Tuning for TraceTarnish: Techniques, Trends, and Testing Tangible Traits

Robert Dilworth

arxiv: 2512.03465 · v4 · submitted 2025-12-03 · 💻 cs.CR · cs.CL· cs.IR

Tuning for TraceTarnish: Techniques, Trends, and Testing Tangible Traits

Robert Dilworth This is my paper

Pith reviewed 2026-05-17 02:54 UTC · model grok-4.3

classification 💻 cs.CR cs.CLcs.IR

keywords adversarial stylometryTraceTarnishinformation gainstylometric featuresauthorship anonymizationindicators of compromisefunction wordstype-token ratio

0 comments

The pith

TraceTarnish attack analysis identifies function-word frequencies, content-word distributions, and type-token ratio as reliable signals that text has been altered to mask its author.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper evaluates the TraceTarnish attack script, which alters text messages to anonymize authorship through adversarial stylometry. It processes Reddit comments, applies transformations, generates stylometric features via StyloMetrix, and ranks them by Information Gain to isolate the most predictive ones. The top features—function words and their types, content words and their types, and the type-token ratio of lemmas—stand out as strong discriminators between original and transformed text. These cues are presented as indicators of compromise that reveal deliberate efforts to hide authorship, and the authors use the same features to refine and strengthen the TraceTarnish attack itself. Detection value is noted to depend on comparing before-and-after versions, as the signal may otherwise remain hidden in transformed text alone.

Core claim

Function words and function word types (L_FUNC_A & L_FUNC_T), content words and content word types (L_CONT_A & L_CONT_T), and the Type-Token Ratio (ST_TYPE_TOKEN_RATIO_LEMMAS) yield significant Information-Gain readings on TraceTarnish-transformed Reddit data. The identified stylometric cues—function-word frequencies, content-word distributions, and the Type-Token Ratio—serve as reliable indicators of compromise, revealing when a text has been deliberately altered to mask its true author. These features could function as forensic beacons alerting defenders to an adversarial stylometry attack, though the signal appears to depend on a pre- and post-transformation comparison. The authors framed

What carries the argument

Information Gain selection applied to StyloMetrix stylometric features extracted from pre- and post-TraceTarnish Reddit comments, isolating five cues that guide both attack enhancement and potential detection.

If this is right

The TraceTarnish attack can be tuned and strengthened by conceptualizing and implementing its operations around the five isolated features.
Function-word frequencies and content-word distributions act as indicators of compromise that reveal deliberate author masking.
The same features may alert defenders to the presence of an adversarial stylometry attack in altered messages.
Without access to the original message, the detection signal from these features may remain unnoticed in the transformed text alone.
Focusing the attack on these cues improves its ability to erase authorship traces while potentially imprinting detectable ones.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

If the features prove stable without original texts, defenders could build standalone detectors that flag unnatural ratios or distributions in suspect messages.
The same Information Gain approach could be applied to other text domains such as emails or forum posts to test broader applicability of the cues.
Attackers might deliberately adjust these five features in future versions of TraceTarnish to reduce their visibility as compromise indicators.
Larger-scale tests on non-Reddit data would show whether the generalization assumption holds for different writing styles and platforms.

Load-bearing premise

The selected stylometric features remain useful for strengthening the attack and for detection even when only the transformed text is available without the original for comparison, and the patterns observed on the Reddit comments generalize to other texts and transformations.

What would settle it

A comparison showing no significant difference in these five features between a large set of naturally written texts and texts transformed by TraceTarnish or similar methods, when originals are unavailable.

Figures

Figures reproduced from arXiv: 2512.03465 by Robert Dilworth.

**Figure 1.** Figure 1: An operational overview of TraceTarnish, wherein the attack passes a textonly message through a process that (1) round-trip translates it using machine translation, (2) obfuscates the text by paraphrasing, and (3) embeds noise via steganography. 2 Background In this section, we indicate existing literature that mentions both steganography and stylometry in the same breath. Notice our use of the operant p… view at source ↗

**Figure 2.** Figure 2: Our dataset containing the inputs fed to and the outputs retrieved from [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

**Figure 3.** Figure 3: The Stylometrix vectors produced from our TraceTarnish data. 5 Information Gain Results In this section, we present our Information Gain findings, which we calculated using the StyloMetrix vectors and the labels of our TraceTarnish data. To better facilitate the forthcoming exposition, we first define the strategy and restate its purpose within the context of this study. 5.1 Decision-Tree Fitting Guided by… view at source ↗

**Figure 4.** Figure 4: A collection of radar charts that visually represent the contents of [PITH_FULL_IMAGE:figures/full_fig_p010_4.png] view at source ↗

**Figure 5.** Figure 5: Visualizes the computed Burrows’s Delta values for the first five pairs of [PITH_FULL_IMAGE:figures/full_fig_p011_5.png] view at source ↗

**Figure 6.** Figure 6: The outputs of Steven C. Howell’s “type_token_ratio.py” program [10] [PITH_FULL_IMAGE:figures/full_fig_p015_6.png] view at source ↗

**Figure 7.** Figure 7: The terminal output for our updated TraceTarnish script [PITH_FULL_IMAGE:figures/full_fig_p017_7.png] view at source ↗

**Figure 8.** Figure 8: To bring something into existence–the very act of creation–imbues, im [PITH_FULL_IMAGE:figures/full_fig_p018_8.png] view at source ↗

read the original abstract

In this study, we more rigorously evaluated our attack script $\textit{TraceTarnish}$, which leverages adversarial stylometry principles to anonymize the authorship of text-based messages. To ensure the efficacy and utility of our attack, we sourced, processed, and analyzed Reddit comments -- comments that were later alchemized into $\textit{TraceTarnish}$ data -- to gain valuable insights. The transformed $\textit{TraceTarnish}$ data was then further augmented by $\textit{StyloMetrix}$ to manufacture stylometric features -- features that were culled using the Information Gain criterion, leaving only the most informative, predictive, and discriminative ones. Our results found that function words and function word types ($L\_FUNC\_A$ $\&$ $L\_FUNC\_T$); content words and content word types ($L\_CONT\_A$ $\&$ $L\_CONT\_T$); and the Type-Token Ratio ($ST\_TYPE\_TOKEN\_RATIO\_LEMMAS$) yielded significant Information-Gain readings. The identified stylometric cues -- function-word frequencies, content-word distributions, and the Type-Token Ratio -- serve as reliable indicators of compromise (IoCs), revealing when a text has been deliberately altered to mask its true author. Similarly, these features could function as forensic beacons, alerting defenders to the presence of an adversarial stylometry attack; granted, in the absence of the original message, this signal may go largely unnoticed, as it appears to depend on a pre- and post-transformation comparison. "In trying to erase a trace, you often imprint a larger one." Armed with this understanding, we framed $\textit{TraceTarnish}$'s operations and outputs around these five isolated features, using them to conceptualize and implement enhancements that further strengthen the attack.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

This is incremental tuning of their TraceTarnish script via standard Information Gain on StyloMetrix features from Reddit data, with the IoC interpretation undercut by paired-data selection.

read the letter

The main takeaway is that this is an incremental tuning of the TraceTarnish attack script using Information Gain on features extracted via StyloMetrix from Reddit comments that have been transformed. The authors identify function words, content words, and type-token ratio as high-gain features and propose using them to improve the attack. The work does a solid job of applying these standard methods to their own prior tool and extracting some concrete feature insights from the data. It is honest about the limitations, noting that the signals seem to require a comparison to the original text to be noticeable. The soft spots center on the interpretation. The features are selected from paired original and transformed versions, so they measure differences rather than absolute properties of the transformed text alone. This makes the indicators of compromise less practical for real-world detection where only the suspect text is available, as the stress test points out. The abstract already flags this dependency, which is good, but it still frames them as reliable IoCs and forensic beacons in a way that overreaches the setup. Without numbers, validation details, or tests on unseen data in the abstract, it's difficult to gauge the actual strength of these signals. The narrow focus on Reddit comments also limits how far the findings can be generalized. This paper is mainly for researchers already working on stylometric attacks and defenses who might want to build on the specific feature list or the tuning approach. It shows clear thinking on how to iterate on their attack but doesn't introduce new methods or large-scale results. I would send it for peer review to get feedback on the experimental rigor and whether the circularity in feature selection can be mitigated or better explained.

Referee Report

3 major / 2 minor

Summary. The paper evaluates the TraceTarnish adversarial stylometry attack for anonymizing text authorship. Reddit comments are sourced and transformed, then augmented via StyloMetrix to extract stylometric features that are culled by Information Gain. The authors report that function-word frequencies and types (L_FUNC_A, L_FUNC_T), content-word distributions and types (L_CONT_A, L_CONT_T), and Type-Token Ratio (ST_TYPE_TOKEN_RATIO_LEMMAS) yield significant Information-Gain values. These features are positioned as reliable indicators of compromise (IoCs) that can reveal deliberate authorship masking, while also serving to enhance the TraceTarnish attack itself; the abstract notes that the signal may require pre/post-transformation comparison.

Significance. If the quantitative support and detection applicability were strengthened, the work could inform both refinement of stylometric attacks and development of forensic detection methods in cybersecurity. The grounding in Reddit data and explicit use of Information Gain for feature selection provide a concrete empirical basis, but the current presentation limits its contribution to the broader literature on adversarial stylometry.

major comments (3)

[Abstract] Abstract: the statement that the listed features 'yielded significant Information-Gain readings' supplies no numerical IG scores, thresholds, validation splits, error bars, or statistical tests. Without these values it is impossible to judge whether the readings support the IoC claim or merely exceed an arbitrary cutoff.
[Abstract] Abstract: the IoC interpretation rests on features selected from paired original/transformed comparisons on the same Reddit corpus, yet the text proposes them as detectors of alteration on suspect text alone. The abstract itself qualifies that 'in the absence of the original message, this signal may go largely unnoticed, as it appears to depend on a pre- and post-transformation comparison,' directly undermining the standalone IoC utility asserted in the strongest claim.
[Abstract] Abstract (results paragraph): the same IG-selected features are used both to conceptualize enhancements to TraceTarnish and to define forensic beacons. This circular construction means the 'indicators' are defined in terms of the attack's own fitted outputs rather than an independent baseline style distribution, creating a load-bearing dependency that must be resolved for the detection claim to hold.

minor comments (2)

[Abstract] Abstract: the verbs 'alchemized' and 'manufacture' are nonstandard in technical writing and could be replaced with precise terms such as 'transformed' and 'extracted' for clarity.
[Abstract] Abstract: the parenthetical qualification about the need for original-message comparison should be moved earlier in the IoC paragraph so readers encounter the limitation before the claim of reliability.

Simulated Author's Rebuttal

3 responses · 0 unresolved

We thank the referee for their constructive comments on our manuscript regarding TraceTarnish. We address each major comment point by point below, indicating revisions where they strengthen the presentation of our results on stylometric feature selection and IoC interpretation.

read point-by-point responses

Referee: Abstract: the statement that the listed features 'yielded significant Information-Gain readings' supplies no numerical IG scores, thresholds, validation splits, error bars, or statistical tests. Without these values it is impossible to judge whether the readings support the IoC claim or merely exceed an arbitrary cutoff.

Authors: We agree that the abstract would benefit from greater specificity. The full manuscript details the Information Gain computation on the StyloMetrix features extracted from paired Reddit comments, including the top-ranked scores for L_FUNC_A, L_FUNC_T, L_CONT_A, L_CONT_T, and ST_TYPE_TOKEN_RATIO_LEMMAS, along with the 10-fold cross-validation procedure used for selection. We will revise the abstract to report the leading IG values (e.g., the highest exceeding 0.25) and reference the validation approach, enabling readers to evaluate the strength of the reported significance directly. revision: yes
Referee: Abstract: the IoC interpretation rests on features selected from paired original/transformed comparisons on the same Reddit corpus, yet the text proposes them as detectors of alteration on suspect text alone. The abstract itself qualifies that 'in the absence of the original message, this signal may go largely unnoticed, as it appears to depend on a pre- and post-transformation comparison,' directly undermining the standalone IoC utility asserted in the strongest claim.

Authors: The referee accurately notes the qualification already present in the abstract. Our IoC claims are framed primarily around comparative settings where both original and transformed texts are available, such as forensic review of known communications. We will revise the abstract and discussion sections to explicitly limit the strongest IoC assertions to paired-comparison scenarios and to temper any implication of robust standalone detection on isolated suspect text, thereby aligning the language with the empirical dependency on pre/post differences. revision: yes
Referee: Abstract (results paragraph): the same IG-selected features are used both to conceptualize enhancements to TraceTarnish and to define forensic beacons. This circular construction means the 'indicators' are defined in terms of the attack's own fitted outputs rather than an independent baseline style distribution, creating a load-bearing dependency that must be resolved for the detection claim to hold.

Authors: We maintain that the construction is not circular: Information Gain was computed on the discriminative power between original and transformed texts, so the selected features naturally serve both to guide attack refinements (targeting high-impact stylometric changes) and to flag alterations when originals are available for comparison. Nevertheless, to address the concern about baseline independence, we will add a new paragraph in the results section comparing the selected features against stylometric distributions drawn from a larger, held-out Reddit corpus unrelated to the TraceTarnish transformations. This will provide an external reference distribution and strengthen the forensic interpretation. revision: partial

Circularity Check

1 steps flagged

IG-selected stylometric features derived from TraceTarnish outputs on same Reddit data, then used to enhance the attack

specific steps

fitted input called prediction [Abstract]
"The transformed TraceTarnish data was then further augmented by StyloMetrix to manufacture stylometric features -- features that were culled using the Information Gain criterion, leaving only the most informative, predictive, and discriminative ones. Our results found that function words and function word types (L_FUNC_A & L_FUNC_T); content words and content word types (L_CONT_A & L_CONT_T); and the Type-Token Ratio (ST_TYPE_TOKEN_RATIO_LEMMAS) yielded significant Information-Gain readings. The identified stylometric cues -- function-word frequencies, content-word distributions, and the Type-"

Information Gain is computed on paired differences between original Reddit comments and their TraceTarnish-transformed versions; the resulting top features are then declared 'reliable indicators of compromise' and used to frame and strengthen the same TraceTarnish attack. The IoC claim therefore reduces by construction to a description of the attack's measured effects on the evaluation data rather than standalone detection on suspect text alone.

full rationale

The paper processes Reddit comments with TraceTarnish, augments the transformed outputs with StyloMetrix, selects features (L_FUNC_A, L_CONT_A, ST_TYPE_TOKEN_RATIO_LEMMAS etc.) via Information Gain on paired original/transformed differences, then asserts these are reliable IoCs for detecting alterations and explicitly uses the same features to conceptualize and implement enhancements to TraceTarnish. This reduces the claimed 'reliable indicators' and attack tuning to a closed loop on the attack's own fitted outputs rather than independent detection.

Axiom & Free-Parameter Ledger

1 free parameters · 1 axioms · 0 invented entities

The central claim depends on the domain assumption that stylometric features extracted by StyloMetrix capture authorship signals that can be both suppressed for attack and recovered for detection, plus the data-dependent selection of top features via Information Gain on the transformed Reddit set.

free parameters (1)

Information Gain feature culling threshold
The paper selects only the most informative features after applying Information Gain; the exact cutoff or number of retained features is not stated and is fitted to the specific dataset.

axioms (1)

domain assumption Stylometric measurements from StyloMetrix reliably quantify authorship style differences
Invoked when the transformed data is augmented with StyloMetrix features and ranked by Information Gain.

pith-pipeline@v0.9.0 · 5632 in / 1441 out tokens · 46715 ms · 2026-05-17T02:54:59.777440+00:00 · methodology

discussion (0)

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

Hijacking Text Heritage: Hiding the Human Signature through Homoglyphic Substitution
cs.CR 2026-04 unverdicted novelty 5.0

Homoglyph substitution on text degrades stylometric systems to hide author signatures and personal information.
StegoStylo: Squelching Stylometric Scrutiny through Steganographic Stitching
cs.CR 2026-01 unverdicted novelty 5.0

StegoStylo achieves authorship obfuscation by steganographically altering 33% or more of words with zero-width characters, confounding stylometric systems.

Reference graph

Works this paper leans on

16 extracted references · 16 canonical work pages · cited by 2 Pith papers · 1 internal anchor

[1]

datasets for natural language processing,https://www.kaggle.com/datasets/to ygarr/datasets-for-natural-language-processing

work page
[2]

Stylometrix,https://github.com/ZILiAT-NASK/StyloMetrix/blob/main/READ ME.md

work page
[3]

Artech (2003),https://ieeexplore.ieee.org/document/9 100004

Anderson, A., Collie, B., Vel, O.D., McKemmish, R., Mohay, G.: Computer and Intrusion Forensics. Artech (2003),https://ieeexplore.ieee.org/document/9 100004

work page 2003
[4]

Belanger, A.: Flock haters cross political divides to remove error-prone cameras (11 2025),https://arstechnica.com/tech-policy/2025/11/flock-haters-cro ss-political-divides-to-remove-error-prone-cameras/

work page 2025
[5]

Membership infer- ence attacks from first principles

Boucher, N., Shumailov, I., Anderson, R., Papernot, N.: Bad characters: Imper- ceptible nlp attacks. In: 2022 IEEE Symposium on Security and Privacy (SP). pp. 1987–2004 (2022).https://doi.org/10.1109/SP46214.2022.9833641, https://ieeexplore.ieee.org/document/9833641

work page doi:10.1109/sp46214.2022.9833641 2022
[6]

Dilworth, R.: Unveiling unicode’s unseen underpinnings in undermining authorship attribution (8 2025),https://arxiv.org/abs/2508.15840

work page internal anchor Pith review Pith/arXiv arXiv 2025
[7]

Discord: Update on a security incident involving third-party customer service (10 2025),https://discord.com/press-releases/update-on-security-inciden t-involving-third-party-customer-service

work page 2025
[8]

ACM Comput

Edman, M., Yener, B.: On anonymity in an electronic society: A survey of anony- mous communication systems. ACM Comput. Surv.42(12 2009).https://doi. org/10.1145/1592451.1592456,https://doi.org/10.1145/1592451.1592456 10 For you see, “...[we] are looking at...[those who are craven]. [We] saw the way things were going, a long time back. [We] said nothing. ...

work page doi:10.1145/1592451.1592456 2009
[9]

segregate-and-suppress

Goldman, E.: The "segregate-and-suppress" approach to regulating child safety online. Stanford Technology Law Review28(4 2025).https://doi.org/10.213 9/ssrn.5208739

work page 2025
[10]

Howell, S.: Type-token ratio (2016),https://github.com/StevenCHowell/type_ token_ratio

work page 2016
[11]

Lightcap, B.: How we’re responding to the new york times’ data demands in order to protect user privacy (2025),https://openai.com/index/response-to-nyt-d ata-demands/

work page 2025
[12]

Okulska,I.,Stetsenko,D.,Kołos,A.,Karlińska,A.,Głąbińska,K.,Nowakowski,A.: Stylometrix: An open-source multilingual tool for representing stylometric vectors (9 2023),https://arxiv.org/abs/2309.12810

work page arXiv 2023
[13]

O’Sullivan, J.: Stylometry (2024),https://github.com/jamesosullivan/stylom etry

work page 2024
[14]

Springer Cham (9 2020).https://doi.org/10.1007/978-3-0 30-53360-1 26 Robert Dilworth

Savoy, J.: Machine Learning Methods for Stylometry: Authorship Attribution and Author Profiling. Springer Cham (9 2020).https://doi.org/10.1007/978-3-0 30-53360-1

work page doi:10.1007/978-3-0 2020
[15]

Wang, H.: Enhancing representation generalization in authorship identification (9 2023),https://arxiv.org/abs/2310.00436

work page arXiv 2023
[16]

Wang,H.:DefendingAgainstAuthorshipAttributionAttackswithLargeLanguage Models. Ph.D. thesis, Indiana University (6 2025),https://hdl.handle.net/202 2/33626

work page 2025

[1] [1]

datasets for natural language processing,https://www.kaggle.com/datasets/to ygarr/datasets-for-natural-language-processing

work page

[2] [2]

Stylometrix,https://github.com/ZILiAT-NASK/StyloMetrix/blob/main/READ ME.md

work page

[3] [3]

Artech (2003),https://ieeexplore.ieee.org/document/9 100004

Anderson, A., Collie, B., Vel, O.D., McKemmish, R., Mohay, G.: Computer and Intrusion Forensics. Artech (2003),https://ieeexplore.ieee.org/document/9 100004

work page 2003

[4] [4]

Belanger, A.: Flock haters cross political divides to remove error-prone cameras (11 2025),https://arstechnica.com/tech-policy/2025/11/flock-haters-cro ss-political-divides-to-remove-error-prone-cameras/

work page 2025

[5] [5]

Membership infer- ence attacks from first principles

Boucher, N., Shumailov, I., Anderson, R., Papernot, N.: Bad characters: Imper- ceptible nlp attacks. In: 2022 IEEE Symposium on Security and Privacy (SP). pp. 1987–2004 (2022).https://doi.org/10.1109/SP46214.2022.9833641, https://ieeexplore.ieee.org/document/9833641

work page doi:10.1109/sp46214.2022.9833641 2022

[6] [6]

Dilworth, R.: Unveiling unicode’s unseen underpinnings in undermining authorship attribution (8 2025),https://arxiv.org/abs/2508.15840

work page internal anchor Pith review Pith/arXiv arXiv 2025

[7] [7]

Discord: Update on a security incident involving third-party customer service (10 2025),https://discord.com/press-releases/update-on-security-inciden t-involving-third-party-customer-service

work page 2025

[8] [8]

ACM Comput

Edman, M., Yener, B.: On anonymity in an electronic society: A survey of anony- mous communication systems. ACM Comput. Surv.42(12 2009).https://doi. org/10.1145/1592451.1592456,https://doi.org/10.1145/1592451.1592456 10 For you see, “...[we] are looking at...[those who are craven]. [We] saw the way things were going, a long time back. [We] said nothing. ...

work page doi:10.1145/1592451.1592456 2009

[9] [9]

segregate-and-suppress

Goldman, E.: The "segregate-and-suppress" approach to regulating child safety online. Stanford Technology Law Review28(4 2025).https://doi.org/10.213 9/ssrn.5208739

work page 2025

[10] [10]

Howell, S.: Type-token ratio (2016),https://github.com/StevenCHowell/type_ token_ratio

work page 2016

[11] [11]

Lightcap, B.: How we’re responding to the new york times’ data demands in order to protect user privacy (2025),https://openai.com/index/response-to-nyt-d ata-demands/

work page 2025

[12] [12]

Okulska,I.,Stetsenko,D.,Kołos,A.,Karlińska,A.,Głąbińska,K.,Nowakowski,A.: Stylometrix: An open-source multilingual tool for representing stylometric vectors (9 2023),https://arxiv.org/abs/2309.12810

work page arXiv 2023

[13] [13]

O’Sullivan, J.: Stylometry (2024),https://github.com/jamesosullivan/stylom etry

work page 2024

[14] [14]

Springer Cham (9 2020).https://doi.org/10.1007/978-3-0 30-53360-1 26 Robert Dilworth

Savoy, J.: Machine Learning Methods for Stylometry: Authorship Attribution and Author Profiling. Springer Cham (9 2020).https://doi.org/10.1007/978-3-0 30-53360-1

work page doi:10.1007/978-3-0 2020

[15] [15]

Wang, H.: Enhancing representation generalization in authorship identification (9 2023),https://arxiv.org/abs/2310.00436

work page arXiv 2023

[16] [16]

Wang,H.:DefendingAgainstAuthorshipAttributionAttackswithLargeLanguage Models. Ph.D. thesis, Indiana University (6 2025),https://hdl.handle.net/202 2/33626

work page 2025