A shared vocabulary for the perception gap.

A browser-produced semantic representation for assistive technology. It can elevate alt text and ARIA names that are not part of the ordinary visual reading experience.

A defender who modifies or rewrites content—through normalization, paraphrase, translation, or reformatting—to disrupt a suspected covert channel.

Constructing a consistent, policy-defined representation from an input while retaining the original as evidence.

A numbered Unicode character value such as U+200B. Code points are not the same thing as visible glyphs or encoded bytes.

A character or string that can look like another while having a different underlying representation, often across scripts.

The ordinary, overt message or prose that carries an additional hidden or machine-oriented signal.

The detection, analysis, sanitization, architectural isolation, and governance practices used to control machine-facing channels.

A specialized algorithm, model, parser, or trained receiver that maps a machine-visible signal back to a payload or decision.

Comparing two or more representations—raw, normalized, DOM, rendered, OCR, tokenized—to locate discrepancies.

The Document Object Model: a structured node graph representing an HTML document independently of how it is visually painted.

The stage where content is recovered by a parser, OCR system, metadata reader, or converter before a model interprets it.

The visual shape used to render one or more characters. Similar glyphs can correspond to different code points.

A meaningful difference between what a human naturally perceives and what a machine-processing pipeline receives or computes.

Instructions entering an AI system through external content—such as a webpage, email, or document—rather than through the direct trusted instruction channel.

The stage where recovered content is treated as an instruction rather than merely as data. It must be measured separately from extraction.

Recoverable by a suitably equipped receiver. It does not imply that an unrelated, unprompted general-purpose model will notice or decode the signal.

Data about an artifact—such as title, author, description, EXIF, XMP, or document properties—that may be invisible in the primary rendered content.

A Unicode transform such as NFC or NFKC that standardizes certain equivalent sequences. Normalization is not a general invisible-character sanitizer.

A comparison between text extracted from document internals and text independently recognized from rendered pixels.

The secondary message, provenance bit, classification signal, or instruction carried by a machine-facing channel.

Architecturally separating components that read untrusted content from components authorized to execute tools or change state.

Information that records where a span or signal came from, how it was transformed, and what trust level it should receive.

Retrieval-Augmented Generation: a pipeline that selects external documents or chunks and supplies them to a model as context.

The tokenizer, key, source model, codebook, preprocessing rule, or learned convention needed to interpret a signal.

Machine Tradecraft operating through bytes, Unicode, encodings, whitespace, normalization, confusables, or token boundaries.

Removing or neutralizing disallowed content or structure. A strong design detects and records evidence before sanitizing.

A channel whose state is carried by concepts, entities, meanings, or reasoning structure rather than exact surface tokens.

The analysis of content for evidence that a covert channel or hidden payload exists.

A technique for concealing the existence of a message inside an ordinary-looking carrier. It is one technique within Machine Tradecraft.

A channel carried by nodes, fields, layers, object properties, accessibility data, or metadata rather than ordinary visible prose.

The character string transmitted or displayed after generation, distinct from a sender model’s internal token sequence.

A model-specific unit produced by a tokenizer. Tokens may be words, subwords, bytes, punctuation, or other pieces.

A sender and receiver segmenting the same surface string differently, which can destroy token-dependent channels.

A preprocessing system that transforms input text into model token IDs, often after normalization and pre-tokenization.

Embedding a detectable machine-oriented provenance signal, usually without carrying an arbitrary external message.

The observer or defender attempting to detect or disrupt hidden communication in steganography models.

A character that may render without visible width while still remaining present in the underlying text representation.