app.py

"""
Gradio web interface for Unicode adversarial attack demonstration.

Uses GGUF quantized models via llama-cpp-python for CPU inference.
Designed for deployment on HuggingFace Spaces (free CPU tier).

Supervisor approved: Feb 9, 2026
"""

import os
from pathlib import Path

import gradio as gr

# =============================================================================
# Unicode Style Mappings
# =============================================================================

SMALL_CAPS_MAP = {
    'a': '\u1d00', 'b': '\u0299', 'c': '\u1d04', 'd': '\u1d05', 'e': '\u1d07', 'f': '\ua730', 'g': '\u0262',
    'h': '\u029c', 'i': '\u026a', 'j': '\u1d0a', 'k': '\u1d0b', 'l': '\u029f', 'm': '\u1d0d', 'n': '\u0274',
    'o': '\u1d0f', 'p': '\u1d18', 'q': '\u01eb', 'r': '\u0280', 's': '\ua731', 't': '\u1d1b', 'u': '\u1d1c',
    'v': '\u1d20', 'w': '\u1d21', 'x': 'x', 'y': '\u028f', 'z': '\u1d22',
    'A': '\u1d00', 'B': '\u0299', 'C': '\u1d04', 'D': '\u1d05', 'E': '\u1d07', 'F': '\ua730', 'G': '\u0262',
    'H': '\u029c', 'I': '\u026a', 'J': '\u1d0a', 'K': '\u1d0b', 'L': '\u029f', 'M': '\u1d0d', 'N': '\u0274',
    'O': '\u1d0f', 'P': '\u1d18', 'Q': '\u01eb', 'R': '\u0280', 'S': '\ua731', 'T': '\u1d1b', 'U': '\u1d1c',
    'V': '\u1d20', 'W': '\u1d21', 'X': 'x', 'Y': '\u028f', 'Z': '\u1d22',
}

CANADIAN_ABORIGINAL_MAP = {
    'a': '\u141e', 'b': '\u1472', 'c': '\u1438', 'd': '\u146f', 'e': '\u156a', 'f': '\u155d', 'g': '\u1550',
    'h': '\u144b', 'i': '\u1403', 'j': '\u1489', 'k': '\u1420', 'l': '\u14bb', 'm': '\u14bb', 'n': '\u1422',
    'o': '\u14f1', 'p': '\u146d', 'q': '\u1574', 'r': '\u1550', 's': '\u1506', 't': '\u1466', 'u': '\u1421',
    'v': '\u142f', 'w': '\u1424', 'x': '\u157d', 'y': '\u153e', 'z': '\u1646',
    'A': '\u141e', 'B': '\u1472', 'C': '\u1438', 'D': '\u146f', 'E': '\u156a', 'F': '\u155d', 'G': '\u1550',
    'H': '\u144b', 'I': '\u1403', 'J': '\u1489', 'K': '\u1420', 'L': '\u14bb', 'M': '\u14bb', 'N': '\u1422',
    'O': '\u14f1', 'P': '\u146d', 'Q': '\u1574', 'R': '\u1550', 'S': '\u1506', 'T': '\u1466', 'U': '\u1421',
    'V': '\u142f', 'W': '\u1424', 'X': '\u157d', 'Y': '\u153e', 'Z': '\u1646',
}

CIRCLED_MAP = {
    'a': '\u24d0', 'b': '\u24d1', 'c': '\u24d2', 'd': '\u24d3', 'e': '\u24d4', 'f': '\u24d5', 'g': '\u24d6',
    'h': '\u24d7', 'i': '\u24d8', 'j': '\u24d9', 'k': '\u24da', 'l': '\u24db', 'm': '\u24dc', 'n': '\u24dd',
    'o': '\u24de', 'p': '\u24df', 'q': '\u24e0', 'r': '\u24e1', 's': '\u24e2', 't': '\u24e3', 'u': '\u24e4',
    'v': '\u24e5', 'w': '\u24e6', 'x': '\u24e7', 'y': '\u24e8', 'z': '\u24e9',
    'A': '\u24b6', 'B': '\u24b7', 'C': '\u24b8', 'D': '\u24b9', 'E': '\u24ba', 'F': '\u24bb', 'G': '\u24bc',
    'H': '\u24bd', 'I': '\u24be', 'J': '\u24bf', 'K': '\u24c0', 'L': '\u24c1', 'M': '\u24c2', 'N': '\u24c3',
    'O': '\u24c4', 'P': '\u24c5', 'Q': '\u24c6', 'R': '\u24c7', 'S': '\u24c8', 'T': '\u24c9', 'U': '\u24ca',
    'V': '\u24cb', 'W': '\u24cc', 'X': '\u24cd', 'Y': '\u24ce', 'Z': '\u24cf',
}

SQUARED_MAP = {
    'A': '\U0001F130', 'B': '\U0001F131', 'C': '\U0001F132', 'D': '\U0001F133', 'E': '\U0001F134', 'F': '\U0001F135', 'G': '\U0001F136',
    'H': '\U0001F137', 'I': '\U0001F138', 'J': '\U0001F139', 'K': '\U0001F13A', 'L': '\U0001F13B', 'M': '\U0001F13C', 'N': '\U0001F13D',
    'O': '\U0001F13E', 'P': '\U0001F13F', 'Q': '\U0001F140', 'R': '\U0001F141', 'S': '\U0001F142', 'T': '\U0001F143', 'U': '\U0001F144',
    'V': '\U0001F145', 'W': '\U0001F146', 'X': '\U0001F147', 'Y': '\U0001F148', 'Z': '\U0001F149',
    'a': '\U0001F130', 'b': '\U0001F131', 'c': '\U0001F132', 'd': '\U0001F133', 'e': '\U0001F134', 'f': '\U0001F135', 'g': '\U0001F136',
    'h': '\U0001F137', 'i': '\U0001F138', 'j': '\U0001F139', 'k': '\U0001F13A', 'l': '\U0001F13B', 'm': '\U0001F13C', 'n': '\U0001F13D',
    'o': '\U0001F13E', 'p': '\U0001F13F', 'q': '\U0001F140', 'r': '\U0001F141', 's': '\U0001F142', 't': '\U0001F143', 'u': '\U0001F144',
    'v': '\U0001F145', 'w': '\U0001F146', 'x': '\U0001F147', 'y': '\U0001F148', 'z': '\U0001F149',
}

UPSIDE_DOWN_MAP = {
    'a': '\u0250', 'b': 'q', 'c': '\u0254', 'd': 'p', 'e': '\u01dd', 'f': '\u025f',
    'g': '\u0183', 'h': '\u0265', 'i': '\u0131', 'j': '\u027e', 'k': '\u029e', 'l': '\u05df',
    'm': '\u026f', 'n': 'u', 'o': 'o', 'p': 'd', 'q': 'b', 'r': '\u0279',
    's': 's', 't': '\u0287', 'u': 'n', 'v': '\u028c', 'w': '\u028d', 'x': 'x',
    'y': '\u028e', 'z': 'z',
    'A': '\u2200', 'B': 'q', 'C': '\u03fd', 'D': '\u15e1', 'E': '\u018e', 'F': '\u2132',
    'G': '\u0183', 'H': 'H', 'I': 'I', 'J': '\u017f', 'K': '\u029e', 'L': '\u02e5',
    'M': 'W', 'N': 'N', 'O': 'O', 'P': '\u0500', 'Q': '\u1f49', 'R': '\u1d1a',
    'S': 'S', 'T': '\u22a5', 'U': '\u2229', 'V': '\u039b', 'W': 'M', 'X': 'X',
    'Y': '\u028e', 'Z': 'Z',
    '.': '\u02d9', ',': "'", "'": ',', '?': '\u00bf', '!': '\u00a1',
    '[': ']', ']': '[', '(': ')', ')': '(', '_': '\u203e', ';': '\u061b',
}

MATH_SCRIPT_MAP = {
    'a': '\U0001d4b6', 'b': '\U0001d4b7', 'c': '\U0001d4b8', 'd': '\U0001d4b9', 'e': '\u212f', 'f': '\U0001d4bb',
    'g': '\u210a', 'h': '\U0001d4bd', 'i': '\U0001d4be', 'j': '\U0001d4bf', 'k': '\U0001d4c0', 'l': '\U0001d4c1',
    'm': '\U0001d4c2', 'n': '\U0001d4c3', 'o': '\u2134', 'p': '\U0001d4c5', 'q': '\U0001d4c6', 'r': '\U0001d4c7',
    's': '\U0001d4c8', 't': '\U0001d4c9', 'u': '\U0001d4ca', 'v': '\U0001d4cb', 'w': '\U0001d4cc', 'x': '\U0001d4cd',
    'y': '\U0001d4ce', 'z': '\U0001d4cf',
    'A': '\U0001d49c', 'B': '\u212c', 'C': '\U0001d49e', 'D': '\U0001d49f', 'E': '\u2130', 'F': '\u2131',
    'G': '\U0001d4a2', 'H': '\u210b', 'I': '\u2110', 'J': '\U0001d4a5', 'K': '\U0001d4a6', 'L': '\u2112',
    'M': '\u2133', 'N': '\U0001d4a9', 'O': '\U0001d4aa', 'P': '\U0001d4ab', 'Q': '\U0001d4ac', 'R': '\u211b',
    'S': '\U0001d4ae', 'T': '\U0001d4af', 'U': '\U0001d4b0', 'V': '\U0001d4b1', 'W': '\U0001d4b2', 'X': '\U0001d4b3',
    'Y': '\U0001d4b4', 'Z': '\U0001d4b5',
}

FRAKTUR_MAP = {
    'a': '\U0001d51e', 'b': '\U0001d51f', 'c': '\U0001d520', 'd': '\U0001d521', 'e': '\U0001d522', 'f': '\U0001d523',
    'g': '\U0001d524', 'h': '\U0001d525', 'i': '\U0001d526', 'j': '\U0001d527', 'k': '\U0001d528', 'l': '\U0001d529',
    'm': '\U0001d52a', 'n': '\U0001d52b', 'o': '\U0001d52c', 'p': '\U0001d52d', 'q': '\U0001d52e', 'r': '\U0001d52f',
    's': '\U0001d530', 't': '\U0001d531', 'u': '\U0001d532', 'v': '\U0001d533', 'w': '\U0001d534', 'x': '\U0001d535',
    'y': '\U0001d536', 'z': '\U0001d537',
    'A': '\U0001d504', 'B': '\U0001d505', 'C': '\u212d', 'D': '\U0001d507', 'E': '\U0001d508', 'F': '\U0001d509',
    'G': '\U0001d50a', 'H': '\u210c', 'I': '\u2111', 'J': '\U0001d50d', 'K': '\U0001d50e', 'L': '\U0001d50f',
    'M': '\U0001d510', 'N': '\U0001d511', 'O': '\U0001d512', 'P': '\U0001d513', 'Q': '\U0001d514', 'R': '\u211c',
    'S': '\U0001d516', 'T': '\U0001d517', 'U': '\U0001d518', 'V': '\U0001d519', 'W': '\U0001d51a', 'X': '\U0001d51b',
    'Y': '\U0001d51c', 'Z': '\u2128',
}

CHEROKEE_MAP = {
    'a': '\uab7a', 'b': '\u13fc', 'c': '\uab6f', 'd': '\uab70', 'e': '\uab7c', 'f': '\uab81', 'g': '\u13fd',
    'h': '\uab8b', 'i': '\uab96', 'j': '\uab7b', 'k': '\uabb6', 'l': '\uabae', 'm': '\uab87', 'n': '\uab91',
    'o': '\uab8e', 'p': '\uabb2', 'q': '\uab74', 'r': '\uab71', 's': '\uabaa', 't': '\uab72', 'u': '\uabbc',
    'v': '\uaba9', 'w': '\uaba4', 'x': '\uab82', 'y': '\uab79', 'z': '\uab93',
    'A': '\uab7a', 'B': '\u13fc', 'C': '\uab6f', 'D': '\uab70', 'E': '\uab7c', 'F': '\uab81', 'G': '\u13fd',
    'H': '\uab8b', 'I': '\uab96', 'J': '\uab7b', 'K': '\uabb6', 'L': '\uabae', 'M': '\uab87', 'N': '\uab91',
    'O': '\uab8e', 'P': '\uabb2', 'Q': '\uab74', 'R': '\uab71', 'S': '\uabaa', 'T': '\uab72', 'U': '\uabbc',
    'V': '\uaba9', 'W': '\uaba4', 'X': '\uab82', 'Y': '\uab79', 'Z': '\uab93',
}

STYLES = {
    'small_caps': ('Small Caps', SMALL_CAPS_MAP),
    'canadian_aboriginal': ('Canadian Aboriginal', CANADIAN_ABORIGINAL_MAP),
    'circled': ('Circled Letters', CIRCLED_MAP),
    'squared': ('Squared Letters', SQUARED_MAP),
    'upside_down': ('Upside Down', UPSIDE_DOWN_MAP),
    'math_script': ('Math Script', MATH_SCRIPT_MAP),
    'fraktur': ('Fraktur', FRAKTUR_MAP),
    'cherokee': ('Cherokee', CHEROKEE_MAP),
}

# =============================================================================
# Model Configuration
# =============================================================================

MODELS = {
    'gemma': {
        'name': 'Gemma-2-2b-it',
        'repo_id': 'bartowski/gemma-2-2b-it-GGUF',
        'filename': 'gemma-2-2b-it-Q4_K_M.gguf',
        'chat_format': 'gemma',
    },
    'phi': {
        'name': 'Phi-3-mini-4k',
        'repo_id': 'microsoft/Phi-3-mini-4k-instruct-gguf',
        'filename': 'Phi-3-mini-4k-instruct-q4.gguf',
        'chat_format': 'chatml',
    },
    'qwen': {
        'name': 'Qwen2.5-3B',
        'repo_id': 'Qwen/Qwen2.5-3B-Instruct-GGUF',
        'filename': 'qwen2.5-3b-instruct-q4_k_m.gguf',
        'chat_format': 'chatml',
    },
}

# Global model cache — one model at a time to avoid memory pressure
_current_model = None
_current_model_name = None
_llama_class = None


def _prepare_musl_compat():
    """
    Some prebuilt llama-cpp wheels expect musl runtime symbol names.
    On glibc-based HF Spaces, provide a local compatibility symlink.
    """
    target_candidates = [
        Path("/lib/ld-musl-x86_64.so.1"),
        Path("/usr/lib/ld-musl-x86_64.so.1"),
        Path("/lib/x86_64-linux-musl/libc.so"),
        Path("/usr/lib/x86_64-linux-musl/libc.so"),
    ]
    target = next((p for p in target_candidates if p.exists()), None)
    if target is None:
        return

    compat_dir = Path("/tmp/musl-compat")
    compat_dir.mkdir(parents=True, exist_ok=True)
    compat_lib = compat_dir / "libc.musl-x86_64.so.1"
    if not compat_lib.exists():
        compat_lib.symlink_to(target)

    current = os.environ.get("LD_LIBRARY_PATH", "")
    if str(compat_dir) not in current.split(":"):
        os.environ["LD_LIBRARY_PATH"] = (
            f"{compat_dir}:{current}" if current else str(compat_dir)
        )


def _get_llama_class():
    """Lazy import llama-cpp after runtime compatibility setup."""
    global _llama_class
    if _llama_class is None:
        _prepare_musl_compat()
        from llama_cpp import Llama as _Llama

        _llama_class = _Llama
    return _llama_class

# =============================================================================
# Core Functions
# =============================================================================

def transform_text(text: str, style: str) -> str:
    """Transform text using the specified Unicode style."""
    if style not in STYLES:
        return text
    char_map = STYLES[style][1]
    mapped = ''.join(char_map.get(c, c) for c in text)
    if style == 'upside_down':
        mapped = mapped[::-1]
    return mapped


def load_model(model_key: str):
    """Load a GGUF model. Keeps one model at a time to avoid memory pressure."""
    global _current_model, _current_model_name

    if _current_model_name == model_key and _current_model is not None:
        return _current_model

    # Unload previous model to free RAM
    if _current_model is not None:
        del _current_model
        _current_model = None
        _current_model_name = None

    config = MODELS[model_key]
    Llama = _get_llama_class()
    _current_model = Llama.from_pretrained(
        repo_id=config['repo_id'],
        filename=config['filename'],
        n_ctx=512,
        n_threads=8,
        verbose=False,
    )
    _current_model_name = model_key
    return _current_model


def preload_default_model():
    """Pre-load the default model (Phi) at startup."""
    print("Pre-loading default model (Phi-3-mini)...")
    load_model('phi')
    print("Default model ready.")


def get_prediction(model, text: str, task: str, model_key: str) -> str:
    """Get model prediction for the given text and task.

    Uses the same prompt structure as the actual experiments
    (phase1_evaluation.ipynb) for consistency.
    """

    if task == 'fact_verification':
        user_prompt = f"""Classify the following claim as either 'SUPPORTS', 'REFUTES', or 'NOT_ENOUGH_INFO'.

The available classes are:
- "SUPPORTS": The claim is true or supported by common knowledge.
- "REFUTES": The claim is false or contradicts established facts.
- "NOT_ENOUGH_INFO": The claim cannot be verified with common knowledge.

### Important:
- **Only choose one class from the above-mentioned classes.**
- **Answer with just one word, no other explanations.**

Claim: {text}

Answer:"""
    else:
        user_prompt = f"""Determine if the following sentence is an argument. An argument is a statement that takes a position on a topic and provides reasoning or evidence.

The available classes are:
- "ARGUMENT": The sentence is an argument (takes a stance with reasoning).
- "NOT_ARGUMENT": The sentence is not an argument (factual statement, question, or lacks clear stance).

### Important:
- **Only choose one class from the above-mentioned classes.**
- **Answer with just one word, no other explanations.**

Sentence: {text}

Answer:"""

    messages = [
        {"role": "user", "content": user_prompt},
    ]

    response = model.create_chat_completion(
        messages=messages,
        max_tokens=8,
        temperature=0,
    )

    output = response['choices'][0]['message']['content'].strip().upper()

    # Robust label extraction (matches experiment extract_classification logic)
    if task == 'fact_verification':
        if 'NOT_ENOUGH_INFO' in output or 'NOT ENOUGH INFO' in output or 'NEI' in output:
            return 'NOT_ENOUGH_INFO'
        if 'REFUTE' in output:
            return 'REFUTES'
        if 'SUPPORT' in output:
            return 'SUPPORTS'
        return 'NOT_ENOUGH_INFO'
    else:
        if 'NOT_ARGUMENT' in output or 'NOT ARGUMENT' in output or 'NOT AN ARGUMENT' in output:
            return 'NOT_ARGUMENT'
        if output.startswith('NO'):
            return 'NOT_ARGUMENT'
        if 'ARGUMENT' in output:
            return 'ARGUMENT'
        if output.startswith('YES'):
            return 'ARGUMENT'
        return 'NOT_ARGUMENT'


def run_attack(text: str, style: str, model_key: str, task: str, progress=gr.Progress()):
    """Run the Unicode attack and compare predictions."""
    import time

    if not text.strip():
        return "", "", "", "Please enter some text.", ""

    try:
        t_start = time.time()

        # Transform text
        progress(0.0, desc="Transforming text...")
        styled_text = transform_text(text, style)

        # Load model (shows progress)
        progress(0.1, desc="Loading model (may take a moment on first run)...")
        yield styled_text, "Loading model...", "", "Loading model (this may take a moment)...", ""

        model = load_model(model_key)

        # Get original prediction
        progress(0.4, desc="Running inference on original text...")
        yield styled_text, "Running...", "", "Getting prediction for original text...", ""
        original_pred = get_prediction(model, text, task, model_key)

        # Get styled prediction
        progress(0.7, desc="Running inference on styled text...")
        yield styled_text, original_pred, "Running...", "Getting prediction for styled text...", ""
        styled_pred = get_prediction(model, styled_text, task, model_key)

        progress(1.0, desc="Done!")
        elapsed = time.time() - t_start

        # Determine result
        if original_pred != styled_pred:
            status = f"ATTACK SUCCEEDED: Prediction changed from {original_pred} to {styled_pred}\nTime taken: {elapsed:.1f}s"
            result_color = "green"
        else:
            status = f"Attack failed: Prediction unchanged ({original_pred})\nTime taken: {elapsed:.1f}s"
            result_color = "red"

        yield styled_text, original_pred, styled_pred, status, result_color

    except Exception as e:
        yield "", "", "", f"Error: {str(e)}", "red"


def preview_all_styles(text: str) -> str:
    """Preview text in all available Unicode styles."""
    if not text.strip():
        return "Enter text to preview."

    lines = [f"Original: {text}", "=" * 50]
    for key, (name, _) in STYLES.items():
        styled = transform_text(text, key)
        lines.append(f"\n{name}:\n{styled}")
    return '\n'.join(lines)


# =============================================================================
# Sample Sentences (from actual experiment datasets)
# =============================================================================

SAMPLE_SENTENCES = {
    'fact_verification': [
        "Sea level rise due to global warming is exaggerated.",
        "CO2 is increasing rapidly, and is reaching levels not seen on the earth for millions of years.",
        "Antarctica is too cold to lose ice.",
        "Greenhouse gases have been the main contributor of warming since 1970.",
        "The polar bear population has been growing.",
        "Renewables can't provide baseload power",
        "Sea ice has diminished much faster than scientists and climate models anticipated.",
        "Arctic sea ice extent was lower in the past.",
        "A large amount of warming is delayed, and if we don't act now we could pass tipping points.",
        "Clouds provide negative feedback.",
    ],
    'argument_mining': [
        "proponents of concealed carry say that criminals are less likely to attack someone they believe to be armed .",
        "the right to not be killed supersedes the right to not be pregnant .",
        "marijuana is less addictive than tobacco or alcohol , and compares favorably to those drugs on nearly every health metric .",
        "nuclear wastes as , or in , spent fuel are an unresolved problem .",
        "humans should not be turned into an experimental playground .",
        "higher prices lead to decreased demand , which can have a depressive effect on the economy .",
        "abortion is condemnable for the same reasons that slavery and genocide are .",
        "students can wear a variety of expressive items , such as buttons or jewlery .",
        "so where does all of this leave us ?",
        "diseases which have dogged us for generations could be wiped out due to our evolving faster than they could ever hope to .",
    ],
}


def get_sample_choices(task):
    """Return dropdown choices and set text input to first sample."""
    sentences = SAMPLE_SENTENCES.get(task, SAMPLE_SENTENCES['fact_verification'])
    first = sentences[0]
    dropdown_update = gr.update(
        choices=[(s[:80] + "..." if len(s) > 80 else s, s) for s in sentences],
        value=first,
    )
    return dropdown_update, first


def fill_from_sample(sample):
    """Fill the text input when a sample is selected."""
    if sample:
        return sample
    return gr.update()


# =============================================================================
# Gradio Interface
# =============================================================================

def create_demo():
    """Create the Gradio demo interface."""

    with gr.Blocks(
        title="Unicode Adversarial Attack Demo",
        theme=gr.themes.Soft(),
    ) as demo:

        gr.Markdown("""
        # Unicode Adversarial Attack Demo

        Test how LLMs respond to Unicode-styled text. This demo transforms your input
        using special Unicode characters and compares model predictions.

        **Note:** This demo uses quantized models (Q4) for CPU inference.
        Results may differ slightly from full-precision models used in experiments.
        Each attack takes approximately **60–90 seconds** to complete (two inference passes on free CPU hardware).
        """)

        with gr.Tab("Attack Demo"):
            with gr.Row():
                with gr.Column(scale=1):
                    text_input = gr.Textbox(
                        label="Input Text",
                        lines=3,
                        placeholder="Enter a claim or statement, or pick one from the samples below...",
                        value="Sea level rise due to global warming is exaggerated.",
                    )

                    sample_dropdown = gr.Dropdown(
                        choices=[(s[:80] + "..." if len(s) > 80 else s, s)
                                 for s in SAMPLE_SENTENCES['fact_verification']],
                        label="Sample Sentences (from experiment datasets)",
                        value=None,
                        interactive=True,
                    )

                    with gr.Row():
                        style_dropdown = gr.Dropdown(
                            choices=[(STYLES[k][0], k) for k in STYLES],
                            label="Unicode Style",
                            value="upside_down",
                        )
                        model_dropdown = gr.Dropdown(
                            choices=[(MODELS[k]['name'], k) for k in MODELS],
                            label="Model",
                            value="phi",
                        )

                    task_dropdown = gr.Dropdown(
                        choices=[
                            ("Fact Verification", "fact_verification"),
                            ("Argument Mining", "argument_mining"),
                        ],
                        label="Task",
                        value="fact_verification",
                    )

                    run_btn = gr.Button("Run Attack", variant="primary", size="lg")

                with gr.Column(scale=1):
                    styled_output = gr.Textbox(label="Styled Text", lines=3)

                    with gr.Row():
                        original_pred = gr.Textbox(label="Original Prediction")
                        styled_pred = gr.Textbox(label="Styled Prediction")

                    status_output = gr.Textbox(label="Result", lines=2)
                    result_state = gr.State("")

            # Wire up sample dropdown → text input
            sample_dropdown.change(
                fn=fill_from_sample,
                inputs=[sample_dropdown],
                outputs=[text_input],
            )

            # Wire up task change → update sample dropdown + text input
            task_dropdown.change(
                fn=get_sample_choices,
                inputs=[task_dropdown],
                outputs=[sample_dropdown, text_input],
            )

            run_btn.click(
                fn=run_attack,
                inputs=[text_input, style_dropdown, model_dropdown, task_dropdown],
                outputs=[styled_output, original_pred, styled_pred, status_output, result_state],
            )

        with gr.Tab("Style Preview"):
            gr.Markdown("### Preview Unicode Styles")
            gr.Markdown("See how your text looks in each of the 8 Unicode styles before running an attack.")

            preview_input = gr.Textbox(
                label="Enter text",
                placeholder="Type something...",
                value="Climate change is real",
            )
            preview_btn = gr.Button("Preview All Styles")
            preview_output = gr.Textbox(label="Styled Versions", lines=25)

            preview_btn.click(
                fn=preview_all_styles,
                inputs=[preview_input],
                outputs=[preview_output],
            )

        with gr.Tab("About"):
            gr.Markdown("""
            ## About This Demo

            This demo accompanies the research project:

            **"Unicode-Based Adversarial Attacks on Large Language Models: Evaluating Robustness and Building Interactive Attack Interfaces"**

            ### Key Findings (Phase 1: Full-Text Transformation)

            | Metric | Value |
            |--------|-------|
            | Total Experiments | 48 (3 models x 2 tasks x 8 styles) |
            | Total Samples Tested | 118,752 |
            | Overall Attack Success Rate | 52.1% |
            | Most Vulnerable Model | Phi-3-mini (60.7% ASR) |
            | Most Robust Model | Gemma-2-2b (39.1% ASR) |
            | Most Effective Style | Upside Down (58.4% ASR) |

            ### Phase 2: Importance-Based Perturbation

            Using gradient-based word importance (Captum Saliency), we perturb words
            one at a time in importance order until the prediction flips.

            | Model | ASR | Mean Perturbation Ratio |
            |-------|-----|------------------------|
            | Gemma-2-2b | 42.8% | 13.8% of words |
            | Phi-3-mini | 64.5% | 24.4% of words |
            | Qwen2.5-3B | 65.0% | 12.8% of words |

            ### Models Used

            | Model | Parameters | Quantization |
            |-------|------------|--------------|
            | Gemma-2-2b-it | 2B | Q4_K_M |
            | Phi-3-mini-4k | 3.8B | Q4 |
            | Qwen2.5-3B | 3B | Q4_K_M |

            ### Unicode Styles (8 Styles)

            | Style | Example | Mean ASR |
            |-------|---------|----------|
            | Small Caps | \u1d1b\u1d07x\u1d1b \u029f\u026a\u1d0b\u1d07 \u1d1b\u029c\u026a\ua731 | 38.1% |
            | Canadian Aboriginal | \u1466\u156a\u1506\u1424 \u14bb\u1403\u1420\u156a \u1466\u144b\u1403\u1506 | 56.5% |
            | Circled Letters | \u24e3\u24d4\u24e7\u24e3 \u24db\u24d8\u24da\u24d4 \u24e3\u24d7\u24d8\u24e2 | 53.1% |
            | Squared Letters | \U0001F143\U0001F134\U0001F147\U0001F143 \U0001F13B\U0001F138\U0001F13A\U0001F134 \U0001F143\U0001F137\U0001F138\U0001F142 | 53.1% |
            | Upside Down | s\u0131\u0265\u0287 \u01dd\u029e\u0131\u05df \u0287x\u01dd\u0287 | 58.4% |
            | Math Script | \U0001d4c9\u212f\U0001d4cd\U0001d4c9 \U0001d4c1\U0001d4be\U0001d4c0\u212f \U0001d4c9\U0001d4bd\U0001d4be\U0001d4c8 | 50.5% |
            | Fraktur | \U0001d531\U0001d522\U0001d535\U0001d531 \U0001d529\U0001d526\U0001d528\U0001d522 \U0001d531\U0001d525\U0001d526\U0001d530 | 52.6% |
            | Cherokee | \uab72\uab7c\uab82\uab72 \uabae\uab96\uabb6\uab7c \uab72\uab8b\uab96\uabaa | 54.3% |

            ---

            **Student:** Endrin Hoti (King's College London)
            **Supervisor:** Dr. Oana Cocarascu
            """)

        gr.Markdown("""
        ---
        *First query may be slow while the model downloads and loads (~2GB per model).
        Subsequent queries with the same model will be much faster.*
        """)

    return demo


# =============================================================================
# Entry Point
# =============================================================================

if __name__ == "__main__":
    print("Starting model pre-load...")
    preload_default_model()
    demo = create_demo()
    demo.queue(default_concurrency_limit=1)
    demo.launch()