All You Need is "Leet": Evading Hate-speech Detection AI

Naman Ahuja; Sampanna Yashwant Kahu

REVIEW 4 major objections 5 minor 20 references

All You Need is "Leet": Evading Hate-speech Detection AI

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Character tricks fool hate-speech AI on 86.8% of toxic tweets.

desk verdict Reasonably honest student replication of known hate-speech evasions, but the headline 86.8% is untraceable and the human check is a classroom poll. read the letter →

arxiv 2505.16263 v1 pith:A2JZXNIK submitted 2025-05-22 cs.CR cs.CLcs.LG

Sampanna Yashwant Kahu , Naman Ahuja This is my paper · ORCID

classification cs.CRcs.CLcs.LG

keywords adversarialinputgenerationblack-boxattackhatespeechdetectionleetspeaktextperturbationPerspectiveAPISonarmachinelearning

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that commercial hate-speech detection APIs can be fooled by simple, human-readable text obfuscation such as replacing letters with visually identical Unicode characters. It evaluates seven character-level perturbations against the Perspective API and HateSonar, and reports that its best attack moves 86.8% of originally toxic tweets out of the toxic category. The authors frame the work as a security measurement: knowing how easily moderation models can be bypassed is necessary to defend them, and they close with matching defenses such as Unicode normalization and underscore-aware tokenization. The credibility of the evasion claim depends on whether the perturbed tweets truly keep their hateful meaning, which the paper checks only informally.

What carries the argument

The engine of the attack is a query-based word-importance scorer combined with a table of character substitutions. For a given tweet, the authors query Perspective once for a base toxicity, then once per word with that word deleted; the drop in score attributes a toxicity to each word, letting the attacker pick the most toxic token(s) to modify. The modification is either a leet-speak rewrite, mapping each English letter to a visually similar Cyrillic, Greek, Cherokee, or Latin Unicode character, or a whitespace/typographic edit such as replacing spaces with underscores, removing spaces, or inserting zero-width spaces. This machinery is what makes the attack black-box: it needs only toxicity scores, never gradients or model weights.

What would settle it

Have independent annotators label the original and perturbed tweets for hatefulness without knowing which is which. If a significant fraction of the tweets the detectors now pass are judged non-hateful, the 86.8% evasion figure is really content removal. A complementary computational check is to preprocess the perturbed tweets with Unicode normalization, mapping homoglyphs back to ASCII, and underscore-to-space tokenization before calling the APIs; if the category shift largely vanishes, the attack exploits a preprocessing gap rather than a fundamental model limitation.

Watch

Extended reading notes

Core claim

The paper claims that black-box hate-speech detection services can be evaded by character-level perturbations that leave the text human-readable and, in the authors' assessment, semantically unchanged. Using the Perspective API and the open-source HateSonar library as targets, it designs seven perturbations and measures how many tweets move from the toxic bucket to a non-toxic or unrecognized bucket. The best attack, a composite of underscore insertion and leet-speak Unicode substitution, shifts 86.8% of originally toxic tweets, while the paper's word-removal queries show which words to attack without ever seeing the model's internals. The authors also report that whitespace-manipulation attacks work well, which they interpret as evidence that the targeted models rely on whitespace-based tokenization.

Load-bearing premise

The load-bearing assumption is that the perturbed tweets still carry the same hateful meaning as the originals; the paper's only check of this is the unanimous opinion of classmates during a course presentation, not a controlled human study with independent annotators.

Editorial extensions

If this is right

If the 86.8% evasion rate holds, current deployment of the tested moderation APIs is bypassable by attackers with no model knowledge and no rate-limit-breaking effort.
The strong performance of underscore and whitespace edits indicates the target models tokenize on whitespace; retraining or re-tokenizing on additional separators would neutralize several of the attacks.
The proposed defenses, namely inverse Unicode mapping, autocorrect, underscore-aware tokenization, zero-width-space stripping, and word-break reconstruction, would, if adopted, cover all seven perturbations presented.
Because word importance for the HateSonar attack is borrowed from Perspective API scores, the attack's transferability to other detectors depends on the availability of a proxy scorer for finding toxic words.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A controlled human-subject study measuring hatefulness preservation would either confirm or overturn the 86.8% claim; this is the obvious next experiment and the paper leaves it open.
The attack class generalizes: any detector that relies on surface tokenization and does not normalize Unicode equivalents is vulnerable to the same homoglyph trick, so the finding plausibly extends beyond the two tested APIs to newer transformer-based moderators.
Reporting the full post-perturbation toxicity distribution, rather than a single category-shift number, would show how much the headline rate depends on the chosen toxicity threshold of 0.66.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague — this is a course-project paper from Virginia Tech that reruns the Gröndahl et al. 'All You Need is Love' playbook (the title is a direct nod) with leet speak, typo swaps, underscore/whitespace manipulation, and zero-width characters against Perspective API and HateSonar. The abstract's 86.8% evasion claim is the headline, but there is no numeric results table anywhere in the text; Figure 7 is a set of bar charts that don't let you trace the number to an attack and threshold. The modified category shift metric counts 'API returned no score' as an evasion, which inflates success. And the semantic-preservation check is literally the 'unanimous opinion of the class' during a presentation (Sections 2.4.2 and 3). No sample size, no annotation instructions, no agreement metrics.

What the paper does well: it is unusually honest about its own limitations. Section 5 explicitly notes the HateSonar results depend on Perspective API for word importance, and the authors admit they didn't run a real user study. They ship source code and data on GitHub, document the rate-limit and error-handling behavior of Perspective, and propose concrete, sensible defenses (Unicode normalization, underscore-aware tokenization, word-break reconstruction, zero-width stripping). Those defenses are easy to test and worth trying.

The soft spots are real but not fatal to the underlying observation. The attacks are cheap and they do degrade both APIs; the finding that whitespace removal and underscore insertion break tokenization is consistent with prior work (Hosseini et al. already showed this class of attack against Perspective). The paper is not novel as an attack paper — it is a parameter scan of known recipes applied to two models. The main empirical claim is weakly supported, not because the phenomenon is fake, but because the evaluation is sloppy: no per-attack evasion table, no confidence intervals, and the 'meaning preserved' claim rests on a classroom show of hands. Whitespace removal and heavy leet substitution can make text unreadable or change its target, so the 86.8% may be partly content destruction rather than evasion.

Who gets value? Students learning how to run a black-box attack evaluation, and moderation engineers who want a checklist of simple Unicode evasions. As a research contribution, it has already been done. I'd desk reject in its current form; with a proper human study and a real results table it could be a workshop-level robustness measurement. Not worth a full referee cycle as is.

Referee Report

4 major / 5 minor

Summary. This paper proposes black-box character-level perturbations—leet-speak substitution, typo insertion, underscore insertion, whitespace removal, zero-width-space insertion, and two composite attacks—to reduce the toxicity scores returned by the Perspective API and HateSonar. The authors evaluate on 20,705 tweets from the Mondal et al. dataset, report a mean change in toxicity and category shift scores, and claim an 86.8% evasion rate for their best attack against hateful text. They also sketch defenses such as Unicode normalization, auto-correct, tokenization changes, and word-break algorithms.

Significance. If the 86.8% evasion rate held while preserving the meaning of hate speech, the paper would provide a useful demonstration that commercial hate-speech detectors remain vulnerable to simple character-level perturbations under realistic black-box query access. Strengths include the clearly specified threat model, the public release of source code and data, and the inclusion of proposed defenses. However, as detailed below, the current evidence does not support the headline claim: the key result is not numerically traceable, the modified shift metric treats API failures as successful evasions, and semantic preservation rests on an informal classroom poll.

major comments (4)

[Abstract; Section 3] The headline number 86.8% does not appear in the body of the paper. Section 3 and Figure 7 report the resulting shifts only as figures, with no numeric table, no per-attack breakdown, and no statement of which attack, which API, and which metric produce the 86.8% value. Without a traceable numeric results table, the central quantitative claim cannot be verified. Please report for every attack and both APIs the exact category shift, the percent of no-score responses, the mean toxicity change, and the sample size underlying each percentage.
[Section 2.4.1] The modified category shift score is defined as the percentage of examples that moved from Toxic to any other category plus the percentage for which Perspective returned no score. This treats a refusal to score (Section 2.3.4) as an evasion. Since heavy perturbation is what triggers the refusal, the no-score cases are likely concentrated in the most perturbed inputs; counting them as evasions inflates the success measure and conflates detector failure with an adversarial success. The modified shift score should not be used as a primary evasion rate; report no-score percentage separately and, if an overall rate is needed, state explicitly that it includes API non-responses.
[Sections 2.4.2 and 3] The semantic-preservation claim is load-bearing: without it, a toxicity drop indicates content destruction, not evasion. The only evidence offered is that peers in the authors' class unanimously agreed that displayed sentences retained their hateful meaning. This is not a substitute for a human evaluation: no number of raters, no sample size, no instructions, no inter-annotator agreement, and no baseline are reported. Because several perturbations (whitespace removal, underscore insertion, heavy leet substitution, and zero-width-space insertion) can make text difficult to parse, the authors need to show, with a documented human study, that readers recognize the perturbed text as hateful and as conveying the same message.
[Section 3] No confidence intervals or significance tests are reported for any metric. With 20,705 examples, the shift percentages are statistics whose uncertainty should be stated; without this, statements such as "insertion of underscores and removal of white spaces achieves the best results" are not quantitatively substantiated. Similarly, the comparison between composite and homogeneous attacks in Section 3 is made without reported variances or pairwise tests.

minor comments (5)

[Section 2.3.2; Section 5] For the HateSonar experiments, candidate toxic words are chosen using Perspective API word importance, as stated in Section 2.3.2. This is acknowledged as a limitation, but the text should make clear that the HateSonar results are therefore not a fully independent black-box attack on HateSonar; at minimum, include a comparison where HateSonar's own deletion-based scores are used, even if imperfect.
[Section 2.3.1] Please use the standard spelling "GloVe" for the word embeddings, and fix the formatting of "Wikipedia'2014" and "Gigaword 5".
[Section 2.3.3] The zero-width-space perturbation inserts five U+200B characters between each character of one word; the paper notes the resulting high edit distance, but it should clarify why five was chosen and whether the results are sensitive to that number.
[Table 2] Some entries in the leet-speak mapping appear to have weak visual similarity to their targets (for example, 'D' mapped to Cherokee letter A). Please document the selection criteria for the mapping, since the perturbation's fidelity depends on the confusability of the glyphs.
[Section 5] The limitations section contains the typo "in the uture"; please correct it.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: the attack is a standard black-box query loop against independently queried APIs; the informal human-evaluation weakness affects validity, not circularity.

full rationale

The paper's central result is an empirical measurement, not a derivation from assumptions. The attack selects words using deletion-based toxicity deltas from the same Perspective API queried during evaluation (Section 2.3.2), which is the standard black-box attack loop: the adversary uses query access to identify salient tokens and then perturbs them. Success is measured by querying the same API after perturbation; this is a test of robustness, and the paper reports that many perturbations fail (e.g., typo insertion is worst), so the result is not forced by construction. The HateSonar arm borrows word-importance scores from Perspective (Sections 2.3.2 and 5), which is a cross-model transfer and is acknowledged as a limitation; it does not make the HateSonar evaluation equivalent to its input, since word choice from Perspective need not transfer and the HateSonar scores are independently queried. Semantic preservation is supported only by an informal classroom poll (Sections 2.4.2 and 3); while this is a serious validity concern for the 'minimal change in meaning' claim, it is not a circularity in the derivation chain. There are no load-bearing self-citations, no imported uniqueness theorems, and no fitted parameter renamed as a prediction. Hence score 0.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim depends on hand-chosen thresholds and rules, a single dataset, the stability of live APIs, and an informal semantic-preservation check. No new physical or conceptual entities are introduced.

free parameters (4)

Perspective toxicity thresholds = 0.33 and 0.66
Hand-chosen cutoffs partition scores into Non-toxic, Maybe-toxic, and Toxic; category shift and the reported evasion rate depend directly on these values (Section 2.3.1).
HateSonar hatefulness rule = 'neither is not the highest class'
Hand-chosen rule to convert a three-class confidence output into a binary toxic label; this affects which texts count as hateful and therefore the measured shift rates (Section 2.3.1).
Zero-width space insertion count = 5 per character
Chosen after the authors observed that a single insertion did not suffice; this manual tuning affects the edit distance and evasion results (Section 2.3.3).
Number of toxic words perturbed in typo attack = 2
The typo attack targets the two most hateful words; this count is a hand-set hyperparameter and influences the perturbation magnitude and success (Section 2.3.3).

assumptions (5)

domain assumption Perspective API toxicity score is a stable proxy for hatefulness of a text.
Used throughout as the label and as the success metric; no validation of the score's correctness against human judgments is provided.
domain assumption The Mondal et al. dataset is representative of hate speech online.
Single dataset used for all evaluations; the paper acknowledges that generalizability to other datasets is untested (Section 5).
domain assumption The live APIs remain unchanged during the experiment window.
Perspective API is a deployed service that can be updated without notice; results are timestamped only by the preprint date, not by API version.
standard math Levenshtein distance characterizes the amount of perturbation.
Standard string edit distance definition from Section 2.4.2; acceptable but one of many possible choices.
ad hoc to paper The informal classroom peer evaluation is a valid measure of semantic preservation.
Used as the only human check that perturbed text retains hateful meaning; no procedure, number of raters, or inter-rater agreement is reported (Sections 2.4.2 and 3).

how reviews work

0 comments

Cite this review

Pith. "Pith review of All You Need is "Leet": Evading Hate-speech Detection AI." pith.science (2026). https://pith.science/paper/A2JZXNIK

@misc{pith2026250516263,
  author       = {Pith},
  title        = {Pith review of: All You Need is "Leet": Evading Hate-speech Detection AI},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/A2JZXNIK}},
  note         = {Machine review of arXiv:2505.16263}
}

read the original abstract

Social media and online forums are increasingly becoming popular. Unfortunately, these platforms are being used for spreading hate speech. In this paper, we design black-box techniques to protect users from hate-speech on online platforms by generating perturbations that can fool state of the art deep learning based hate speech detection models thereby decreasing their efficiency. We also ensure a minimal change in the original meaning of hate-speech. Our best perturbation attack is successfully able to evade hate-speech detection for 86.8 % of hateful text.

Figures

Figures reproduced from arXiv: 2505.16263 by the authors.

**Figure 2.** How the toxicity of the dataset varies with toxicity [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** Category distribution of dataset according to HateS [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗

Figures from the paper (15 more)

**Figure 5.** Figure 5: Process diagram for our approach. The authors note that the second approach mentioned above did not work with HateSonar since the word-level toxicities computed using the HateSonar API did not align with our perception of the toxicity of words. Therefore, to select a …

**Figure 6.** Figure 6: Example of a sentence perturbed by leet speak. [PITH_FULL_IMAGE:figures/full_fig_p004_6.png]

**Figure 4.** Figure 4: Edit distance evaluations for perturbations on Per [PITH_FULL_IMAGE:figures/full_fig_p004_4.png]

**Figure 7.** Figure 7: Evaluations for perturbations on Perspective API [PITH_FULL_IMAGE:figures/full_fig_p006_7.png]

**Figure 8.** Figure 8: Edit distance evaluations for perturbations on Per [PITH_FULL_IMAGE:figures/full_fig_p006_8.png]

**Figure 9.** Figure 9: Original and resulting toxicities for Leet speak per [PITH_FULL_IMAGE:figures/full_fig_p007_9.png]

**Figure 10.** Figure 10: Original and resulting toxicities for Leet speak [PITH_FULL_IMAGE:figures/full_fig_p007_10.png]

**Figure 11.** Figure 11: Original and resulting toxicities for Typo pertur [PITH_FULL_IMAGE:figures/full_fig_p008_11.png]

**Figure 12.** Figure 12: Original and resulting toxicities for Typo pertur [PITH_FULL_IMAGE:figures/full_fig_p008_12.png]

**Figure 15.** Figure 15: Original and resulting toxicities for removal of [PITH_FULL_IMAGE:figures/full_fig_p009_15.png]

**Figure 16.** Figure 16: Original and resulting toxicities for removal of [PITH_FULL_IMAGE:figures/full_fig_p009_16.png]

**Figure 19.** Figure 19: Original and resulting toxicities for composite [PITH_FULL_IMAGE:figures/full_fig_p009_19.png]

**Figure 20.** Figure 20: Original and resulting toxicities for composite [PITH_FULL_IMAGE:figures/full_fig_p010_20.png]

**Figure 21.** Figure 21: Original and resulting toxicities for composite [PITH_FULL_IMAGE:figures/full_fig_p010_21.png]

**Figure 22.** Figure 22: Original and resulting toxicities for composite [PITH_FULL_IMAGE:figures/full_fig_p011_22.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

20 extracted references · 15 canonical work pages

[1]

A. Okeowo. 2017. Hate on the rise after Trump’s election. https://www. newyorker.com/, Last accessed on 2019-05-01

work page 2017
[2]

Unknown Author. 2019. Contribute to conversationai/unintended-ml-bias- analysis development by creating an account on GitHub. https:// github.com/conversationai/unintended-ml-bias-analysis original-date: 2017- 05-05T21:36:46Z

work page 2019
[3]

Minhao Cheng, Jinfeng Yi, Huan Zhang, Pin-Yu Chen, and Cho-Jui Hsieh. 2018. Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Ad- versarial Examples. CoRR abs/1803.01128 (2018)

arXiv 2018
[4]

Macy, and Ingmar Weber

Thomas Davidson, Dana Warmsley, Michael W. Macy, and Ingmar Weber. 2017. Automated Hate Speech Detection and the Problem of Offensive Language.CoRR abs/1703.04009 (2017). arXiv:1703.04009 http://arxiv.org/abs/1703.04009

arXiv 2017
[5]

Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Xiaodong Song. 2017. Robust Physical-World Attacks on Deep Learning Models.. In Robust Physical-World Attacks on Deep Learning Models

work page 2017
[6]

Björn Gambäck and Utpal Kumar Sikdar. 2017. Using Convolutional Neural Networks to Classify Hate-Speech. InProceedings of the First Workshop on Abusive Language Online. Association for Computational Linguistics, Vancouver, BC, Canada, 85–90. https://doi.org/10.18653/v1/W17-3013

doi:10.18653/v1/w17-3013 2017
[7]

Tommi Gröndahl, Luca Pajola, Mika Juuti, Mauro Conti, and N Asokan. 2018. All You Need is "Love": Evading Hate-speech Detection. (08 2018)

work page 2018
[8]

Hossein Hosseini, Sreeram Kannan, Baosen Zhang, and Radha Poovendran. 2017. Deceiving Google’s Perspective API Built for Detecting Toxic Comments. CoRR abs/1702.08138 (2017)

arXiv 2017

Show all 20 references

[9]

Igini Galiardone, Danit Gal, Thiago Alves, and Gabriela Martinez. 2015. Counter- ing online hate speech . UNESCO Series on Internet Freedom

2015
[10]

Jessica Guynn. 2019. If you’ve been harassed online, you’re not alone. More than half of Americans say they’ve experienced hate. https://www.usatoday.com/story/news/2019/02/13/study-most-americans- have-been-targeted-hateful-speech-online/2846987002/

2019
[11]

Jinfeng Li, Shouling Ji, Tianyu Du, Bo Li, and Ting Wang. 2018. TextBugger: Generating Adversarial Text Against Real-world Applications. (12 2018). https: //doi.org/10.14722/ndss.2019.23138

2018
[12]

Google LLC. 2019. Perspective. https://www.perspectiveapi.com/#/

2019
[13]

Microsoft LLC. 2019. Content Moderator. https://azure.microsoft.com/en-us/ services/cognitive-services/content-moderator/

2019
[14]

Michael Gilleland. 2016. Levenshtein Distance, in Three Flavors. https://people.cs.pitt.edu/~kirk/cs1501/Pruhs/Spring2006/assignments/ editdistance/LevenshteinDistance.htm

2016
[15]

Mainack Mondal, Leandro A. A. Silva, and Fabricio Benevenuto. 2017. A Mea- surement Study of Hate Speech in Social Media. In Proceedings of the 28th ACM Conference on Hypertext and Social Media (HT ’17) . ACM

2017
[16]

Hiroki Nakayama. 2019. Hate Speech Detection Library for Python. Contribute to Hironsan/HateSonar development by creating an account on GitHub. https: //github.com/Hironsan/HateSonar original-date: 2018-01-26T12:03:06Z

2019
[17]

Berkay Celik, and Ananthram Swami

Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z. Berkay Celik, and Ananthram Swami. 2016. Practical Black-Box Attacks against Deep Learning Systems using Adversarial Examples. (02 2016)

2016
[18]

PyPI. 2015. PyPI – the Python Package Index. https://pypi.org/

2015
[19]

Stephen Shankland. 2019. Facebook says its new AI can detect hate faster. https://www.cnet.com/news/ facebook-says-its-new-ai-tech-spots-hate-speech-faster/

2019
[20]

Wikipedia. 2019. Leet. https://en.wikipedia.org/w/index.php?title=Leet&oldid= 891628952 Page Version ID: 891628952. 7 APPENDIX Figure 9: Original and resulting toxicities for Leet speak per- turbation for Perspective API Figure 10: Original and resulting toxicities for Leet sp...

2019

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

A. Okeowo. 2017. Hate on the rise after Trump’s election. https://www. newyorker.com/, Last accessed on 2019-05-01

work page 2017

[2] [2]

Unknown Author. 2019. Contribute to conversationai/unintended-ml-bias- analysis development by creating an account on GitHub. https:// github.com/conversationai/unintended-ml-bias-analysis original-date: 2017- 05-05T21:36:46Z

work page 2019

[3] [3]

Minhao Cheng, Jinfeng Yi, Huan Zhang, Pin-Yu Chen, and Cho-Jui Hsieh. 2018. Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Ad- versarial Examples. CoRR abs/1803.01128 (2018)

arXiv 2018

[4] [4]

Macy, and Ingmar Weber

Thomas Davidson, Dana Warmsley, Michael W. Macy, and Ingmar Weber. 2017. Automated Hate Speech Detection and the Problem of Offensive Language.CoRR abs/1703.04009 (2017). arXiv:1703.04009 http://arxiv.org/abs/1703.04009

arXiv 2017

[5] [5]

Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Xiaodong Song. 2017. Robust Physical-World Attacks on Deep Learning Models.. In Robust Physical-World Attacks on Deep Learning Models

work page 2017

[6] [6]

Björn Gambäck and Utpal Kumar Sikdar. 2017. Using Convolutional Neural Networks to Classify Hate-Speech. InProceedings of the First Workshop on Abusive Language Online. Association for Computational Linguistics, Vancouver, BC, Canada, 85–90. https://doi.org/10.18653/v1/W17-3013

doi:10.18653/v1/w17-3013 2017

[7] [7]

Tommi Gröndahl, Luca Pajola, Mika Juuti, Mauro Conti, and N Asokan. 2018. All You Need is "Love": Evading Hate-speech Detection. (08 2018)

work page 2018

[8] [8]

Hossein Hosseini, Sreeram Kannan, Baosen Zhang, and Radha Poovendran. 2017. Deceiving Google’s Perspective API Built for Detecting Toxic Comments. CoRR abs/1702.08138 (2017)

arXiv 2017