Pith. sign in

REVIEW 4 major objections 6 minor 84 references

Occluded Oculus: Operationalizing Stylistic Obscurement

T0 review · 4 major / 6 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Invisible Unicode alone fools an authorship attribution system

desk verdict A real but overgeneralized ablation: Injection flips stylo attribution at maximal dose, but the 'necessary and sufficient' claim needs re-scoping. read the letter →

arxiv 2607.24411 v2 pith:Z6LPXBJA submitted 2026-07-27 cs.CR cs.CLcs.IR

Robert Dilworth This is my paper · ORCID
classification cs.CRcs.CLcs.IR
keywords adversarialstylometryauthorshipattributionablationstudyzero-widthUnicodecharactershomoglyphsubstitutiontextanonymizationprivacyTraceTarnish
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper attempts to prove that, within its four-part adversarial stylometry attack, only one component can actually flip the verdict of an authorship attribution system: Injection, which embeds zero-width Unicode characters, swaps in homoglyphs, and introduces alternate spellings. In the reported experiment, a text by Eric Hughes that received only Injection was attributed to Timothy May, while every variant without Injection was still attributed to Hughes. The paper claims that Injection is both necessary and sufficient for a successful attack in its setup, with Translation, Imitation, and Obfuscation providing at most ancillary support. A sympathetic reader would care because the result suggests that simple, near-invisible text mutations can be a more immediately effective tool for evading stylometric surveillance than sophisticated paraphrasing or impersonation.

What carries the argument

The load-bearing object is the Injection module, a combination of three sub-techniques: Liminal Injection (inserting zero-width Unicode characters inside words), Doppelgänger Injection (replacing letters with visually identical homoglyphs from other scripts, such as Latin 'o' to Cyrillic 'о'), and Surrealist Injection (deliberate alternate spellings such as 'emphasise' for 'emphasize'). Applied at maximal intensity so that nearly every word is affected, these characters survive into the token stream that a standard stylometry classifier reads, inflating the distance between the attacked text and the author's known samples while leaving the text visually near-unchanged to a human reader. The

What would settle it

Re-run the ablation after sanitizing the Injection variants by stripping zero-width characters and mapping homoglyphs to canonical Latin forms; if attribution returns to the true author, the observed effect depends entirely on the surface artifacts. Separately, increase the dose of each non-Injection component (longer translation chains, stronger paraphrase models, more LLM rewrites) across many documents; if any such variant flips an attribution, the claim that Injection is unique and sufficient collapses.

Watch

Extended reading notes

Core claim

The paper's central claim, stated in the conclusion, is that the Injection module alone can reverse an authorship attribution: in the ablation, the Hughes text altered only by Injection was re-attributed to May by the classifier, whereas none of the non-Injection combinations (Translation, Imitation, Obfuscation, and their pairwise or triple combinations) produced a misattribution. The authors interpret this as demonstrating that Injection is both necessary and sufficient for a successful adversarial attack on authorship attribution in this test setting, and that the other techniques at best contribute a small additional buffer.

Load-bearing premise

The comparison treats a single fixed dose of each technique — one translation chain, one LLM rewrite, one paraphrase pass, and maximal injection — as a fair measure of each component's power, and assumes the resulting ranking carries over from one test document to other texts and settings.

Editorial extensions

If this is right

  • Injection alone is sufficient: a text modified only by Injection is misattributed, so even without translation, imitation, or paraphrasing, the attack flips authorship in the study's setup.
  • Removing Injection from every combination restored correct attribution, so in this setting Injection is necessary; a defensive pipeline that strips or canonicalizes the injected characters would neutralize the attack.
  • Injection-modified texts cluster tightly together stylometrically, meaning the attack leaves a detectable trace; anonymity in practice would require many users adopting the same modifications so that the group resembles a crowd.
  • The paper advocates defense-in-depth: even though Injection is the decisive component, layering Translation, Imitation, and Obfuscation is advisable as a robustness measure against partial countermeasures.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Inference: the main-text ranking Injection > Imitation > Obfuscation > Translation is sensitive to the chosen doses and text lengths; the appendix's full-text runs reverse Obfuscation and Translation, so the hierarchy should not be read as a fixed law of technique strength.
  • Inference: a natural extension is to sweep the 'dose' of each non-Injection component — longer translation chains, stronger paraphrase models, more LLM rewrite iterations — to find the threshold at which any of them could alone flip an attribution; the paper's own admission that such variants 'might have performed better' points in that direction.
  • Inference: the practical arms race implied by the paper is between injection tooling and platform data hygiene, since Unicode-aware preprocessing, character-level feature extraction, and platform-level sanitation are listed as trivially neutralizing the attack.
  • Inference: the sufficiency claim rests on a single test document and a small corpus; re-running the ablation across many authors, genres, and text lengths would reveal whether the effect is general or an artifact of this particular classifier and corpus.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper presents an ablation study of a four-component adversarial stylometry attack, TraceTarnish, whose components are Translation (round-trip machine translation), Imitation (LLM rewrite), Obfuscation (PEGASUS paraphrasing), and Injection (zero-width Unicode characters, homoglyph substitution, and spelling conversion). Using stylo::classify() on a small cypherpunk corpus — training texts by Gilmore, Hughes, and May, with Hughes's A Cypherpunk's Manifesto as the test text and its 15 ablated variants as test inputs — the authors report that only variants containing Injection produce a misattribution (Hughes’s text assigned to May). They conclude that Injection is the most effective component and, in §3.4, state that the ablation confirms Injection is “both necessary and sufficient for a successful adversarial attack on authorship attribution.” The paper also includes full-text re-runs, imposters() and crossv() analyses, and distance metric formulas in appendices.

Significance. If the central claim were properly scoped, the paper would provide a useful empirical data point: a standard, off-the-shelf stylometric classifier is vulnerable to Unicode-based injection in at least one realistic near-duplicate test scenario. The strengths of the paper are that the evaluation uses an external tool (stylo::classify()) and a public cypherpunk corpus, and that the appendices report full distance tables and multiple classifier variants, which aids reproducibility. The authors also candidly acknowledge several limitations, including defenses in §1.7 and dose-related caveats in the Figure 12 caption. The main weakness is the gap between a narrow, single-text, fixed-dose experiment and the broad “necessary and sufficient” conclusion; once that gap is addressed, the finding is of moderate interest for adversarial stylometry and text-privacy research.

major comments (4)
  1. [Abstract and §3.4] The claim that Injection is “necessary and sufficient for a successful adversarial attack” goes beyond the evidence. The experiment uses one test document (Hughes's A Cypherpunk's Manifesto), a three-author training corpus, one classifier function, and a single realization of each component. In Table 1, the Injection-only variant (Adversarial-IN) is classified as May, but the margin is narrow: the nearest May distance is 2.6731 versus 2.7861 for the nearest Hughes text, a gap of 0.113 with no repeated trials or confidence intervals. “Necessary” is an unsupported universal negative; “sufficient” is demonstrated only for this particular text/classifier configuration.
  2. [§1.1 and Figure 12 caption] The ablation compares components at unequal doses. §1.1 states that Injection is applied at “maximal levels” (almost every word receives zero-width characters, all visible characters receive homoglyphs, and alternate spellings are replaced), whereas Translation is a single English→Spanish→German→English chain, Imitation is a single LLM pass with one prompt, and Obfuscation is a single PEGASUS pass. The Figure 12 caption concedes that a longer translation chain, a different paraphrasing method, or a more thorough prompt “might have performed better.” The reported hierarchy Injection > Imitation > Obfuscation > Translation is therefore a statement about the chosen fixed doses, not about the techniques in general.
  3. [Appendix A.4 vs §2.1/§3.4] There is an internal inconsistency in the component ranking. The main text (§2.1, §3.4) ranks Obfuscation above Translation, but the Figure 16 caption in Appendix A.4 reports that with full texts “the actual ranking of techniques is Injection>Imitation>Translation>Obfuscation,” informed by the crossv() confusion matrices and imposters() scores. This directly contradicts the unqualified main-text hierarchy and the abstract's “most effective approach” framing. The authors should either reconcile the two rankings or present the main-text result as conditional on text length and experimental setup.
  4. [Appendix A.3] The imposters() configuration as written appears to test the original Hughes text against the adversarially modified variants: the text says the test parameter is “Hughes_CypherpunkManifesto.txt” and the candidate.set is “the collection of adversarially modified versions.” If that is what was run, the scores do not answer whether an adversarial text is attributed to Hughes; they answer the reverse question. Since Table 4 is used in the Figure 16 caption as evidence for the component ranking, this needs clarification or correction.
minor comments (6)
  1. [Table 1] Table 1 does not state which distance metric (e.g., delta, wurzburg, cosine) and feature set were used for the classify() run. The formulas in Appendix C are not explicitly linked to the table, which makes the results harder to interpret and reproduce.
  2. [Appendix C] The mathematical formulas are rendered as inline text (e.g., “1 m Pm i=1”) and are difficult to read. They should be typeset as display equations.
  3. [Appendix A.3, Table 4] The first column of Table 4 is labeled “Distance Measure” but the entries are adversarial-variant names such as “Adversarial-IM delta.” The label should be something like “Adversarial variant / distance measure.”
  4. [Figure 12] The Figure 12 caption is a lengthy paragraph that contains substantive caveats affecting the central interpretation. These caveats belong in the main text, not buried in a figure caption.
  5. [§1.7] The paper states that preprocessing can “trivially render the Injection component inert,” but no sanitization or defense experiment is run. This is a missed opportunity; a simple stripping/normalization comparison would strengthen the claims about the attack's robustness.
  6. [References] The reference list includes “Cited on Page 44” annotations, but the manuscript pages are not numbered in the provided version. These page references should be updated or removed.

Circularity Check

0 steps flagged · score 0.0 of 10

No load-bearing circularity; Injection's apparent necessity is an empirical ablation result against an external classifier, though its generalizability is limited by unequal component dosing.

full rationale

The paper's derivation chain is an empirical ablation, not a derivation from fitted parameters or from the paper's own definitions. Each component is operationally defined in Section 1.1, and the dependent measure is stylo::classify() applied to an external corpus of Gilmore, Hughes, and May texts (Section 1.3, Figure 5). The central conclusion in Section 3.4 that Injection is 'both necessary and sufficient' follows from observed classification outcomes: only Injection-containing variants were re-attributed to May, and no non-Injection variant produced a misattribution. This is an externally falsifiable experimental result, not a tautology. The strongest critique—that the comparison doses are unequal (Translation is one EN→ES→DE→EN chain, Imitation is one LLM pass, Obfuscation is one PEGASUS pass, while Injection is applied at maximal levels), and that Appendix A.4's full-text crossv()/imposters() results change the non-Injection ranking—is a threat to external validity and generalizability, not circularity, because the result does not reduce to its inputs by construction. The self-citations to Dilworth [21–24] are used only to establish the attack's lineage and prior imposters()-based results; the current study's central claim is evaluated against an independent tool and corpus, so the self-citations are not load-bearing. There is no fitted parameter renamed as a prediction, no uniqueness theorem imported from the authors, and no ansatz smuggled in via citation. The honest finding is no significant circularity.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The paper introduces no new physical or formal entities; TraceTarnish is the authors' previously introduced attack system, and the named injection variants are relabelings of known steganographic techniques.

free parameters (2)
  • Injection intensity (maximal) = 100% homoglyph substitution; zero-width chars in almost every word
    Hand-chosen maximum; the paper notes in Fig. 12 that different doses could change rankings.
  • Translation chain = English→Spanish→German→English
    Single round-trip chain is a hand-chosen dose; paper admits a longer chain 'might have performed better.'
assumptions (3)
  • domain assumption stylo::classify() with default settings is a representative stylometric system for evaluating the attack
    All attribution results are from this one tool; no other attribution systems are tested.
  • domain assumption One test document (A Cypherpunk's Manifesto) and two non-target authors suffice to establish a stable technique ranking
    Appendix A.4 shows the ranking changes with full texts, violating stability.
  • domain assumption Platforms will accept multilingual text and retain zero-width characters (practical feasibility)
    Sections 1.5 and 1.6 state the attack is only practical under these conditions.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Occluded Oculus: Operationalizing Stylistic Obscurement." pith.science (2026). https://pith.science/paper/Z6LPXBJA

@misc{pith2026260724411,
  author       = {Pith},
  title        = {Pith review of: Occluded Oculus: Operationalizing Stylistic Obscurement},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Z6LPXBJA}},
  note         = {Machine review of arXiv:2607.24411}
}
abstract

What did it take for Hermes, the devout messenger of the Olympian gods, to slay Argus Panoptes, the multi-eyed giant of Greek myth? As the perfect guardian, Panoptes' legion of ever-watchful eyes proved difficult -- but not impossible -- to defeat. The centerpiece of Hermes' strategy was obfuscation and sabotage. Posing as a shepherd, Hermes sealed each of Panoptes' eyes -- eyes that would otherwise have alerted the fearsome giant to Hermes' plot -- and vanquished him. The moral of the story: when a challenger must surmount a formidable foe -- one far greater in stature and vastly more equipped -- crafty maneuvers are not merely advisable but indispensable for victory. In this work, the "challenger" is a collective leveraging adversarial tactics to overcome the "multi-eyed giant" of stylometric systems and surveillance apparatuses. To successfully claw back the privacy siphoned by the multi-eyed giant, the challenger must carefully evaluate their plan of attack, $\textit{TraceTarnish}$, and determine what does and does not work to anonymize the authorship of text. To that end, we conduct an ablation study of $\textit{TraceTarnish}$ to better understand which module -- Translation, Obfuscation, Imitation, or Injection -- best confounds a stylometric system. Our results indicate that the most effective approach was Injection, meaning that inserting zero-width Unicode characters, homoglyphs, and intentional misspellings neutralizes the indefatigable eyes long enough to claim the head of the all-seeing giant.

Figures

Figures reproduced from arXiv: 2607.24411 by the authors.

Figure 1
Figure 1. A stylized visual illustrating the paper’s logical framework and organiza [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. The prompt issued to our offline, self-hosted LLM that facilitates the ad [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. A showcase6of the LLM’s “persona preambles.” Upon reflection, there appears to be a bias in the selection of “nationality,” with the LLM choosing a Brazilian persona more often than any other option. In most runs, the initial persona the model generates belongs to that demographic. For this iteration, the model assumed Australian, Portuguese, Nigerian, Filipino, Japanese, Indian, and South Korean personas. Perhaps t… view at source ↗
Figures from the paper (13 more)
Figure 4
Figure 4. Figure 4: The components of our modular attack, TraceTarnish, are decomposed into distinct scenarios to quantify the adversarial effect achievable with the in￾clusion or exclusion of techniques [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: As classify() expects a training and test corpus, we have organized our files into suitably named directories, the contents of which are shown here. The training set consists of texts authored by John Gilmore [33], Eric Hughes [40–44], and Timothy C. May [59,60]. The t…
Figure 6
Figure 6. Figure 6: For ease of recognizing which files were associated with which scenario and [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 7
Figure 7. Figure 7: The final results of the classify() experiment show that only texts altered by Injection successfully induced misclassification [PITH_FULL_IMAGE:figures/full_fig_p017_7.png]
Figure 8
Figure 8. Figure 8: A principal components analysis of the feature space shows how texts [PITH_FULL_IMAGE:figures/full_fig_p019_8.png]
Figure 9
Figure 9. Figure 9: A hierarchical clustering of all Injection-modified texts versus all other [PITH_FULL_IMAGE:figures/full_fig_p020_9.png]
Figure 10
Figure 10. Figure 10: A bootstrap consensus tree derived from repeated clustering of the [PITH_FULL_IMAGE:figures/full_fig_p021_10.png]
Figure 11
Figure 11. Figure 11: classify() Experiment (Full-Text Supplied): Final Results Gilmore Hughes Hughes Hughes Hughes Hughes May May Adversarial-IM 1.1861 1.1586 0.8651 0.9927 1.2019 1.0485 1.4635 1.4687 Adversarial-IM+O 1.1642 1.1630 0.6939 0.9639 1.1953 0.9936 1.4438 1.4557 Adversarial-IM+…
Figure 12
Figure 12. Figure 12: classify() Experiment (Full-Text Supplied): From everything pre￾sented thus far, we can, with a certain degree of confidence, claim that the Injection component of TraceTarnish is the source from which the attack de￾rives most of its adversarial effect. Had we employe…
Figure 13
Figure 13. Figure 13: stylo Visualization (Full-Text Supplied): Principal Components Analysis [PITH_FULL_IMAGE:figures/full_fig_p035_13.png]
Figure 14
Figure 14. Figure 14: stylo Visualization (Full-Text Supplied): Cluster Analysis [PITH_FULL_IMAGE:figures/full_fig_p036_14.png]
Figure 15
Figure 15. Figure 15: stylo Visualization (Full-Text Supplied): Bootstrap Consensus Tree [PITH_FULL_IMAGE:figures/full_fig_p037_15.png]
Figure 16
Figure 16. Figure 16: crossv() Experiment (Full-Text Supplied): On the whole, Obfuscation seems to fare far worse than Translation when using the full texts rather than snippets of the originals. Using a majority rather than a modicum of the text implies that the actual ranking of techniqu…

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

84 extracted references · 6 linked inside Pith

  1. [1]

    Protect the Children

    Age Verification Won’t “Protect the Children”,https://www.eff.org/pages/ag e-verification-wont-protect-childrenCited on Page 12

  2. [2]

    Bootstrap Consensus Networks,https://computationalstylistics.github.io/ projects/bootstrap-networks/Cited on Page 44

  3. [3]

    Cosine Delta Distance (aka Wurzburg Distance),https://search.r-project.o rg/CRAN/refmans/stylo/html/dist.wurzburg.htmlCited on Page 46

  4. [4]

    Distance-based classifier,https://search.r-project.org/CRAN/refmans/stylo/ html/perform.delta.htmlCited on Page 44

  5. [5]

    Min-Max Distance (aka Ruzicka Distance),https://search.r-project.org/CRA N/refmans/stylo/html/dist.minmax.htmlCited on Page 46

  6. [6]

    Principal component analysis (4 2026),https://carpentries-incubator.githu b.io/high-dimensional-stats-r/04-principal-component-analysis.html Cited on Page 44

    2026

  7. [7]

    2486039,https://dl.acm.org/doi/10.1145/2486001.2486039Cited on Page 12

    Adib, F., Katabi, D.: See through walls with WiFi! ACM SIGCOMM Computer Communication Review43, 75–86 (9 2013).https://doi.org/10.1145/2534169. 2486039,https://dl.acm.org/doi/10.1145/2486001.2486039Cited on Page 12

    arXiv 2013

  8. [8]

    In: 2014 IEEE Symposium on Security and Privacy

    Afroz, S., Islam, A.C., Stolerman, A., Greenstadt, R., McCoy, D.: Doppelg¨ anger Finder: Taking Stylometry to the Underground. In: 2014 IEEE Symposium on Security and Privacy. pp. 212–226. IEEE (5 2014).https://doi.org/10.1109/SP .2014.21,https://ieeexplore.ieee.org/document/6956566Cited on Page 12

    arXiv 2014

Show all 84 references
  1. [9]

    Entropy21, 355 (4 2019).https://doi.org/10.3390/e21040355,https://pmc.ncbi.nlm.nih.g ov/articles/PMC7514839/Cited on Pages 7 and 45

    Ahvanooey, M.T., Li, Q., Hou, J., Rajput, A.R., Chen, Y.: Modern Text Hiding, Text Steganalysis, and Applications: A Comparative Analysis. Entropy21, 355 (4 2019).https://doi.org/10.3390/e21040355,https://pmc.ncbi.nlm.nih.g ov/articles/PMC7514839/Cited on Pages 7 and 45

    2019 doi

  2. [10]

    Alajaji, R.: Lawmakers Want to Ban VPNs–And They Have No Idea What They’re Doing (11 2025),https://www.eff.org/deeplinks/2025/11/lawmakers-want-b an-vpns-and-they-have-no-idea-what-theyre-doingCited on Page 12

    2025

  3. [11]

    Alsobeh, A.M., Alkurdi, R.M., Darwish, O.: MIA-Bench: Quantifying the Phase TransitionofUserRe-IdentificationfromSparseSocialMediaText.In:Proceedings of the 17th International Conference on Information and Communication Systems. pp. 1–10. ACM (5 2026).https://doi.org/10.1145/3...

    2026

  4. [12]

    htmlCited on Page 44

    Bhandari, G.: K-Nearest Neighbors (KNN) Using R (3 2025),https://rstudio-p ubs-static.s3.amazonaws.com/1281653_abef48360410417ab37ada1086fb22d7. htmlCited on Page 44

    2025

  5. [13]

    ACM Transactions on Information and System Security15, 1–22 (11 2012).https://doi.org/10.114 5/2382448.2382450,https://dl.acm.org/doi/abs/10.1145/2382448.2382450 Cited on Page 45

    Brennan, M., Afroz, S., Greenstadt, R.: Adversarial stylometry: Circumventing authorship recognition to preserve privacy and anonymity. ACM Transactions on Information and System Security15, 1–22 (11 2012).https://doi.org/10.114 5/2382448.2382450,https://dl.acm.org/doi/abs/10....

    2012

  6. [14]

    93% match

    Brodkin, J.: Man sues Florida cops over arrest spurred by “93% match” in facial recognition (6 2026),https://arstechnica.com/tech-policy/2026/06/man-jai led-due-to-faulty-face-recognition-says-florida-cops-ignored-other-e vidence/Cited on Page 12

    2026

  7. [15]

    Brozovsky, E.: How Language Nerds Solve Crimes (1 2024),https://www.pbs.or g/video/how-language-nerds-solve-crimes-n34x31/Cited on Page 45

    2024

  8. [16]

    Buckley, M.: One Step Forward, Two Steps Back: CA’s AB 1856 Exempts Open Source But Expands Age-Gating (5 2026),https://www.eff.org/deeplinks/20 26/05/one-step-forward-two-steps-back-cas-ab-1856-exempts-open-sourc e-expands-age-gatingCited on Page 12

    2026

  9. [17]

    In: Proceedings of the 18th ACM Workshop on Artificial Intelligence and Security

    Castagnaro, A., Salviati, U., Conti, M., Pajola, L., Pizzi, S.: The Hidden Threat in Plain Text: Attacking RAG Data Loaders. In: Proceedings of the 18th ACM Workshop on Artificial Intelligence and Security. pp. 170–181. ACM (10 2025). https://doi.org/10.1145/3733799.3762976,ht...

    2025

  10. [18]

    In: Findings of the Association for Computa- tional Linguistics: EMNLP 2023

    Cooper, P., Surdeanu, M., Blanco, E.: Hiding in Plain Sight: Tweets with Hate Speech Masked by Homoglyphs. In: Findings of the Association for Computa- tional Linguistics: EMNLP 2023. pp. 2922–2929. Association for Computational Linguistics (2023).https://doi.org/10.18653/v1/2...

    2023 doi

  11. [19]

    Cox, J.: This Company Will Add Phone, AirPod, and Smartwatch Trackers to License Plate Readers (6 2026),https://www.404media.co/this-company-wil l-add-phone-airpod-and-smartwatch-trackers-to-license-plate-readers/ Cited on Page 12

    2026

  12. [20]

    Cyphers, B.: Inside Fog Data Science, the Secretive Company Selling Mass Surveil- lance to Local Police (8 2022),https://www.eff.org/deeplinks/2022/08/insi de-fog-data-science-secretive-company-selling-mass-surveillance-loc al-policeCited on Page 12

    2022

  13. [21]

    Dilworth, R.: Tuning for TraceTarnish: Techniques, Trends, and Testing Tangible Traits (12 2025),https://arxiv.org/abs/2512.03465Cited on Page 2

    2025 arXiv

  14. [22]

    Dilworth, R.: Unveiling Unicode’s Unseen Underpinnings in Undermining Author- ship Attribution (10 2025),https://arxiv.org/abs/2508.15840Cited on Page 2

    2025 arXiv

  15. [23]

    Dilworth, R.: Hijacking Text Heritage: Hiding the Human Signature through Ho- moglyphic Substitution (5 2026),https://arxiv.org/abs/2604.10271Cited on Pages 2 and 10

    2026 arXiv

  16. [24]

    Dilworth, R.: StegoStylo: Squelching Stylometric Scrutiny through Steganographic Stitching (1 2026),https://arxiv.org/abs/2601.09056Cited on Pages 2 and 10

    2026 arXiv

  17. [25]

    Pervert Glasses

    Dupr´ e, M.H.: The Backlash Is So Strong That People With “Pervert Glasses” Are Afraid to Use Them in Public (7 2026),https://futurism.com/future-society /backlash-meta-pervert-glasses-afraidCited on Page 12

    2026

  18. [26]

    Occluded Oculus 27

    Eder, M.: Custom distance measures (8 2015),https://computationalstylistic s.github.io/blog/custom_distances/Cited on Page 46. Occluded Oculus 27

    2015

  19. [27]

    The R Journal8, 107 (2016).https://doi.org/10.326 14/RJ-2016-007,https://journal.r-project.org/articles/RJ-2016-007/R J-2016-007.pdfCited on Pages 10 and 45

    Eder, M., Rybicki, J., Kestemont, M.: Stylometry with R: A Package for Compu- tational Text Analysis. The R Journal8, 107 (2016).https://doi.org/10.326 14/RJ-2016-007,https://journal.r-project.org/articles/RJ-2016-007/R J-2016-007.pdfCited on Pages 10 and 45

    2016

  20. [28]

    Eder, M., Rybicki, J., Kestemont, M., Pielstroem, S.: Package ‘stylo’ (5 2026), https://cran.r- project.org/web/packages/stylo/stylo.pdfCited on Page 10

    2026

  21. [29]

    In: Calzolari, N., Kan, M.Y., Hoste, V., Lenci, A., Sakti, S., Xue, N

    Emmery, C., Miotto, M., Kramp, S., Kleinberg, B.: SOBR: A Corpus for Stylom- etry, Obfuscation, and Bias on Reddit. In: Calzolari, N., Kan, M.Y., Hoste, V., Lenci, A., Sakti, S., Xue, N. (eds.) Proceedings of the 2024 Joint International Conference on Computational Linguistics...

    2024

  22. [30]

    Evert, S., Proisl, T., Jannidis, F., Reger, I., Pielstr¨ om, S., Sch¨ och, C., Vitt, T.: Understanding and explaining Delta measures for authorship attribution. Digital Scholarship in the Humanities32, ii4–ii16 (12 2017).https://doi.org/10.1093/ llc/fqx023,https://www.research...

    2017

  23. [31]

    Feder, J.: How Flock Cameras Wrongly Tracked Me for Days Over ‘Stolen’ Plates and Sent Police After Me (7 2026),https://www.thedrive.com/news/how-flock -cameras-wrongly-tracked-me-for-days-over-stolen-plates-and-sent-pol ice-after-meCited on Page 12

    2026

  24. [32]

    In: Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing

    Fisher, J., Hallinan, S., Lu, X., Gordon, M.L., Harchaoui, Z., Choi, Y.: StyleRemix: Interpretable Authorship Obfuscation via Distillation and Perturbation of Style Elements. In: Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing. pp. 4172–4...

    2024 doi

  25. [33]

    In: The 23rd IEEE Conference on Decision and Control

    Gilmore, J.F.: Knowledge base systems in computer aided technology. In: The 23rd IEEE Conference on Decision and Control. pp. 586–590 (1984).https://doi.or g/10.1109/CDC.1984.272069Cited on Page 11

    1984

  26. [34]

    Goodin, D.: Beware of ads that use inaudible sound to link your phone, TV, tablet, and PC (11 2015),https://arstechnica.com/tech-policy/2015/11/beware-o f-ads-that-use-inaudible-sound-to-link-your-phone-tv-tablet-and-pc/ Cited on Page 12

    2015

  27. [35]

    Goodin, D.: Fed up with vibe coders, dev sneaks data-nuking prompt injection into their code (5 2026),https://arstechnica.com/security/2026/05/fed-up-wit h-vibe-coders-dev-sneaks-data-nuking-prompt-injection-into-their-cod e/Cited on Page 12

    2026

  28. [36]

    Guariglia, M.: Flock’s Gunshot Detection Microphones Will Start Listening for Human Voices (10 2025),https://www.eff.org/deeplinks/2025/10/flocks-g unshot-detection-microphones-will-start-listening-human-voicesCited on Page 12

    2025

  29. [37]

    28 Robert Dilworth

    Guariglia, M., Quintin, C., Maass, D.: Add Bluetooth to the Long List of Border Surveillance Technologies (5 2024),https://www.eff.org/deeplinks/2024/0 5/add-bluetooth-long-list-border-surveillance-technologiesCited on Page 12. 28 Robert Dilworth

    2024

  30. [38]

    Hamid, S.: EFF’s Investigations Expose Flock Safety’s Surveillance Abuses: 2025 in Review (12 2025),https://www.eff.org/deeplinks/2025/12/effs-investi gations-expose-flock-safetys-surveillance-abuses-2025-reviewCited on Page 12

    2025

  31. [39]

    Huang, B., Chen, C., Shu, K.: Can Large Language Models Identify Authorship? In: Findings of the Association for Computational Linguistics: EMNLP 2024. pp. 445–460. Association for Computational Linguistics (2024).https://doi.org/10 .18653/v1/2024.findings-emnlp.26,https://acl...

    2024

  32. [40]

    Hughes, E.: A Cypherpunk’s Manifesto (3 1993),https://erichughes.org/Cited on Page 11

    1993

  33. [41]

    NetWorker1(3), 38– 50 (Nov 1997).https://doi.org/10.1145/344509.344546,https://doi.org/10 .1145/344509.344546Cited on Page 11

    Hughes, E.: A long-term perspective on electronic commerce. NetWorker1(3), 38– 50 (Nov 1997).https://doi.org/10.1145/344509.344546,https://doi.org/10 .1145/344509.344546Cited on Page 11

    1997

  34. [42]

    In: Proceedings

    Hughes, E.: Component technologies: avoiding the herd mentality. In: Proceedings. The Twenty-Second Annual International Computer Software and Applications Conference (Compsac ’98) (Cat. No.98CB 36241). pp. 598– (1998).https://doi. org/10.1109/CMPSAC.1998.716731Cited on Page 11

    1998

  35. [43]

    In: 1999 Proceedings

    Hughes, E.: Persistent enterprise components: improving the availability of legacy systems. In: 1999 Proceedings. Fourth International Workshop on Object-Oriented Real-Time Dependable Systems. pp. 95–100 (1999).https://doi.org/10.1109/ WORDS.1999.806566Cited on Page 11

    1999

  36. [44]

    Linux J.1999(63es), 18–es (Jul 1999), https://dl.acm.org/doi/10.5555/327906.327924Cited on Page 11

    Hughes, E.: The Point Really is Free Beer. Linux J.1999(63es), 18–es (Jul 1999), https://dl.acm.org/doi/10.5555/327906.327924Cited on Page 11

    1999

  37. [45]

    Ingraham, C.: Police Have Reportedly Used License Plate Readers to Stalk Ro- mantic Interests at Least 24 Times in Recent Years (4 2026),https://ij.org/p olice-have-reportedly-used-license-plate-readers-to-stalk-romantic-i nterests-at-least-14-times-in-recent-years/Cited on Page 12

    2026

  38. [46]

    Ireland, I.: ‘We Are Not Expendable’: Southaven Residents Fight xAI’s Plan for 41 Gas Turbines to Power Musk’s Grok (3 2026),https://www.mississippifre epress.org/xai-faces-fierce-opposition-over-southaven-mississippi-pow er-plant-permit/Cited on Page 14

    2026

  39. [47]

    In: Proceedings of the Fifth Workshop on Privacy in Natural Language Processing

    Kandula, H., Karakos, D., Qiu, H., Ulicny, B.: Improving Authorship Privacy: Adaptive Obfuscation with the Dynamic Selection of Techniques. In: Proceedings of the Fifth Workshop on Privacy in Natural Language Processing. pp. 137–142. Association for Computational Linguistics (...

    2024 doi

  40. [48]

    Kestemont, M., Stover, J., Koppel, M., Karsdorp, F., Daelemans, W.: Authen- ticating the writings of Julius Caesar. Expert Systems with Applications63, 86–96 (11 2016).https://doi.org/10.1016/j.eswa.2016.06.029,https: //www.pure.ed.ac.uk/ws/files/38106536/Stover_et_al_2016_ESA...

    2016

  41. [49]

    Artifi- cial Intelligence Review58, 89 (1 2025).https://doi.org/10.1007/s10462-024 -11071-z,https://link.springer.com/article/10.1007/s10462-024-11071-z Cited on Page 15

    Khan, J., Ahmad, K., Jagatheesaperumal, S.K., Sohn, K.A.: Textual variations in social media text processing applications: challenges, solutions, and trends. Artifi- cial Intelligence Review58, 89 (1 2025).https://doi.org/10.1007/s10462-024 -11071-z,https://link.springer.com/a...

    2025 doi

  42. [50]

    and Abroad: 2025 in Review (12 2025),https://www.eff.org/deeplinks/2025/12/defending-encryption-us-a nd-abroad-2025-reviewCited on Page 12

    Klosowski, T.: Defending Encryption in the U.S. and Abroad: 2025 in Review (12 2025),https://www.eff.org/deeplinks/2025/12/defending-encryption-us-a nd-abroad-2025-reviewCited on Page 12. Occluded Oculus 29

    2025

  43. [51]

    Kocher, M., Savoy, J.: Distance measures in author profiling. Information Process- ing & Management53, 1103–1119 (9 2017).https://doi.org/10.1016/j.ipm.20 17.04.004,https://www.sciencedirect.com/science/article/abs/pii/S030 6457316306495Cited on Page 46

    2017 doi

  44. [52]

    Koebler, J.: City Learns Flock Accessed Cameras in Children’s Gymnastics Room as a Sales Pitch Demo, Renews Contract Anyway (4 2026),https://www.404med ia.co/city-learns-flock-accessed-cameras-in-childrens-gymnastics-roo m-as-a-sales-pitch-demo-renews-contract-anyway/Cited on Page 12

    2026

  45. [53]

    Koebler, J.: With Ring, American Consumers Built a Surveillance Dragnet (2 2026),https://www.404media.co/with-ring-american-consumers-built-a -surveillance-dragnet/Cited on Page 12

    2026

  46. [54]

    In: CHI Conference on Human Factors in Computing Systems

    Lee, H.N., Ashok, V.: Impact of Out-of-Vocabulary Words on the Twitter Ex- perience of Blind Users. In: CHI Conference on Human Factors in Computing Systems. pp. 1–20. ACM (4 2022).https://doi.org/10.1145/3491102.3501958, https://dl.acm.org/doi/10.1145/3491102.3501958Cited on Page 14

    2022

  47. [55]

    Liu, C.J., Quintin, C.: The FCC’s Spam Call Proposal Is Just a Data Collection Scheme (6 2026),https://www.eff.org/deeplinks/2026/06/fccs-spam-call-p roposal-just-data-collection-schemeCited on Page 12

    2026

  48. [56]

    In: 2024 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV)

    Liu, F., Ashbaugh, R., Chimitt, N., Hassan, N., Hassani, A., Jaiswal, A., Kim, M., Mao, Z., Perry, C., Ren, Z., Su, Y., Varghaei, P., Wang, K., Chan, S., Ross, A., Shi, H., Wang, Z., Jain, A., Liu, X.: FarSight: A Physics-Driven Whole-Body Biometric System at Large Distance an...

    2024

  49. [57]

    eff.org/deeplinks/2026/05/more-license-plate-reader-mission-creep-sch ool-residency-verification-background?language=esCited on Page 12

    Maass, D., Alajaji, R.: More License Plate Reader Mission Creep: School Residency Verification, Background Checks, and Noise Complaints (5 2026),https://www. eff.org/deeplinks/2026/05/more-license-plate-reader-mission-creep-sch ool-residency-verification-background?language=es...

    2026

  50. [58]

    Majka, M.: Introduction to naivebayes package (3 2024),https://cran.r-proje ct.org/web//packages/naivebayes/vignettes/intro_naivebayes.pdfCited on Page 44

    2024

  51. [59]

    IEEE Transactions on Electron Devices26(1), 2–9 (1979).https://doi.org/10 .1109/T-ED.1979.19370Cited on Page 11

    May, T.C., Woods, M.: Alpha-particle-induced soft errors in dynamic memories. IEEE Transactions on Electron Devices26(1), 2–9 (1979).https://doi.org/10 .1109/T-ED.1979.19370Cited on Page 11

    1979

  52. [60]

    In: 16th International Reliability Physics Symposium

    May, T.C., Woods, M.H.: A New Physical Mechanism for Soft Errors in Dynamic Memories. In: 16th International Reliability Physics Symposium. pp. 33–40 (1978). https://doi.org/10.1109/IRPS.1978.362815Cited on Page 11

    1978

  53. [61]

    (4 2026),https://www.washin gtonpost.com/opinions/interactive/2026/04/26/artificial-intelligenc e-could-kill-anonymity-online/Cited on Page 12

    McArdle, M.: Will AI end anonymity? I tested it. (4 2026),https://www.washin gtonpost.com/opinions/interactive/2026/04/26/artificial-intelligenc e-could-kill-anonymity-online/Cited on Page 12

    2026

  54. [62]

    McGruder, C.H., VanDerMeer, B.W.: The 1916 PhD Thesis of Johannes Droste and the Discovery of Gravitational Repulsion (1 2018),https://arxiv.org/abs/ 1801.07592Cited on Page 15

    1916 arXiv

  55. [63]

    Textbooks5, 136–137 (2017),https://digitalcommons.usu.e du/oer_textbooks/5/Cited on Page 1

    Mellenthin, J., Shapiro, S.O.: Mythology Unbound: An Online Textbook for Clas- sical Mythology. Textbooks5, 136–137 (2017),https://digitalcommons.usu.e du/oer_textbooks/5/Cited on Page 1

    2017

  56. [64]

    30 Robert Dilworth

    Meyer, D.: Support Vector Machines (12 2025),https://cran.r-project.org/w eb/packages/e1071/vignettes/svmdoc.pdfCited on Page 44. 30 Robert Dilworth

    2025

  57. [65]

    Mouselimis, L.: Functionality of the ClusterR package (12 2025),https://cran.r -project.org/web/packages/ClusterR/vignettes/the_clusterR_package.ht mlCited on Page 44

    2025

  58. [66]

    Mullin, J.: The KIDS Act Would Require Age Checks To Get Online (6 2026), https://www.eff.org/deeplinks/2026/06/kids-act-would-require-age-che cks-get-onlineCited on Page 12

    2026

  59. [68]

    Page, A.: Unstyle: A Tool for Circumventing Modern Techniques of Authorship Attribution (2015),https://github.com/pagea/unstyle/blob/master/doc/the sis.pdfCited on Page 16

    2015

  60. [69]

    Pilkington, E.: Rise of ‘voiceprint’ ID technology has privacy campaigners con- cerned (10 2014),https://www.theguardian.com/technology/2014/oct/13/r ise-voiceprint-id-technology-privacy-campaigners-concernedCited on Page 12

    2014

  61. [70]

    Prahlow, S.P., Cohle, S., Shattuck, B., Prahlow, J.A.: Homicides Disguised as Staged Suicides. Academic Forensic Pathology10, 104–112 (6 2020).https: //doi.org/10.1177/1925362120956855,https://pmc.ncbi.nlm.nih.gov/a rticles/PMC7691936/,Content Warning:This article contains gra...

    2020 doi

  62. [71]

    Quintin, C., Greenberg, W.: Meet Rayhunter: A New Open Source Tool from EFF to Detect Cellular Spying (3 2025),https://www.eff.org/deeplinks/2025/03/ meet-rayhunter-new-open-source-tool-eff-detect-cellular-spyingCited on Page 12

    2025

  63. [72]

    In: Proceedings of the 20th Interna- tional Database Engineering & Applications Symposium on - IDEAS ’16

    Rizzo, S.G., Bertini, F., Montesi, D.: Content-preserving Text Watermarking through Unicode Homoglyph Substitution. In: Proceedings of the 20th Interna- tional Database Engineering & Applications Symposium on - IDEAS ’16. pp. 97–104. ACM Press (2016).https://doi.org/10.1145/29...

    2016

  64. [73]

    Rumi: New ChatGPT Models Seem to Leave Watermarks on Text (4 2025),https: //www.rumidocs.com/newsroom/new-chatgpt-models-seem-to-leave-waterma rks-on-textCited on Page 45

    2025

  65. [74]

    Sarrat, T., Finn, T.: Surveillance Psychology: Ethical Risks of Continuous Be- havioral Monitoring with AI in Schools and Workplaces. ResearchGate (1 2025), https://www.researchgate.net/profile/Tom-Sarrat/publication/39163551 8_SURVEILLANCE_PSYCHOLOGY_ETHICAL_RISKS_OF_CONTINUO...

    2025

  66. [75]

    Springer Cham (9 2020).https://doi.org/10.1007/978-3-0 30-53360-1Cited on Pages 2 and 32

    Savoy, J.: Machine Learning Methods for Stylometry: Authorship Attribution and Author Profiling. Springer Cham (9 2020).https://doi.org/10.1007/978-3-0 30-53360-1Cited on Pages 2 and 32

    2020 doi

  67. [76]

    Occluded Oculus 31

    Shane, T.S., Mylius, S., Hobbs, H.: Scheming in the wild: detecting real-world AI scheming incidents with open-source intelligence (4 2026),https://arxiv.org/ab s/2604.09104Cited on Page 23. Occluded Oculus 31

    2026 arXiv

  68. [77]

    Journal of Quantitative Linguistics18, 63–88 (2 2011)

    Smith, P.W.H., Aldridge, W.: Improving Authorship Attribution: Optimizing Bur- rows’ Delta Method*. Journal of Quantitative Linguistics18, 63–88 (2 2011). https://doi.org/10.1080/09296174.2011.533591,https://www.tandfonl ine.com/doi/abs/10.1080/09296174.2011.533591Cited on Page 46

    2011

  69. [78]

    In: 2025 Second International Conference on Pioneering Developments in Computer Science & Digital Technolo- gies (IC2SDT)

    Srivastava, A.K., Bhatia, L., Pandey, V., Sharma, A.K.: AI-Driven Cross-Genre Authorship Impersonation: A Forensic Challenge. In: 2025 Second International Conference on Pioneering Developments in Computer Science & Digital Technolo- gies (IC2SDT). pp. 350–355 (2025).https://d...

    2025

  70. [79]

    Stanik¯ unas, D., Mandravickait˙ e, J., Krilaviˇ cius, T.: Comparison of distance and similarity measures for stylometric analysis of Lithuanian texts. Proceedings of the International Conference for Young Researchers in Informatics, Mathematics and Engineering1852, 1–7 (4 201...

    2017

  71. [80]

    Thereallo: Claude Code Is Steganographically Marking Requests (6 2026),https: //thereallo.dev/blog/claude-code-prompt-steganographyCited on Page 45

    2026

  72. [81]

    (7 2026),https: //agentic.tracebit.com/context-bombs/Cited on Page 24

    Tracebit: Context Bombs: stopping AI attackers in their tracks. (7 2026),https: //agentic.tracebit.com/context-bombs/Cited on Page 24

    2026

  73. [82]

    Tripathy, M.: The Cognitive Fingerprint: LLM-Resistant Cross-Domain Threat Actor Attribution via Temporal-Syntactic Fusion (3 2026).https://doi.org/10 .36227/techrxiv.177272729.99887126/v1,https://www.techrxiv.org/doi/f ull/10.36227/techrxiv.177272729.99887126/v1Cited on Page 13

    2026

  74. [83]

    vmfunc, MDL, Dziurwa: the watchers: how openai, the US government, and per- sona built an identity surveillance machine that files reports on you to the feds (2 2026),https://vmfunc.re/blog/personaCited on Page 25

    2026

  75. [84]

    Wilkins, J.: Man Trapped in Dystopian Nightmare Thanks to AI Surveillance Cameras Flagging His Every Move (4 2026),https://futurism.com/future-soc iety/flock-ai-surveillance-coloradoCited on Page 12

    2026

  76. [85]

    wherever humans produce structured text—be it prose, code, or even spreadsheet formulas—individual habits leak through

    Woodbridge, J., Anderson, H.S., Ahuja, A., Grant, D.: Detecting Homoglyph At- tacks with a Siamese Neural Network (5 2018),https://arxiv.org/abs/1805.0 9738Cited on Page 7. Appendix A Full-Text Classification andstylo Visualization Results [They] tried to conjure up a face...b...

    2018

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.