PHISH in MESH: Korean Adversarial Phonetic Substitution and Phonetic-Semantic Feature Integration Defense

Bugeun Kim; Byungjun Kim; Hyeonchu Park; Minju Kim

REVIEW 3 major objections 4 minor 26 references

PHISH in MESH: Korean Adversarial Phonetic Substitution and Phonetic-Semantic Feature Integration Defense

T0 review · 3 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that jamo-level phonetic substitution degrades Korean hate speech detectors, and that MESH, which fuses phoneme sequences through cross-attention, restores and even improves detection on perturbed and original text.

desk verdict PHISH is a solid, well-tested Korean attack; MESH's defense claim is overstated because a missing control plus their own KCBERT/dir-MESH numbers don't support 'consistently outperformed.' read the letter →

arxiv 2505.21380 v1 pith:NMHE4L2F submitted 2025-05-27 cs.CL

Byungjun Kim , Minju Kim , Hyeonchu Park , Bugeun Kim This is my paper

classification cs.CL

keywords KoreanhatespeechdetectionphoneticsubstitutionattackjamoHangulphonologycross-attentiondefenseadversarialrobustnessphonemesequence

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that phonetic substitution is an under-exploited and realistic way to slip offensive Korean text past hate speech detectors, and that detectors can be made substantially more resilient by feeding them phoneme information alongside the written text. To show the attack is real, it introduces PHISH, which swaps individual Hangul components (jamo) with phonetically similar ones using an IPA-based look-up table, and shows that this measurably degrades three Korean BERT-family detectors on two hate speech datasets. To show the defense works, it introduces MESH, a cross-attention module that merges the text's semantic representation with a phoneme sequence, and reports that both variants outperform their base models on perturbed and original test sets alike. The practical upshot, if the results hold, is that Korean hate speech filters can be hardened without collecting new perturbed training data.

What carries the argument

The load-bearing pieces are (1) a look-up table $D$ that maps each Hangul jamo (the consonant and vowel components of a syllable block) to a set of phonetically similar alternatives, built from IPA base phones for onsets and nuclei and from Korean standard pronunciation rules for codas, and (2) a cross-attention mechanism that merges the token representation of the text with an embedded phoneme sequence: seq-MESH adds one cross-attention layer per encoder block, while dir-MESH replaces self-attention with cross-attention. The table makes PHISH produce pronounceable, human-readable substitutions that still break tokenizer expectations; the cross-attention lets the detector consult phonological information to recover from the resulting semantic distortion.

What would settle it

Take the best MESH model (for example, KCBERT with seq-MESH), replace the phoneme sequence with a randomly permuted or plain character-level sequence of equal length, retrain under the same protocol, and compare F1 on the PHISH-perturbed test sets; if the gain over the base detector largely survives, the phonetic content of the sequence is not the load-bearing factor.

Watch

Extended reading notes

Core claim

The central discovery is that jamo-level phonetic perturbation, grounded in the phonological structure of Hangul, is an effective attack against current Korean hate speech detectors, and that the same phonological information can be used architecturally to defend against it. PHISH's look-up table groups onset, nucleus, and coda jamo by shared articulation features and by Korean standard pronunciation rules, so a perturbed syllable remains pronounceable and readable while producing unknown tokens and semantic drift that degrade F1. MESH counters this by embedding a phoneme sequence of the text and letting it interact with the token representation through cross-attention: seq-MESH adds a cross-attention layer inside each encoder block, and dir-MESH replaces self-attention with cross-attention. On K-HATERS and KoLD, the paper reports that MESH-equipped models outperform their base counterparts in the large majority of settings, with the gap widening as the perturbation ratio or the number of swapped jamo increases, and that KCBERT with seq-MESH reaches 81.4% F1 on the unperturbed KoLD test set, 3.9 points above its base model.

Load-bearing premise

The improvements attributed to phonetic information are not separated from the effect of simply adding cross-attention layers or parameters; if a random sequence achieves the same gains, the phonetic mechanism is not doing the work.

Editorial extensions

If this is right

If MESH's gains hold, Korean hate speech detectors can be made more resilient to phonetic substitution without any new perturbed training data, since the models are trained only on the original training sets.
On the unperturbed test sets, MESH's improvement over base models implies that naturally occurring Korean text already contains phonetic perturbations that current tokenizers mishandle, making the defense relevant beyond synthetic attacks.
The widening advantage at higher attack ratios and dual-jamo swaps suggests the defense is especially valuable against exactly the perturbations that most degrade current detectors.
Because MESH initializes cross-attention weights from pretrained checkpoints, existing Korean BERT-family detectors can be upgraded rather than retrained from scratch.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A direct ablation replacing the phoneme sequence with a random or character-level sequence of the same length would test whether the phonetic content, rather than the extra cross-attention parameters, drives the reported improvements.
The look-up table design could plausibly transfer to other shallow-orthography writing systems, though PHISH's own limitation states that it assumes readers can infer the original from the perturbed form.
The unknown-token statistics in Appendix B suggest MESH works partly by compensating for tokenizer failure; a test on deliberately misspelled but non-phonetic text would reveal how much of the gain is tokenization repair versus phonological recovery.
If the gains on original test sets reflect real-world phonetic substitution, the same cross-attention approach could benefit other Korean text-classification tasks vulnerable to character-level noise.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The attack is the real contribution here. PHISH is a genuinely new jamo-level phonetic substitution for Korean, grounded in Hangul structure and standard pronunciation rules, and it degrades all three base detectors across two datasets with sensible monotonicity. The unknown-token statistics in Appendix B back the proposed mechanism, which gives the attack independent plausibility beyond the F1 drops. I would trust that part of the paper.

MESH is a reasonable architectural idea—cross-attention with a phoneme sequence—but the defense claim is softer than the paper presents. The central sentence in Section 5, that seq-MESH and dir-MESH "consistently outperformed their base counterparts," is simply false for dir-MESH: in Tables 1 and 3, KCBERT dir-MESH is numerically below KCBERT at 10% and 20% attack ratios, and the differences are within one standard deviation anyway. What actually holds is that seq-MESH consistently helps on these test sets. That is a meaningful but narrower result.

The bigger issue is attribution. seq-MESH adds a cross-attention layer per block; dir-MESH adds a separate phoneme embedding and changes the attention key/value source. Neither is compared with a non-phonetic control, such as a random jamo sequence or the original text as key/value. So the gains on original and perturbed sets—including the "real-world alignment" inference—are compatible with added capacity or a different inductive bias rather than phonetic content specifically. The lack of significance tests makes this worse, since some reported gaps are within the reported standard deviations.

The real-world claim in Section 5 is an overreach. Improvement on the original test set could come from many things; concluding that phonetic substitution is present in real-world data needs more than one model family showing a gain. That should be softened to a hypothesis.

These are fixable. An ablation with a non-phonetic auxiliary sequence, a corrected consistency statement, and significance tests would firm the defense up. The attack itself is in good shape, and the dataset-side contribution—no curated perturbed training data needed—is useful for the Korean hate speech robustness community.

I'd send this to peer review. The attack is novel and the defense, even if overclaimed, is a legitimate architectural direction worth referee attention. The authors will need to do one solid ablation round, but the work is on the right track.

For your reading group, it's a maybe—the attack section is a clean case study in language-specific adversarial methods, and the MESH discussion is a good teaching example of a confounded architecture comparison.

Referee Report

3 major / 4 minor

Summary. The paper proposes two contributions for Korean hate speech detection: (1) PHISH, a jamo-level phonetic substitution attack that replaces one or two jamos per syllable with phonetically similar Hangul alternatives using an IPA-based look-up table; and (2) MESH, presented as seq-MESH and dir-MESH, architectural defenses that inject phoneme sequences into transformer encoders via cross-attention layers. The authors evaluate base models and MESH variants on K-HATERS and KoLD under PHISH perturbations at 10/20/30% attack ratios and single/dual-jamo degrees, reporting F1 means and standard deviations over ten seeds. They conclude that PHISH degrades base detectors, that MESH variants improve robustness, and that improvements on original test sets indicate alignment with real-world phonetic substitution.

Significance. The attack contribution is concrete and reasonably well supported: PHISH is language-specific, uses a hand-crafted table based on Korean phonology, and the degradation pattern across attack ratios, together with the unknown-token statistics in Appendix B, gives a plausible mechanism. The defense idea is also worth pursuing, since an architectural defense that does not require attack-specific fine-tuning data would be a useful alternative to dataset-level defenses. The paper reports ten-seed runs with standard deviations and evaluates on two public datasets, which is a strength. However, the central claim that MESH's gains are due to phonetic information is not currently established because no non-phonetic control is tested, and the claim that MESH 'consistently outperformed' base models is contradicted by the paper's own tables. If the control ablation confirms the specific contribution of phonetic content, the paper would be a solid contribution; as written, the defense attribution is under-supported.

major comments (3)

[Section 5, Tables 1-4] The statement that 'detectors equipped with seq-MESH or dir-MESH consistently outperformed their base counterparts' is contradicted by the reported numbers. In Table 1 (K-HATERS, single-jamo attack), KCBERTdir-MESH is below KCBERT at every attack ratio: 75.5 vs 75.7 at 10%, 74.2 vs 74.8 at 20%, and 73.2 vs 73.4 at 30%. In Table 3 (K-HATERS, dual-jamo attack), KCBERTdir-MESH is below KCBERT at 10% (74.9 vs 75.1) and at 20% (72.4 vs 72.5). No significance tests are reported, and several differences are smaller than the corresponding standard deviations. The claim should either be restricted to configurations where it actually holds, or to seq-MESH, or supported by paired significance testing over the ten seeds.
[Section 3 and Section 5] The central attribution of MESH's improvements to the phonetic content of the auxiliary sequence is not tested. seq-MESH inserts an additional cross-attention layer in every encoder block, increasing the parameter count relative to the base model, while dir-MESH replaces self-attention with cross-attention and introduces a separate phoneme embedding. Without a control condition--for example, a random jamo sequence, a character-level sequence, or the original text itself used as the key/value source--the observed F1 gains on both perturbed and original test sets can be explained by added capacity or a different inductive bias rather than by phonetic information. Please add an ablation that controls for these factors and report whether the phonetic content is specifically responsible for the gains.
[Section 5, third finding] The inference from improved performance on original (0% attack) test sets to the claim that 'the real-world dataset may contain such phonetic substitutions' is an overreach. Improved F1 at 0% attack does not demonstrate the presence of phonetic substitution in the test set; it may also result from additional model capacity, changes in inductive bias, or other factors. To support the real-world alignment claim, the authors should either weaken the claim or provide direct evidence, such as an analysis of naturally occurring perturbed examples in the original test set or a demonstration that MESH's gains are specifically associated with the presence of phonetic perturbations.

minor comments (4)

[Table 2] In the KoLD single-jamo table, the BERTseq-MESH row at 30% attack reports ΔF1 = -0.65±1.3, but the corresponding F1 values (79.5 to 73.0) give a drop of 6.5; this appears to be a typographical error and should be corrected.
[Table 4] In the KoLD dual-jamo table, the KCBERTseq-MESH row at 20% attack reports ΔF1 = -0.5±0.9, but the corresponding F1 values (81.4 to 76.4) give a drop of 5.0; this appears to be a typographical error and should be corrected.
[Sections 1 and 2.1] There are minor typographical errors: 'sequntial' should be 'sequential' in Section 1, and 'respetively' should be 'respectively' in Section 2.1.
[Algorithm 1] The pseudocode in Algorithm 1 is difficult to read in the manuscript text, particularly the condition 'nA/nV < r' and the variables nV and nA; please ensure the typesetting renders subscripts and fractions clearly.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: PHISH and MESH are evaluated on held-out test sets using hand-crafted, non-fitted components.

full rationale

The paper's derivation chain is self-contained and empirically falsifiable. PHISH's look-up table (Table 5) is hand-crafted from IPA place/manner features and Korean standard pronunciation rules; it is not fitted to the evaluation outcomes. The attack is then applied to held-out test sets and measured against three base detectors, with degradation increasing with attack ratio and degree, which is an independent empirical result. MESH is trained on the original unperturbed training data only, and evaluated on both original and PHISH-perturbed held-out test sets against external baselines; no fitted parameter is later relabeled as a prediction. There is no load-bearing self-citation: the cited prior work (e.g., Rothe et al. 2020 for parameter initialization, g2pK for phonemization) provides implementation details or tools, not the paper's conclusions. The main interpretive weakness is that the paper attributes F1 gains to the phonetic content of the auxiliary sequence without a non-phonetic control ablation, so added capacity could explain part of the gains; however, this is an experimental-design/attribution concern, not circularity, because the prediction is not equivalent to the input by construction. The limitations section (Section 8) explicitly acknowledges dependence on an external phonemizer and added computational overhead, which are real engineering constraints rather than circular steps. No equation, fitted parameter, or self-citation chain reduces the central claims to their own inputs.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central claims rest on a hand-crafted jamo-similarity table, the accuracy of the external phonemizer, and the assumption that cross-attention gains are driven by phonetic content. No new physical entities are introduced.

free parameters (2)

Look-up table D = Table 5: jamo sets (e.g., onset /k/ = {ㄱ,ㄲ,ㅋ})
Hand-constructed from IPA and standard pronunciation rules; not fitted, but a design choice that determines attack behavior.
Perturbation ratio r = 0.1, 0.2, 0.3 in experiments
Experimental hyperparameter; not part of the method itself but affects the evaluated threat level.

assumptions (4)

domain assumption Korean is a phonographic language with shallow orthographic depth; phonetic substitutions remain intelligible to readers.
Section 2 states this as the foundation for PHISH.
domain assumption The external phonemizer g2pK provides accurate phoneme sequences.
Section 3 uses it without optimization; Limitations acknowledge accuracy could affect performance.
domain assumption Cross-attention layers with copied weights from the base model do not simply add capacity that explains the performance gains.
No ablation compares phonetic versus non-phonetic auxiliary inputs, so the improvement may be due to additional parameters.
domain assumption K-HATERS and KoLD are representative of Korean online hate speech.
Section 4.1 uses these two datasets without external validation.

how reviews work

0 comments

Cite this review

Pith. "Pith review of PHISH in MESH: Korean Adversarial Phonetic Substitution and Phonetic-Semantic Feature Integration Defense." pith.science (2026). https://pith.science/paper/NMHE4L2F

@misc{pith2026250521380,
  author       = {Pith},
  title        = {Pith review of: PHISH in MESH: Korean Adversarial Phonetic Substitution and Phonetic-Semantic Feature Integration Defense},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NMHE4L2F}},
  note         = {Machine review of arXiv:2505.21380}
}

read the original abstract

As malicious users increasingly employ phonetic substitution to evade hate speech detection, researchers have investigated such strategies. However, two key challenges remain. First, existing studies have overlooked the Korean language, despite its vulnerability to phonetic perturbations due to its phonographic nature. Second, prior work has primarily focused on constructing datasets rather than developing architectural defenses. To address these challenges, we propose (1) PHonetic-Informed Substitution for Hangul (PHISH) that exploits the phonological characteristics of the Korean writing system, and (2) Mixed Encoding of Semantic-pHonetic features (MESH) that enhances the detector's robustness by incorporating phonetic information at the architectural level. Our experimental results demonstrate the effectiveness of our proposed methods on both perturbed and unperturbed datasets, suggesting that they not only improve detection performance but also reflect realistic adversarial behaviors employed by malicious users.

Figures

Figures reproduced from arXiv: 2505.21380 by the authors.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

26 extracted references · 17 canonical work pages

[1]

online" 'onlinestring :=

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...
[2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...
[3]

Piush Aggarwal and Torsten Zesch. 2022. https://aclanthology.org/2022.wnut-1.25/ Analyzing the real vulnerability of hate speech detection systems against targeted intentional noise . In Proceedings of the Eighth Workshop on Noisy User-generated Text (W-NUT 2022), pages 230--242, Gyeongju, Republic of Korea. Association for Computational Linguistics

work page 2022
[4]

Nicholas Boucher, Ilia Shumailov, Ross Anderson, and Nicolas Papernot. 2022. https://doi.org/10.1109/SP46214.2022.9833641 Bad characters: Imperceptible nlp attacks . In 2022 IEEE Symposium on Security and Privacy (SP), pages 1987--2004

arXiv 2022
[5]

Portia Cooper, Mihai Surdeanu, and Eduardo Blanco. 2023. https://doi.org/10.18653/v1/2023.findings-emnlp.192 Hiding in plain sight: Tweets with hate speech masked by homoglyphs . In Findings of the Association for Computational Linguistics: EMNLP 2023, pages 2922--2929, Singapore. Association for Computational Linguistics

doi:10.18653/v1/2023.findings-emnlp.192 2023
[6]

Hicham El Boukkouri, Olivier Ferret, Thomas Lavergne, Hiroshi Noji, Pierre Zweigenbaum, and Jun ' ichi Tsujii. 2020. https://doi.org/10.18653/v1/2020.coling-main.609 C haracter BERT : Reconciling ELM o and BERT for word-level open-vocabulary representations from characters . In Proceedings of the 28th International Conference on Computational Linguistics,...

doi:10.18653/v1/2020.coling-main.609 2020
[7]

Nick C Ellis, Miwa Natsume, Katerina Stavropoulou, Lorenc Hoxhallari, Victor HP Van Daal, Nicoletta Polyzoe, MARIA-LOUISA TSIPA, and Michalis Petalas. 2004. The effects of orthographic depth on learning to read alphabetic, syllabic, and logographic scripts. Reading research quarterly, 39(4):438--468

work page 2004
[8]

Younghoon Jeong, Juhyun Oh, Jongwon Lee, Jaimeen Ahn, Jihyung Moon, Sungjoon Park, and Alice Oh. 2022. https://doi.org/10.18653/v1/2022.emnlp-main.744 KOLD : K orean offensive language dataset . In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 10818--10833, Abu Dhabi, United Arab Emirates. Association for Co...

doi:10.18653/v1/2022.emnlp-main.744 2022

Show all 26 references

[9]

Young-Suk Kim. 2011. https://doi.org/10.1016/j.cedpsych.2010.06.003 Considering linguistic and orthographic features in early literacy acquisition: Evidence from korean . Contemporary Educational Psychology, 36(3):177--189

2011 doi
[10]

Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. 2012. https://proceedings.neurips.cc/paper_files/paper/2012/file/c399862d3b9d6b76c8436e924a68c45b-Paper.pdf Imagenet classification with deep convolutional neural networks . In Advances in Neural Information Processing Sy...

2012
[11]

Gustavo Laboreiro and Eug \'e nio Oliveira. 2014. What we can learn from looking at profanity. In Computational Processing of the Portuguese Language: 11th International Conference, PROPOR 2014, S \ a o Carlos/SP, Brazil, October 6-8, 2014. Proceedings 11 , pages 108--113. Springer

2014
[12]

Thai Le, Jooyoung Lee, Kevin Yen, Yifan Hu, and Dongwon Lee. 2022. https://doi.org/10.18653/v1/2022.findings-acl.232 Perturbations in the wild: Leveraging human-written text perturbations for realistic adversarial attack and defense . In Findings of the Association for Computa...

2022 doi
[13]

Thai Le, Yiran Ye, Yifan Hu, and Dongwon Lee. 2023. https://doi.org/10.1109/ICDE55515.2023.00287 Cryptext: Database and interactive toolkit of human-written text perturbations in the wild . In 2023 IEEE 39th International Conference on Data Engineering (ICDE), pages 3639--3642

2023
[14]

Hanyong Lee, Chaelyn Lee, Yongjae Lee, and Jaesung Lee. 2025. https://aclanthology.org/2025.findings-naacl.247/ B it A buse: A dataset of visually perturbed texts for defending phishing attacks . In Findings of the Association for Computational Linguistics: NAACL 2025, pages 4...

2025
[15]

Junbum Lee. 2020. Kcbert: Korean comments bert. In Proceedings of the 32nd Annual Conference on Human and Cognitive Language Technology, pages 437--440

2020
[16]

Chaewon Park, Suhwan Kim, Kyubyong Park, and Kunwoo Park. 2023. K-haters: A hate speech detection corpus in korean with target-specific ratings. Findings of the EMNLP 2023

2023
[17]

San-Hee Park, Kang-Min Kim, Seonhee Cho, Jun-Hyung Park, Hyuntae Park, Hyuna Kim, Seongwon Chung, and SangKeun Lee. 2021 a . https://doi.org/10.18653/v1/2021.emnlp-demo.9 KOAS : K orean text offensiveness analysis system . In Proceedings of the 2021 Conference on Empirical Met...

2021 doi
[18]

Sungjoon Park, Jihyung Moon, Sungdong Kim, Won Ik Cho, Ji Yoon Han, Jangwon Park, Chisung Song, Junseong Kim, Youngsook Song, Taehwan Oh, Joohong Lee, Juhyun Oh, Sungwon Lyu, Younghoon Jeong, Inkwon Lee, Sangwoo Seo, Dongjun Lee, Hyunwoo Kim, Myeonghwa Lee, Seongbo Jang, Seung...

2021
[19]

Manuel Perea and Stephen J Lupker. 2004. Can caniso activate casino? transposed-letter similarity effects with nonadjacent letter positions. Journal of memory and language, 51(2):231--246

2004
[20]

Edwin Puertas and Juan Carlos Martinez-Santos. 2021. Phonetic detection for hate speech spreaders on twitter

2021
[21]

Sascha Rothe, Shashi Narayan, and Aliaksei Severyn. 2020. https://doi.org/10.1162/tacl_a_00313 Leveraging pre-trained checkpoints for sequence generation tasks . Transactions of the Association for Computational Linguistics, 8:264--280

2020 doi
[22]

Dev Seth, Rickard Stureborg, Danish Pruthi, and Bhuwan Dhingra. 2023. https://doi.org/10.18653/v1/2023.eacl-main.238 Learning the legibility of visual text perturbations . In Proceedings of the 17th Conference of the European Chapter of the Association for Computational Lingui...

2023 doi
[23]

Venkatesan

Ankita Shekhar and M. Venkatesan. 2018. https://doi.org/10.1109/ICCTCT.2018.8550938 A bag-of-phonetic-codes modelfor cyber-bullying detection in twitter . In 2018 International Conference on Current Trends towards Converging Technologies (ICCTCT), pages 1--7

2018
[24]

Hsu Yang and Chuan-Jie Lin. 2020. https://aclanthology.org/2020.trac-1.2/ TOCP : A dataset for C hinese profanity processing . In Proceedings of the Second Workshop on Trolling, Aggression and Cyberbullying, pages 6--12, Marseille, France. European Language Resources Associati...

2020
[25]

MoungHo Yi, MyungJin Lim, Hoon Ko, and JuHyun Shin. 2021. Method of profanity detection using word embedding and lstm. Mobile Information Systems, 2021(1):6654029

2021
[26]

Seunguk Yu, Juhwan Choi, and YoungBin Kim. 2024. https://doi.org/10.18653/v1/2024.findings-naacl.219 Don`t be a fool: Pooling strategies in offensive language detection from user-intended adversarial attacks . In Findings of the Association for Computational Linguistics: NAACL...

2024 doi

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

online" 'onlinestring :=

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

[2] [2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

[3] [3]

Piush Aggarwal and Torsten Zesch. 2022. https://aclanthology.org/2022.wnut-1.25/ Analyzing the real vulnerability of hate speech detection systems against targeted intentional noise . In Proceedings of the Eighth Workshop on Noisy User-generated Text (W-NUT 2022), pages 230--242, Gyeongju, Republic of Korea. Association for Computational Linguistics

work page 2022

[4] [4]

Nicholas Boucher, Ilia Shumailov, Ross Anderson, and Nicolas Papernot. 2022. https://doi.org/10.1109/SP46214.2022.9833641 Bad characters: Imperceptible nlp attacks . In 2022 IEEE Symposium on Security and Privacy (SP), pages 1987--2004

arXiv 2022

[5] [5]

Portia Cooper, Mihai Surdeanu, and Eduardo Blanco. 2023. https://doi.org/10.18653/v1/2023.findings-emnlp.192 Hiding in plain sight: Tweets with hate speech masked by homoglyphs . In Findings of the Association for Computational Linguistics: EMNLP 2023, pages 2922--2929, Singapore. Association for Computational Linguistics

doi:10.18653/v1/2023.findings-emnlp.192 2023

[6] [6]

Hicham El Boukkouri, Olivier Ferret, Thomas Lavergne, Hiroshi Noji, Pierre Zweigenbaum, and Jun ' ichi Tsujii. 2020. https://doi.org/10.18653/v1/2020.coling-main.609 C haracter BERT : Reconciling ELM o and BERT for word-level open-vocabulary representations from characters . In Proceedings of the 28th International Conference on Computational Linguistics,...

doi:10.18653/v1/2020.coling-main.609 2020

[7] [7]

Nick C Ellis, Miwa Natsume, Katerina Stavropoulou, Lorenc Hoxhallari, Victor HP Van Daal, Nicoletta Polyzoe, MARIA-LOUISA TSIPA, and Michalis Petalas. 2004. The effects of orthographic depth on learning to read alphabetic, syllabic, and logographic scripts. Reading research quarterly, 39(4):438--468

work page 2004

[8] [8]

Younghoon Jeong, Juhyun Oh, Jongwon Lee, Jaimeen Ahn, Jihyung Moon, Sungjoon Park, and Alice Oh. 2022. https://doi.org/10.18653/v1/2022.emnlp-main.744 KOLD : K orean offensive language dataset . In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 10818--10833, Abu Dhabi, United Arab Emirates. Association for Co...

doi:10.18653/v1/2022.emnlp-main.744 2022