Sub-line ink-luminance carrier — R&D findings
Goal: a forensic carrier that marks the documents the word-gap carrier can't — dense/tight layouts
(Skia/Google-Docs exports where inter-word gap ≈ inter-letter gap) — and survives a screenshot.
Idea: stop writing into the whitespace between words; write into the ink itself, and never
segment a word or glyph.
How it works
- Lay a fixed grid of cells over the text block; each inked cell carries one bit.
- Inside a cell, split the ink by a fine checkerboard (tile = 3 px) into two interleaved sets
A and B. Encode the bit as "make A's ink darker than B's" (bit 1) or the reverse (bit 0), amplitude δ. - Decode reads
stat = mean_gray(ink∩B) − mean_gray(ink∩A)per cell. Because A and B interleave
the same letters at tile scale, the document's own content (the host) is ≈ equal in both and
cancels in the difference — only the injected ±δ survives. That is what makes a blind decode
possible without knowing the text. - Bits map to a 120-bit RS(15,8) MAC-gated codeword (reused verbatim from the word-gap prototype), so
a decode is CONFIRMED-grade. The RS solver sums the signed magnitudes per slot (soft
spread-spectrum combining) — this is what lets thousands of individually-weak cells vote; hard
per-cell majority failed through blur.
Signal is intensity + multi-pixel — the two things a screenshot preserves (it destroys sub-pixel
position, which is why the current geometric carriers can't survive one).
Results (measured on the real dense Google-Docs proposal, 150-DPI screenshot channel)
Operating point: cell = 10 px, tile = 3 px. "lines" = text lines available to the decoder.
Cell = success rate over 8 issuance seqs.
Survivability — lines to a CONFIRMED (MAC-gated) decode:
| channel (screenshot grade) | δ=16 | δ=24 (rec.) | δ=32 |
|---|---|---|---|
| clean (faithful PNG grab) | ~6 lines | 3–4 lines | 3 lines |
| typical (zoom 0.85× + JPEG 85) | ~16 lines | ~8–12 lines | 4 lines |
| degraded (photo of a screen) | ✗ | ✗ | ~16 lines (marginal) |
Covertness (PSNR on real dense body text; max per-pixel change = δ gray levels):
| δ | PSNR | look |
|---|---|---|
| 16 | 36 dB | faintest mesh, most covert |
| 24 | 33 dB | subtle mesh on ink, easy to miss at reading scale |
| 32 | 30 dB | mesh visible on close reading |
The mark is a fine checkerboard mesh on the ink only (background untouched → invisible on white).
At reading scale a full page looks clean at a glance; under magnification the mesh is visible. It is
not truly invisible — black ink has no headroom to go darker, so the carrier can only lighten
half the ink, which reads as faint gray speckle on the strokes. This is more visible than word-gap's
"slightly uneven justification," and is the main covertness cost.
Versus the word-gap carrier
| word-gap (live) | sub-line (this) | |
|---|---|---|
| dense Google-Docs doc | fails (can't mark) | works |
| line floor, clean screenshot | ~16 lines | ~3–6 lines |
| layout constraint | justified only | none (ragged/dense/left-aligned) |
| covertness | reads as uneven spacing | subtle ink mesh (more visible) |
| where it applies | PDF content stream | image pixels |
Open engineering questions (not yet solved)
- Applying it to a PDF download. This is an image-level mark. It drops directly into the
image/preview egress channel — the server-rendered secure-preview images, which is exactly where
the reported leak happened (a screenshot of a preview). For the raw PDF download it needs either
rasterising the text layer (loses selectable text) or a PDF-native per-glyph application — a real
design task. - Registration. The prototype rescales the screenshot back to the marked shape; a deploy needs a
sync anchor (finder pattern or a scale/offset correlation search) so the grid re-aligns blindly. - Photo-of-screen (
degraded) still needs a visibly-high δ; the true photo regime is the
DL-model family, out of scope here. - Covertness lever (untested): modulate only stroke interiors (erode the ink mask before
marking) so edges stay crisp black — perception is edge-dominated, so this should cut visibility
substantially at the same δ.
Recommendation
Deploy the sub-line carrier on the image / secure-preview channel first — it applies with no PDF
surgery and closes the exact gap that was hit (a dense doc, screenshotted from preview, untraceable).
Keep word-gap for markable PDF downloads and fail-closed for the rest, until the PDF-application
question (#1) is built out. Prototype: research/sublinecodec.py, research/subline_measure.py.