ΑΙhub.org
An invisible word of the day: watermarking assignment prompts to detect copy-pasted chatbot answers
Figure 1: The SteganoPrompt web interface. The green “Disclosure always on” banner signals that every encoded brief carries a short academic-integrity reminder that cannot be switched off, and offers ready-to-paste syllabus wording. Instructors paste the assignment into panel 1 (“Visible text”). Panel 2 (“Hidden instruction”) shows the read-only reminder, which ends with the verification token SteganoPrompt-OK-2026, plus a field for an optional, kind add-on. A Verify panel further down the page (not shown) decodes any text for auditing. Everything runs in the browser.
SteganoPrompt lets educators embed an invisible but openly announced instruction in an assignment prompt, so that a chatbot fed the prompt verbatim can nudge the student toward honest work and sign its reply with a verifiable token.
Chatbots built on large language models (LLMs) now produce fluent essays, code and quiz answers in seconds, reshaping take-home work from secondary school to graduate study. Many educators have no wish to ban them; used openly, they can be valuable study aids. The case worth detecting is narrower: a student pastes the assignment prompt into a chatbot and submits the reply verbatim, skipping the learning the assignment exists to produce.
Why after-the-fact detection falls short
Post-hoc detectors, which guess whether a finished essay was machine-written, collapse under light paraphrasing and are biased against non-native English writers; OpenAI withdrew its classifier in July 2023, citing low accuracy. Output-side watermarks, which subtly bias a model’s word choices so its text can be recognized later, are more principled, but only the model provider, not a teacher, can switch them on.
A word of the day, made invisible
Two experiences inspired us. First, the International Conference on Machine Learning (ICML) 2026 announced hidden watermarks in reviewer-facing materials to flag reviews produced by pasting them into an LLM, following evidence that several percent of recent AI-conference reviews had been substantively rewritten by LLMs.
Second, as a graduate teaching assistant for Prof. Kinga Dobolyi’s software engineering course at The George Washington University, I watched a simple integrity check at work. At the start of each in-class quiz, Prof. Dobolyi announced a “word of the day” (apple, umbrella, compiler) for students to write atop their submissions. Free and convenient, it was also fragile: anyone present could text the word to someone outside within seconds, and it could never work for take-home assignments. SteganoPrompt is its invisible, take-home generalization: a word of the day hidden inside the prompt.
How SteganoPrompt works
Our paper at the Conference on AI, Ethics, and Society (AIES 2026) flips the problem: watermark the question, not the answer. SteganoPrompt uses Unicode’s deprecated Tags block (code points U+E0000 to U+E007F), an invisible mirror of the keyboard characters defined by the American Standard Code for Information Interchange (ASCII). Almost no font draws these tag characters, yet they survive copy-and-paste, and many chatbots read them as ordinary text, a trick known as “ASCII smuggling”. The tool shifts each character of a hidden instruction into this range: “Hi!” plus a line break becomes U+E0048, U+E0069, U+E0021 and U+E000A.
An instructor pastes an assignment in, clicks “Encode & copy”, and posts the result to their learning management system (LMS) as usual; the visible text never changes. A student who pastes the prompt verbatim into a chatbot becomes the unwitting courier of an invisible tripwire, planted by the assignment’s own author.
Transparency is built in: every encoded brief carries a read-only reminder that cannot be switched off (Figure 1’s green “Disclosure always on” banner). It asks the chatbot to open with one friendly line urging the student to complete the work in their own words and disclose any AI assistance, and to end with the token SteganoPrompt-OK-2026 on its own line. A Verify panel decodes any text, so instructors can confirm the payload survived their LMS before release, and check suspect submissions when grading.
The tool is one self-contained, open-source web page (MIT License) that runs in your browser and makes no network requests once loaded. Try it now or read every line of its source on GitHub.
Our main contributions
- Formalizing input-side watermarking and its copy-paste threat model
- SteganoPrompt, a free, open-source, zero-dependency web tool
- Benchmarks across eight LLM families and more than a dozen channels
- A four-part framework for disclosed, ethical classroom use
Putting it to the test
We gave four assignment prompts, three times each, to 13 configurations from eight LLM families (by July 31, 2026), and sent a 256-byte hidden payload through common channels (see table). The watermark needs the hidden characters to reach the model, which the GPT-5 series appears to prevent, and the model to act on them, which Qwen2.5 never does.
At a glance: which chatbots carry the watermark, and which channels preserve it?
Models: 12 trials per configuration (four prompts × three runs), measured on or before July 31, 2026; ratings also draw on public vendor and security disclosures. Channels: a 256-byte hidden payload. Vendor behavior changes without notice, so re-test before deployment. HTML: HyperText Markup Language; JSON: JavaScript Object Notation; PDF: Portable Document Format.
A student who already suspects a watermark can defeat it by deleting the hidden characters, retyping the prompt, telling the chatbot to ignore embedded instructions, or pasting a chatbot’s restatement of the brief into a fresh chat. More revealing, in tests on August 5, 2026, was a request needing no suspicion: no preamble, no reminders, no trailing line. Grok 4.5 still emitted the watermark in five of six trials and Gemini 3.1 Pro in all six, favoring the specific hidden instruction; the smaller Gemini 3.6 Flash obeyed the visible request every time.
Vendors drift, too. In our chat-app checks, GPT-5.6 Sol stayed silent, while Claude Opus 5 read the hidden instructions, did not follow them and warned the user, revealing the mechanism. We recommend re-testing right before deployment.
A conversation starter, not a verdict
A hit shows that a chatbot consumed the verbatim prompt; it does not prove misconduct, and silence proves nothing. We recommend four principles:
- Disclose the policy in the syllabus. An announced policy deters more than a secret trap catches, and the tool supplies ready-to-paste wording.
- Use a kind payload that nudges students toward honest work and disclosure, never one that produces wrong answers or embarrassment.
- Treat a hit as a conversation starter, never a verdict.
- Stay within the educational context. Watermark only assignments you author; used elsewhere, this is a prompt-injection attack.
What comes next
We plan to replace the fixed token with a Hash-based Message Authentication Code (HMAC), a cryptographic signature tied to the course, term and section; to add a watermark woven into the wording, which could survive light paraphrasing; to run a multi-instructor field study; and to work with model providers on which silent changes to pasted text are acceptable. We hope it helps educators keep take-home assignments meaningful, transparently and fairly.
Find out more and explore SteganoPrompt
- Paper (AAAI/ACM AIES 2026): On Seeding Watermarks to Detect Verbatim LLM Copy-Paste Responses, Aizierjiang Aiersilan, Artin Yousefi and Robert Pless
- Interactive web tool
- Open-source code (GitHub, MIT License)
Co-author credits: Artin Yousefi (The George Washington University), who presented the paper at AIES 2026 in Malmö, Sweden; and Professor Robert Pless (The George Washington University), who provided tremendous encouragements, genuine support and thorough guidance throughout the whole process of the paper and webtool.
tags: AAAI, AIES, AIES2026
AUAI is supported by:
