This research introduces confusable-vision, an empirical analysis framework designed to quantify the visual similarity of Unicode "confusable" pairs (homoglyphs) by rendering them across 230 system fonts. Utilizing the Structural Similarity Index Measure (SSIM), the study evaluates 1,418 pairs from Unicode’s TR39 dataset to bridge the gap between abstract character mappings and actual pixel-level risks.
The findings challenge current security assumptions: while 96.5% of documented confusables pose low visual risk, 82 pairs are pixel-identical (SSIM 1.000) in at least one standard font, primarily within Cyrillic and Roman numeral blocks. The research identifies "danger rates" for specific typefaces, noting that geometric and all-caps fonts (e.g., Phosphate, Copperplate) significantly escalate spoofing risks. These results advocate for a transition from binary confusable detection to context-aware, font-specific security policies within namespace validation systems like namespace-guard.
III. Summary
[0:00] The "Gap" in Unicode Security: Current Unicode Technical Standard (UTS) #39 identifies confusables based on skeletons/data but fails to account for actual font rendering. Confusable-vision was built to empirically measure pixel similarity.
[1:10] Methodology (SSIM vs. CNN): The tool uses SSIM (Structural Similarity Index Measure) to evaluate luminance, contrast, and structure. SSIM was chosen over Convolutional Neural Networks (CNNs) for its determinism, auditability, and reproducibility without GPU infrastructure.
[2:45] Font Discovery & Scaling: The analysis queried 230 fonts on macOS (Standard, Script, Noto, Math, Symbol). It performed 235,625 comparisons, focusing on "same-font" (highest risk) and "cross-font" (fallback risk) scenarios.
[3:30] The Headline Finding: 96.5% of the confusables.txt dataset is not high-risk (SSIM < 0.7). Many entries are semantically related but visually distinct, leading to high false-positive rates in basic security filters.
[4:15] Pixel-Identical Threats (The 1.000 Club): 82 pairs are pixel-identical in at least one font. Cyrillic characters (а, е, о, р, с, у, х) are the most dangerous, reusing Latin outlines in 40+ standard fonts, making visual detection impossible.
[5:50] Roman Numerals and Greek Exceptions: Roman numerals (U+2170-U+217F) are largely identical to Latin equivalents. Greek omicron is high-risk, but Greek rho (ρ) only becomes dangerous in specific geometric fonts like Phosphate.
[6:45] Hebrew Paseq Risk: A non-obvious finding identified the Hebrew Paseq (U+05C0) as a high-risk spoof for the lowercase 'l' in common fonts like Tahoma and Arial.
[7:30] Font Danger Rates: The research quantifies font-specific risk. Phosphate (67.5%) and Copperplate (67.0%) have the highest danger rates, while calligraphic fonts like Zapfino (0.0%) have the lowest.
[9:15] Web and UI Implications: Browser font fallback and system UI fonts (San Francisco/Segoe UI) determine the actual threat. If a moderation tool or address bar uses a high-danger font, homoglyph spoofs (e.g., all-Cyrillic "apple") remain invisible to users.
[11:00] Mathematical Alphanumeric False Positives: Over 800 pairs in the dataset involve mathematical symbols (Fraktur, Script) which score very low or even negative in similarity, representing semantic rather than visual confusability.
[13:30] Strategic Recommendations for Namespace-Guard:
Transition to weighting by max same-font SSIM.
Automate hard blocks for the 82 pixel-identical pairs.
Implement per-script thresholds to reduce noise (e.g., aggressive Cyrillic blocking vs. permissive Arabic/Math blocks).
IV. Target Reviewers & Persona Summary
Recommended Reviewers:
AppSec Engineers: To refine WAF (Web Application Firewall) and input validation logic.
Identity & Access Management (IAM) Architects: To prevent account takeover via homoglyph usernames.
Browser Security Teams: To improve Internationalized Domain Name (IDN) spoofing heuristics.
Expert Review (Senior AppSec Architect Persona):
"The confusable-vision data confirms what we've long suspected: our reliance on the raw Unicode TR39 map is producing an unacceptable signal-to-noise ratio. From a threat modeling perspective, the revelation that 82 pairs are pixel-identical across 40+ standard system fonts is a 'critical' severity finding for any platform handling public-facing identifiers.
The distinction between 'same-font' and 'cross-font' risk is the most actionable takeaway here. We must move away from binary filters and toward a risk-weighted validation model. By prioritizing the 1.000 SSIM Cyrillic homoglyphs and deprioritizing low-similarity Mathematical Alphanumerics, we can significantly harden our namespace against IDN spoofing and MFA fatigue attacks while simultaneously reducing user friction from false-positive blocks."