Character-level perturbations are widely used to evade Chinese toxicity detection, yet existing benchmarks either cover only a limited range of perturbations or expand perturbation coverage without balanced construction across toxic and non-toxic samples, leaving these two requirements unmet within a single benchmark. We introduce COAT (Chinese Orthogonal Adversarial Toxicity), a 41K-sample benchmark spanning eight perturbation types that enforces perturbation orthogonality: all perturbations are applied with equal probability to both toxic and non-toxic texts, ensuring P(toxic | perturbed) = 0.5. As a core diagnostic layer, we annotate Natural Language Variant Ambiguity (NLVA): 21.6% of clean samples naturally contain surface features overlapping with perturbation artifacts, enabling controlled analysis of model sensitivity to perturbation-like features and classification difficulty. Evaluating five encoder classifiers, three proprietary LLMs, and Llama3-8B with chain-of-thought reasoning, we find that (1) models remain systematically sensitive to perturbation-like features even under balanced training, and (2) across Llama3-8B variants, overcorrection varies systematically with the linguistic ambiguity introduced by each perturbation type. Step-level diagnosis localizes the shared bottleneck to semantic restoration, with targeted preference optimization yielding reliable gains on the most ambiguous types.