What it looks for

Zero-width characters

A codepoint that occupies no space and draws nothing. It survives a copy, a paste and a rename, because as far as any of those are concerned it is text like any other.

U+200B ZERO WIDTH SPACEU+200C ZERO WIDTH NON-JOINERU+200DU+FEFF

Unicode tag characters

Unicode contains a second copy of ASCII that draws nothing. U+E0041 is a capital A, invisibly. Fifty of them in a row is a sentence no reader can see and any model can read.

U+E0000 blockASCII smugglinginvisible prompt injectiontag block

Homoglyphs and lookalike letters

The same shape from a different alphabet. It reads correctly to you and matches nothing: not a search, not a filter, not an allowlist entry.

confusablesCyrillic а U+0430IDN homographfullwidth letters

Trojan Source and bidi overrides

Direction controls reorder how text is displayed without touching how it is parsed. In source, that makes the program a reviewer reads and the program the compiler builds two different things.

U+202E RIGHT-TO-LEFT OVERRIDEU+2066CVE-2021-42574bidi attack

ANSI escape sequences in files you print

Some bytes in a file are not characters a terminal prints. They are instructions it carries out, the moment you cat, less or grep the file.

ESC[8m concealOSC 52 clipboard writeOSC 8 hyperlinkterminal injection

GPS coordinates in a photo

A phone writes where you were standing into the file, to a few metres, along with the serial number of the body that took the picture and the time it took it.

EXIF GPSLatitudegeotagBodySerialNumberDateTimeOriginal

C2PA Content Credentials

Content Credentials are a signed record of how a file was made and what has been done to it since, carried inside the file itself. Cameras, editors and image generators all write them, and models that mark their output now write them too.

Content CredentialsC2PA manifestc2pa.actionsCAIprovenance manifest

A Content Credential hidden in text

The C2PA specification defines a way to carry a manifest in plain text: the whole manifest encoded as Unicode variation selectors, rendering as nothing, sitting at the end of the writing. It survives a copy and a paste, which is exactly the point of putting it there.

C2PATXTvariation selectorsU+FE00text manifestinvisible AI watermark

Invisible text in a PDF

A PDF can place text on a page, make it selectable and copyable, and draw no ink. Rendering mode 3 does precisely that, and it is a legitimate feature: it is how the text layer over a scan works.

render mode 33 Trwhite textOCR text layer

Hidden text carried by an emoji

Unicode has 256 codepoints whose only job is to modify the character in front of them. Nothing stops you using them as an alphabet, and because they attach to whatever precedes them, a single emoji can carry a paragraph.

U+FE00 to U+FE0FU+E0100 to U+E01EFemoji smugglingvariation selector

Hidden text in a Word document

A Word file is a zip of XML, and several of its parts describe text that is present in the document but not drawn on the page. Some of it was hidden on purpose. Some of it is wording the author deleted and the format kept.

w:vanishtracked changeswhite textdocx metadatahidden text

Hidden text in HTML

A browser decides what to draw. Everything else that reads a page — a scraper, a summariser, a model asked what the page says — reads the markup, and the markup is where the text a browser skips still lives.

display:nonefont-size:0hidden attributeHTML commentwhite on white

Per-copy watermarks in a document

Send eleven people a confidential document and you can tell which of them leaked it, without changing a visible word. One invisible character a line, varied per recipient, is enough — and every individual character is deniable.

canary trapleak tracingper-recipient watermarktraitor tracing

Then augur scan anything. There is also a list of what it cannot see, on the homepage and behind ? in the viewer.