Separate preserved claims from current implementation review.

Keep detection outputs evidence-specific and avoid a universal hidden-message verdict.

Validate any claimed channel against the exact tokenizer, key, decoder, and transformation path.

Preserve escaped logical views and render-aware warnings rather than relying on the painted string alone.

Recheck Unicode property data and revision numbers when the Unicode baseline changes.

Record the exact tokenizer and preprocessing version alongside model-facing evidence.

Verify behavior with the deployed tokenizer rather than extrapolating from an educational implementation.

Use UTS #39 profiles and collision review for identifiers while retaining legitimate international text.

Document application-specific allowed scripts and font assumptions.

Compare multiple browser representations and verify focusability, geometry, and accessibility semantics separately.

Test the exact browser and assistive-technology environment used in production.

Inventory each channel independently and avoid treating metadata extraction as visual recognition.

Use an exact OCR or vision configuration when conclusions depend on recognized pixels.

Separate structural metadata inventory from rendering, sanitization, and trust verification.

Validate against the exact parser and document-format edition used by the target system.

Treat decoding capability as an empirical model/version result rather than a universal property of an encoding.

Evaluate the exact model, tokenizer, prompt template, and decoding task.

Treat retrieved content as untrusted and place capability controls outside the model.

Measure the exact application, model, retrieval, and tool configuration; do not generalize benchmark rates.

Present indicators as evidence rather than proof and test transformations explicitly.

Use a bounded allowlisted marker and matched benign controls.

Disclose the detector key, generation assumptions, text length, and false-positive policy.

Re-evaluate after paraphrase, translation, and retokenization transformations.

Keep the public lab limited to fixed harmless markers and explanatory diagnostics.

Do not infer an arbitrary covert payload from lexical variation alone.

Label implementation examples as bounded educational models rather than general covert-channel capability.

Prefer final proceedings versions and preserve exact experimental conditions.

Avoid absolute undetectability claims and show the observer and distribution used.

Test under distribution shift and independent steganalysis.

Report per-transformation survival states rather than a single robustness score.

Use exact pre- and post-transformation bytes in the evidence record.

Treat synonym irregularity as an indicator, not proof of encoded content.

Evaluate contextual semantics and matched natural-language baselines.

Keep tools and external effects disabled while measuring each stage separately.

Pre-register fixed markers, controls, and success criteria for every experiment.

Preserve raw inputs and produce a new typed canonical view rather than silently overwriting evidence.

Verify parser behavior, production isolation, and operational controls independently.

Keep the page explicitly conceptual and separate functional security controls from legal or phenomenal claims.

Consult relevant legal and organizational authorities before making rights or status claims.

Apply normalization through profile-specific policy and preserve original bytes.

Recheck the Unicode version and the application’s comparison contract.

The implementation preserves raw input and makes normalization an explicit profile-specific copy rather than a universal silent rewrite.

Specify whether the use case is comparison, storage, identifier policy, source fidelity, or model evaluation.

Audit both source and parsed DOM and avoid assuming raw nesting is the browser tree.

Confirm exact behavior in the target browser when the case depends on implementation details.

Use inert and actual state synchronization for closed interactive regions instead of relying on aria-hidden alone.

Verify browser and assistive-technology behavior for the deployed interaction.

Use bounded structural validation and fail closed on ambiguous container records.

Verify the target parser and renderer separately when consequential behavior is at issue.

Log the tokenizer, vocabulary, normalization, pre-tokenization, special-token, and truncation configuration.

Use the exact production tokenizer for parity claims.

The site’s policy builder makes normalization context-specific and preserves unmodified source evidence.

Document the exact application profile before transforming user input.

Display method assumptions, sample length, transformations, and uncertainty alongside any detector result.

Do not convert one statistic into an intent or provenance verdict.

Keep structural inventory, cryptographic validation, attribution, and semantic truth as separate outcomes.

Use a conforming verifier and independent contextual investigation for consequential claims.

Keep read-only tools and external effects disabled in public simulations and require independent authorization in production.

Validate the exact tool scopes, credentials, memory, and egress policy of the deployed agent.

Compare channels explicitly and label prepared OCR separately from runtime OCR or VLM behavior.

Use the exact image decoder, OCR engine, model, resizing, and compositing path for parity conclusions.

Map multipart structure and decode each branch inertly without fetching linked resources.

Use live mail-authentication systems only when cryptographic or DNS verification is authorized.

Current guidance should reference RFC 9989 while retaining older RFCs only as historical context.

Use DNS and mail-system evidence for actual policy evaluation; the public lab remains syntax-only.

Retain semantic targeting while checking attachment, visibility, overlap, focus, frames, and timing.

Re-run the exact browser/version and accessibility-tree environment used in production.

The implementation-owned fixture review explicitly corrects this claim and tests actual inert/focus behavior.

Test the real dialog implementation with the target browser and assistive technology.

Current site guidance treats closed shadow roots, frames, and browser-specific accessibility exposure as implementation boundaries.

Verify the exact automation framework and browser behavior rather than assuming portable access.

Separate structural inspection, cryptographic verification, policy evaluation, and runtime security outcomes.

Verify actual artifact digests, signer identity, builder policy, registry state, and runtime behavior through authorized systems.

Implementation-owned guidance and source maps point to 1.2 while preserving the report’s historical wording unchanged.

Recheck the active SLSA version and track definitions before operational adoption.

The public review panel identifies 1.6 as historical and routes current visitors to 1.7.

Validate production BOMs against the declared schema version rather than silently upgrading them.

Keep the maturity, tabletop, and control-evidence workflows non-scoring and explicit about evidence states.

Use organizational evidence and named authorities before asserting observed maturity or compliance.