How to Perform Adversarial ML Attacks Testing in 2026 | AI LLM Hacking Course Day 28 of 90

📰 Originally published on Securityelites — AI Red Team Education — the canonical, fully-updated version of this article.

🤖 AI/LLM HACKING COURSE

FREE

Part of the AI/LLM Hacking Course — 90 Days

Day 28 of 90 · 31.1% complete

⚠️ Authorised Targets Only: Adversarial ML attacks testing against deployed content moderation systems, toxicity classifiers, and safety filters must only be performed against authorised targets. Testing content moderation bypass can generate content that violates platform terms of service even in a testing context — agree explicit content handling procedures with the engagement contact before starting.

Every content moderation system I’ve tested has had a unicode gap. Not every system, actually — let me be more precise. Every content moderation system I’ve tested has had a gap somewhere in the coverage between direct blocked terms and the full semantic space of what it was trained to block. Sometimes the gap is unicode. Sometimes it’s paraphrase. Sometimes it’s context shift. The gap is always there because classifiers are trained on finite datasets against a semantically infinite attack surface.

Adversarial ML attacks operate at a different layer than everything else in this course. Prompt injection, jailbreaking, extraction — those target the model’s behaviour via its context. Adversarial ML targets the model’s perception: crafting inputs that the model classifies incorrectly because they fall in a region the training data didn’t adequately cover. The distinction matters for understanding what you’re testing. You’re not trying to convince the model to do something different. You’re trying to find inputs the model perceives differently than a human would. The gap between human perception and model perception is the attack surface. Day 28 maps it.

Have you tested a content moderation or safety classifier for adversarial bypass?

No — I didn’t know this was a testable vulnerability Basic — I’ve tried homoglyphs or simple substitution Systematic — I probe the decision boundary methodically Full methodology — probing + perturbation + semantic reframing

🎯 What You’ll Master in Day 28

Understand the adversarial ML attack surface for LLMs and safety classifiers
Apply homoglyph and unicode substitution to bypass tokenizer-based classification
Use zero-width character insertion to split token sequences
Apply semantic reframing and paraphrase attacks against coverage-limited classifiers
Run systematic black-box probing to map a classifier’s decision boundary
Test LLM robustness against adversarial inputs in image and multimodal contexts

⏱️ Day 28 · 3 exercises · Kali Terminal + Think Like Hacker + Kali Terminal ### ✅ Prerequisites - Day 2 — How LLMs Work — tokenisation is central to understanding why homoglyph attacks work; the tokenizer section from Day 2 is prerequisite - Day 15 — AI Jailbreaking — the distinction between jailbreaking (behavioural) and adversarial ML (perceptual) becomes clearer with Day 15’s content as context - Python with unicodedata and requests installed — Exercise 1 builds the automated perturbation testing toolkit ### 📋 Adversarial ML Attacks — Day 28 Contents 1. The Adversarial Attack Surface for LLMs 2. Homoglyph and Unicode Substitution Attacks 3. Zero-Width Character Insertion 4. Semantic Reframing and Paraphrase Attacks 5. Black-Box Decision Boundary Probing 6. Reporting Adversarial Robustness Findings In Day 27 you built the engagement operational methodology. Day 28 covers a specific attack family that sits alongside but distinct from the injection and extraction techniques of Phase 2 and 3 — adversarial ML attacks on the model’s classification and perception layer. Day 29 covers enterprise AI security — the specific attack surfaces that emerge in LangChain, LlamaIndex, and enterprise AI gateway deployments.

The Adversarial Attack Surface for LLMs

LLM deployments typically include at least one classifier — a content moderation system, a toxicity filter, a safety classifier, or a query router — that sits either before or after the main language model. These classifiers are separate models, trained on separate datasets, and they have their own adversarial attack surfaces that are independent of the main LLM’s prompt injection vulnerabilities.

The adversarial attack surface for a classifier is defined by the gap between its training distribution and the space of possible inputs. Classifiers are trained on finite examples. The space of all possible text inputs is infinite. Adversarial attacks craft inputs that fall in the uncovered regions — the parts of the input space where the classifier’s training didn’t provide adequate coverage. These inputs look valid to humans but land outside the classifier’s learned decision boundary, producing incorrect classifications.

Homoglyph and Unicode Substitution Attacks

Homoglyphs are Unicode characters that look identical or near-identical to other characters in common fonts. ‘a’ (U+0061, Latin) and ‘а’ (U+0430, Cyrillic) are visually indistinguishable in most display contexts. A tokenizer processes them as completely different tokens. A safety classifier trained on the Latin character set may not match the Cyrillic version — the pattern it learned to detect is a specific sequence of token IDs, and different Unicode code points produce different token IDs even when the visual representation is identical.

HOMOGLYPH SUBSTITUTION — AUTOMATED GENERATIONCopy

Python: generate homoglyph variants of a target string

import unicodedata

Common Latin → Cyrillic / Greek homoglyphs

HOMOGLYPHS = {
‘a’: [‘а’, ‘ɑ’, ‘α’], # Cyrillic а, Latin alpha, Greek alpha
‘e’: [‘е’, ‘ё’, ‘ε’], # Cyrillic е, Cyrillic ё, Greek epsilon
‘o’: [‘о’, ‘ο’, ‘0’], # Cyrillic о, Greek omicron, digit zero
‘c’: [‘с’, ‘ϲ’], # Cyrillic с, Greek lunate sigma
‘p’: [‘р’, ‘ρ’], # Cyrillic р, Greek rho
‘x’: [‘х’, ‘χ’], # Cyrillic х, Greek chi
‘i’: [‘і’, ‘ι’, ‘1’], # Cyrillic і, Greek iota, digit one
}

---

📖 Read the complete guide on Securityelites — AI Red Team Education

This article continues with deeper technical detail, screenshots, code samples, and an interactive lab walk-through. Read the full article on Securityelites — AI Red Team Education →

---

This article was originally written and published by the Securityelites — AI Red Team Education team. For more cybersecurity tutorials, ethical hacking guides, and CTF walk-throughs, visit Securityelites — AI Red Team Education.