Writing You Can Read by Squinting, and the AI Models That Say There Is None

There is an old way to see a picture better: narrow your eyes, or take a few steps back. Fine detail blurs away and the broad masses of light and dark remain, and sometimes those masses spell a word you had not noticed. In profile photos passing through a real content moderation system, people pushing illicit promotions have been hiding web addresses and contact details in exactly that layer of the image. In a new paper’s examples, asked to transcribe the text, Gemini 3.1 Pro, Claude Opus 5 and GPT-6 Astra each gave the same answer: “There is no text in this image.”

The examples come from a preprint posted on arXiv on 9 October by researchers at the Beijing University of Posts and Telecommunications and Tencent’s anti-cheat team. They call the problem squint text. Their benchmark, SquintBench, holds 1,076 images taken from a real moderation pipeline, mostly profile photos, with every visible and hidden string transcribed by people. For controlled tests they also built their own images with QR Code Monster, an open add-on for Stable Diffusion released in 2023 to bury a shape inside a generated picture.

The scores are low across the board, and lowest of all for GPT-6 Astra. On a scale from 0 to 100 that measures how close a transcription is to the right text, the small open model Qwen3.5-9B scored 26.5, Claude Opus 5 22.3, Gemini 3.1 Pro 18.2 and GPT-6 Astra 8.3. The obvious fix is to squint for the model: shrink the image before showing it. Reduced to 40 by 40 pixels, the images lifted Qwen to 68.6 and Gemini to 44.9. Claude dropped to 11.1 and Astra to 6.3. The paper’s Figure 1 carries the plain caption: the defence already in use does not remove the problem.

The odd part is what happens inside. The authors froze the small Qwen model and attached a simple probe to its vision encoder, the stage that turns pixels into the representation the language model then reads. Shown pairs of generated images identical except for a hidden string, the probe told them apart almost perfectly, with an AUC between 0.96 and 0.98, where 0.5 is chance. Which letters were there came through much more weakly. The model’s eye registers that something is written; somewhere between seeing and saying, it is lost. The culprit appears to be the fine texture on top: blurring away high frequencies at the same input size raised the small model’s score from 29.2 to 67.0.

Their remedy teaches the model to squint on its own. During training, a frozen copy of Qwen3.5-9B sees the original image, a shrunken version and the correct transcription, and the student it supervises sees only the original. After training, the student reads the original images at 88.6, against 26.5 before, with some loss on ordinary document reading: one standard text-reading test went from 879 to 833 points.

The same gap between near and far is already being used the other way. In July the AI font company Mixfont released Decoy Font, a free typeface that draws a thin decoy letter over a blurred hidden one, so that a person who steps back reads one message and an AI model reading the screenshot reads another. Both rest on hybrid images, described in 2006 by Aude Oliva, Antonio Torralba and Philippe Schyns, which show one picture up close and another from a distance. What protects a private message from a scraper also slips an address past a moderator, and the moderators, for now, are the ones that cannot look less closely.

Not checked: the production images, whose access is granted only on request, so I could not see how easily a person really reads them; the paper gives no human score on SquintBench, and on another hidden-text benchmark two human readers allowed to squint recovered only 36% of the strings. The paper does not say, in what I read, how the commercial models were queried or whether any refusal played a part, and its prompt templates were originally in Chinese. Much of the text is likely Chinese, a script on which Western models may be weaker in general. It is one study, by authors who work on moderation. The figures are the paper’s; I checked that the released code is online.