We then explore three shielding methods-visual character embeddings, adversarial training, and rule-based recovery-which substantially improve the robustness of the models.
the shielding methods still fall behind performances achieved in non-attack scenarios, which demonstrates the difficulty of dealing with visual attacks.