References

Boucher, N. and Anderson, R.

32nd USENIX Security Symposium (USENIX Security '23), Anaheim CA, pp. 6507–6524 · arXiv:2111.00169 · ISBN 978-1-939133-37-3

Anchor citation for the bidi finding. Working attacks demonstrated in C, C++, C#, JavaScript, Java, Rust, Go, Python, SQL, Bash, Assembly, and Solidity, with industry-wide coordinated disclosure. Project site: trojansource.codes.

Boucher, N., Shumailov, I., Anderson, R., Papernot, N.

43rd IEEE Symposium on Security and Privacy (SP), 2022, pp. 1987–2004 · DOI 10.1109/SP46214.2022.9833641 · arXiv:2106.09898

Cited on the homoglyph and zero-width findings. Extends invisible-character attacks from compilers to NLP systems: a single imperceptible injection significantly degrades vulnerable models, and three injections functionally break most. Tested against deployed commercial systems from Microsoft and Google.

Gao, K., Li, Y., Du, C., Wang, X., Ma, X., Xia, S.-T., Pang, T.

arXiv preprint, October 2025 · arXiv:2510.05025

Cited on the variation-selector finding. Confirms the ranges this decoder implements: 256 invisible selectors, the original 16 (U+FE00–U+FE0F) plus 240 supplementary (U+E0100–U+E01EF). Invisible suffixes alter tokenization while leaving the prompt visually identical. Reported qualitatively — the paper's abstract states high attack success rates against four aligned LLMs without printing percentages. Code: github.com/sail-sg/imperceptible-jailbreaks.

arXiv preprint, February 2026 · arXiv:2603.00164

Used to keep this tool's copy calibrated rather than inflated. Evaluates zero-width binary and Unicode Tags encodings across five frontier models, and finds tool access to be the single largest factor in compliance — models resist hidden instructions at high rates when no tools are available. Cited here precisely because it limits the claim.

Rehberger, J.

embracethered.com (security research blog, not peer-reviewed)

The primary source for the tag-block byte channel and the two-character “Sneaky Bits” scheme this decoder implements, and the correct attribution for tag-block smuggling against Microsoft Copilot. Cited honestly as blog posts; referenced as prior work in arXiv:2603.00164, which lends it standing.

NVD

Attached directly to the bidi-override finding.

NVD

Attached directly to the mixed-script and punycode host findings.

The Unicode Consortium

The specification behind the homoglyph finding. The matcher implements the single-script restriction: a confusable is only reported when it is mixed into a Latin word, so wholly Cyrillic or Greek text is not flagged as a spoof. It uses a curated confusables subset rather than the full skeleton algorithm and confusables.txt data file.

The Unicode Consortium

Normative reference for bidi behaviour; cited as UAX #9 in the Trojan Source paper itself.

The Unicode Consortium

Source of the behaviour that makes tag characters render invisibly, and the citation on the tag-block finding.

arXiv preprint, 2025 · arXiv:2504.11168

Character injection — zero-width characters, homoglyphs, emoji and Unicode tag smuggling — bypassed every guardrail tested, including Azure Prompt Shield, Meta Prompt Shield, and NVIDIA NeMo Guard Detect. tryb deliberately states this structurally rather than quoting a bypass rate: those figures reflect 2025 guardrail versions, vendors have patched since, and the paper's own framing emphasises variance across systems. The durable point is that deterministic detection has no bypass rate.

Aim Security (Aim Labs), disclosed June 2025

NVD · CVSS 9.3 critical · published 11 June 2025 · patched server-side

Cited only as evidence that indirect prompt injection is a real, severe, exploited class. Explicitly NOT cited on any Unicode-encoding finding: the payload was delivered as HTML comments and white-on-white text chained with a CSP bypass, via a technique the researchers named “LLM Scope Violation.” It involves no Unicode tag characters. tryb previously carried this misattribution on its tag-block finding and it has been corrected.

Davis, J.C., Coghlan, C.A., Servant, F., Lee, D.

ESEC/FSE 2018, pp. 246–256 · Best Paper Award · DOI 10.1145/3236024.3236027

The “why this matters” citation for the ReDoS checker: thousands of super-linear regexes affecting over 10,000 modules across the JavaScript and Python ecosystems.

Davis, J.C., Michael IV, L.G., Coghlan, C.A., Servant, F., Lee, D.

ESEC/FSE 2019, pp. 443–454 · DOI 10.1145/3338906.3338909

Cited specifically on the per-flavour verdict grid — regex behaviour is not portable across engines — rather than as a general ReDoS reference.

Weideman, N., van der Merwe, B., Berglund, M., Watson, B.

CIAA 2016, LNCS vol. 9705, pp. 322–334 · DOI 10.1007/978-3-319-40946-7_27

The source of the EDA/IDA severity split, cited as motivation and not as implementation: tryb.dev applies a heuristic plus empirical timing, not the formal NFA-ambiguity analysis described in this paper.

Weber, A. and Seidl, H.

Theoretical Computer Science 88(2), pp. 325–349, 1991 · DOI 10.1016/0304-3975(91)90381-B

The theoretical root of degree-of-ambiguity, underpinning the EDA/IDA distinction.

Wüstholz, V., Olivo, O., Heule, M.J.H., Dillig, I.

TACAS 2017, LNCS vol. 10206, pp. 3–20 · DOI 10.1007/978-3-662-54580-5_1

Related work on sound static analysis, and the answer to why tryb does not attempt it.

Bray, T.

IETF, December 2017 · DOI 10.17487/RFC8259

Defines the strict grammar and documents interoperability concerns for non-unique object names, number range and precision, Unicode escapes, encoding, and parser limits.

Bishop Fox

Bishop Fox research blog

Motivates differential testing across parser boundaries. tryb covers the issue families with named semantic profiles rather than presenting historical parser observations as live runtime results.

Meli, M., McNiece, M.R., Reaves, B.

NDSS 2019 · DOI 10.14722/ndss.2019.23418

The empirical basis for hybrid rule-plus-entropy detection. First large-scale longitudinal analysis of secret leakage on GitHub — billions of files, a roughly six-month real-time commit scan plus a snapshot covering 13% of open-source repositories, focused on private key files and 11 high-impact platforms with distinctive API key formats. Over 100,000 repositories affected, with thousands of new unique secrets leaked daily. GitHub shipped repository secret scanning after this paper published. Table I sets tryb's provider coverage order, and its Primary Risks and single-/multi-factor columns are the basis for the rotation-urgency priority carried by each rule; Table III supplies the key formats. Two of the 11 platforms are excluded as retired rather than left uncovered, and the two loosest patterns are deliberately narrowed — see the notes in lib/data/secret-rules.json, gated by secrets-priority.test.ts.

MIT licensed

Provider rule patterns are derived from gitleaks. Attribution here is a license obligation under MIT, not a courtesy citation.

Sheffer, Y., Hardt, D., Jones, M.

IETF, February 2020 · updates RFC 7519 · DOI 10.17487/RFC8725

Cited per JWT finding — §3.1 on algorithm verification for the alg:none finding, §3.5 ("Ensure Cryptographic Keys Have Sufficient Entropy") for the recovered-weak-secret finding, §3.8 on key material for the jku/x5u/x5c finding. Note that draft-ietf-oauth-rfc8725bis is in progress and will obsolete RFC 8725, adding threats discovered since 2020.

IETF

Claim and header semantics used by the decoder.

IETF

Access-token-specific claim requirements.

IETF, December 2005

tryb's weak-secret cracker needs a synchronous HMAC-SHA256 (crypto.subtle is async and cannot run inside a matcher). Rather than trust a hand-rolled implementation, its output is pinned in tests against the HMAC-SHA-256 test vectors in §4 of this RFC, plus FIPS 180-4 for the underlying SHA-256 and a real jwt.io reference signature.

Nemec, M., Sýs, M., Švenda, P., Klinec, D., Matyáš, V.

ACM CCS 2017 · CVE-2017-15361

Basis for the ROCA finding only. tryb ships the paper's fast fingerprint (the primorial/generator-subgroup pre-filter, not the full Coppersmith factorization), so it reports a POSSIBLE ROCA-family key, never a recovered private key. The vendored prime/bitmask constants are re-derived from first principles in rsa-analysis.test.ts and asserted element-by-element against this fingerprint's definition.

NIST, May 2020

Key-size guidance behind the undersized-modulus findings: RSA below 2048 bits is deprecated and below ~1024 bits is trivially factorable. tryb maps these to a warning and a critical respectively.

Boneh, D.

Notices of the AMS, 46(2), 1999

Context for the exponent and close-prime findings — low-public-exponent risks and the fact that primes chosen close together fall to Fermat factorization. tryb's Fermat check is time-bounded and a bounded miss is reported as inconclusive, never as "primes are well separated."

IETF, November 2016

Defines the RSAPublicKey ASN.1 structure and the SubjectPublicKeyInfo wrapping that tryb's hand-rolled DER parser decodes, plus the recommended public exponent (F4 = 65537) the exponent findings compare against.

IETF, May 2008 · DOI 10.17487/RFC5280

The profile tryb's parser implements: TBSCertificate field order and the optional/explicitly-tagged fields, the UTCTime and GeneralizedTime rules behind the validity findings (§4.1.2.5 — two-digit years 50–99 mean 19xx, which is precisely why a certificate valid past 2049 must use GeneralizedTime), the rule that a conforming implementation MUST reject a certificate carrying an unrecognized critical extension (§4.2), and the deprecation of CN-as-hostname in favour of subjectAltName (§4.2.1.6) behind the missing-SAN finding.

Stevens, M., Bursztein, E., Karpman, P., Albertini, A., Markov, Y.

CRYPTO 2017, LNCS vol. 10401, pp. 570–596 · DOI 10.1007/978-3-319-63688-7_19

Cited only on the SHA-1 signature finding: a practical collision means a SHA-1 signature no longer binds a certificate to its contents. It says nothing about the certificate's key size or validity dates, so it is not attached to those findings.

Stevens, M., Sotirov, A., Appelbaum, J., Lenstra, A., Molnar, D., Osvik, D.A., de Weger, B.

CRYPTO 2009, LNCS vol. 5677, pp. 55–69 · DOI 10.1007/978-3-642-03356-8_4

Why an MD5 signature is reported as critical rather than merely obsolete: this work produced a working rogue CA certificate, making an MD5-signed certificate forgeable in practice and not just in theory.

CA/Browser Forum

Source of the 398-day maximum-lifetime rule (in force since September 2020, enforced by the Apple, Google, and Mozilla root programs) behind the over-long-lifetime finding, and of the requirement that subjectAltName be present. tryb reports a long lifetime as a warning about public-CA acceptance rather than as a cryptographic weakness — a decade-long internal or self-signed certificate is a policy matter, not a broken key. Note that this ceiling is set by the CA/Browser Forum and is being ratcheted down further, so the constant in the matcher tracks this document rather than anything in the certificate.

IETF, January 2005 · DOI 10.17487/RFC3986

Defines percent-encoding as a percent sign followed by two hexadecimal digits (§2.1) and warns against decoding the same string more than once (§2.4). tryb uses those rules to reject incomplete escapes and to flag multiple decoding layers without claiming what a downstream application will do. The bibliography also cites RFC 3986 elsewhere for URL parsing; the distinct id keeps finding-card deep links unambiguous while preserving the narrower relevance statement here.

WHATWG Living Standard

Defines form-style query parsing, including percent-decoding and converting plus signs to spaces. tryb preserves repeated keys in source order because the serialized format permits them; the warning accurately says application frameworks may choose different first-value, last-value, array, or rejection semantics.

WHATWG Living Standard

Normative catalogue and syntax reference for HTML named character references. tryb intentionally implements a small, explicit common-name subset plus decimal and hexadecimal numeric references; it does not claim to be a browser HTML tokenizer, and requires a terminating semicolon to avoid overclaiming ambiguous prose.

IETF, October 2006 · DOI 10.17487/RFC4648

Defines base16 as two hexadecimal characters per octet. That byte-pair invariant is why tryb rejects odd nibble counts. RFC 4648 does not assign semantic meaning to the bytes, so hash- and color-shaped values remain lower-confidence generic hex interpretations rather than being reclassified.

Oracle

Java Object Serialization Specification

Defines the STREAM_MAGIC AC ED and STREAM_VERSION 00 05 bytes used for Java serialization recognition.

Python Software Foundation

Python documentation

Documents pickle protocols and explicitly warns that unpickling untrusted data can execute arbitrary code.

The PHP Group

PHP Manual

Documents PHP serialized input and warns not to pass untrusted user input to unserialize().

Microsoft

Microsoft Open Specifications

Defines the SerializedStreamHeader record and version fields used for structural NRBF recognition; NRBF is not represented as an invented universal magic byte.

MITRE

Common Weakness Enumeration

Supports the conditional source-to-sink risk language for untrusted native deserialization.

Fielding, R., Nottingham, M., Reschke, J.

IETF, June 2022 · DOI 10.17487/RFC9112

Defines HTTP/1.1 message syntax, CRLF line endings, field parsing, Content-Length, Transfer-Encoding, and rules intended to prevent request smuggling.

MITRE

Common Weakness Enumeration

Frames request smuggling as inconsistent request interpretation across intermediary boundaries.

IETF, September 1981 · DOI 10.17487/RFC0791

Defines the 32-bit IPv4 address format. tryb uses strict four-octet decimal syntax and separately classifies private, loopback, link-local, multicast, and reserved ranges; it does not infer a geographic location or whether an address is reachable.

IETF, February 2006 · DOI 10.17487/RFC4291

Defines IPv6 textual forms, zero compression, IPv4-embedded forms, and address types. tryb expands to eight hextets for inspection and emits RFC-style compressed text without claiming network ownership.

IANA

Authoritative registry for service-name and port-number assignments and ranges. A registered or commonly used name is only a convention: tryb does not claim that a process is listening, that TCP and UDP use the same service, or that traffic is safe.

IANA

Authoritative registry of assigned HTTP status codes. tryb distinguishes assigned codes from values that are structurally valid within 100–599 but unassigned; local frameworks may define extension codes that the IANA registry does not.

IETF, June 2022 · DOI 10.17487/RFC9110

Defines the three-digit status-code format and the five response classes. This supports classifying a code as informational, successful, redirection, client error, or server error without treating every class-valid number as an assigned standard response.

NIST, August 2024 · DOI 10.6028/NIST.FIPS.203

Table 3 defines raw ML-KEM encapsulation-key, decapsulation-key, ciphertext, and shared-secret sizes. Size alone cannot distinguish standardized ML-KEM from similarly sized pre-standard Kyber artifacts or validate either encoding.

NIST, August 2024 · DOI 10.6028/NIST.FIPS.204

Table 2 defines public-key, private-key, and signature byte lengths for ML-DSA-44, ML-DSA-65, and ML-DSA-87.

NIST, August 2024 · DOI 10.6028/NIST.FIPS.205

Table 2 defines key and signature sizes for all twelve SHA2 and SHAKE SLH-DSA parameter sets. Many key lengths collide, while the large signature lengths are more distinctive but still not self-authenticating.

IETF Internet-Draft · work in progress

Defines named TLS hybrid groups, key_exchange component order, and client/server wire lengths. tryb reports these only as protocol-context candidates and does not infer a generic hybrid from arbitrary concatenated sizes.

freedesktop.org

Documents identifying file types from byte patterns. tryb recognizes a deliberately small set of common signatures at offset zero; a header match is a type hint, not proof that the complete file is valid or safe.

The Open Group Base Specifications Issue 8

Defines owner, group, other, set-user-ID, set-group-ID, and sticky mode bits. tryb converts those bits between octal and symbolic notation but does not model ownership, umask, ACLs, capabilities, or filesystem-specific enforcement.

Node.js Documentation

Documents common .env variable-name, value, quoting, export-prefix, whitespace, and comment rules. tryb parses assignments for inspection without interpolation or shell execution and redacts values whose keys look credential-sensitive.

IETF OAuth Working Group

Internet-Draft

Current draft guidance for algorithm validation, password-based JWE iteration policy, and compressed-content size limits. tryb labels draft-derived thresholds as policy rather than universal vulnerability boundaries.

Jones, M., Hildebrand, J.

IETF, May 2015

Defines compact JWE's five segments and protected-header semantics.

The Go Authors

Go standard library documentation and source

Documents exact-key preference followed by case-insensitive matching when mapping JSON object keys to Go struct fields. tryb implements a bounded simple-fold projection rather than JavaScript locale lowercasing.

YAML Language Development Team

Defines explicit tags and YAML syntax. tryb lexically recognizes a narrow unsafe-tag set without parsing aliases, applying implicit types, or constructing objects.

PyYAML documentation

Documents Python-specific object tags and the distinction between safe loading and constructor-capable loading.

W3C Recommendation

Defines DTD entity declarations, general entities, parameter entities, and references used by the non-resolving lexical analyzer.

OWASP Foundation

OWASP Cheat Sheet Series

Supports parser-configuration mitigations and the distinction between observable declarations and actual external resolution.

MITRE

Common Weakness Enumeration

Defines conditional XXE consequences including file disclosure and server-side requests.

Python Software Foundation

Python documentation

Documents exponential and quadratic entity expansion as resource-exhaustion classes. tryb projects local replacement characters; it does not measure runtime memory.

NIST

Source of the monobit, runs, and serial tests used by the entropy matcher. Stated plainly: SP 800-22 targets long generator output, not short tokens. tryb borrows individual tests as heuristics and does not claim conformance with the suite.

IETF · supersedes RFC 4122

Version and variant semantics, v1 MAC and timestamp layout, and v7 embedded time.

ISO/IEC

Checksum and structure validation for card-shaped and IBAN-shaped input.

IETF

URL parsing and internationalized domain name handling.

Mozilla Foundation · MPL 2.0

Registrable-domain boundaries for host analysis. Attribution is a license obligation, not a courtesy citation.