Paper Review: 11 Ways Humans Hide Sensitive Words — A Mechanism-Oriented Taxonomy of Indirect Linguistic Encoding
> *"The medium is the message."* > — Marshall McLuhan
1. Three Real Posts First
Post 1 (TikTok): > "I just got my seggsuality back 🦷"
Post 2 (Bluesky): > "Unc cooked the turkey fr fr"
Post 3 (TikTok): > "Looking for a plug for 🍃 in the 614"
If you're not in the right community, these posts may be baffling. But they all do the same thing: use some encoding strategy to hide sensitive meaning.
- "seggsuality" = sexuality (visually similar substitution)
- "Unc" = Uncle Sam = US government (referential alias)
- "plug" = drug dealer (community-conventional term)
- 🦷 = tooth = "the tooth" = TikTok slang for "truth"
- 🍃 = weed (emoji visual similarity)
- "614" = Columbus, Ohio (area code standing in for a place)
- Zhang et al. (2014): studied Chinese social media censorship evasion with 5 categories (visually similar substitution, character splitting, translation, semantic reinterpretation, historical allusion). But it only works for Chinese and fails when transferred to English.
- Renwick & Barbosa (2021): focused on character-level operations (leetspeak, punctuation insertion, glyph substitution), ignoring semantic and conventional strategies.
- Calhoun & Fawcett (2023): classified by orthography, morphology, phonology, prosody, and reanalysis, but omitted indirect strategies requiring shared cultural knowledge.
- Leal-Arenas & Corizzo (2024): centered on algospeak (abbreviations, phonetic respelling, symbol substitution, paraphrase, re-semantization), but with muddled levels.
- TikTok video descriptions (1,400 posts, March–May 2026)
- Bluesky posts (600 posts, October 2025 – January 2026)
- Document-level: whether the post contains ILE (binary)
- Span-level: the minimal contiguous ILE spans
- Mechanism-level: assigning categories from the 11 classes
- Document-level κ = 0.852
- Category-level κ = 0.789
- Span-level κ = 0.886
- 4 existing taxonomies (Zhang; Calhoun & Fawcett; Fillies & Paschke; Leal-Arenas & Corizzo)
- The newly proposed 11-class taxonomy
- A no-taxonomy baseline (LLM judges freely)
- No-taxonomy baseline recall = 0.587
- Zhang taxonomy recall = 0.556
- Calhoun taxonomy recall = 0.317
- New taxonomy recall = 0.952
- Orthographic: all methods do fine, because it's the most visible surface operation
- Formal Encoding: new taxonomy +62.2% recall — because only the new taxonomy lists this class explicitly
- Referential Alias: new taxonomy +20.8% — because old taxonomies don't handle alias-based reference, which requires cultural knowledge
- Morpho-Lexical: new taxonomy +24.2% — because old taxonomies lack a "word-formation" dimension
These are not random typos. They are Indirect Linguistic Encoding (ILE) — systematic strategies humans use to hide sensitive meaning in language.
The question: can AI recognize these encodings?
2. The Fragmentation Problem in Existing Research
Hamed Firoozfar et al. (University of Virginia) found that before their work, academic taxonomies of ILE were fragmented:
Each taxonomy covered only part of the phenomenon. Worse, the classification criteria depend on the data source — researchers studying Chinese only saw Chinese strategies; algospeak researchers only saw algospeak strategies. There was no unified "encoding–decoding path" framework.
It's like blind men touching an elephant: everyone touches something real, but no one assembles the whole animal.
3. The New Taxonomy: 11 Classes × 33 Subclasses
The team used Nickerson et al. (2013)'s iterative taxonomy methodology across 4 rounds (conceptual → empirical → conceptual → empirical), building a taxonomy whose meta-characteristic is the "encoding–decoding path".
Key design decision: the meta-characteristic is "how" (how the meaning is encoded), not "why" (motive) or "about what" (topic).
Why? Because motives (censorship evasion, politeness, in-group identity) and topics (drugs, self-harm, sex) change across platforms, cultures, and eras — but "how": the path from surface form to hidden meaning — is stable across contexts.
The result is 11 top-level categories:
1. Orthographic Transformation: modify letter forms while keeping readability, e.g., leetspeak ("s3x"), glyph substitution 2. Phonetic Substitution: encode via homophones, e.g., "seggs" = sex 3. Formal Compression: abbreviations and acronyms, e.g., "fr" = for real 4. Formal Encoding Systems: rule-based encodings, e.g., ROT13, Base64 5. Conventional Sign Reassignment: giving existing symbols new meanings, e.g., 🍃 = weed 6. Morpho-Lexical Encoding: coining new words via word-formation, e.g., "unalive" = kill 7. Referential Alias Encoding: referring to entities by aliases, e.g., "Unc" = US government 8. Semantic Circumlocution: descriptive phrases instead of direct words, e.g., "the plant" = marijuana 9. Metaphorical and Metonymic Encoding: cross-domain mappings, e.g., "cook" = perform well 10. Pictorial and Symbolic Encoding: emoji as meaning carriers, e.g., 🦷 = truth 11. Cross-Linguistic Transformation: using other languages or scripts, e.g., pinyin for Chinese sensitive words
One token can trigger multiple categories at once. For example, "seggs" is simultaneously an orthographic transformation (visual similarity) and a phonetic substitution (sound similarity); "🍃" is both pictorial encoding and conventional sign reassignment. The taxonomy does not require mutual exclusivity and allows combined labeling.
4. Dataset: 2,000 Real Posts
The team collected 2,000 English posts from two platforms:
The platforms have different moderation regimes — TikTok strict, Bluesky relatively lax — allowing observation of how encoding strategies differ under different moderation pressure.
Sampling used a stratified strategy: part seed-word-based biased sampling from an ILE seed list, part random sampling. Posts consisting purely of URLs/hashtags/@mentions were removed, as were verified bot accounts.
Two annotators independently labeled every post at three levels:
Inter-annotator agreement was high:
Ultimately, 44.8% of posts contained at least one ILE instance. Nearly half. ILE is not a marginal phenomenon — it is the norm of social media language.
5. Experiments: LLM + New Taxonomy vs LLM + Old Taxonomies
The team ran 3 LLMs (GPT-5.4, Claude Sonnet 4.6, DeepSeek V4 Flash) × 6 prompt variants:
All prompts used the same 4 few-shot examples; only the embedded taxonomy differed.
Four non-LLM baselines were added: TF-IDF + logistic regression, character n-gram + SVM, Word2Vec cosine similarity, and embedding-graph centrality.
6. Results: The New Taxonomy Wins Across the Board
Taking GPT-5.4 as an example:
| Metric | No taxonomy | Best old taxonomy | New taxonomy | Gain | |---|---|---|---|---| | Document accuracy | 78.5% | 80.5% (Leal) | 84.3% | +3.8pp | | Document F1 | 77.1% | 79.6% (Leal) | 83.9% | +4.3pp | | Span F1 | 59.9% | 64.0% (Leal) | 66.2% | +2.2pp |
Across all three LLMs, the new taxonomy achieved the highest document- and span-level F1. All LLM variants crushed the non-LLM baselines (best NLP method accuracy: only 68.4%).
But the more important findings are at the category level.
6.1 A Partial Taxonomy Can Be Worse Than None
On the "Formal Encoding Systems" class (e.g., ROT13):
The Calhoun taxonomy performed *worse than no taxonomy* on this class! Because it doesn't cover this phenomenon at all — "formal encoding" isn't in its category list, so the LLM sees ROT13 but has nowhere to put it, and simply doesn't label it.
An incomplete taxonomy can be worse than no taxonomy — it doesn't just fail to help; it constrains the LLM's judgment space.
6.2 The New Taxonomy's Biggest Advantage Is on "Combined Encodings"
Real posts often combine multiple encoding strategies. For example, "seggs 🦷" is simultaneously phonetic substitution + pictorial encoding + conventional sign reassignment.
On "combined ILE" (posts with 2+ mechanisms), the new taxonomy's advantage is most pronounced: it allows multiple categories per span, while most old taxonomies force mutually exclusive classification and fall apart on combined encodings.
6.3 Each Class Gains for a Different Reason
7. Why This Work Matters
7.1 Direct Implications for Content Moderation
Current moderation systems rely mainly on keyword matching and classifiers. But the essence of ILE is bypassing keywords — "seggs" isn't on the sexuality keyword list, and "🍃" is just an emoji to most moderation systems.
If moderation systems don't understand encoding mechanisms, they can only play catch-up: users invent a new encoding, systems label data, train a classifier, deploy — then users invent another. It's a cat-and-mouse game.
The new taxonomy provides a mechanism-level framework: whatever the specific encoding is, it must fall into one of 11 paths. Moderation systems can design detection strategies per path rather than per encoding instance. It's a paradigm shift from "whack-a-mole" to "sealing the holes."
7.2 Implications for AI Safety
LLMs themselves can be used to generate ILE — bypassing safety filters, generating veiled harmful content, spreading in-group codes. If an LLM can recognize ILE, it can also produce it. Understanding encoding mechanisms is the first step of defense.
The deeper issue: LLMs' understanding of ILE depends on the taxonomy framework provided. This means the LLM's "understanding" is not universal pattern recognition but constrained by the supplied framework. Swap frameworks and the same LLM's performance can drop by 20 percentage points. That's an important data point in the debate over whether LLMs truly understand language.
7.3 A Methodological Contribution to Linguistic Taxonomy
The work also offers computational linguistics a methodological demonstration: using Nickerson's iterative taxonomy construction to build a computationally usable classification. Many NLP tasks still rely on ad hoc categories ("I think it should split like this") rather than systematic iterative construction. This paper shows how to make taxonomy-building itself a reproducible research process.
8. An Honest Assessment: The Work's Limits
1. English-only data. ILE strategies in Chinese, Russian, or Arabic may differ entirely. Zhang et al. (2014)'s Chinese taxonomy has 5 classes with limited overlap with the new 11. Cross-lingual generalization needs more validation. 2. Two platforms. ILE on Reddit, Twitter/X, Telegram, or Discord may differ. TikTok and Bluesky are both short-text platforms; long-text ILE may be more complex. 3. The 44.8% ILE rate may be inflated — seed-word biased sampling was used; the true distribution is likely lower. The authors acknowledge this. 4. Few-shot LLM setup. All experiments used 4-shot. Fine-tuning or longer contexts might yield different results. 5. Only 2 annotators. Agreement is high, but 2 annotators still leave subjective bias; more would strengthen credibility. 6. The taxonomy is static. ILE evolves dynamically — new encodings are born daily. The paper doesn't discuss a continuous-update mechanism.
9. Closing: McLuhan's Prophecy
In 1964, Marshall McLuhan said "The medium is the message": the mode of transmission itself shapes the meaning of the message.
ILE is a perfect illustration. When someone writes "seggs" instead of "sex," she isn't just evading moderation — she is declaring "I belong to this community," "I know the rules," "I'm willing to pay the extra character cost for this expression." The encoding itself is a social signal.
What Firoozfar's team's 11-class taxonomy fundamentally says: humans use 11 basic ways to hide sensitive meaning inside surface forms. Across platforms, languages, and cultures, these 11 paths are stable.
And for AI to truly understand human language, it must understand these 11 paths — not as keyword lists, but as encoding–decoding mechanisms.
Because language is not just what you say, but how you say it. And "how" is often more important than "what."
---
Paper: arXiv:2606.27314 Code and data: github.com/hmdfiroozfar/mechanism-oriented-ile-taxonomy Authors: Hamed Firoozfar, Sina Firoozfar, Amir Karami (University of Virginia & University of South Carolina)