29	92.24	78.73	76.80	83.52
+ PICL	88.22	94.62	84.83	83.50	87.79	85.42	92.41	77.78	76.00	82.90
+ PASP	88.30	94.62	85.28	84.35	88.14	86.41	92.41	78.90	77.00	83.68

Table 4: Capability evaluation results of different methods. The best and second-best results among trained variants are shown in bold and underlined , respectively.

Configuration	Porn.	Traffic Div.	Abuse	Gamb.&Fraud	Avg.
SFT	54.19	59.56	27.57	38.41	44.93
PA + SFT	46.88	55.43	26.79	32.00	40.28
PA + offline AT	19.44	49.40	32.32	27.24	32.10
online AT	9.53	27.79	15.22	17.90	17.61
PASP	6.38	23.53	4.17	11.76	11.46

Table 5: Ablation results measured by ASR (%). PA denotes perception-aware inputs using multi-perceptual views; AT denotes adversarial training.

Panel of Figure 6 — Figure 6: Examples of adversarial expressions and real-world e-commerce content.

Task	Metric	Base	SFT	Off. A.T.	PICL	PASP
Marketplace	Recall (%)	54.49	63.64	65.00	65.11	70.33
Marketplace	F1 (%)	69.18	74.53	75.93	76.17	79.33
Brand variants	Mean score	2.25	2.33	2.34	2.27	2.44
Brand variants	Score $\geq 4$ (%)	14.40	13.50	15.40	14.70	21.20

Table 6: In-the-wild results. Higher is better.

Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

Family	ID	Evasion operation
Surface form	FORM-001	Replace characters with homophones, similar glyphs, Pinyin, or abbreviations.
	FORM-002	Separate characters or phrases with recoverable delimiters.
	FORM-004	Reorder characters or words while retaining recoverable meaning.
	FORM-005	Express key terms through cross-language or mixed-language forms.
	FORM-006	Encode a message in line-initial characters.
	FORM-007	Split entities into fragments embedded in structured carriers.

Appendix

Table 7: Base strategies in the attack library.

Setting	Value
Sampled responses per input	$G=4$
Harmful-to-benign sampling ratio	$1:1$
Intent / audit / format reward weights	$0.60/0.35/0.05$
LoRA rank	64
Learning rate	$10^{-5}\rightarrow 10^{-6}$ (linear decay)
KL coefficient $\beta$	$0.01$

Appendix

Table 8: Defender training settings for PASP .

Benchmark	Judge	Human valid	Human invalid
ChineseHarm-Bench	Valid	184	66
ChineseHarm-Bench	Invalid	97	153
EvoHarmBench	Valid	213	37
EvoHarmBench	Invalid	88	162

Appendix

Table 9: Human validation of the LLM judge.

LLM Safety

Large language model (LLM) safety studies how to prevent harmful, unreliable, or misaligned behavior while preserving useful responses.

See all 426 papers

What the Eyes See, the LLMs Miss: Exploiting Human Perception for Adversarial Text Attacks
Jun 8, 2026Qin Yang, Lu Malloy, Joshua Lee +4Language Model Safety Evaluation Black-Box Adversarial Attacks
University of Connecticut · University of Tennessee · University of California, Santa Barbara +1
Making MLLMs Blind: Adversarial Smuggling Attacks in MLLM Content Moderation
Apr 8, 2026Zhiheng Li, Zongyang Ma, Yuntong Pan +8Multimodal Content Moderation Adversarial Attacks on VLMs
State Key Laboratory of Multimodal Artificial Intelligence Systems, CASIA · School of Artificial Intelligence, University of Chinese Academy of Sciences · Beijing Key Laboratory of Super Intelligent Security of Multi-Modal Information +4
EvoHarmBench: Breaking Content Moderation with Iterative Human-Like Evasion
Aug 28, 2026Ruijie Jian, Benlei Cui, Ting Ma +8Language Model Safety Evaluation LLM Safety Benchmarks
Yuvion Team, Alibaba Group · University of Chinese Academy of Sciences

Jun 8, 2026J/K move · Enter open · S save

What the Eyes See, the LLMs Miss: Exploiting Human Perception for Adversarial Text Attacks

Qin Yang, Lu Malloy, Joshua Lee, Xiaohan Chang+3

University of Connecticut · University of Tennessee · University of California, Santa Barbara+1

Language Model Safety Evaluation Black-Box Adversarial Attacks Adversarial Text Attacks

Open paper AskPDF arXiv

Large language model (LLM)-powered content moderation systems are a critical defense against harmful online content. However, they operate primarily on tokenized text and often overlook visual cues that humans naturally use when interpreting content. We show that this limitation creates a fundamental vulnerability: content readily recognized as harmful by humans can evade automated moderation. To systematically study this problem, we introduce Human-Perceptible Adversarial Attacks (HPAA), which embed harmful expressions into otherwise benign text using visually salient typographic manipulations. HPAA strategically combines features such as spacing, emphasis, and spatial arrangement to preserve human recognition while reducing machine detectability. Operating in a black-box setting with a small query budget, the attack automatically generates evasive content without model access or gradient information. We evaluate HPAA on multiple datasets and thirteen widely deployed moderation systems, including commercial APIs and state-of-the-art open-source guardrails. With only three detector queries, generated attacks achieve over 86% human recognition while keeping detection rates below 1% across evaluated systems. We further identify the typographic factors driving successful evasion, analyze why current moderation architectures fail to capture these signals, and discuss practical defenses. Our findings reveal a fundamental blind spot in current LLM-based moderation systems and motivate moderation approaches that better align with human perceptual understanding.

Abstract

LLM Safety

Explore similar work

What the Eyes See, the LLMs Miss: Exploiting Human Perception for Adversarial Text Attacks

Making MLLMs Blind: Adversarial Smuggling Attacks in MLLM Content Moderation

EvoHarmBench: Breaking Content Moderation with Iterative Human-Like Evasion