The Lies Characters Tell: Utilizing Large Language Models to Normalize Adversarial U nicode Perturbations (2025)

Abstract: Homoglyphs, Unicode characters that are visually homogeneous to Latin letters, are widely used to mask offensive content. Dynamic strategies are needed to combat homoglyphs as the Unicode library is ever-expanding and new substitution possibilities for Latin letters continuously emerge. The present study investigated two novel mitigation approaches that do not rely on strict mappings but instead harness the power of large language models to neutralize both known and unknown homoglyphs: (1) indirectly normalizing homoglyphs by replacing non-Latin characters with a delimiter and prompting large language models to “fill in the blanks” and (2) directly normalizing homoglyphs by using large language models to determine which characters should be replaced with Latin letters. We found that GPT-4o-mini constructed normalized text with an average cosine similarity score of 0.91 to the original tweets when applying our indirect method and 0.96 to the original tweets when applying our direct method. This study indicates that large language model-based normalization techniques can effectively unmask offensive content concealed by homoglyphs. Code and data are available in our GitHub repository: https://github.com/pcoopercoder/The-Lies-Characters-Tell.

## introduction a significant subset of unicode characters are visually similar to latin letters but possess disjointed symbolic and linguistic meanings. for example, the latin "a" and the cyrillic "а" appear visually homogeneous, but their underlying unicode code points, u+0061 and u+0430, are not equivalent. these look-alike characters are referred to as homoglyphs and present significant challenges for modern content detection models. hate speech infused with homoglyphs lowered the f1 scores of transformer-based content detection models by 56% on the offensive tweets with homoglyphs (oth) dataset @xcite . additionally, our analysis of the oth dataset indicated that the set of characters from which progenitors of online offensive text draw homoglyphs grew each year from 2009 to 2022 (figure 1 ). while several existing normalization tools and methods exist, the use of large language models for the mitigation of homoglyphs has not been explored in detail. we present two novel methods to normalize homoglyphs. specifically, the key contributions of our work include: ## related work previous work has demonstrated the effectiveness of homoglyph obfuscation. @xcite used homoglyphs and other perturbations to expose vulnerabilities in models published by facebook, ibm, and hugging face. additionally, @xcite and valle aguilera et al. (2024) explored the use of homoglyphs inserted in misinformation to avoid detection. and @xcite demonstrated that ai-generated text infused with homoglyphs avoided detection by content filters. these prior studies tested the effectiveness of homoglyphs as an adversarial strategy. conversely, the present study investigated solutions to mitigate the malicious effects of homoglyphs. the detection of homoglyphs has been studied in the context of domain spoofing and cyber security attacks. @xcite created a tool for detecting homoglyph phishing attempts by using a hash function and a machine learning model. @xcite and @xcite explored the use of convolutional neural networks to combat the usage of homoglyph characters in web domains. in addition, @xcite utilized hit-zone maps for predicting homoglyph characters. unlike the previous studies, we focused on normalizing adversarial homoglyphs in offensive text. @xcite trained and evaluated transformer hate speech detection models on real-world offensive tweets with homoglyphs. and @xcite created the anthro dataset which captured over 600,000 examples of real world text perturbations and trained transformer models to detect toxic content containing homoglyphs. @xcite experimented with training models on data with synthetically generated perturbations for content detection and proposed a contextual denoising autoencoder method robust against homoglyphs. unlike prior work, the present study proposed normalization as a pre-processing strategy and evaluated both normalization and downstream task quality. ## approach to ensure access to fully normalized variants when deriving our normalization methods, we augmented an existing corpus of hate and non-hate speech tweets with real-world homoglyph patterns. the tweets from the original data were used as a homoglyph-free baseline. ## discussion for both gpt and llama, direct normalization, in which llms determined which characters should be replaced with latin letters, produced the highest quality outputs. on the homoglyph-augmented tweets, gpt's average cosine similarity scores were 0.05 higher for the direct normalizations. similarly, llama had a delta of 0.08 between the direct and indirect normalizations. this result is notable as it indicates that the llms possessed both an understanding of what homoglyphs were and which latin letters the homoglyphs had replaced. we reason that indirect normalization was a more difficult task for the models, as 172 of the identified mappings derived from the oth dataset sample were fully composed of homoglyphs. while training on the unnormalized, homoglyphed data granted all four hate speech detection models a significant performance boost (this aligns with the findings of @xcite , the models' performance on gpt direct normalizations was nearly identical to that on the human normalizations for both zeroshot and five-fold cross-validation. this feature is useful when large amounts of domain-specific annotated homoglyphed training data do not exist since high-quality normalizations can be produced by llms with 10 input examples. future work is needed to determine the effectiveness of the proposed normalization methods on unicode perturbations which extend past homoglyph substitutions for the latin letters. specifically, additional studies may consider the evaluation of llm-based homoglyph normalization on datasets such as anthro. further, little research currently exists which focuses on the normalization of homoglyphs of punctuation characters. future work may include the evaluation of llm-based normalization on perturbations of this type. ## conclusion the homoglyph normalization tools of the future should not rely on rigid mappings or statically learned data. as expected, hate speech detection models performed best on human normalized text, but normalization of this type is untenable for many applications. we show that by harnessing the power of large language models, robust indirect and direct techniques for combating homoglyphs are possible.