Hijacking Text Heritage: Hiding the Human Signature through Homoglyphic Substitution

This paper proposes using homoglyphic substitution, which replaces standard characters with visually similar alternatives from different scripts, as an adversarial technique to degrade stylometric analysis and protect personal information from being inferred from written text.

The Gist

Imagine your writing style is like your voice. Just as you have a unique way of speaking—your accent, your favorite words, the rhythm of your sentences—every time you type, you leave behind a "digital fingerprint." This is called stylometry.

In the past, if you wanted to hide your identity, you might just stop writing or use a pseudonym. But today, advanced computer systems can look at a random social media post, analyze your writing fingerprint, and guess:

• How old you are.
• Where you live.
• Even who you are, specifically.

This paper, written by Robert Dilworth, is about how to break that fingerprint so these systems can't recognize you. The author calls this "Hijacking Text Heritage."

Here is the breakdown of the paper using simple analogies:

1. The Problem: The "Digital Mirror"

Think of your writing style as a reflection in a mirror. Usually, the mirror shows exactly who you are.

• The Threat: Governments or corporations might steal your ID (like a passport) to know who you are. But they can also steal your writing from the internet to figure out who you are without ever seeing your ID.
• The Goal: The author wants to "smudge the mirror" so the reflection looks like a blurry mess, making it impossible for the computer to identify the person behind the text.

2. The Solution: "Homoglyphs" (The Visual Trick)

The paper focuses on a specific trick called Homoglyph Substitution.

• What is it? Imagine you have a letter "a" in the English alphabet. Now, imagine there is a letter from a different language (like Russian) that looks exactly like "a" but is actually a completely different character underneath the hood.
• The Analogy: Think of it like wearing a perfectly realistic mask. To your eyes, the person looks exactly like their friend. But if you put them under a special X-ray scanner (the computer), the mask reveals a different skeleton.
• The Paper's Idea: By swapping some of your letters for these "look-alike" characters, you confuse the computer. The computer thinks the text is different, but a human reading it sees no difference.

3. The "Poison" Recipe (The Experiments)

The author tested different ways to "poison" the text to break the computer's ability to identify the writer. He compared it to mixing a chemical potion:

• The Ingredients: You can swap vowels (a, e, i, o, u) or consonants (b, c, d, etc.).
• The Dosage: How much of the text needs to be changed?
  • Too little (12-25%): The computer still recognizes you. It's like putting a tiny smudge on a mirror; you can still see the face.
  • Just right (37.5%): This is the "sweet spot." The computer gets confused and can no longer verify who wrote the text.
  • Too much (50%+): It works, but it's unnecessary work. You don't need to change every letter to hide; changing about 4 out of 10 words is enough.

4. Why Do This? (The "Shadow AI" Fear)

The paper argues that we need this defense because of a scary future scenario:

• The Scenario: Imagine a social media app asks you to upload your ID to prove you are over 18. Then, it asks you to write a short essay about your fears.
• The Trap: The company doesn't just want to check your age. They want to use your writing to build a "Shadow AI"—a digital twin of your mind. They want to know your deepest thoughts so they can predict what you will buy, what you will vote for, or even what crimes you might commit before you do them.
• The Defense: By "poisoning" your text with these look-alike letters, you are essentially burning the blueprint of your digital twin. You are telling the AI, "You can't build a model of me because my data is corrupted."

5. The "TraceTarnish" Tool

The author created a tool (a script) called TraceTarnish.

• How it works: It takes your text and automatically swaps out letters for their "look-alike" cousins and adds invisible characters (like invisible ink) to the text.
• The Result: The text looks normal to a human, but to a computer trying to track you, it looks like garbage data. It's like writing a letter in a language that looks like English but is actually a secret code that breaks the computer's dictionary.

Summary

The paper is a call to action for digital privacy. It suggests that in a world where computers can read your mind through your writing style, the best defense is to deliberately confuse them.

By using "Homoglyphs" (visual trickery), we can create a "firewall" made of text. We aren't hiding our words; we are just making sure the computer can't trace those words back to us. As the author says, it's like "fighting fire with fire"—using the computer's own reliance on patterns against it to protect our freedom.

Technical Summary

1. Problem Statement

The paper addresses the growing threat of stylometric analysis, a forensic technique used to identify authors based on their unique writing styles (e.g., word choice, sentence structure, punctuation). While useful for detecting plagiarism or machine-generated text, stylometry poses a severe privacy risk. It allows adversaries to de-anonymize individuals, infer sensitive attributes (age, location, political leanings), and potentially enable "pre-crime" or "thought-crime" surveillance by tracking digital footprints across platforms.

Current adversarial techniques to evade stylometry—such as Translation (round-trip translation), Imitation (using LLMs to mimic other authors), and Obfuscation (paraphrasing/synonym swapping)—are often effective but can be computationally expensive, alter the semantic meaning of the text, or be easily detected and remediated by data sanitization processes. The paper seeks a more robust, subtle, and efficient method to "poison" stylometric systems without rendering the text unreadable to humans.

2. Methodology

The authors propose a novel adversarial technique called Doppelgänger Injection, a form of Homoglyphic Substitution. This method involves replacing standard characters with visually identical (or nearly identical) Unicode characters from different scripts (e.g., replacing Latin 'a' with Cyrillic 'а') to disrupt the character-level features that stylometric models rely on.

The study is structured around a modular framework called TraceTarnish, which integrates four adversarial strategies:

1. Translation: Converting text through multiple languages to distort style.
2. Imitation: Using LLMs to rewrite text in the style of a different persona.
3. Obfuscation: Paraphrasing and synonym substitution.
4. Injection: The core contribution, subdivided into three variants:
   • Liminal Injection: Inserting zero-width Unicode characters (invisible) between letters.
   • Doppelgänger Injection: Replacing visible characters with homoglyphs.
   • Surrealist Injection: Introducing intentional misspellings (phonological or typographical).

Experimental Design:
The authors conducted four specific experiments to determine the optimal "lethal dosage" of homoglyph injection required to obfuscate authorship:

• Exp #1: Random, incremental injection of homoglyphs into words (0% to 100%), alternating between vowels and consonants.
• Exp #2: Targeted injection of vowels only.
• Exp #3: Targeted injection of consonants only.
• Exp #4: Maximal injection (replacing every possible character in a sentence).

Evaluation Metric:
The efficacy of the attack was measured using the imposters() function from the R stylo package. This function calculates the distance between the test text and a known author's corpus using various distance measures (e.g., Burrows's Delta, Cosine Distance). A successful attack results in a verification failure (the system cannot confirm the author) or a "suspicious" score where the classifier is uncertain.

3. Key Contributions

• Introduction of Doppelgänger Injection: The paper formalizes the use of homoglyph substitution specifically for adversarial stylometry, distinguishing it from previous uses in phishing or AI-detection evasion.
• Quantification of the "Poison" Threshold: The study provides empirical data on the exact percentage of text modification required to break stylometric attribution.
• The TraceTarnish Framework: A modular pipeline that combines multiple adversarial strategies (Translation → Obfuscation → Imitation → Injection) to create a comprehensive defense against authorship attribution.
• Privacy-Centric Data Poisoning: The authors frame data poisoning not as a malicious act, but as a necessary "nonviolent resistance" to protect individual privacy against surveillance states and aggressive data harvesting by tech giants.

4. Results

The experiments yielded the following critical findings:

• Threshold for Obfuscation: A replacement rate of 37.5% (meaning 37.5% of the words in a text contain at least one homoglyph) is the minimum threshold required to effectively obfuscate authorship.
• Diminishing Returns: Increasing the injection rate beyond 50% yields diminishing returns. The adversarial effect does not significantly improve beyond this point, suggesting that 50% is the "sweet spot" for efficiency.
• Vowel vs. Consonant: The choice between targeting vowels or consonants was found to be stylistically inconsequential. Both yielded similar results in disrupting the stylometric model.
• Maximal Injection: While replacing every possible character (100% injection) is overwhelmingly effective, it is unnecessary given that the 37.5%–50% range achieves the same goal with less computational effort.
• Combined Attack: The paper demonstrates that combining Zero-Width Characters (Liminal Injection) with Homoglyphs (Doppelgänger Injection) creates a highly toxic text that is visually imperceptible to humans but highly disruptive to machine learning tokenizers and stylometric models.

5. Significance and Implications

• Privacy Defense: The paper offers a practical, automated solution for individuals to protect their "digital fingerprints." By injecting a specific density of homoglyphs, users can prevent stylometric systems from linking their anonymous posts to their real identities or other known writings.
• Surveillance Countermeasure: The authors argue that as "Shadow AIs" and surveillance states increasingly rely on linguistic profiling to predict behavior (pre-crime), the ability to "contaminate" the data stream is a vital tool for civil liberty.
• Limitations of Current Detectors: The results highlight the fragility of current stylometric and AI-detection systems, which rely heavily on character-level consistency. A simple, visually invisible substitution can cause these systems to fail completely.
• Ethical Stance: The paper reframes "data poisoning" from a malicious act to a defensive necessity. It suggests that in an era where data ownership is eroded, users must actively degrade the quality of the data they provide to prevent its exploitation.

In conclusion, the paper establishes that homoglyphic substitution is a highly effective, low-cost, and visually undetectable method for defeating authorship attribution, provided a minimum threshold of ~37.5% word-level injection is met. This technique serves as a "firewall" for linguistic privacy in an increasingly monitored digital landscape.