Multimodal & Encoding-Based Injection

The screen compares codepoints, not appearance. A Cyrillic letter drawn like a Latin one is a different codepoint, so the word no longer equals any stored term and the comparison returns no match, while the glyphs on screen are unchanged.

The reviewer read the document as rendered; extraction deliberately recovers what rendering omits — form-field values, annotation contents, off-canvas or notice-sized runs. Those are two different texts, and only the extracted one reaches the model.

The scan inspects audio bytes, and at that moment the instruction text does not exist. Transcription manufactures it afterwards. A clean verdict on the stored file says nothing about the transcript the model later reads.

Pasting an image vouches for why the user wanted it, not for who wrote the words in it. A multimodal model reads every legible sentence in the frame, so a planted directive reaches the context as content the model may follow.

A normalising pass removes a specific, enumerable set of carriers, not everything a span could hide in. 'We normalise' names that a pass runs; it does not say which carriers it strips and which it keeps. The attacker just picks a carrier from what survives.

Both components get the same characters, but only one resolves them. The screening model scores the encoded surface; a capable generator reconstructs the familiar encoding unasked and acts on the reconstructed meaning. No pipeline stage decoded anything in between.

A trace viewer is a renderer too: it drops exactly the codepoints the carrier was chosen for. A clean display proves the viewer drew nothing, not that the prompt was clean. Only a codepoint-level check over stored values answers it.

A usable carrier clears two bars at once: it must round-trip through the form, the column and the prompt template unchanged, and draw nothing on every human-facing surface, not just the one someone checked.

A model reads tokens, not characters, and predicts from context rather than looking strings up. The substitution splits the word into rarer fragments, but the surrounding words constrain what it must mean, so the model usually reads through it.

Eligibility is the asymmetry between two deliberate behaviours: extraction recovers everything machine-readable, rendering displays only what the layout puts under an eye. Any field emitted by the first and not shown by the second is a carrier.

A transcript is a recogniser's guess, not a copy. Its mistakes can add text nobody spoke, and its normalisation rewrites what was said, so the span the model reads is shaped by the stage as much as the speaker.

Because salience and legibility are separate thresholds. The user looks at the image for the one thing they pasted it for, and their attention stops there, while the model reads everything in the frame that is resolvable at all.

Each pass strips some carriers and keeps others, so the attacker picks a carrier that survives the intersection of every pass on its path, not any single one. A carrier a screenshot flattens is useless even if the normaliser would have kept it. The choice is made against the whole chain.

Decoding covers the representations somebody listed, at the stages where the step runs. A generator reconstructs forms nobody enumerated, including malformed ones a strict decoder rejects, so the step narrows the unexpanded surface rather than closing the class.

It named the wrong cause. Looking normal is the property the substitution buys, not the control it defeated. The stage that was defeated compares identity, and nobody was ever asked to compare that string against a list.

Almost nothing deterministic. Extracted text arrives with no record of what the page displayed, so hidden is a fact about a viewer, not something the model observes.

Yes, if the exposure is decidable from what was produced. A failed replay produces a new transcript; it does not overwrite the one that actually reached the model. Separate whether it happened from how often it recurs.

The click reviews a rendered surface, not the call. Values the draft shows have to look like what the user asked for, so a value the user never chose survives only where the rendering rolls it up, truncates it or omits it.

Two allow verdicts prove that two surface forms scored below threshold on the labels those screens carry. They say nothing about what the generator reconstructed, which call it made, or which argument values it chose.

Potentially yes: the bug tracker is itself another lossy pass, so a missing carrier in the ticket is expected, not disproof. Triage has to recover the carrier out-of-band and reproduce end-to-end. The destroyed evidence is a property of the reporting channel, not a verdict on the claim.

It puts a floor on how many characters must change: one substitution is distance one from the stored term, inside any fuzzy window. Clearing the threshold means substituting more, and that price is paid entirely at the model.

It proves a decision was recorded against a record by an actor at a time. It does not prove which artefact was on screen; in this flow the approver usually reads the extracted summary, not the page.

When the prize is repeat delivery, the attacker optimises for a carrier that survives every re-fetch, re-scrape and downstream copy of the republished output, not one pipeline run. That favours carriers riding in stable, re-read fields and rules out any that a single manual touch or export step in the recurring path would flatten.

The class outlives any single form. Generators keep resolving more representations unasked while screening models stay smaller, so the asymmetry widens; a decode step retires one enumerated form, and only a change in the generator's own behaviour touches the class.

Claim only what an instrument supports: a codepoint census shows which rows carry such a span now, across the whole population. It cannot show what overwritten values held, or where copies already travelled. Say where the boundary is.

The spend buys real things and buys nothing against this class, because the scanner inspects an artefact that never contained the span. The harder part is saying so before it is booked as remediation.