As AI-powered spam filters become more widely deployed, researchers and threat analysts are documenting a growing arsenal of techniques that attackers use to defeat them — from classic obfuscation tricks to sophisticated adversarial manipulation and training-data poisoning. Among the most persistent is text salting, a method that has resurfaced as a particularly effective tactic against modern filtering systems as of mid-2026.
Text salting involves the intentional addition or distortion of email content to evade automatic filtering. Attackers pad phishing or spam emails with large volumes of harmless-looking text, confusing AI content analysis engines and diluting the malicious signal. Salt text is frequently invisible to human recipients yet remains fully processed by filtering systems. By manipulating the word-frequency statistics that Bayesian and machine-learning filters depend on, salting skews spam probability calculations toward benign classifications, allowing malicious messages to reach inboxes undetected.
Legacy obfuscation techniques remain equally disruptive. Spammers continue to break target words into fragments, insert HTML comments, and substitute special characters to defeat keyword matching. Misplaced spaces, deliberate misspellings, and letter substitutions preserve human readability while degrading machine recognition. Unicode transliteration and HTML redrawing further complicate tokenization and feature extraction by altering visual presentation without changing semantic content.
Behavioral research confirms that spammers systematically cycle through modified email templates and structures, continuously probing and exploiting weaknesses in statistical filters that rely heavily on isolated term frequencies.
Beyond obfuscation, adversarial attacks pose a deeper structural threat. Machine-learning spam filters are susceptible to carefully crafted perturbations that cause misclassification of spam as legitimate email. Research on adversarial email generation demonstrates that small, targeted modifications to message content can flip spam to ham and ham to spam, destabilizing filtering pipelines without altering the underlying filter code.
These attacks exploit model decision boundaries and feature-weighting weaknesses, operating entirely on the content layer. In documented cases, misclassification rates under adversarial manipulation have risen sufficiently to force organizations to disable antispam services due to unacceptable performance degradation.
Training-data poisoning represents a longer-term threat vector. By corrupting the datasets on which statistical filters are trained, attackers cause models to learn misleading associations between words and spam or ham classifications. Experiments on SpamBayes have shown that access to approximately 1% of training messages is sufficient for an adversary to render the filter largely ineffective.
More targeted poisoning attacks can subvert filters to suppress specific legitimate emails while allowing general spam traffic to pass freely through.
Taken together, these techniques — text salting, obfuscation, adversarial perturbation, and data poisoning — form a layered threat landscape that continues to outpace defenses. As filtering systems grow more sophisticated, so do the methods used to undermine them, raising persistent questions about the long-term reliability of AI-driven email security.
