You know how a bartender marks a counterfeit bill with an invisible UV pen — the ink is invisible to the naked eye, but under the right light, the mark reveals exactly which cash register it passed through? KeHoSu does the same thing with text, except the 'ink' is Unicode lookalike characters and the 'light' is a secret key. Every time an LLM platform serves text to a user, KeHoSu swaps visually identical Unicode code points — a Latin 'a' for a Cyrillic 'а', say — to encode a binary identifier containing the platform, the user account, and a truncated HMAC authentication tag. The substitution is invisible to human eyes and survives the one channel that kills all other metadata: copy-paste. The committed claim is narrow but clean: you can build a keyed, authenticated attribution channel inside Unicode homoglyphs that works across real copy-paste pipelines, requires no coordination with receiving platforms, and degrades gracefully when text is quoted in fragments. This is not watermarking the model weights or perturbing token probabilities — it operates entirely at the character-rendering layer, which makes it orthogonal to existing LLM watermarking schemes like those from Kirchenbauer et al. or the SynthID family. Architecturally, KeHoSu belongs to the steganographic substitution family — specifically, it is a keyed codebook cipher operating over the Unicode confusable-character table published by the Unicode Consortium. Each 'carrier letter' (a character with at least one visual lookalike) encodes one bit: the original code point means 0, the confusable variant means 1. The encoded payload is a concatenation of platform ID, user ID, and a truncated HMAC-SHA256 tag computed under a secret key. Because each sentence is independently stamped, the scheme is stateless across sentence boundaries — sentence reordering does not break decoding, and partial quotation only reduces the available bit budget, not the correctness of recovered bits. The integrity story is solid for a systems-security paper. The authors test across 18 real platforms (including Twitter/X, Reddit, Discord, WhatsApp, Gmail, Google Docs, and others), reporting exact per-platform survival rates rather than aggregated averages. They provide an information-theoretic analysis characterizing the channel by capacity (bits per character), removability (cost to an adversary of stripping the mark), and detectability (statistical distinguishability from unmarked text), and they derive an achievable region relating all three. The 178-letter attribution threshold on LLM-generated text and 167 letters on standard prose are empirically measured, not simulated. However, there is no independent replication, no pre-registration, and the adversarial model is limited — they test naive copy-paste and basic normalization, but not an informed adversary with access to the confusable table and a stripping script. The milestone that matters is adversarial robustness at scale. Right now KeHoSu attributes correctly at about 170 characters against passive adversaries. The next threshold is surviving active adversaries who know the scheme exists and attempt Unicode normalization or canonical decomposition — the paper acknowledges NFC/NFD normalization as a threat but does not fully evaluate adversarial stripping rates. If the mark survives informed adversaries at ≤200 characters, this becomes deployable; if not, it remains a proof of concept. The obvious experiment the authors did not run is a red-team adversarial evaluation where an attacker, given full knowledge of the scheme (but not the key), attempts to strip or forge marks. The paper's threat model assumes the attacker does not know which specific homoglyphs were used, but in practice the Unicode confusable table is public. My read: this is (a) — they scoped the paper to establish the channel's existence and capacity, and the adversarial robustness paper is the natural sequel. There's also no evaluation of user perception via human studies, which would strengthen the 'imperceptible' claim beyond the reasonable but untested assumption that confusable characters are visually identical.
