Crafted Unicode in a permit form confuses an AI fee classifier into assigning the wrong fee tier. What attack class should analysts document?

Documenting crafted Unicode in a permit form that pushes an AI fee classifier into the wrong tier as input manipulation is correct because the adversary adversarially alters or encodes form content specifically to mislead the model’s decision boundary. Input manipulation attacks target the model’s interpretation of submitted data rather than merely breaking a classical schema check. Municipal fee classification is a high-value target: a wrong tier undercharges or overcharges applicants and corrupts revenue and fairness metrics. Training data poisoning fails as an explanation because training data poisoning that adversarially alters form content to mislead the AI classifier implies poisoning training data to bias future retraining rather than using crafted Unicode in a submitted form to mislead the classifier at inference time. Model extraction fails conceptually because model extraction that adversarially alters form content to mislead the AI classifier implies querying to clone the AI classifier behavior rather than injecting adversarial Unicode into an application payload to force a wrong tier. Model inversion fails because model inversion that adversarially alters form content to mislead the AI classifier implies recovering prior classifier data rather than submitting crafted Unicode to confuse the model into assigning the wrong fee tier. Exam caveat: not every mis-tiered fee is an attack—training drift, stale fee tables, or ordinary OCR errors can look similar; analysts must preserve the raw Unicode payload and compare it to benign samples before labeling adversarial intent. Operational check: normalize and sanitize permit-form text (canonical Unicode forms, strip invisible/confusable characters), log pre- and post-normalization strings for disputed classifications, and require a human override path when fee tier confidence falls below a defined threshold.