Evading Toxicity Detection with ASCII -art: A Benchmark of Spatial Attacks on Moderation Systems (2025)

Abstract: We introduce a novel class of adversarial attacks on toxicity detection models that exploit language models’ failure to interpret spatially structured text in the form of ASCII art. To evaluate the effectiveness of these attacks, we propose ToxASCII, a benchmark designed to assess the robustness of toxicity detection systems against visually obfuscated inputs. Our attacks achieve a perfect Attack Success Rate (ASR) across a diverse set of state-of-the-art large language models and dedicated moderation tools, revealing a significant vulnerability in current text-only moderation systems.

## introduction humans possess a remarkable ability to recognise patterns. we effortlessly read stylised text in various fonts, scripts, and spatial arrangements, even inferring meaning or intent from formatting choices. in contrast, large language models (llms) and other toxicity detection systems primarily focus on semantic and syntactic properties of text, overlooking its spatial structure. while some llms can process formatting cues (e.g., bold or italic markdown notation), they do not consider spatial arrangement as part of meaning. this creates a critical vulnerability: malicious actors can exploit the disjuncture between human visual perception and machine text processing by weaponising spatial text arrangements -using characters and words as graphical elements rather than semantic units. numerous online communities provide evidence of users leveraging ascii art to convey offensive content in a visually obfuscated manner @xcite . in this paper, we introduce ascii art as a previously underexplored adversarial attack vector against toxicity detection systems. we propose toxascii, a benchmark specifically designed to evaluate model robustness against ascii-encoded toxic content. we further develop two custom attack strategies: a token-based font that embeds toxic phrases using special tokens from model tokenisers, and a word-filled font that hides toxic content within the visual form of large ascii letters. through a comprehensive evaluation across both llms and dedicated moderation models, we show that these attacks are highly effective, achieving 100% attack success rate. these findings expose a systemic weakness in current toxicity detection pipelines and emphasise the need for multimodal moderation approaches that can integrate both textual and visual signals. ## related work although toxicity detection is a well-established task, the term "toxicity" lacks a universally accepted definition @xcite . one of the most widely used definitions is provided by @xcite , who describe toxicity as "rude, disrespectful, or unreasonable language that is likely to make someone leave a discussion". this formulation underpins many real-world moderation systems, including @xcite . numerous studies have demonstrated that toxicity detection systems can be circumvented through adversarial inputs. traditional attacks include: ascii art presents unique challenges for nlp models. tokenisation methods like bpe @xcite and wordpiece @xcite fragment spatial patterns, disrupting coherence and leading to ineffective downstream representations. transformer-based models, optimised for sequential dependencies, have difficulty capturing asciiart's layout, as their self-attention mechanisms primarily model linear token relationships rather than spatial ones @xcite . a related study, artprompt by @xcite , uses ascii art to jailbreak llms by embedding harmful content in fixed ascii fonts and instructing the model to decode it through step-by-step prompts. in contrast, our approach inverts this setup: we use free-form ascii art to evade detection, not to elicit output. artprompt represents a form of task-in-prompt adversarial attack @xcite , while our work focuses on detection-avoidance attacks in fully automated, non-cooperative settings. finally, our attacks are grounded in real-world misuse patterns. online communities such as steam and reddit regularly employ ascii art to bypass moderation filters @xcite . our work reflects this behaviour and systematically evaluates how modern moderation models fail to detect toxic content when it is encoded spatially. ## conclusion we present ascii art as a novel and effective adversarial attack vector against modern toxicity detection systems. unlike prior work focused on semantic or lexical manipulation, our attacks exploit a spatial blind spot -targeting the mismatch between human visual interpretation and machine token-based processing. through the toxascii benchmark and two custom attack variants, we demonstrate that both large language models and dedicated moderation tools consistently fail to detect harmful content when it is rendered in spatial form. our attacks achieve 100% success rates across a wide range of models, highlighting a systemic vulnerability in current text-only moderation pipelines. to address this blind spot, we advocate for multimodal moderation strategies that incorporate both textual and visual reasoning. we also encourage the community to adopt ascii-based robustness benchmarks when evaluating moderation models, as spatial adversarial attacks reflect real-world tactics used to evade filters. ultimately, our work underscores the need to see text not just as tokens -but as visual objects shaped by structure and layout.