Understanding the Ability of LLMs to Handle Character-Level Perturbation

This work investigates the resilience of contemporary large language models (LLMs) against frequent character-level perturbations. We examine three types of character-level perturbations including introducing numerous typos within words, shuffling the characters in each word, and inserting a large number of invisible characters into the text. Surprisingly, even under severe perturbation, such as shuffling nearly all words character-wise to produce text that is almost unreadable to humans, or inserting invisible characters which are several times more than the visible ones as noise, many LLMs still maintain notable performance. We explore the underlying causes of this robustness and find that LLMs exhibit remarkable resilience to chaotic segmentation and fragmented tokenization. Furthermore, we examine the mechanisms by which LLMs remove perturbations to correctly comprehend text, including both implicit and explicit mechanisms for character-level perturbation. We hope that our findings on the low-level robustness of LLMs will unveil their inherent architectural strengths, reveal the potential risks of their misuse, and inform the reliable deployment of LLMs across diverse application scenarios.

In daily use of Large Language Models (LLMs), input texts sometimes contain natural errors like typos. Alternatively, some might intentionally introduce perturbations into the text to cause the model to produce unexpected outputs. Because LLMs process words in units of tokens, these character-level perturbations can cause unexpected tokenization and introduce noise. This raises a critical question: are models resilient to such interference? This paper investigates this by testing models with severe distortions, such as excessive typos, completely shuffled letters within words, and injected invisible noise characters. Surprisingly, even when the text is altered to the point of being completely unreadable to humans, many LLMs can still successfully comprehend the input and maintain a notable level of performance on reasoning tasks. To understand why this happens, the study explores the underlying mechanisms that allow these models to tolerate such chaotic text and recover the true meaning of the words. Ultimately, these findings highlight a previously underexplored resilience in LLMs. This robustness shows promise for processing messy real-world data, but also reveals potential security vulnerabilities where bad actors might use invisible noise to bypass AI safety filters.