It modifies the prompt, aka the input, not the output. It is smuggling 3 bits of secret user/session data in a wrapper that doesn’t look like it contains that data. As the article explains:
So the marker becomes part of the system context sent to the model.
This is a normal timestamp on a prompt:
Today's date is 2026-07-11.
But if your system timezone is a Chinese mainland timezone, it looks like:
Today's date is 2026/07/11.
Then, if your base URL includes a keyword like “deepseek,” it silently replaces the apostrophe from a ' to a ʼ:
Todayʼs date is 2026-07-11.
Or if the base URL has one of the domains on the list, like any .cn domain, it replaces the apostrophe with another apostrophe character:
Today’s date is 2026-07-11.
And if it has both a URL and a keyword on the watchlist, the prompt context includes:
Todayʹs date is 2026-07-11
That’s 3 bits of information: does this system have a mainland Chinese time zone, does the base URL contain a known keyword (associated with Chinese AI competitors) or a known domain (associated with mainland China or its major tech companies). And it sneaks it on by without making it obvious.
That’s steganography.
It’ll only make a difference during the times in which it is being hit by a beam that wouldn’t otherwise hit the earth, since whatever it reflects will be offset by some shadow behind it. I wonder if, as a matter of orbital mechanics, it would be possible to make the satellite orbit in such a way so that it never casts a shadow and is always in the sunlight.