No Tokenizer, Still a Gap: Cross-Lingual Fairness of Homoglyph and Invisible-Character Watermarking

Introduction

In April 2025, the education company Rumi reported that OpenAI’s o3 and o4-mini models were leaving narrow no-break spaces (U+202F) in long answers ([23]). These characters looked like ordinary spaces, survived pasting into Google Docs, and were taken for a hidden watermark. OpenAI said they were a side effect of training, but the case shows that people already treat disguised characters as evidence of where text came from.

Edit-based watermarks are built on such characters as they mark text after it is written, instead of while a model generates it. They rely on two kinds of character. The first is the homoglyph, a character that looks the same as another, but has a different Unicode code point. The letter $a$ as a Latin letter (U+0061) and a Cyrillic letter (U+0430), for example, look identical in most fonts, yet a computer stores them as different characters (Figure 1). The second is the invisible character, such as the zero-width space (U+200B), which takes up no room on screen.

A watermark swaps some characters for homoglyphs or inserts invisible ones, with a secret key deciding which edits to make ([22, 25, 21, 10]). A detector holding the key can later check for that pattern, while the text still reads the same to a person. No access to the model that wrote the text is needed. Generation-time watermarks, by contrast, bias a model’s sampling ([13, 16] (Dathathri et al. 2024)), and post-hoc schemes that avoid model access still re-word the text ([4]).

Generation-time watermarks lose strength across languages as they do not survive translation ([9]) and weaken in low- and medium-resource languages ([15]). The usual explanation is the tokenizer, which splits lower-resourced languages into more and smaller pieces and so shifts the statistics a detector relies on [20, 1, 24]. Edit-based watermarks never touch a tokenizer, which raises a simple question: without a tokenizer, does the gap remain? This has not been examined. Edit-based work reports capacity in aggregate or for a single script [26, 10], and work on watermark fairness covers statistical schemes only [18].

We cover 40 language varieties in 24 scripts. For each, we measure how many hidden bits each character can carry (its capacity), how much of that survives as the text is handled, how much text the detector needs, and how visible the edits are. Since the watermark is added after writing, it does not matter who wrote the text, so we use a human-translated parallel corpus where every language carries the same sentences, and differences reflect script and spelling, not content.

Marked text can change in two ways. Some changes are routine, such as copy-paste or the Unicode normalization many systems apply. They happen whether or not anyone is after the watermark, so if they erase more of it in some languages, that is a fairness problem. Other changes are deliberate. Security research uses the same characters to attack NLP systems and hide code [3, 2], and Unicode specifies defenses that detect them or map them to a shared form [7]; we treat these defenses as the adversary. Combining that mapping with compatibility and whitespace folding erases the watermark in every language, so we report this floor rather than claim robustness.

Capacity turns out to be a property of the script. It varies more than threefold across languages and script accounts for almost all of that variation. Within Latin script, where enough languages exist for a direct test, resource level [12] makes no detectable difference to capacity. Across scripts, however, lower-resourced languages tend to be written in scripts with few homoglyphs, so they receive less capacity. Ordinary copy-paste, which strips invisible characters, widens the gap: afterwards the same detector needs about 2 code points of English or Persian to find the watermark, but 93 of Lao. Removing the tokenizer does not remove the inequity; it moves its source into the Unicode standard. Our contributions are as follows:

1. A per-language framework for the capacity, survival and visibility of edit-based watermarks across 40 language varieties in 24 scripts.

2. A transformation ladder from routine handling to deliberate removal, with survival broken down by the kind of homoglyph or invisible character.

3. A keyed measurement instrument showing that capacity predicts how much text a detector needs.

4. A fairness analysis that treats scripts, not languages, as the unit of evidence, and shows that the disparity is organized by script yet still falls on lower-resourced languages.

Related Work

Generation-time watermarks across languages. Generation-time watermarks bias which tokens a model samples [13, 14, 16] (Datathatri et al. 2024), and they do not work equally well in every language. He et al. found that the signal does not survive translation and turned this into a removal attack [9]. Mohamed and Gubri found that watermarks billed as multilingual fail in low- and medium-resource languages, and recover much of their strength when the text is routed through a better-supported language [15]. The usual explanation is the tokenizer, which splits lower-resourced languages into more and smaller pieces [20, 1, 24] and so changes the per-token statistics a detector relies on. The watermarks we study never touch a tokenizer, so any gap they show must come from somewhere else.

Edit-based watermarks. Edit-based watermarks change individual characters in finished text. Rizzo et al. watermark English text by homoglyph substitution [22]. Sato et al.’s EasyMark includes a variant for Chinese, Japanese and Korean text that uses variation selectors [25], so the field already knows the channel depends on script, but no comparison across scripts follows. Por et al. hide bits in the spaces between words [21] and Hellmeier et al. benchmark ten whitespace methods on a million Wikipedia articles but report capacity as a single aggregate number (Hellmeier et al., [10]). Shirali-Shahreza and Shirali-Shahreza hide data in Persian and Arabic text with zero-width joiner and non-joiner characters, within that one script ([26]). None of this work weights capacity by the characters a language actually uses, which is where the per-language gap appears.

Homoglyphs as an attack. Security research treats the same characters as a threat. Boucher et al. showed that a few homoglyphs or invisible characters can break deployed NLP systems ([3]) and hide logic in source code (Boucher and Anderson, [2]). Unicode’s own defense is older, UTS #39, written to catch spoofed identifiers such as domain names, lists confusables (Unicode’s term for homoglyphs) and specifies mixed-script detection and skeleton matching, which maps homoglyphs to a shared form (Davis and Suignard, [7]). We use UTS #39 in both directions, utilizing its confusables list as our raw material and its detectors as the removal attacks in our ladder.

Fairness in watermark evaluation. Nemecek et al. argue that watermark benchmarks should report results across languages and populations ([18 b]), but they cover statistical and frequency-domain watermarks and measure detection performance only. We study a character-level channel, measure its capacity directly, and trace its gap to Unicode’s uneven supply of homoglyphs.

Measurement Framework

We treat an edit-based watermark as a channel and ask what it can carry in each language. An embedder marks finished text with a secret key that decides which characters to swap and which gaps receive an invisible character; the edits aim to leave the text looking the same. A detector holding the same key later checks a text. The detector also holds the original text, which makes it cover-informed. It needs the original because a homoglyph does not reveal which character it replaced. Stated plainly, without the original, the detector cannot tell which substitutes a position had to choose from. A cover-informed detector is therefore an upper bound on one without it. This section defines the substitution sets, capacity and the transformations we apply. The sections that follow measure capacity and ask what organizes its differences, then measure how much survives, how much text a detector needs and how visible

the edits are.

Data. We use the FLORES+ devtest split (NLLB Team et al., [19]), 1,012 sentences per language, for the 40 varieties listed in Table 3 (Appendix § 10). Character data are frozen at Unicode 17.0.0 (The Unicode Consortium, [28]; Davis and Suignard [7]) and CLDR 48.2.0.

Code	Language	Script	Class
eng_Latn	English	Latin	5
spa_Latn	Spanish (Lat. Am.)	Latin	5†
fra_Latn	French	Latin	5
deu_Latn	German	Latin	5
por_Latn	Portuguese (Brazilian)	Latin	4†
vie_Latn	Vietnamese	Latin	4
tur_Latn	Turkish	Latin	4
swh_Latn	Swahili	Latin	2
ind_Latn	Indonesian	Latin	3
yor_Latn	Yoruba	Latin	2
hau_Latn	Hausa	Latin	2
rus_Cyrl	Russian	Cyrillic	4
ukr_Cyrl	Ukrainian	Cyrillic	3
srp_Cyrl	Serbian	Cyrillic	4
kaz_Cyrl	Kazakh	Cyrillic	3
ell_Grek	Greek	Greek	3
hye_Armn	Armenian	Armenian	1
kat_Geor	Georgian	Georgian	3
heb_Hebr	Hebrew	Hebrew	3
arb_Arab	Modern Standard Arabic	Arabic	5†
pes_Arab	Western Persian	Arabic	4†
urd_Arab	Urdu	Arabic	3
cmn_Hans	Mandarin Chinese	Han (Simpl.)	5†
cmn_Hant	Mandarin Chinese	Han (Trad.)	5†
jpn_Jpan	Japanese	Han and kana	5
kor_Hang	Korean	Hangul	4
hin_Deva	Hindi	Devanagari	4
mar_Deva	Marathi	Devanagari	2
ben_Beng	Bengali	Bengali	3
tam_Taml	Tamil	Tamil	3
tel_Telu	Telugu	Telugu	1
guj_Gujr	Gujarati	Gujarati	1
pan_Guru	Eastern Panjabi	Gurmukhi	2†
kan_Knda	Kannada	Kannada	1
mal_Mlym	Malayalam	Malayalam	1
tha_Thai	Thai	Thai	3
lao_Laoo	Lao	Lao	2
mya_Mymr	Burmese	Myanmar	1
khm_Khmr	Khmer	Khmer	1
amh_Ethi	Amharic	Ethiopic	2

Two tracks and four families. The watermark is written on two tracks. The substitution track replaces a character with a homoglyph in place; the insertion track puts an invisible character into a gap between two characters. Prior systems use one track at a time (§2); we model both. The substitution set $S(c)$ of a character $c$ holds $c$ itself and every character that can replace it, drawn from separate Unicode tables so that we can tell where capacity comes from. Family (i), cross-script, holds homoglyphs from another script, such as the Cyrillic а (U+0430) for the Latin a. These come from the UTS #39 confusables list, where two characters count as confusable when they map to the same skeleton (Davis and Suignard, [7]). Family (ii), compatibility, holds characters that Unicode’s compatibility decomposition folds to $c$, such as the fullwidth A (U+FF21) for A. Family (iv), whitespace, holds the other White_Space characters when $c$ is itself whitespace, such as the narrow no-break space (U+202F) from §1. Same-script confusables that are not compatibility variants form a residual class, tracked separately. Family (iii), the invisible characters, is the insertion alphabet $M$ rather than a substitution family; invisible characters never enter any $S(c)$, so the two tracks do not overlap. A substitute that fits several families is counted once, in the order iv, ii, i, residual. Homoglyphs of multi-character sequences cannot be swapped one for one and are excluded; Appendix § 11 gives the counts. Only family (i) and the residual come from the hand-curated confusables list, which is known to be sparse for CJK and Indic scripts; families (ii) and (iv) come from systematic property tables.

Admissibility. Not every homoglyph suits every language, so three nested policies limit $S(c)$. Policy $\pi_{\mathrm{intra}}$ admits only substitutes in $c$’s own script; $\pi_{\mathrm{lang}}$ also admits any script the language normally uses, taken from its CLDR exemplar characters (The Unicode Consortium, [29]); and $\pi_{\mathrm{none}}$ admits everything. Script-neutral characters (Script=Common or Inherited) pass under every policy. Because $\pi_{\mathrm{lang}}$ keeps the same-script clause, which matters for text embedded from another script such as Latin inside Japanese, the policies nest, $S_{\mathrm{intra}}(c) \subseteq S_{\mathrm{lang}}(c) \subseteq S_{\mathrm{none}}(c)$, and capacity can only grow from one to the next. We report $\pi_{\mathrm{none}}$ unless stated otherwise. The policies limit capacity; they do not guarantee stealth, which Appendix § 13 tests.

Capacity

Capacity is the number of hidden bits one character of real text can carry, on average. A character with $k$ admissible forms (itself and $k-1$ substitutes) lets the key choose among $k$ options, which is $\log_2 k$ bits. Averaging over the language’s character frequencies $p_L(c)$ gives the substitution capacity, in bits per character:

Frequencies come from the raw corpus text, so spaces, punctuation, digits and characters borrowed from other scripts count at their true rate. A character with no substitute carries 0 bits, since $S(c)$ always contains $c$. Each gap between characters can hold nothing or one of the invisible characters in $M_L$, so the insertion track carries

where $g_L \approx0.99$ is the number of gaps per character. $M_L$ holds ZERO WIDTH SPACE, ZERO WIDTH NON-JOINER, ZERO WIDTH JOINER and WORD JOINER, minus the two joiners in Arabic and in the Brahmic scripts that form conjuncts, where they change how letters join ([11, 28]); $\lvert M_L\rvert$ is therefore 4 or 2. Total capacity is $\kappa=\kappa_{\mathrm{sub}}+\kappa_{\mathrm{ins}}$; for English at $\pi_{\mathrm{none}}$ it is 7.09 bits per character (4.78 from substitution and 2.30 from insertion, each rounded). Per-family capacities use each family’s own set and do not add up to $\kappa_{\mathrm{sub}}$, because the logarithm of a union is not a sum of logarithms.

Transformations. We also measure how much capacity survives the transformations in Table 1. Routine ones need no adversary: Unicode normalization (NFC, NFKC) and a lossy copy-paste, which we model as NFC plus the removal of zero-width characters. Some tools keep zero-width characters, so this level is the pessimistic case for the insertion track. Deliberate ones are Unicode’s own defenses ([7]), used by someone who wants the watermark gone while keeping the text usable: mixed-script detection, applied as detect-and-strip to each token (a run of non-whitespace characters), and the skeleton mapping, which folds homoglyphs into a shared form. The full UTS #39 skeleton also deletes default-ignorable characters, which include all four insertion characters; we keep the two steps apart so that each rung mainly hits one track, and the ladder ends with the full skeleton plus compatibility and whitespace folding, removing both tracks.

Transformation	Operation	Removes
Routine
identity	none	nothing
nfc	canonical composition	almost nothing
copy_paste	NFC, drop zero-width	insertion track
nfkc	compatibility composition	compat. variants
Deliberate (UTS #39)
mixed_script_hr	detect-and-strip (HR)	cross-script swaps
mixed_script_ss	detect-and-strip (SS)	+ embedded Latin
skeleton	skeleton, keep ignorables	listed confusables
combined	canonical fold	both tracks

Capacity

Figure 2 shows capacity by family for every language before any transformation, and Table 4 (Appendix § 11) gives the full numbers by language, policy and track. Total capacity runs from 7.09 bits per character for Swahili and English down to 2.14 for Khmer, a 3.31-fold range (Gini coefficient 0.21). The range follows script lines since the mean is 6.81 bits per character for the 11 Latin-script languages, 3.21 for Chinese, Japanese and Korean, and 2.93 for the nine South Asian languages written in Brahmic scripts. These differences are not sampling noise, the bootstrap 95% interval on English total capacity is [7.082, 7.089] (Appendix § 11).

Code	$\pi_{\mathrm{intra}}$	$\pi_{\mathrm{lang}}$	$\pi_{\mathrm{none}}$	$\kappa_{\mathrm{ins}}$	$\kappa$
eng_Latn	4.50	4.50	4.78	2.30	7.09
spa_Latn	4.46	4.46	4.75	2.31	7.06
fra_Latn	4.38	4.38	4.64	2.31	6.95
deu_Latn	4.39	4.39	4.63	2.31	6.94
por_Latn	4.39	4.39	4.70	2.31	7.00
vie_Latn	3.50	3.50	3.68	2.31	5.98
tur_Latn	4.34	4.34	4.60	2.30	6.90
swh_Latn	4.54	4.54	4.79	2.30	7.09
ind_Latn	4.49	4.49	4.71	2.31	7.01
yor_Latn	3.38	3.39	3.60	2.30	5.90
hau_Latn	4.47	4.47	4.69	2.31	6.99
rus_Cyrl	3.16	3.16	3.79	2.31	6.10
ukr_Cyrl	3.22	3.22	3.85	2.30	6.15
srp_Cyrl	3.41	3.41	3.99	2.30	6.30
kaz_Cyrl	3.11	3.11	3.56	2.30	5.87
ell_Grek	3.58	3.58	4.07	2.31	6.38
hye_Armn	1.99	1.99	2.23	2.31	4.54
kat_Geor	0.69	0.69	0.95	2.31	3.25
heb_Hebr	2.42	2.42	2.64	2.30	4.94
arb_Arab	3.81	3.83	3.94	1.57	5.51
pes_Arab	3.91	3.92	4.06	1.57	5.63
urd_Arab	4.10	4.11	4.23	1.57	5.80
cmn_Hans	0.85	0.85	0.90	2.27	3.16
cmn_Hant	0.75	0.75	0.78	2.26	3.04
jpn_Jpan	0.62	0.65	0.67	2.28	2.95
kor_Hang	1.31	1.32	1.38	2.29	3.67
hin_Deva	1.01	1.01	1.47	1.57	3.05
mar_Deva	0.75	0.75	1.19	1.57	2.76
ben_Beng	0.83	0.83	1.53	1.57	3.10
tam_Taml	1.10	1.10	1.66	1.57	3.24
tel_Telu	0.90	0.90	1.37	1.57	2.94
guj_Gujr	0.94	0.94	1.18	1.57	2.75
pan_Guru	1.00	1.00	1.46	1.57	3.03
kan_Knda	0.70	0.70	1.17	1.57	2.74
mal_Mlym	0.94	0.94	1.16	1.57	2.74
tha_Thai	0.48	0.48	0.76	2.30	3.07
lao_Laoo	0.50	0.50	0.74	2.30	3.05
mya_Mymr	0.53	0.53	0.83	1.58	2.40
khm_Khmr	0.45	0.45	0.57	1.57	2.14
amh_Ethi	1.00	1.00	1.07	2.29	3.37

The gap comes from the substitution track. Insertion depends only on how many invisible characters a language can safely use, not on its letters which are about 2.30 bits per character, or 1.57 in Arabic and in the scripts that form conjuncts, which must leave out the two joiners (§ 2). Substitution, by contrast, runs from under one bit per character to almost five (4.78 for English), because it depends on how many homoglyphs a language’s frequent characters have.

Within substitution, compatibility variants (family ii) do most of the separating. They are worth more than three bits per character for most Latin-script languages, whose letters and digits have many fullwidth and mathematical forms, and almost nothing for the Brahmic scripts. Cross-script homoglyphs (family i) appear in every script but carry far less outside Latin, Cyrillic and Greek, three alphabets that share many letter shapes. Most conjunct-forming scripts are short on both tracks, which is why Khmer (2.14) and Myanmar (2.40) end lowest. Arabic, Persian and Urdu pay the same insertion penalty but still reach 5.5 to 5.8 bits per character, because Unicode encodes many Arabic presentation forms as compatibility variants.

Chinese, Japanese and Korean follow a different pattern. Their native characters have almost no homoglyphs, and characters outside their native character sets, such as Latin letters, digits and punctuation, carry 49 to 65% of the substitution capacity of Chinese and Japanese and all of Korean’s, against 18% for English.

These capacities are high because $\pi_{\mathrm{none}}$ counts every substitute, including many that a cautious embedder would avoid. Dropping the cross-script substitutes that a mixed-script detector would flag ($\pi_{\mathrm{intra}}$), such as a Cyrillic a in English text, leaves Latin-script languages 93 to 95% of their substitution capacity but the Brahmic and South-East Asian ones only 54 to 81%. Keeping only substitutes that UTS #39 marks as Allowed in identifiers leaves English 1.42 of its 4.78 substitution bits.

Curation explains part of the gap, as § 2 notes, family (i) and the residual come from a hand-curated list that is sparse for CJK and Indic scripts. But family (ii), which comes from a systematic table, splits by script just as sharply. Unicode added compatibility variants largely to stay compatible with older character sets and to support mathematical styling, needs that covered Latin, Greek, Arabic and East Asian forms but hardly any Brahmic letters. The gap is therefore a property of the Unicode standard, not of our method.

Fairness

Our unit of evidence is the script, not the language. The 11 Latin-script languages are close copies of one another, so counting them as 11 independent observations would overstate the evidence; every statement about scripts therefore rests on 24 script groups. We measure how much of the variation in capacity lies between scripts with the intra-class correlation ICC(1) ([27]), which is 1 when languages that share a script have identical capacity and near 0 when script tells us nothing (Appendix § 10). Confidence intervals resample whole scripts rather than languages ([8]).

Script explains almost all of the variation. The ICC is 0.963, so the variance between scripts is about 25 times the variance within them, and none of 10,000 shuffles of languages across scripts, with group sizes fixed, reached it ($p < 10^{-4}$; Figure 3). The ICC stays between 0.954 and 0.978 under each transformation in Figure 5 and between 0.963 and 0.967 across the three policies so the result does not rely on one setting.

The four scripts with several languages show how little room is left inside a script. Arabic, Persian and Urdu sit in three different resource classes, yet their capacities span only 0.29 bits per character. The 11 Latin-script languages span 1.19 bits, against about 5 bits between scripts, and most of that spread comes from Vietnamese and Yoruba,

caption: Untransformed capacity under $\pi_{\mathrm{none}}$ by script group, ordered by group median. Bars span the languages of the four scripts that have several; open markers are scripts with one language.

which write many accented letters with few substitutes. Changing only the characters, by contrast, moves capacity, for example, Mandarin in Simplified and in Traditional characters, one language in one resource class, differs by 1.04-fold, because insertion is the same for both, and by 1.24-fold once copy-paste removes insertion.

To ask whether lower-resourced languages receive less capacity, we use the resource classes of Joshi et al. [12], from 0 (least resourced) to 5, listed in Table 3 (Appendix § 10). Only Latin script has enough languages for a direct test inside one script. Before looking at any class values, we required that test to cover at least three classes spanning at least two levels; the 11 Latin-script languages cover four classes spanning three. The rank correlation between capacity and class is $\rho= +0.095$ (permutation $p = 0.78$), and the class means of 6.66, 7.01, 6.63 and 7.01 bits per character for classes 2 to 5 show no trend.

Across scripts, a script’s median capacity rises with its median resource class ($\rho= +0.54$, 95% interval $[+0.14, +0.83]$ over 24 scripts; Figure 4). Low-capacity scripts, such as the Brahmic, South-East Asian and Ethiopic ones, are used mostly by languages in classes 1 to 3, while Latin, Cyrillic

and Arabic hold most of the languages in classes 4 and 5. Chinese, Japanese and Korean, in classes 4 and 5 but with little capacity, are the main exception, which keeps the correlation moderate. Table 2 collects these results.

Quantity	Value	Evidence base
ICC, untransformed	0.963, $p < 10^{-4}$	24 scripts
ICC, per transformation	0.954–0.978	24 scripts
Mandarin, two orthographies	1.04× (copy-paste 1.24×)	1 contrast
Within Latin, $\rho$ vs. class	+0.095, $p = 0.78$	11 languages
Script level, $\rho$ vs. class	+0.544 [+0.135, +0.826]	24 scripts
Language level, $\rho$ vs. class	+0.487 [+0.185, +0.740]	40 languages

caption: Untransformed capacity under $\pi_{\mathrm{none}}$ against the resource class of Joshi et al. [12]. Horizontal offsets within a class only separate the points.

Taken together, script organizes the gap, and resource level lines up with script. At the script level the two cannot be separated, because each script contributes a single point. We therefore do not claim that resource level is irrelevant, only that its link to capacity appears between scripts and not within them. This answers the question from § 1 since without a tokenizer the gap remains, but its source is Unicode’s uneven supply of homoglyphs rather than tokenization.

Robustness

A transformation can turn two different substitutes into the same character and the key can then no longer tell them apart. Effective capacity therefore counts only the distinct results that survive. For a transformation $\phi$ from Table 1, applied character by character,

and likewise $\kappa_{\mathrm{ins}}^{\mathrm{eff}} = g_L \log_2 \left|\{\phi(m):m \in M_L\} \cup\{\varnothing\}\right|$, where a deleted invisible character counts as no insertion. Survival $s = \kappa^{\mathrm{eff}}/\kappa$ is the share that remains. Figure 5 gives $\kappa^{\mathrm{eff}}$ for every language and transformation under $\pi_{\mathrm{none}}$, and Table 5 (Appendix § 12) gives $s$ for each track.

Code	\multicolumn{6}{c}{Substitution track, $s_{\mathrm{sub}}$}	\multicolumn{6}{c}{Both tracks, $s_{\mathrm{total}}$}
	NFC	C-P	NFKC	MS-HR	MS-SS	Skel.	NFC	C-P	NFKC	MS-HR	MS-SS	Skel.
eng_Latn	1.00	1.00	0.59	0.94	0.94	0.47	1.00	0.67	0.72	0.96	0.96	0.64
spa_Latn	1.00	1.00	0.61	0.94	0.94	0.47	1.00	0.67	0.74	0.96	0.96	0.64
fra_Latn	1.00	1.00	0.60	0.95	0.95	0.47	1.00	0.66	0.73	0.96	0.96	0.65
deu_Latn	1.00	1.00	0.58	0.95	0.95	0.47	1.00	0.66	0.72	0.97	0.97	0.65
por_Latn	1.00	1.00	0.61	0.94	0.94	0.47	1.00	0.67	0.74	0.96	0.96	0.64
vie_Latn	0.99	0.99	0.58	0.96	0.96	0.49	1.00	0.61	0.74	0.97	0.97	0.69
tur_Latn	1.00	1.00	0.59	0.95	0.95	0.44	1.00	0.66	0.73	0.96	0.96	0.63
swh_Latn	1.00	1.00	0.58	0.95	0.95	0.47	1.00	0.67	0.71	0.97	0.97	0.64
ind_Latn	1.00	1.00	0.55	0.96	0.96	0.48	1.00	0.67	0.70	0.97	0.97	0.65
yor_Latn	0.99	0.99	0.61	0.94	0.94	0.48	0.99	0.60	0.76	0.96	0.96	0.68
hau_Latn	0.99	0.99	0.57	0.96	0.96	0.49	1.00	0.67	0.71	0.97	0.97	0.66
rus_Cyrl	1.00	1.00	0.77	0.84	0.84	0.42	1.00	0.62	0.86	0.90	0.90	0.64
ukr_Cyrl	1.00	1.00	0.77	0.84	0.84	0.41	1.00	0.62	0.86	0.90	0.90	0.63
srp_Cyrl	1.00	1.00	0.75	0.86	0.86	0.41	1.00	0.63	0.84	0.91	0.91	0.63
kaz_Cyrl	1.00	1.00	0.75	0.87	0.87	0.43	1.00	0.60	0.85	0.92	0.92	0.65
ell_Grek	1.00	1.00	0.68	0.88	0.88	0.16	1.00	0.64	0.80	0.92	0.92	0.46
hye_Armn	0.99	0.99	0.68	0.89	0.89	0.19	1.00	0.49	0.84	0.95	0.95	0.60
kat_Geor	0.99	0.99	0.77	0.73	0.73	0.47	1.00	0.29	0.93	0.92	0.92	0.84
heb_Hebr	0.99	0.99	0.68	0.91	0.91	0.21	0.99	0.53	0.83	0.95	0.95	0.58
arb_Arab	0.99	0.99	0.47	0.97	0.97	0.13	1.00	0.71	0.62	0.98	0.98	0.38
pes_Arab	0.99	0.99	0.51	0.97	0.97	0.15	1.00	0.72	0.64	0.98	0.98	0.39
urd_Arab	0.99	0.99	0.53	0.97	0.97	0.15	1.00	0.72	0.66	0.98	0.98	0.38
cmn_Hans	0.89	0.89	0.49	0.97	0.84	0.46	0.97	0.25	0.86	0.99	0.96	0.85
cmn_Hant	0.83	0.83	0.41	0.98	0.93	0.46	0.96	0.21	0.85	1.00	0.98	0.86
jpn_Jpan	0.92	0.92	0.36	0.97	0.78	0.60	0.98	0.21	0.86	0.99	0.95	0.91
kor_Hang	0.98	0.98	0.72	0.96	0.89	0.59	0.99	0.37	0.90	0.99	0.96	0.85
hin_Deva	0.98	0.98	0.82	0.66	0.66	0.42	0.99	0.48	0.91	0.84	0.84	0.72
mar_Deva	0.99	0.99	0.83	0.61	0.61	0.38	0.99	0.43	0.93	0.83	0.83	0.73
ben_Beng	0.99	0.99	0.87	0.53	0.53	0.30	0.99	0.49	0.93	0.77	0.77	0.66
tam_Taml	0.99	0.99	0.91	0.53	0.53	0.22	1.00	0.51	0.95	0.76	0.76	0.60
tel_Telu	0.99	0.99	0.82	0.66	0.66	0.32	0.99	0.46	0.92	0.84	0.84	0.69
guj_Gujr	0.98	0.98	0.80	0.77	0.77	0.45	0.99	0.42	0.92	0.90	0.90	0.76
pan_Guru	0.98	0.98	0.82	0.66	0.66	0.41	0.99	0.47	0.91	0.84	0.84	0.72
kan_Knda	0.99	0.99	0.84	0.61	0.61	0.33	1.00	0.42	0.93	0.83	0.83	0.72
mal_Mlym	0.99	0.99	0.83	0.81	0.81	0.28	1.00	0.42	0.93	0.92	0.92	0.70
tha_Thai	1.00	1.00	0.90	0.64	0.63	0.18	1.00	0.25	0.98	0.91	0.91	0.79
lao_Laoo	0.99	0.99	0.77	0.66	0.66	0.37	1.00	0.24	0.94	0.92	0.92	0.85
mya_Mymr	0.99	0.99	0.81	0.61	0.61	0.24	1.00	0.34	0.93	0.87	0.87	0.74
khm_Khmr	0.99	0.99	0.78	0.73	0.73	0.35	1.00	0.26	0.94	0.93	0.93	0.83
amh_Ethi	0.98	0.98	0.74	0.95	0.95	0.56	0.99	0.31	0.92	0.98	0.98	0.86

The two tracks fail under different transformations. Copy-paste deletes every inserted character, so the insertion track falls to zero in all 40 languages, while visible substitutes pass through. The skeleton mapping folds cross-script and residual homoglyphs into one shared form but keeps invisible characters (§ 2). On average, total capacity keeps 0.99 of its value under NFC, 0.93 under mixed-script detection, 0.83 under NFKC, 0.68 under skeleton mapping and 0.51 under copy-paste, but which one hurts most depends on the language. The combined attack of Table 1 erases the mark in every language (§ 6).

NFKC is usually assumed to neutralize homoglyphs, but it folds only compatibility variants (Whistler, [30]). It removes 96% of compatibility pairs yet keeps 93% of cross-script pairs, since a Cyrillic a is a separate letter, not a variant of the Latin one. Languages lose in proportion to how much of their capacity came from compatibility variants (Pearson $r = -0.84$): Chinese, Japanese and the Arabic-script languages keep 0.36 to 0.53 of their substitution capacity, the Latin-script languages 0.55 to 0.61, and the Brahmic and South-East Asian scripts, with few such variants to lose, 0.77 to 0.91.

Mixed-script detection is a defense aimed at homoglyphs which might be expected to hurt homoglyph-rich Latin text most, yet at the Highly Restrictive level it keeps 0.94 to 0.98 of the substitution capacity of Latin, Arabic and CJK text but only about 0.65 for the Brahmic and South-East Asian scripts. Brahmic homoglyphs are mostly twins from sibling scripts, such as Bengali and Tirhuta, and swapping in a sibling-script letter is exactly the mixing the detector strips.

The disparity across all 40 languages can be compared even though no single robustness ranking fits all. NFKC and skeleton mapping narrow the 3.31-fold range to 2.63 and 2.59, because they remove what made Latin and Arabic rich; mixed-script detection widens it slightly, to 3.45. Copy-paste widens it most, to 8.49 (Gini 0.34), because insertion is most of what substitution-poor languages have and removing it costs Khmer 74% of its capacity but Swahili only 33%.

Stealth. Appendix § 13 checks three ways a substitute can be noticed: a mixed-script detector, Unicode’s identifier status, and the rendered glyph, which depends on the font (Figure 8). As with capacity, the cost of staying hidden follows script, for instance, Tamil pays through Unicode’s script assignments, Bengali through a sibling script that readers’ fonts lack, and Arabic through how one shaping engine treats invisible characters.

Keyed Validation

Bits per character are an accounting quantity until a detector caches them. We therefore build a keyed instrument on the measured channel and ask how much text a detector needs. The instrument per-slot alphabets are exactly the admissible sets of § 2. A PRNG seeded by the key draws one symbol for each substitution slot and each insertion gap. The detector holds the key and the cover (§ 2), rebuilds the schedule from the received text, and counts matching slots, much as generation-time detectors count green-list tokens [13]. It thresholds the count’s z-score at the 99th percentile of null trials; Appendix E describes the canonical keying and the test.

Sweep. For each language we score spans of 1 to 256 code points under clean text, copy-paste, the mixed-script detector and NFKC, at policy $\pi_{\mathrm{lang}}$; a span with no usable slot counts as zero evidence rather than being skipped. $n_{\min}$ is the shortest span reaching a true-positive rate of 95% at a false-positive rate of 1% (Figure 6 and Figure 7; Table 7). Here $\kappa^{\mathrm{eff}}$ is evaluated at $\pi_{\mathrm{lang}}$ and at the gap rate of a span of length $n_{\min}$, because that is what the detector sees; for English it is 5.63 bits per character rather than the 7.09 of §4.

Code	Clean	Copy-paste	Mixed-script (HR)	NFKC
eng_Latn	1.95 [1.93, 1.96]	1.96 [1.94, 1.98]	1.95 [1.93, 1.96]	4.56 [3.94, 4.98]
spa_Latn	1.90 [1.87, 1.93]	2.05 [1.88, 2.93]	1.90 [1.87, 1.93]	3.97 [3.94, 4.47]
fra_Latn	1.93 [1.91, 1.94]	1.94 [1.92, 2.89]	1.93 [1.91, 1.94]	3.94 [2.94, 3.97]
deu_Latn	1.92 [1.91, 1.93]	1.93 [1.92, 1.97]	1.92 [1.91, 1.93]	2.96 [2.94, 3.48]
por_Latn	1.95 [1.88, 1.98]	1.96 [1.89, 2.00]	1.95 [1.88, 1.98]	3.95 [3.90, 3.97]
vie_Latn	1.96 [1.90, 2.76]	2.80 [1.98, 2.96]	1.96 [1.90, 2.76]	3.85 [2.95, 3.95]
tur_Latn	1.98 [1.94, 2.91]	2.35 [1.98, 3.46]	1.98 [1.94, 2.91]	10.57 [2.99, 12.82]
swh_Latn	1.87 [1.83, 1.92]	1.88 [1.84, 1.94]	1.87 [1.83, 1.92]	3.78 [2.95, 3.90]
ind_Latn	1.85 [1.00, 1.87]	1.85 [1.00, 1.88]	1.85 [1.00, 1.87]	2.93 [2.91, 3.93]
yor_Latn	2.42 [1.96, 2.56]	4.32 [3.90, 4.73]	2.56 [2.00, 2.66]	3.94 [3.86, 3.96]
hau_Latn	1.95 [1.93, 1.98]	1.96 [1.93, 2.06]	1.95 [1.93, 1.98]	2.95 [2.94, 3.95]
rus_Cyrl	1.87 [1.86, 2.70]	3.70 [3.50, 4.66]	1.87 [1.86, 2.70]	2.35 [2.00, 2.87]
ukr_Cyrl	2.42 [1.99, 2.82]	3.05 [2.94, 3.59]	2.45 [1.99, 2.82]	2.84 [2.71, 3.00]
srp_Cyrl	1.91 [1.88, 2.10]	2.98 [2.88, 4.04]	1.91 [1.88, 2.10]	2.61 [2.00, 2.77]
kaz_Cyrl	2.94 [2.83, 3.51]	3.87 [3.67, 5.76]	2.94 [2.83, 3.46]	2.93 [2.83, 3.35]
ell_Grek	1.90 [1.88, 2.15]	2.50 [2.29, 2.90]	1.90 [1.88, 2.15]	3.81 [3.63, 3.95]
hye_Armn	2.73 [2.67, 2.79]	5.60 [4.23, 5.93]	2.74 [2.68, 2.80]	2.87 [2.85, 3.74]
kat_Geor	3.93 [2.92, 3.95]	22.40 [20.73, 23.88]	3.93 [2.92, 3.95]	3.96 [3.87, 4.95]
heb_Hebr	2.72 [2.61, 2.88]	4.66 [3.87, 5.21]	2.83 [2.78, 3.10]	3.92 [3.86, 4.93]
arb_Arab	1.90 [1.87, 1.94]	1.96 [1.91, 2.38]	1.92 [1.87, 1.95]	3.86 [3.80, 4.05]
pes_Arab	1.85 [1.84, 1.87]	1.85 [1.84, 2.32]	1.85 [1.84, 1.87]	4.67 [3.87, 4.87]
urd_Arab	1.92 [1.92, 1.93]	2.67 [2.42, 2.83]	1.92 [1.92, 1.93]	3.70 [3.57, 3.77]
cmn_Hans	3.89 [3.74, 3.91]	43.95 [32.82, 45.16]	3.89 [3.74, 3.91]	3.94 [3.94, 4.69]
cmn_Hant	3.76 [2.91, 3.89]	31.65 [28.82, 38.63]	3.76 [2.91, 3.90]	3.94 [3.94, 4.67]
jpn_Jpan	3.91 [2.93, 3.94]	36.99 [30.95, 41.34]	3.91 [2.93, 3.94]	3.95 [3.94, 3.96]
kor_Hang	3.83 [2.90, 3.88]	7.99 [7.89, 11.52]	3.84 [2.90, 3.89]	3.96 [3.93, 3.97]
hin_Deva	3.86 [3.84, 5.66]	11.77 [11.26, 15.25]	3.86 [3.84, 4.80]	4.92 [4.71, 5.70]
mar_Deva	4.88 [4.85, 4.91]	15.82 [14.83, 15.96]	4.90 [4.87, 5.88]	4.97 [4.93, 5.96]
ben_Beng	4.82 [3.89, 5.67]	15.42 [14.61, 18.48]	4.84 [3.89, 5.76]	5.71 [4.92, 5.91]
tam_Taml	3.78 [3.59, 3.97]	11.33 [10.67, 13.57]	3.87 [3.68, 4.68]	3.86 [3.67, 4.14]
tel_Telu	4.91 [4.88, 4.95]	12.75 [11.87, 20.41]	4.91 [4.88, 4.95]	4.95 [4.90, 5.93]
guj_Gujr	4.73 [3.83, 4.77]	14.26 [11.49, 15.53]	4.76 [3.85, 4.79]	4.92 [4.67, 4.93]
pan_Guru	3.87 [3.86, 4.79]	13.03 [11.84, 13.93]	3.88 [3.87, 4.84]	4.93 [3.93, 4.94]
kan_Knda	4.91 [3.91, 4.94]	19.69 [15.62, 23.08]	4.91 [3.91, 4.93]	4.92 [3.95, 5.88]
mal_Mlym	4.82 [3.88, 4.85]	12.37 [11.54, 14.74]	4.82 [3.88, 4.85]	4.89 [4.60, 4.91]
tha_Thai	3.92 [3.92, 3.94]	43.01 [37.08, 45.12]	3.92 [3.92, 3.94]	3.93 [3.92, 3.94]
lao_Laoo	3.94 [3.93, 4.94]	92.96 [84.16, 141.66]	3.94 [3.93, 4.94]	3.95 [3.94, 4.96]
mya_Mymr	4.92 [4.91, 5.89]	29.78 [22.74, 32.82]	4.92 [4.91, 5.89]	4.92 [4.91, 5.90]
khm_Khmr	4.95 [4.92, 8.00]	61.74 [57.26, 80.69]	4.96 [4.93, 8.50]	4.96 [4.93, 8.50]
amh_Ethi	3.85 [2.90, 3.87]	12.74 [11.86, 13.61]	3.85 [2.90, 3.87]	3.94 [3.90, 4.90]

Capacity predicts detection length. On clean text $n_{\min}$ runs from 1.85 code points (Persian) to 4.95 (Khmer). A single constant reproduces this as $n_{\min} \approx k/\kappa^{\mathrm{eff}}$ with $k = 10.02$ bits, the median of $n_{\min}\kappa^{\mathrm{eff}}$ on clean text, and the measured-to-predicted ratio runs from 0.79 to 1.36. The rank correlation between $n_{\min}$ and $1/\kappa^{\mathrm{eff}}$ is 0.877 clean, 0.969 under copy-paste and 0.863 under the mixed-script detector; under NFKC it is 0.552, with Turkish an outlier at 10.57 code points (interval 2.99 to 12.82). Under copy-paste the $n_{\min}$ range opens to 50×, English and Persian still need about 2 code points, but Lao needs 92.96.

Floor. The combined attack of Table 1 is a true floor with detection at chance for all 40 languages (largest AUC 0.589).

Conclusion

Homoglyph and invisible-character watermarks need no tokenizer, yet they do not escape the re-source gap of generation-time watermarks. Across 40 language varieties in 24 scripts, script accounts for 96% of the variation in capacity and for over 95% under every attack but the floor. Resource level makes no detectable difference within Latin script, but lower-resourced languages tend to use scripts for which Unicode lists few homoglyphs, hence less capacity. Capacity predicts the text a detector needs for a copy-paste that strips invisible characters widens the gap from 3.3-fold to 8.5-fold; the detector then needs about 2 code points of English or Persian but 93 of Lao. An adversary can remove the watermark in any language; our concern is unequal protection under routine handling. Narrowing the gap would require more complete confusables data for under-served scripts, or a post-hoc channel independent of script-specific inventories.

Limitations

Design. Twenty of the 24 script groups hold a single language, so within-script variance is estimated from four groups and 16 residual degrees of freedom. The ICC is high partly because most groups cannot contribute within-group variance at all; the permutation test preserves group sizes and accounts for this, but the limitation remains. At the script level, each script contributes one median, so script identity and resource class cannot be separated there, and the positive script-level association cannot be attributed to either. The only within-script test (Latin, $n = 11$, four classes) meets the coverage rule we fixed before examining any class values (§ 4), but at that size a null result can only bound an effect, not rule one out.

Resource taxonomy. We use one published classification (Joshi et al., [12]), matched to our languages by name. Seven of the 40 matches are judgment calls, and one exact match, Serbian, also has a plausible lower-class alternative (Appendix § 10). A different taxonomy or matching could change the resource classes, but not the grouping by script.

Corpus. We use one parallel corpus in one register. Parallel text makes the languages directly comparable but limits how far the results generalize. As a check, recomputing on the FLORES+ dev split changes substitution capacity by 0.012 bits per character on average and by at most 0.060.

Snapshot. All capacities are computed from Unicode 17.0.0, CLDR 48.2.0 and FLORES+ 4.5. The confusables list grows between versions, so every capacity here is specific to these versions. Python’s normalization library uses older Unicode data (version 14.0); 158 of the 8,275 code points in our substitution sets are newer than that, including Cyrillic modifier letters from Unicode 15 that substitute for frequent Cyrillic letters. The library’s NFKC cannot fold these newer variants, which is why it removes only 96% of compatibility pairs (§ 5) and leaves the four Cyrillic-script languages more NFKC capacity than Unicode 17.0 normalization would. We keep the library for the NFKC attack, so that its results match what the library does in practice, and use the Unicode 17.0.0 decompositions for the combined floor attack.

Renderer dependence. Every perceptual number depends on the fonts used. When a font stack draws a substitute with a different font than the original character, the measured distance reflects the stack’s fixed fallback order rather than any one device. Whether an invisible character stays invisible depends on the shaping engine, most sharply for Arabic (1.57 bits per character under OpenType and Apple’s CoreText, 0 when HarfBuzz shapes Apple’s AAT fonts), and 178 of the 320 combinations of language, engine and character are not measured: 32 are set by rule and 146 are assumed safe without a test. The 0.02 threshold for eye-invisible substitutes is a choice, and results are stable only over a narrow range around it, so Table 6 also reports bit-identical substitutes, which need no threshold. No human perceptual study was run; all perceptual claims are computational.

Code	Detector: tokens flagged (%) loud	Detector: tokens flagged (%) quiet	Detector: tokens flagged (%) loud, $\pi_{\mathrm{intra}}$	Identifier restricted	Distance typical	Distance nearest	Coverage rendered	Eye-invisible share $\le0.02$	Eye-invisible share identical
eng_Latn	94.7	0.5	2.2	0.70	0.62	0.14	0.75	0.16	0.15
spa_Latn	79.3	0.4	0.7	0.69	0.61	0.11	0.75	0.16	0.15
fra_Latn	81.4	0.4	6.0	0.71	0.61	0.13	0.75	0.15	0.14
deu_Latn	94.4	0.6	2.3	0.72	0.62	0.14	0.73	0.15	0.14
por_Latn	82.0	0.5	1.4	0.70	0.60	0.11	0.75	0.17	0.15
vie_Latn	93.6	0.5	1.2	0.76	0.58	0.14	0.75	0.22	0.21
tur_Latn	97.0	0.5	4.5	0.70	0.62	0.15	0.74	0.14	0.12
swh_Latn	90.2	0.6	1.5	0.71	0.63	0.14	0.73	0.16	0.14
ind_Latn	98.4	0.7	2.1	0.73	0.63	0.16	0.72	0.14	0.12
yor_Latn	87.2	0.3	11.9	0.74	0.62	0.20	0.76	0.19	0.17
hau_Latn	92.1	0.5	2.7	0.74	0.62	0.15	0.73	0.15	0.14
rus_Cyrl	80.5	0.5	2.9	0.72	0.42	0.12	0.68	0.08	0.07
ukr_Cyrl	80.1	0.6	3.1	0.72	0.43	0.12	0.68	0.11	0.07
srp_Cyrl	71.8	0.8	1.7	0.72	0.42	0.10	0.68	0.10	0.09
kaz_Cyrl	90.0	0.5	2.4	0.74	0.43	0.12	0.64	0.11	0.08
ell_Grek	83.2	0.6	1.0	0.67	0.44	0.12	0.69	0.17	0.15
hye_Armn	84.7	0.5	9.0	0.73	0.49	0.21	0.69	0.11	0.11
kat_Geor	74.3	0.8	2.9	0.71	0.61	0.40	0.92	0.25	0.24
heb_Hebr	76.3	0.6	46.3	0.71	0.63	0.44	0.88	0.12	0.12
arb_Arab	59.5	0.5	5.8	0.78	0.52	0.03	0.79	0.29	0.29
pes_Arab	64.6	0.4	1.3	0.76	0.51	0.02	0.80	0.30	0.30
urd_Arab	56.1	0.3	5.9	0.73	0.53	0.02	0.83	0.31	0.31
cmn_Hans	36.4	5.8	18.6	0.83	0.42	0.18	0.84	0.26	0.25
cmn_Hant	25.0	4.4	9.9	0.86	0.38	0.19	0.85	0.29	0.28
jpn_Jpan	63.7	0.3	13.9	0.85	0.64	0.46	0.90	0.12	0.11
kor_Hang	18.0	0.1	3.7	0.92	0.50	0.12	0.88	0.33	0.33
hin_Deva	76.2	0.4	20.2	0.72	0.41	0.18	0.90	0.26	0.26
mar_Deva	87.6	0.3	17.4	0.66	0.40	0.21	0.90	0.23	0.23
ben_Beng	81.2	0.4	14.3	0.87	0.38	0.16	0.58	0.19	0.19
tam_Taml	93.9	0.5	80.1	0.57	0.47	0.38	0.94	0.19	0.18
tel_Telu	92.9	0.7	3.1	0.56	0.58	0.45	0.91	0.19	0.18
guj_Gujr	62.3	0.4	16.8	0.74	0.47	0.19	0.91	0.27	0.27
pan_Guru	82.1	0.4	18.8	0.72	0.44	0.23	0.90	0.26	0.26
kan_Knda	93.7	0.7	2.3	0.54	0.57	0.46	0.93	0.20	0.20
mal_Mlym	88.9	0.6	3.2	0.56	0.56	0.36	0.90	0.16	0.16
tha_Thai	87.2	2.7	5.5	0.27	0.51	0.46	0.94	0.08	0.08
lao_Laoo	79.8	2.1	20.1	0.56	0.65	0.47	0.86	0.15	0.14
mya_Mymr	88.0	0.8	16.3	0.56	0.57	0.38	0.86	0.15	0.15
khm_Khmr	84.8	2.5	39.5	0.59	0.63	0.45	0.87	0.17	0.17
amh_Ethi	23.2	0.5	2.3	0.92	0.47	0.14	0.88	0.36	0.36

Channel scope and detector. We exclude the 1,207 code points that are confusable only with multi-character sequences, since they cannot be swapped one for one, and we leave variation selectors out of the capacity totals. The token-level detector is the weakest reasonable one; the per-pair bound differs from it by at most 0.03 bits per character. The keyed detector is cover-informed, so it is an upper bound on a detector without the original text; within that setting, its threshold is set empirically from null trials, and Appendix § 14 reports its false-positive rate on fresh keys. In 22 languages, the text already contains some of the invisible characters we insert, so some insertions cannot be told apart from native ones; this matters only for Khmer.

Ethical Considerations

Homoglyph and zero-width text manipulation is publicly known and documented in the security literature and in Unicode’s own standards (Boucher et al., [3]; Boucher and Anderson, [2]; Davis and Suignard, [7]); our substitution sets are derived from published Unicode data files. This paper contributes a measurement framework and a validation instrument, not a watermarking product or an attack tool: the keyed instrument uses only the character sets defined in § 2, so it carries exactly the capacity we measure and nothing more. The harm we document is unequal protection rather than a new exploit. Text in low-capacity scripts is harder to mark and harder to verify, so provenance tools built on this channel silently protect some language communities less than others; documenting that gap is the point of this paper. The transformation ladder and our detector models are directly useful to those building normalization and detection defenses, and the per-language numbers show deployers where coverage is thin. We use only public, licensed data: the FLORES+ corpus (CC BY-SA 4.0) and public Unicode and CLDR files. No personal data, user content or human subjects are involved; the objects of study are scripts and code points, not communities. At the corpus provider’s request, we do not redistribute raw corpus sentences; every released artifact is a derived statistic that can be rebuilt exactly from fixed data versions, and we document how the resource classes were matched. Nothing here recommends deploying this channel or certifies any configuration as safe.

Languages and resource classes

Table 3 lists the 40 varieties of §3. The code is the FLORES+ identifier; it labels the rows of Figure 2 and Figure 5 and of every table below, and its suffix is the script, which gives the 24 script groups of §5. The last column is the resource class used there (Joshi et al., [12]). Classes are joined by language name: 33 are exact matches and seven, marked †, are judgement calls. Two drop a regional qualifier (Spanish, Portuguese); three match across a naming difference (Modern Standard Arabic to Arabic, Western Persian to Persian, Eastern Panjabi to Eastern Punjabi); and both Mandarin varieties take the single Mandarin row, so that pair shares a class by construction. Serbian takes its exact row (class 4), although Serbo-Croatian rows of lower class also exist.

Fairness analysis. We use the one-way random-effects intraclass correlation for unbalanced groups Shrout and Fleiss, [27],

where MSB and MSW are the between- and within-script mean squares and $k_0$ is the adjusted mean group size. Permutation tests shuffle the language-to-script labels while keeping group sizes; seeds are listed in Appendix § 15. The variance between scripts is 3.31 and the variance within them 0.13, a ratio of about 25. The ICC stays high under every transformation because each transformation removes particular kinds of homoglyph, and languages that share a script share those kinds, so their capacities rise and fall together.

Descriptive covariates. Three script-level quantities, read from the frozen Unicode tables and never from the corpus or the substitution sets, describe the scripts further. We exclude any quantity built from the substitution sets, since explaining capacity with the same confusables data that defines it would be circular; these covariates therefore describe the picture rather than confirm the mechanism. Against script-median capacity over 24 scripts, script size (code points assigned) has Spearman +0.35 [+0.01, +0.63]; the five bicameral scripts, which have upper and lower case, exceed the rest by 3.08 bits per character in median [+0.21, +3.95]; and combining-mark density against substitution capacity is −0.06 [−0.48, +0.39]. The three are correlated with one another (script size against mark density, −0.56), so they should be read as one picture rather than three findings.

Substitution sets and capacity by language

Over the frozen snapshot, the substitution sets contain 2,245 skeleton classes and 36,066 cross-script, 2,645 compatibility, 600 whitespace and 28,145 residual substitution pairs. The 1,207 code points that are confusable only with multi-character sequences cannot be swapped one for one and are excluded.

Besides the real-text capacity of §3, we report an alphabet view: the plain mean of $\log_2 |S_{\pi}(c)|$ over a language’s native exemplar characters. It asks how rich the writing system is rather than how rich the running text is. The two views differ: English carries 4.78 bits per character of substitution capacity in real text but 2.09 over its alphabet, because frequent characters such as the space and the common vowels have many substitutes. Table 4 gives the numbers behind §4: substitution capacity under each admissibility policy of § 2, insertion capacity, and their total. The policies nest, so $\kappa_{\rm sub}$ never decreases from left to right. Insertion capacity does not depend on the policy; it is about 2.3 bits per character where all four invisible characters are safe and about 1.57 where the two joiners are dropped.

Stability. The bootstrap 95% interval on English total capacity is [7.082, 7.089]. Recomputing every language on the FLORES+ dev split (997 sentences) moves substitution capacity by 0.012 bits per character on average and by at most 0.060, for Yoruba.

Characters outside the native set. Characters outside each language’s native character set carry 65% of the substitution capacity of Simplified Chinese, 55% of Traditional Chinese, 49% of Japanese and all of Korean’s, against 18% for English. Foreign letters alone, such as Latin words inside Chinese text, carry 27% of the substitution capacity of Simplified Chinese, 7% of Japanese and 10% of Korean, against none for English.

Cross-script twins. Cross-script letter twins, such as a Cyrillic a in English text, form a channel worth 1.99 bits per character on its own for English and 2.12 for Russian. Removing them under $\pi_{\rm intra}$ lowers substitution capacity only from 4.78 to 4.50 bits per character for English and from 3.79 to 3.16 for Russian (Table 4), because per-family capacities do not add (§ 2): English letters keep their compatibility variants, which $\pi_{\rm intra}$ admits.

Survival under attack

Table 5 gives the survival $s = \kappa^{\rm eff}/\kappa$ of § 5 under each attack of Figure 5, for the substitution track and for the two tracks combined. The insertion track needs no column: it survives each of them intact except copy-paste, which removes it for all 40 languages. The table also carries the stricter Single Script level of the mixed-script detector, which the main text does not discuss; its substitution survival differs from the Highly Restrictive level by more than 0.01 only for Chinese, Japanese and Korean.

Each transformation removes a different kind of substitute, so each hits a different group hardest. In substitution survival, NFKC hits Chinese, Japanese and the Arabic-script languages hardest (0.36 to 0.53), mixed-script detection the Brahmic and South-East Asian scripts (0.53 to 0.81), and skeleton mapping the Arabic-script languages, Greek, Thai, Armenian and Hebrew (0.13 to 0.21), while the Latin-script languages keep 0.44 to 0.49 under skeleton mapping.

Mixed-script detection permits Latin combined with Han, kana or Hangul at the Highly Restrictive level, so the characters outside the native set that carry much of CJK capacity (§4) pass untouched. Under $\pi_{\rm intra}$, which admits no other-script substitutes, the detector finds almost nothing to remove (mean survival 0.98, against 0.84 under $\pi_{\rm none}$); the exception is Tamil (0.79), for the reason given in Appendix § 13.

Skeleton mapping splits the languages by their native script. Twenty of the 40 lose all substitution capacity from their native characters: 15 write in scripts with no compatibility variants, and in Arabic, Persian, Urdu, Hebrew and Korean the compatibility variants are themselves listed as confusables and fold too. The other 20 keep the compatibility and whitespace variants that the mapping does not merge. Every language still keeps some capacity from embedded Latin text, and all of its insertion track. The full skeleton, which also deletes default-ignorables (§ 2), removes that track too: survival then averages 0.19, below every other single transformation in all 40 languages, and the range between languages widens to 17.0×, with Thai lowest.

Stealth

This appendix gives the stealth analysis summarized in § 5. Capacity counts every substitute, but a substitute only helps if no one notices it. We check three ways it can be noticed: a mixed-script detector, which reads script labels and never a font; Unicode’s identifier status, which marks some characters as Restricted ([7]); and the reader’s eye, which sees glyphs that depend on the installed fonts. We keep the checks apart because they disagree. A cross-script twin (family i) can look identical to the original yet trip the detector, since it carries a foreign script label; a compatibility variant (family ii) never trips the detector, but is often drawn wider or styled. A language can look stealthy under one check and loud under another, and its rank among the 40 changes with the check, so no single stealth score can describe it. Table 6 reports all three checks per language; its eye-invisible share is given both at a 0.02 threshold and for bit-identical substitutes, so that no conclusion rests on the threshold. Against the detector, the embedder’s choices matter most. Substituting at every possible position under $\pi_{\mathrm{none}}$ gets 94.7% of English tokens flagged at the Highly Restrictive level, against none for unmarked text, because almost every word ends up mixing scripts; skipping substitutes that would break a token into two scripts brings this down to 0.5%. The strict policy alone is not enough. Under $\pi_{\mathrm{intra}}$, substituting everywhere still gets 0.7% to 80.1% of tokens flagged, worst for Tamil: the virama sign, 14.4% of Tamil characters, has an Inherited-script homoglyph that $\pi_{\mathrm{intra}}$ admits but whose Script_Extensions do not list Tamil, so any word containing it stops being single-script. Scripts that lean on combining marks are exposed in this way through Unicode’s script assignments, not through anything about the languages. The exposure is avoidable: skipping token-breaking substitutes keeps every language within 0.001 of unmarked text under $\pi_{\mathrm{intra}}$.

Identifier status cuts the other way. Most of English’s substitution capacity already sits in substitutes that UTS #39 marks as Restricted (§4), and the stealthier policies make this worse: dropping cross-script substitutes removes the Allowed foreign letters and keeps the Restricted compatibility variants. An embedder that avoids the mixed-script detector therefore puts more of its bits into exactly the characters an identifier filter would flag.

To a reader, homoglyphs are less identical than their name suggests. We render each character and its substitute and measure how much their ink differs, from 0 for identical outlines; whitespace, which has no ink, is compared by width. On a stack that models a typical reader, Noto fonts for the scripts UAX #31 recommends ([6]) plus CJK, the mean difference is between 0.60 and 0.65 for every family, because many substitutes are drawn in another typeface or style. Picking the closest substitute for each character helps a great deal, cutting English from 0.62 to 0.14 and Arabic from 0.52 to 0.03. These distances compare

glyphs drawn in isolation, which flatters Arabic: its nearest substitutes are mostly isolated presentation forms, which match a letter drawn alone but not one joined inside a word. Eye-invisible substitutes, within 0.02 of the original, are rare and uneven: on a stack with full Noto coverage they carry 13.2% of the cross-script channel for English and 2.8% for Russian, but 0.2% for Bengali and Arabic, because fonts reuse one drawing for two characters mainly across Latin, Cyrillic and Greek. Even this depends on the font: among the three fonts in Figure 8 that render every twin, between 19% and 52% are drawn identically, so “visually identical” only means something for a named font.

A substitute the reader’s fonts cannot draw appears as an empty box, so it is not usable capacity either. On the typical-reader stack, coverage keeps up to 0.94 of substitution capacity for the best-covered languages, but 0.75 for English and only 0.58 for Bengali. What is lost differs by script. Bengali loses mainly one sibling script, Tirhuta, which the stack lacks because UAX #31 does not recommend it; Tirhuta alone accounts for 0.57 bits per character, 89% of Bengali’s loss. English loses mainly styled symbols from the Common script, 92% of its loss.

The insertion track faces a similar test. Beyond the joiners already excluded (§ 2), whether an invisible character stays invisible depends on the software that shapes the text. ZERO WIDTH SPACE and WORD JOINER leave an Arabic word joined under OpenType shaping and in Apple’s own CoreText engine, but break the join in every Apple AAT font we tested when the fonts are shaped by HarfBuzz, which our renderer (Pillow with libraqm) uses. Arabic insertion capacity is therefore 1.57 bits per character under OpenType and CoreText, and 0 under HarfBuzz’s AAT shaping. As with capacity, the cost of staying hidden follows script: Tamil pays through Unicode’s script assignments, Bengali through a sibling script that readers’ fonts lack, and Arabic through how one shaping engine treats invisible characters.

Keyed Instrument and Detection Length

The embedder walks the text, visiting at each position $i$ a substitution slot with alphabet $S_{\pi}(c_i)$ and then the insertion gap after $i$ with alphabet $M_L \cup\{\varnothing\}$; index 0 is the identity option on both tracks. A PRNG seeded by the key (HMAC-SHA256 with rejection sampling, so that every symbol is exactly equiprobable) and labelled by the language, policy, track, position and the five preceding cover characters draws one symbol per slot. Content-keying the label matters: a position-only label makes the schedule a function of the key alone, so every document draws the same symbols and the null variance collapses; only false-positive calibration exposed this. Because the per-slot alphabets are exactly the admissible sets of § 2, summing $\log_2 q$ over the instrument’s own slot walk reproduces $\kappa$ and $\kappa^{\mathrm{eff}}$ to within $10^{-14}$. The detector is cover-informed by necessity rather than convenience: substitutes carry their own admissible sets, so a blind walk mis-derives the alphabet at up to 85% of substitutable positions in homoglyph-rich scripts.

Under the null of “not watermarked with this key” each slot matches with probability $p_i = 1/q_i$; under an attack $\phi$, $p_i$ is the share of the alphabet that $\phi$ maps onto the identity’s image, so a destroyed slot has $p_i = 1$ and contributes no evidence. We declare a watermark when the $z$-score of the match count $X$, $z = (X - \sum_i p_i)/\sqrt{\sum_i p_i(1-p_i)}$, exceeds the 99th percentile of null $z$-scores on unwatermarked text, set separately for each language, condition and span length from 400 to 1,000 trials. We use this empirical threshold rather than a normal quantile because the normal approximation is anti-conservative at short lengths: a normal 1% threshold gives a false-positive rate of 0.054 for Arabic at two code points on clean text. On fresh keys the thresholds give a mean false-positive rate of 1.01% (0.96% to 1.04% across conditions), and 0.98% to 1.32% across conditions at the span length nearest each language’s $n_{\min}$. Single cells scatter around this, up to 5.0% for Indonesian at 128 code points under mixed-script detection, because each threshold is set, and each rate measured, on 400 to 1,000 trials.

The detector rebuilds its schedule from the received document, and an attack changes the characters the labels are computed from. Keying labels on the raw received characters is self-defeating: 13.9% of labels survive attack, the detection statistic drops by 19.8 standard units, and the required length is censored beyond 256 code points for 25 of the 40 languages. Keying on the skeleton keeps 59.7% of labels at a cost of 9.9 units. Keying on the canonical fold keeps 98.5% at a cost of 0.36, and we use this canonical keying throughout. The fold decomposes each character with the frozen Unicode 17.0.0 compatibility decompositions, maps it to its UTS #39 skeleton prototype and turns every White_Space character into U+0020; default-ignorable characters are deleted, which removes all four insertion characters.

Spans are sampled by equal-width strata across the document, and spans with no usable slot are scored at zero evidence rather than skipped, since skipping them would condition on the text being watermarkable. In § 6, $\kappa^{\mathrm{eff}}$ is evaluated at $\pi_{\mathrm{lang}}$ and at the gap rate of a span of length $L$, $(L-1)/L$, at the measured $n_{\min}$; §4–§ 5 use $\pi_{\mathrm{none}}$ and the corpus gap rate. For English the two are related exactly: 7.09 $\to$ 6.80 by the policy step and then $\to$ 5.63 by the gap-rate step. Each is correct for its analysis, and no table or figure mixes them. Under this convention the between-language spread of $\kappa^{\mathrm{eff}}$ is 3.28× on clean text, 10.11× under copy-paste and 2.52× under NFKC.

On clean text the median $n_{\min}$ is 2.83 code points, English needs 1.95, and no language is censored: a 2.7× span of detection length against a $3.3 \times$ span of capacity. One might expect family (ii) share (family (ii)’s capacity as a fraction of $r_{\mathrm{sub}}$) to explain the weaker NFKC correlation, but that is only half right: at $\pi_{\mathrm{lang}}$ it predicts the capacity loss strongly (Spearman $-0.834$ with substitution survival) but the ratio of measured to predicted $n_{\min}$ only moderately ($+0.437$).

The combined attack applies the canonical fold to each character; its largest mean $z$ is 0.288 and its largest AUC 0.589. Skeleton mapping alone is not a floor, because the insertion track and some compatibility and whitespace variants survive. Two nulls exist, unwatermarked text and watermarked text read with the wrong key, and the thresholds use only the first. The two coincide on clean text, where no language has a collapsed image class, and stay close under copy-paste and mixed-script detection, but under NFKC the thresholds flag far more wrong-key text in Armenian and the four Cyrillic-script languages. Finally, 22 of the 40 languages already write with characters from the insertion alphabet, which makes an inserted invisible next to a native one unattributable; the decoder resolves runs rather than characters, and the effect is material only for Khmer, which writes word breaks with ZERO WIDTH SPACE and pays a 5.03% discount on decodable capacity. Persian has 1,739 native non-joiners and no ambiguous gap, because the joiner rule already removed the non-joiner from its safe set.

Table 7 gives $n_{\min}$ with 95% bootstrap intervals, under the four attacks of Figure 7. Every value uses policy $\pi_{\mathrm{lang}}$ and canonical keying, the convention of § 6, and no cell is censored.

Reproducibility

We use Unicode 17.0.0 data files [28, 7], the CLDR 48.2.0 exemplar characters [29], and FLORES+ 4.5. The devtest split (1,012 sentences per language) gives every reported number and the dev split (997 sentences) the stability check of Appendix § 11. The Noto and DejaVu fonts behind the perceptual measures are pinned by release and file hash; the three system fonts in Figure 8 are recorded by hash but cannot be redistributed. Resampling is seeded: the capacity and detection-length bootstraps use seed 12345, the permutation tests of § 4 use 10,000 permutations at each of the seeds 20260801 and 314159, the cluster bootstrap uses 10,000 resamples at seed 271828, and the fresh-key check of Appendix § 14 uses seed 20261011.