Perplexity invisible character detector limits

There are two distinct things in this network and the difference is worth stating before any claim is made. One is a deterministic scan: a fixed list of codepoints, matched character by character, executed in the browser. The other is a model reading your text on our server and describing what it finds. This route is the second.

The consequence is concrete. Nothing here is a guarantee that a specific codepoint was found or missed, because no fixed list is being applied on this route. The fixed list exists and is published below, and it belongs to the watermark checker and cleaner, which run locally. A page that blurred the two would be claiming determinism it does not have.

Most tools in this space are sold on the belief that language models embed hidden characters in their output. Originality.ai published a test across several models and reported the result plainly: no model produced an invisible character, though all of them relied heavily on visible Unicode. Its account of the visible characters is a training-data argument, that models learn from professionally edited text where em dashes and smart quotes are standard, and that a model faces none of the keyboard friction that makes a person reach for a hyphen instead.

The same source addresses the watermark theory directly, calling it incorrectly reported, noting that removal would be trivial if it were true, and quoting OpenAI describing the behaviour as a quirk of large-scale reinforcement learning. Take the implication seriously: if the characters are not being emitted at generation time, an invisible character in your document is evidence about your toolchain, not about the model. That changes what you should be investigating.

Published in full, because coverage claimed in the abstract is not verifiable. Eleven of the fourteen are deleted outright. Three are substituted with U+0020, since they occupy the position of a space and deleting one would concatenate the words on either side.

U+200B, U+200C, U+200D, U+2060

Zero-width space, non-joiner, joiner and word joiner. All four are invisible, all four occupy a character slot, and all four survive copy and paste.

U+FEFF

Byte-order mark. Legitimate at the head of a file and disruptive anywhere else, where it confuses parsers, feeds and validators.

U+00AD

Soft hyphen. Dormant until a line wrap makes it visible, at which point a hyphen appears in a word that never contained one.

U+00A0, U+202F, U+200A

No-break space, narrow no-break space, hair space. Substituted with a normal space rather than removed, for the reason above.

U+202A, U+202B, U+202C, U+202D, U+202E

Directional embeddings, the pop, and the two overrides. U+202E reverses display order, so a file name can read differently from what it is.

Coverage without declared omissions is not coverage information. Competing tools advertise 87 codepoints, or ranges reaching U+E007F, and a reader comparing against those figures deserves the specific difference rather than a larger number.

Absent from the list: U+200E and U+200F, the left-to-right and right-to-left marks. U+2028 and U+2029, the line and paragraph separators. U+034F, the combining grapheme joiner. The variation selectors U+FE00 to U+FE0F. The tag characters U+E0000 to U+E007F, which are the ones used in the prompt-injection demonstrations that circulate periodically. And the typographic spaces U+2000 to U+2009 along with U+205F and U+3000. A document containing any of these will pass a clean run unchanged, which is worth knowing before you conclude the document is clean.

Brief, with the provenance point built into step 1 because it determines whether the check is useful at all.

Step 1

Submit 1 to 12,000 characters, taken from the artefact exhibiting the symptom rather than from an upstream copy. The intervening tools are the likely source.

Step 2

Optionally scope with up to 300 characters of instruction, naming the observed symptom: a failing string match, a broken slug, an unexpected line wrap.

Step 3

Read the findings, then perform any removal with the local cleaner, which applies the fixed list deterministically rather than describing what it sees.

Treating every invisible codepoint as noise is the standard failure in this category, and it destroys correct text. Two cases carry real semantics and they are handled differently.

The zero-width joiner composes emoji. A joiner between two pictographic characters builds a single glyph, and our engine tests for exactly that adjacency, skipping the joiner when both neighbours are pictographic, with skin-tone and variation modifiers walked past on the way. So composed emoji survive a clean rather than decomposing into their parts.

The zero-width non-joiner is the harder case and we do not pretend otherwise. It is orthographically meaningful in Persian and in several Indic scripts, and there is no reliable local test that distinguishes a meaningful instance from a stray one. The engine therefore reports it and the guidance attached to it says to review text in those scripts before cleaning. A tool that claims to make that judgement for you is claiming something it cannot do.

Perplexity presents numbered inline citations through its answers, comparable to an academic paper, with a corresponding source list. Copying an answer carries those bracketed numbers into the destination document as ordinary visible text.

That puts them in scope for any regex-driven cleanup a user applies, and they do not belong there. The practical rule is to exclude bracketed spans before running any substitution over a Perplexity draft. The stakes are slightly higher than they look, because that product does not render its sources into APA or MLA, so the markers represent formatting work still outstanding rather than a completed bibliography.

No claim is made here in any direction, and the reasoning is worth following rather than accepting. If the published testing is right that models do not emit invisible characters, then removing them removes nothing that a detector was reading, and the premise of the whole bypass argument fails at the first step.

Independently of that, we run no tests against Turnitin, GPTZero, Copyleaks or Originality.ai, hold no affiliation with any of them, and never predict a third-party verdict. On Perplexity specifically we assert nothing about a character-based marker in either direction: we have observed no evidence of one, and absence of observed evidence is not a finding of absence.