KeHoSu: Keyed Homoglyph Substitution for Authenticated Text Provenance over Copy-Paste Channels

Andrei Alexandru Drăghici; Sediola Ruko; Briland Hitaj; Dorjan Hitaj

cs.CRNov 5, 2026

KeHoSu: Keyed Homoglyph Substitution for Authenticated Text Provenance over Copy-Paste Channels

Authors: Andrei Alexandru Drăghici, Sediola Ruko, Briland Hitaj, Dorjan Hitaj

Organizations: Faculty of Mathematics and Informatics, University of Bucharest · Department of Computer Science, Sapienza University of Rome · Confidencial Inc

Abstract

Nowadays, large language models produce text at scale, and much of it is redistributed across platforms. A moderator who finds a suspicious comment, post or article may want to know which platform generated it and for which account. In this paper we study attribution over the channel through which such text actually travels, copy-paste, which discards document metadata but keeps Unicode code points. We present KeHoSu, which turns the confusable characters of homoglyph attacks into a keyed attribution channel: the variant chosen for each carrier letter encodes one bit of an identifier made of a platform field, a user field and a truncated authentication tag. Moreover, given that reshared text is often quoted in fragments, and the placement therefore keeps no positional state, we show that KeHoSu is invariant to sentence reordering up to a constant boundary layer and depends on a partial quotation only through the retained length. We characterize the code-point channel by its capacity, removability and detectability, and provide an achievable region that relates the three. We evaluate KeHoSu over a wide range of use cases and show that the mark survived copy-paste across 18 common platforms, attributing the majority of all excerpts to the correct account at 178 letters (about two sentences) on LLM-generated stories and 167 letters (about one sentence) on standard English prose.

Figures & tables

Panel of Figure 1 — Fig. 1 : Overview of KeHoSu. The carriers are the letters that have an identical-looking Cyrillic counterpart. A carrier written in Latin encodes bit 0 and its Cyrillic counterpart bit 1. The platform encrypts and authenticates the pair (platform, user), expands it with a rateless code and writes each coded bit into the carriers whose local context hashes, under the key, to the index of that bit. The decoder recomputes the hashes from the received text.

Latin	a	c	e	i	j	o	p	s	x	y
Cyrillic	0430	0441	0435	0456	0458	043E	0440	0455	0445	0443
Greek	–	03F2	–	–	–	03BF	03C1	–	03C7	–
Latin	A	C	E	I	J	O	P	S	X	Y
Cyrillic	0410	0421	0415	0406	0408	041E	0420	0405	0425	0423
Greek	0391	03F9	0395	0399	–	039F	03A1	–	03A7	03A5

TABLE I : Homoglyph code points (U+) of the carrier letters.

Edit	Tolerated	Cost
Reordering of sentences	unbounded	none
Deletion of sentences	$b\nu(L_{S})\geq(1+\varepsilon)K$	length only
Cuts at sentence bounds	unbounded $F$	none
Cuts inside sent. (outer code)	$F\leq\theta L_{S}/2W_{\mathrm{ctx}}\alpha_{c}$	$2W_{\mathrm{ctx}}\alpha_{c}$ /frag.
Bare threshold, English Literature	$167$ – $168$ letters	no reserve
Bare threshold, LLM-generated text	$178$ letters	no reserve

TABLE II : Tolerance and cost of each structural edit.

Panel of Figure 4 — Fig. 2 : Logistic fits of recovery against received letters for character excerpts and sentence selections with the elimination decoder, and for excerpts with the RS outer code (Section VI-E ).

Panel of Figure 5 — Fig. 3 : Equal numbers of edited characters, scattered or in one contiguous run.

erased fraction	$0.30$	$0.40$	$0.45$	$0.50$	$0.55$	$0.60$
recovered	$1.00$	$1.00$	$0.94$	$0.45$	$0.03$	$0.00$
distinct indices left	$101$	$87$	$80$	$73$	$66$	$59$

TABLE III : Pure erasures at the

320

-letter design point (

40

documents,

8

keys,

640

trials per cell).

erased fraction	$0.30$	$0.40$	$0.45$	$0.50$	$0.55$	$0.60$
recovered	$1.00$	$0.95$	$0.69$	$0.12$	$0.00$	$0.00$
distinct indices left	$95$	$82$	$75$	$68$	$62$	$55$

TABLE IV : Pure erasures at the

320

-letter design point on the LLM-generated stories (

40

documents,

8

keys,

640

trials per cell).

Panel of Figure 8 — Fig. 4 : Erasures (Figure 4(a) and Figure 4(b) (Left)) and scattered substitutions ( Figure 4(a) and Figure 4(b) (Right)) at the $320$ -letter design point.

Panel of Figure 9 — Fig. 5 : Recovery by decoder after one substitution (Figure 5(a) and Figure 5(b) (Left)) and after cutting into $F=4$ pieces (Figure 5(a) and Figure 5(b) (Right)).

	Positional codec	This work
clean copy	$1.000$	$1.000$
a carrier deleted, anywhere	$0.938$	$1.000$
a carrier deleted in the first $K$	$0.000$	$1.000$
sentences reordered	$0.031$	$1.000$

TABLE VIII : Positional codec against this work on the

4053

-letter LLM story document (

32

trials).

Text Watermarking

Text watermarking embeds detectable signals in generated text to indicate provenance, identify sources, or carry messages.

See all 45 papers

Who's Behind the Text? Robust Model Authorship Attribution
Oct 14, 2026Minseok Ko, Hyunseok Lee, Woomin Song +3Authorship Attribution OOD Generalization
Korea Advanced Institute of Science and Technology (KAIST)
Forging LLM Authorship Fingerprints with Targeted Rewriting
Sep 30, 2026Haohan Yuan, Simin Chen, Xi Niu +3Language Model Fingerprinting Adversarial Text Attacks
University of North Carolina at Charlotte · George Mason University · Indiana University
Every Model Leaves a Trace: Multi-Resolution LLM Fingerprinting
Oct 20, 2026Mohammad Reza Modarres, Armin Tourajmehr, Artin Tavasoli +2Language Model Fingerprinting Language Model Robustness
School of Electrical and Computer Engineering, College of Engineering, University of Tehran, Tehran, Iran · Tehran Institute for Advanced Studies, Khatam University, Iran · Cardiff University, United Kingdom

Oct 14, 2026J/K move · Enter open · S save

Who's Behind the Text? Robust Model Authorship Attribution

Minseok Ko, Hyunseok Lee, Woomin Song, Beomjun Kim+2

Korea Advanced Institute of Science and Technology (KAIST)

Authorship Attribution OOD Generalization

Open paper AskPDF arXiv

As large language models (LLMs) are increasingly used to generate text, their misuse has become a growing societal problem, with implications for academic misconduct, model distillation, and cyberattacks. For these reasons, Model Authorship Attribution (MAA), which identifies the source model of a given text, is important for promoting the responsible use of LLMs and improving AI safety. In practice, attribution systems must remain reliable beyond the distributions observed during training. They may encounter texts from unseen domains and writing settings, as well as generations from future versions of model families that were not available when the system was trained. However, existing MAA methods often exhibit substantial performance degradation under such distribution shifts. To address this challenge, we propose Authorship Tracing via Likelihood-based Attribution of Sources (ATLAS), which formulates MAA through source-conditioned text modeling rather than direct source prediction. ATLAS learns how text from each source family is generated and attributes a given text by comparing its likelihood under each learned source condition. We aggregate this likelihood evidence at the token level with clipping so that no single token dominates the decision. We further introduce MAABench, a broad MAA benchmark for evaluating practical OOD settings such as domain and version. Our experiments show that ATLAS consistently outperforms existing baselines across MAABench and OpenTuringBench. In particular, when both the generation domain and the model version change on MAABench, ATLAS achieves 74.27% accuracy, 9.00pp higher than the strongest baseline. Beyond MAA, ATLAS can also help identify distillation source models by measuring which source model a target LLM most closely resembles. Our extended experiments show that ATLAS recovers the known teacher of every distilled model we evaluate.

Abstract

Text Watermarking

Explore similar work

Who's Behind the Text? Robust Model Authorship Attribution

Forging LLM Authorship Fingerprints with Targeted Rewriting

Every Model Leaves a Trace: Multi-Resolution LLM Fingerprinting