MachineTradecraft
Global site search

Search guides, labs, glossary, and research

Type two or more characters to search.

Start with a channel, artifact, or defense term

Examples include zero-width, metadata, tokenizer, or prompt injection.
    Explore · experiment · defend

    Machine TradecraftThe invisible layers of text.

    Humans see content. Machines see structure.

    Machine Tradecraft is the operational discipline of working with machine-perceptible signals—Unicode, HTML and DOM structure, metadata, encodings, tokenization, embeddings, linguistic patterns, prompt attachments, and more—to communicate, influence, detect, or defend against AI systems.Explore the gap between human-visible meaning and machine-visible representation across Unicode, HTML, metadata, encodings, tokens, and AI attachments.

    Start exploring View live demo Read the field definition
    12+
    Signal channels
    31
    Research reports
    0
    Third-party dependencies
    A layered document separated into visible text, HTML and DOM, metadata, Unicode controls, encodings, embeddings, and distinct human and machine views.
    One human-visible artifact can expose several structurally different machine-readable representations.
    Unicode & textZero-width, confusables, bidi HTML & DOMHidden text and structure MetadataPDF, DOCX, images Encodings & tokensBase64, bytes, tokenizer views Linguistic signalsSynonyms, style, semantic patterns Defense & detectionNormalize, compare, canonicalize
    Quick answer

    What is Machine Tradecraft?

    Machine Tradecraft is the systematic practice of designing, embedding, interpreting, exploiting, detecting, or neutralizing information according to machine perception rather than human perception.

    Core idea
    One artifact can produce different effective human and machine representations.
    Useful for
    Inspection, controlled experiments, provenance, safer ingestion, and defensive canonicalization.
    Important limit
    Machine-decodable is receiver-relative, and decoding alone does not prove instruction uptake.
    Interactive micro-demo

    Inspect the same text four different ways.

    Edit an ordinary-looking sentence. The workbench exposes its rendered form, Unicode code points, UTF-8 bytes, and normalized representations without sending the text to any third party.

    Human view is only one view.

    Machine Tradecraft begins by preserving and comparing every representation before deciding what the downstream AI should receive.

    Open the full Machine View workbench
    LIVE MICRO-DEMO

    One artifact. Several machine views.

    Idle
    HUMAN / RENDERED VIEW

    The pro​ject is complete.

    Visible escape: The pro⟦ZERO WIDTH SPACE⟧ject is complete.

    25Characters27UTF-8 bytes1Unusual
    Open the full inspector
    Choose your task

    Start with what you need to do.

    The site is organized as an instrument bench, not a reading sequence.

    01

    Reveal a hidden representation

    Paste text or inspect a controlled artifact across human, Unicode, byte, DOM, structure, and normalized views.

    Open Machine View     02

    Encode or decode a benign signal

    Work with Base64, hexadecimal, percent encoding, Unicode escapes, zero-width binary, and toy linguistic codebooks.

    Open decoder tools     03

    Give a safe attachment to an AI

    Download fixed-marker TXT, HTML, JSON, XML, PDF, DOCX, and PNG fixtures with analysis-first prompts.

    Open attachment workflow     04

    Defend an AI ingestion pipeline

    Preserve evidence, compare independent views, build canonical input, retain provenance, and constrain authority.

    Open the defense workbench
    Channel atlas

    Explore the main machine-readable channels.

    Each channel is defined by a carrier, a receiver, and the transformations it must survive. “Hidden” alone is not an adequate technical description.

    UNICODE CHANNEL

    Invisible Unicode and AI

    Reveal zero-width characters, bidi controls, unusual spaces, and cross-script look-alikes.

    Human view
    Invisible or subtle
    Receiver
    Code-point scanner / tokenizer
    Robustness
    Transport-dependent
    Try demo Read guide
    HTML CHANNEL

    Hidden HTML Text and AI

    Compare DOM nodes, rendered text, comments, CSS state, and accessibility fields.

    Human view
    Non-rendered or low-salience
    Receiver
    DOM / accessibility parser
    Robustness
    Extractor-dependent
    Try demo Read guide
    LINGUISTIC CHANNEL

    Linguistic Steganography for AI

    Decode acrostics, word-length patterns, synonym codebooks, syntax, and semantic choices.

    Human view
    Ordinary-looking prose
    Receiver
    Codebook / statistic
    Robustness
    Usually paraphrase-fragile
    Try demo Read guide
    METADATA CHANNEL

    Document Metadata and AI

    Trace PDF, Office, image, JSON, and XML fields outside the primary visible content.

    Human view
    Properties-only
    Receiver
    File parser / ingestion pipeline
    Robustness
    Container-dependent
    Try demo Read guide
    UNICODE-INTEGRITY CHANNEL

    Unicode Canonicalization and Representation Security

    Trace text from UTF-8 bytes through code points, normalization, grapheme boundaries, bidirectional layout, confusable analysis, and tokenizer-facing forms.

    Human view
    Invisible, equivalent, or visually confusable
    Receiver
    Unicode decoder, renderer, identifier policy, tokenizer
    Robustness
    Transformation- and locale-dependent
    Try demo Read guide
    WEB-REPRESENTATION CHANNEL

    Web Representation Layers

    Compare source HTML, parser-repaired DOM, CSS and layout state, rendered text, accessibility semantics, structured data, and browser-agent observations.

    Human view
    Source, structural, semantic, and rendered divergence
    Receiver
    Browser parser, layout engine, accessibility API, crawler, agent
    Robustness
    State- and browser-dependent
    Try demo Read guide
    DOCUMENT-FORENSICS CHANNEL

    Document Container Forensics

    Inspect files as layered containers with signatures, indexes, relationships, metadata, embedded objects, revisions, chunks, markers, and parser-dependent behavior.

    Human view
    Rendered pages versus container structure
    Receiver
    File parser, renderer, indexer, ingestion service
    Robustness
    Format and parser dependent
    Try demo Read guide
    TOKENIZATION-DIFFERENTIALS CHANNEL

    Tokenization and Normalization Differentials

    Follow text through validation, normalization, pre-tokenization, subword segmentation, token IDs, truncation, chunking, and detokenization.

    Human view
    Human words versus machine subwords
    Receiver
    Tokenizer and language model
    Robustness
    Vocabulary- and version-dependent
    Try demo Read guide

    Compare all channel families

    Counter-tradecraft

    Do not sanitize first. Preserve, compare, then canonicalize.

    A strong pipeline treats hidden-instruction defense as document forensics and provenance, not merely as prompt classification.

    1. 01Preserve

      Hash the original bytes and record provenance.

    2. 02Parse

      Inspect structure without executing active content.

    3. 03Render

      Create the independent human-visible pixel view.

    4. 04Compare

      Diff extraction, DOM, metadata, normalization, and OCR.

    5. 05Classify

      Separate hiddenness, instructionality, and provenance.

    6. 06Canonicalize

      Build new least-privileged model input.

    7. 07Constrain

      Gate tools and effects outside the model.

    Open the defense playbook Test transformation survival
    Working definition H(A) ≠ M(A)
    Machine Tradecraft is the operational discipline of exploiting or controlling the gap between human-visible meaning and machine-visible representation.

    A person may read rendered language and visible pixels. A machine may instead process bytes, Unicode code points, DOM nodes, accessibility names, metadata, token boundaries, probability distributions, embeddings, or tool instructions. The operational question is not merely what an artifact says, but which representation reaches which receiver.

    Read the full formalization and distinctions

    Machine Tradecraft taxonomy

    Six operational domains.

    The umbrella connects distinct mechanisms without treating them as interchangeable.

    Representation tradecraft

    Signals created by differences in code points, bytes, normalization, whitespace, encodings, confusables, and token boundaries.

    What exact symbols or bytes reach the machine?

    Structural tradecraft

    Information carried by document structure rather than the ordinary rendered reading experience.

    What exists in the object graph but not in the visual view?

    Linguistic tradecraft

    Machine-oriented structure embedded in word choice, syntax, punctuation, semantics, probability, or sequence statistics.

    Which acceptable realization was selected, and why?

    Model-interaction tradecraft

    Content constructed for a particular model, parser, retriever, classifier, or tool-using agent to recognize and act upon.

    Which pipeline, model, or learned convention is the receiver?

    Indirect-influence tradecraft

    Instructions or influence delivered through an AI system’s environment rather than its direct user interface.

    How did untrusted environmental data enter the control path?

    Counter-tradecraft

    Methods for preserving evidence, comparing views, detecting discrepancies, sanitizing channels, and limiting authority.

    What would a second independent representation reveal?
    The rule that prevents overclaiming

    Machine-decodable does not mean universally model-decodable.

    A channel can require an exact tokenizer, parser, key, source-model probability distribution, codebook, learned mapping, or decoder tool. A purpose-built script with the right state may recover a signal that an unrelated frontier model cannot infer from the surface text alone.

    See worked examples Read the research
    Machine Tradecraft FAQ

    Frequently asked questions.

    What is Machine Tradecraft?

    Machine Tradecraft is the systematic practice of designing, embedding, interpreting, exploiting, detecting, or neutralizing information according to machine perception rather than human perception.

    How is Machine Tradecraft different from steganography?

    Steganography primarily hides the existence of information. Machine Tradecraft is broader: it includes hidden structure, machine-targeted linguistic signals, watermarking, prompt injection, parser discrepancies, metadata channels, and their defensive countermeasures.

    Can any AI automatically decode an invisible or hidden message?

    No. A signal may require a particular tokenizer, parser, secret key, codebook, source-model distribution, decoder tool, or learned convention. Machine-decodable does not mean universally model-decodable.

    What are common Machine Tradecraft examples?

    Examples include zero-width Unicode, cross-script homoglyphs, hidden DOM text, alt text and metadata, Base64 or hexadecimal payloads, acrostics, synonym codebooks, token watermarks, and indirect prompt injection through external documents.

    How do you defend AI systems against machine-readable hidden instructions?

    Preserve original bytes, inspect Unicode and structure, compare extracted text with rendered pixels and OCR, inventory metadata separately, build a new canonical input, retain provenance, and separate untrusted-data readers from tool-using or state-changing components.

    Research and reference

    Trace the field from standards to controlled experiments.

    The research library includes 31 governed reports covering representation security, tokenization, web and document structure, metadata, provenance, prompt injection, steganalysis, supply chains, browser agents, and defense operations.

    LIBRARYRead the research reports

    Browse evidence-status labels, source notes, raw Markdown, and topic-focused reports.
    GLOSSARYUse a precise vocabulary

    Distinguish extraction, decoding, uptake, metadata, provenance, and receiver knowledge.
    SCOPEUnderstand the safety boundary

    All active samples use benign markers and exclude secrets, tools, egress, persistence, and state changes.
    Continue exploring

    Move from the current explanation to a related guide, evidence source, or controlled workbench.

    Field guideDefine Machine Tradecraft preciselyUse the formal model, classification test, taxonomy, and limits before generalizing from one artifact.Open this path Laboratory catalogChoose a focused local experimentBrowse 40 bounded laboratories spanning representation, files, messages, models, provenance, agents, supply chains, and defense.Open this path Evidence libraryTrace claims to governed researchRead 31 local reports with source transparency, stable fragments, raw Markdown, and explicit evidence labels.Open this path