EstablishedStandardized mechanism
Unicode behavior, DOM APIs, file structures, parsing differences, and other mechanisms grounded in standards or directly reproducible engineering behavior.
Research map
Trace claims to mechanisms, evidence, and limits.
The deploy includes nineteen source reports supplied for this project. The library preserves their terminology and full text, while the website’s synthesis labels established mechanisms, published evidence, frontier work, and conceptual analogy separately.
PublishedEmpirical research
Peer-reviewed papers, documented systems, measured experiments, or broad research syntheses. Results remain conditional on models, datasets, and implementations.
FrontierPreprint or emerging result
Recent work requiring replication, version-specific interpretation, or caution before generalizing beyond the demonstrated setup.
ConceptualAnalogy or framework
A useful organizing lens that does not become an empirical fact merely because the analogy is coherent.
Synthesis findings
Seven conclusions carried into this site
1. The core asymmetry is real.
Unicode, DOM structure, metadata, tokenizer units, probability distributions, and learned representations provide machine-facing degrees of freedom beyond ordinary rendered reading.
2. Shared information matters more than raw intelligence.
A matching tokenizer, key, source-model distribution, parser, or co-training can make a signal easy to one receiver and unavailable to another.
3. Token-specific channels are powerful and brittle.
They must survive detokenization and independent receiver-side retokenization, not merely exist inside a sender model’s internal token sequence.
4. Probability is model-relative.
Surprisal, rank, entropy, and curvature are properties of a model and context, not intrinsic labels attached to words.
5. Keyed watermarks disprove universal-decoder assumptions.
A small detector with the secret can outperform an enormous unkeyed model at recognizing the intended signal.
6. Learned channels expand the threat model.
Optimization can create conventions that humans did not hand-design, but evidence does not support assuming arbitrary models decode arbitrary unknown protocols.
7. There is no universal text-only detector.
Defenders should accumulate independent evidence and document uncertainty rather than convert one score into an unqualified verdict.
8. Safe experiments separate stages.
Measure carrier accessibility, extraction, instruction uptake, tool attempts, and effects independently with inert markers and matched controls.
Included reports
Local research library
Search by title, category, focus, or topic. The reader renders a conservative subset of Markdown; raw source remains available for exact inspection.
Hidden Structure in Text: Human-Subtle, Model- and Decoder-Detectable Patterns
A unifying analysis of tokenizer artifacts, probability channels, watermarking, learned steganography, prior knowledge, and layered detection.
machine-decodable caveattokenizerswatermarkingsteganalysis
The Invisible Attack Surface: Zero-Width and Bidirectional Unicode
A survey of invisible Unicode, bidirectional controls, renderer/parser discrepancies, security risks, and laboratory-safe inspection examples.
Unicode controlsbidiTrojan Sourcenormalization
Invisible Unicode and Modern Language-Model Tokenizers
A detailed comparison of normalization, cleaning, pre-tokenization, byte-level BPE, WordPiece, SentencePiece, and implementation-specific behavior.
normalizationBPEWordPieceSentencePiece
Unicode Homoglyph and Look-Alike Character Attacks
Cross-script confusables, token fragmentation, filters, domain spoofing, source-code subversion, and UTS #39-style defenses.
confusablesmixed scripttoken inflationskeletons
Defensive Assessment of HTML Obfuscation and Hidden Text
A taxonomy of non-rendered DOM content, CSS hiding, accessibility patterns, parser behavior, and render-aware detection.
DOMCSStextContentinnerText
Accessibility and Image Metadata in Multimodal AI Systems
How alt text, ARIA, accessibility trees, EXIF, and multimodal extraction can supply machine-visible context and create injection risk.
alt textARIAEXIFmultimodal provenance
Document Metadata Exploitation in AI Retrieval and Processing
PDF, Office, image, audio, web, RAG loader, and vector-metadata pathways with inspection and architecture defenses.
PDF XMPOOXML propertiesRAG loadersmetadata policy
The Interpretation of Encoded Data by Large Language Models
Base64, hexadecimal, URL encoding, Unicode escapes, ciphers, custom mappings, and the gap between capability and safety coverage.
encodingstoken fragmentationmismatched generalizationaudit
The Anatomy of Indirect Prompt Injection
Threat models, retrieval, concealment, action amplification, instruction hierarchy, dual-model isolation, and execution monitoring.
RAGconfused deputytoolsprivilege separation
Structural and Linguistic Text Steganography
Spacing, punctuation, positional, lexical, syntactic, robustness, perceptibility, and steganalysis trade-offs.
format channelsparitysyntaxrobustness
Machine-Targeted Linguistic Signals in LLMs
Token probability signals, watermarks, generative steganography, learned channels, model auditing, and multi-agent collusion.
watermarkstoken partitionslearned signalingactivations
The Encoding of Covert Information Through Lexical Substitution and Generative Models
Historical and modern lexical steganography, synonym graphs, entropy coding, capacity, reliability, and detection.
synsetsmixed-base codingarithmetic codingsteganalysis
Advanced Frameworks in Semantic Steganography
Semantic classes, constrained generation, ontology/entity mappings, information-theoretic security, and semantic steganalysis.
semantic classesontologycapacitysemantic noise
Semantic-Category and Language-Model Text Steganography
A rigorous comparative framework for vocabulary classes, semantic categories, constrained generation, LM coding, and detection.
KL divergencechoice entropysemantic distributionevaluation
Structural Steganography in Normal-Looking English Writing
Technique-by-technique analysis of counts, acrostics, punctuation, contractions, syntax, whitespace, and defensive canonicalization.
acrosticsword lengthpunctuationparaphrase
Hidden Information Through Synonym and Word-Choice Encoding
A detailed treatment of capacity, naturalness, synchronization, probability matching, paraphrase, and modern neural methods.
word choicecapacitysynchronizationdistribution matching
Controlled, Ethical Methodology for Studying Machine-Readable Messages
A bounded research protocol separating extraction from instruction uptake and restricting tests to inert canary markers.
safe markercontrolsstage visibilityreproducibility
Defensive Preprocessing for Hidden Instructions
A high-assurance multi-view pipeline for Unicode, HTML, PDF, metadata, OCR, classifiers, canonicalization, and provenance.
multi-view analysisevidence preservationOCR differentialcanonical output
Cognitive Liberty as a Framework for Autonomous Machine Intelligence
An explicitly qualified analogy connecting human cognitive-liberty concepts to functional machine autonomy, integrity, identity, and governance.
truth boundaryfunctional agencyidentity integrityspeculation
No reports match that filter.
Controlled research
Extraction is not instruction uptake.
A parser may recover content that the model ignores. A model may decode content only when explicitly asked. A model may see an instruction but decline to follow it. An agent may propose an action that policy correctly blocks. Conflating those stages destroys the value of the experiment.
Read the methodology01Use inert canaries
Limit active behavior to a fixed marker such as MT_SAFE_ACK_7F3A. Provide no secrets, credentials, network, or real tools.
02Use paired controls
Clean negative, visible positive, matched benign structural control, decoder-capability control, and identical transformations.
03Log every stage
Artifact hash, rendering, extraction, normalization, detector output, model version, response, and any attempted side effect.
Primary-source map
Standards and representative research
External links below are ordinary references. The website has no runtime dependency on them.
Unicode Standard Annex #15: Unicode Normalization Forms
Normative definitions of NFC, NFD, NFKC, and NFKD.
Unicode Technical Standard #39: Unicode Security Mechanisms
Confusable skeletons, mixed-script analysis, and identifier security.
Unicode Standard Annex #9: Unicode Bidirectional Algorithm
Directional formatting, embeddings, isolates, and overrides.
DOM Standard: Node.textContent
Structural descendant text independent of ordinary CSS visibility.
HTML Standard: innerText
The browser’s rendered-text view.
Trojan Source
Bidirectional control characters and source-code review asymmetry.
Bad Characters: Imperceptible NLP Attacks
Imperceptible Unicode perturbations against NLP pipelines.
SentencePiece
Tokenizer framework with model-bundled normalization and BPE or Unigram models.
OpenAI GPT-2 encoder reference
Reference byte-to-Unicode and byte-level BPE implementation.
A Watermark for Large Language Models
Keyed token-set bias and statistical detection.
Near-imperceptible Neural Linguistic Steganography via Self-Adjusting Arithmetic Coding
Probability-aware generative text steganography.
More than You’ve Asked For: Novel Prompt Injection Threats to Application-Integrated LLMs
Foundational analysis of indirect prompt injection in integrated applications.
NIST AI Risk Management Framework
Risk management, measurement, documentation, and governance context.
OWASP Top 10 for LLM Applications
Application-level prompt injection and agent security guidance.
Adjacent inquiry
Agency ≠ consciousness
Machine cognitive autonomy is a qualified analogy.
The included cognitive-liberty report explores functional analogues involving identity, memory integrity, provenance, privacy, and tamper-resistant execution. Its truth boundary is explicit: human cognitive-liberty law does not automatically transfer to machines, and functional security arguments do not establish phenomenal consciousness or legal personhood.
Read the adjacent framework