Evading Detection or Triggering False Alarms? A Character Level Adversarial Attack on LLM Detection of Arabic Social Media Bots

Abstract

In conflict-affected regions, social media users often try to evade AI and Machine Learning (ML) moderation systems by making subtle visual alterations to text, such as modifying diacritic dots while keeping the content understandable to human readers. This poses a challenge to modern detection pipelines, as AI systems are increasingly employed for content filtering and the detection of toxic content such as hate speech. Such threats are sometimes facilitated through social bots or campaigns with strong emotional tones, specifically in Arabic. We demonstrate that these automated systems are vulnerable to a subtle, linguistically grounded adversarial attack that evades detection by automatically and objectively altering the placement of diacritic dots in Arabic characters. Our dot-level adversarial attack reduces the performance of traditional deep learning sentiment classifiers and modern open-source LLMs (e.g., Mistral via Ollama) used for bot detection and content moderation. Evaluations on Telegram messages and benchmark Arabic datasets demonstrate significant drops in classification accuracy and a satisfactory attack success rate, even with minimal perturbations. This work reveals how bot operators can evade LLM-based detection pipelines. The results highlight the need for robust defenses that account for orthographic manipulation in morphologically rich languages like Arabic, particularly in politically polarized regions where bot-driven campaigns often target public opinion.