The operational discipline of perceptual asymmetry
Machine Tradecraft is the deliberate use, detection, and management of machine-perceptible signals, structures, and behaviors that differ from what a human observer naturally perceives, in order to communicate with, influence, identify, evade, or defend machine-processing systems.
“Human-visible” is shorthand, not a claim that all humans perceive an artifact identically. A sighted reader, a screen-reader user, a source-code reviewer, and a forensic examiner may receive different views. The analytical question is always contextual: what does the intended human workflow expose, and what does the machine pipeline receive?
Machine Tradecraft begins when the difference between those views becomes operationally meaningful.
One artifact, multiple effective representations
Let an artifact be A. A human workflow produces an effective view H(A, h), where h includes display, accessibility technology, expertise, and task. A machine pipeline produces M(A, p), where p includes parsing, normalization, metadata extraction, tokenization, retrieval, and model behavior.
Rendered language, visible pixels, audible content, familiar semantics, and the fields the interface exposes.
Bytes, code points, DOM nodes, metadata, accessibility names, tokens, embeddings, scores, and tool instructions.
The gap is not inherently malicious. It can support accessibility, indexing, provenance, compression, localization, rendering, and safe automation. Tradecraft concerns the deliberate operational use or control of that gap.
When does something count as Machine Tradecraft?
A useful test asks four questions. The more clearly all four are answered, the stronger the classification.
- Asymmetry: Is there a material difference between the ordinary human view and a machine-facing representation?
- Receiver: Is there an identifiable parser, tokenizer, classifier, retriever, decoder, model, or agent that can use the difference?
- Purpose: Is the difference deliberately designed, exploited, measured, or controlled for communication, influence, identification, evasion, or defense?
- Effect: Can the signal change a machine decision, recover a payload, alter retrieval, establish provenance, evade a detector, or trigger a defensive response?
A random Unicode anomaly with no intended receiver may be a defect rather than tradecraft. A keyed watermark with a dedicated detector is clearly tradecraft. A defensive preprocessor comparing DOM text with rendered text is counter-tradecraft even when no attack is present.
The six-domain map
| Domain | Carrier | Typical receiver | Primary defensive comparison |
|---|---|---|---|
| Representation | Bytes, Unicode, whitespace, encodings, token boundaries | Scanner, parser, tokenizer, filter | Raw vs normalized vs tokenized |
| Structural | DOM, CSS state, accessibility fields, metadata, PDF objects | Extractor, crawler, document loader, UI agent | Structure vs render vs OCR |
| Linguistic | Word choice, syntax, punctuation, semantics, token probabilities | Keyed detector, language model, statistical decoder | Matched-corpus statistics and perturbation tests |
| Model interaction | Prompts, retrieval context, tool descriptions, model-specific conventions | LLM, agent, classifier, retriever | Trusted instructions vs untrusted data provenance |
| Indirect influence | Webpages, email, documents, APIs, search results, environment state | RAG or tool-using system | Source-to-action trace and privilege boundary |
| Counter-tradecraft | Forensic views, sanitizers, canonicalizers, monitors, architecture | Security pipeline and reviewer | Independent evidence across layers |
Related terms are mechanisms, not synonyms
It is defined by hiding the existence of a message inside a cover. Machine Tradecraft also includes overt machine-readable fields, watermarks, parser discrepancies, and defensive normalization where no secret message exists.
It may be fully visible and use no perceptual asymmetry. It becomes a particularly important Machine Tradecraft case when instructions arrive through machine-only or low-salience environmental channels.
A watermark normally answers a hypothesis such as “was this generated by a keyed process?” rather than transporting an arbitrary payload. It is a deliberate machine-facing signal.
It may target a person, a rule-based filter, a tokenizer, or a model. Machine Tradecraft asks which representation is made difficult for which observer.
The receiver is part of the signal
A statement such as “the AI can see it” is underspecified. The receiver may need one or more of the following:
- Tokenizer knowledge: the exact vocabulary, normalizer, and pre-tokenization rules.
- Distributional knowledge: source-model logits, ranks, surprisals, or sampling intervals.
- A key or codebook: a mapping from otherwise ordinary choices to bits or classes.
- Shared training: a learned convention between a sender and receiver.
- A structural parser: access to DOM attributes, metadata, comments, object streams, or accessibility nodes.
- Tools: code execution or a decoder that converts anomalous symbols into a message.
Machine-decodable ≠ arbitrary-model-decodable. A keyed statistical detector can recognize a signal that a far larger unkeyed language model cannot infer. Conversely, a byte scanner can expose invisible Unicode without any language model at all.
Stealth and robustness are different properties
Format-level channels can be almost impossible to notice visually yet disappear under one normalization pass. Semantic channels can survive spelling changes and paraphrase while producing detectable topic or entity distributions. The relevant stress test depends on the layer.
| Signal layer | Often survives | Often fails under | Diagnostic transformation |
|---|---|---|---|
| Zero-width / whitespace | Untouched byte transport | Canonicalization, copy/paste, reflow | NFC/NFKC plus explicit control scan |
| Exact-token probability | Same tokenizer and source model | Retokenization, paraphrase, model mismatch | Multi-tokenizer and source-model comparison |
| Lexical / syntactic | Plain-text transport and OCR | Meaning-preserving rewrite | Controlled paraphrase and style normalization |
| Semantic / entity | Many lexical rewrites | Conceptual rewrite or content substitution | Semantic-type and topic-distribution analysis |
| Metadata / structure | Container-preserving workflows | Rebuild, flattening, allowlisted extraction | Object inventory and render/extraction differential |
What the concept does not establish
- It does not prove that a hidden channel is malicious. Accessibility and metadata often serve legitimate, essential functions.
- It does not prove that an LLM will spontaneously decode arbitrary hidden information.
- It does not make every detector result a factual verdict. Detection must be calibrated against matched benign data.
- It does not imply machine consciousness, moral status, or legal personhood. Those are adjacent philosophical questions.
- It does not eliminate ordinary visible prompt injection. Structural detection solves hiddenness; architecture must still enforce instruction/data boundaries.