  Online texts with toxic content are a threat in social media that might cause
cyber harassment. Although many platforms applied measures, such as machine
learning-based hate-speech detection systems, to diminish their effect, those
toxic content publishers can still evade the system by modifying the spelling
of toxic words. Those modified words are also known as human-written text
perturbations. Many research works developed certain techniques to generate
adversarial samples to help the machine learning models obtain the ability to
recognize those perturbations. However, there is still a gap between those
machine-generated perturbations and human-written perturbations. In this paper,
we introduce a benchmark test set containing human-written perturbations online
for toxic speech detection models. We also recruited a group of workers to
evaluate the quality of this test set and dropped low-quality samples.
Meanwhile, to check if our perturbation can be normalized to its clean version,
we applied spell corrector algorithms on this dataset. Finally, we test this
data on state-of-the-art language models, such as BERT and RoBERTa, and black
box APIs, such as perspective API, to demonstrate the adversarial attack with
real human-written perturbations is still effective.
