Scholarlink

<p>This paper identifies a critical vulnerability in Transformer-based malicious URL detectors: the visual-semantic misalignment inherent in subword tokenization, where visually imperceptible character substitutions drastically alter token sequences and shift model predictions. Exploiting this vulnerability, we propose Homoglyph-Guided Beam Search (HG-BS), an adversarial attack framework that generates evasive URLs preserving both visual appearance and functional validity under strict structural constraints. Under a budget of only five character substitutions, HG-BS achieves Attack Success Rates of 40.65% against RoBERTa and 50.80% against DistilBERT, demonstrating that even minimal perturbations can critically undermine detection reliability. Comparative analysis further reveals that compressed models exhibit consistently higher vulnerability under realistic class distributions, which we attribute to sharper loss landscape geometry induced by knowledge distillation. These findings establish that current high-accuracy URL detectors rely on fragile token patterns rather than robust semantic understanding, underscoring the urgent need for adversarially-aware defense mechanisms in security-critical deployment environments.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Crafting evasive phishing URLs: exploiting tokenizer vulnerabilities in transformer-based detection systems

  • 期刊论文

  • 发表日期：

    2026年7月18日

查看全文
  • Hyun Kwon,
  • Junhyeong Lee

摘要

This paper identifies a critical vulnerability in Transformer-based malicious URL detectors: the visual-semantic misalignment inherent in subword tokenization, where visually imperceptible character substitutions drastically alter token sequences and shift model predictions. Exploiting this vulnerability, we propose Homoglyph-Guided Beam Search (HG-BS), an adversarial attack framework that generates evasive URLs preserving both visual appearance and functional validity under strict structural constraints. Under a budget of only five character substitutions, HG-BS achieves Attack Success Rates of 40.65% against RoBERTa and 50.80% against DistilBERT, demonstrating that even minimal perturbations can critically undermine detection reliability. Comparative analysis further reveals that compressed models exhibit consistently higher vulnerability under realistic class distributions, which we attribute to sharper loss landscape geometry induced by knowledge distillation. These findings establish that current high-accuracy URL detectors rely on fragile token patterns rather than robust semantic understanding, underscoring the urgent need for adversarially-aware defense mechanisms in security-critical deployment environments.