Why does restructured code slip past MOSS?

MOSS compares token sequences, so anything that changes the shape of the token stream without changing behaviour breaks its k-gram fingerprints. Converting for loops to while loops, expanding operators (i++ to i = i + 1), splitting expressions into several statements, inverting if-else blocks and adding dead code all do this. Renaming variables and changing whitespace do not, because MOSS normalises those away. This is why a clean MOSS report is not proof of original work.

What is MOSS (Measure of Software Similarity)?

MOSS (Measure of Software Similarity) is a plagiarism detection system developed by Stanford University in 1994 by Alex Aiken. It uses the winnowing algorithm to create document fingerprints from code and compare them for similarity. MOSS is widely used by universities to detect code plagiarism in programming assignments.

Does renaming variables change what MOSS matches?

No. MOSS normalizes all identifiers during tokenization, so every variable name becomes the same token and renamed copies still match. It is structural edits, such as loop transformations, expression decomposition and control-flow changes, that alter the token sequence and go unflagged. That is the gap this demonstration shows.

What is the winnowing algorithm in MOSS?

The winnowing algorithm is MOSS's fingerprinting technique. It creates k-grams (sequences of k tokens) from normalized code, then uses a sliding window to select representative fingerprints. These fingerprints are compared across documents to detect similarity. Structural code changes break the k-gram sequences, which is why MOSS misses restructured copies.

Can MOSS detect code copied from the internet?

MOSS can only detect similarity between documents you submit to it. It does not search the internet or have a database of code. Instructors can add known solutions or code from online sources as base files, but anything they did not think to include is invisible to it. Modern detection adds public-web and repository search on top of token matching.

Mossad is a 2020 research project from UMass that showed MOSS can be defeated automatically: it restructures code while preserving behaviour until MOSS no longer flags it. It is the academic evidence behind this demonstration, and it highlights the limits of text-based plagiarism detection.

How does MOSS plagiarism checker work?

MOSS works by: 1) Removing all whitespace and comments, 2) Normalizing all identifiers to generic tokens, 3) Creating k-grams (token sequences), 4) Using winnowing to select fingerprints, 5) Comparing fingerprints across submissions. Understanding this process explains why structural changes, not cosmetic ones, are what MOSS misses.

Is this demonstration a cheating tool?

No. It is a demonstration for educators. It applies the restructuring techniques that have been publicly documented for years (loop conversion, operator expansion, expression splitting) to a sample submission so faculty can see for themselves that MOSS no longer flags it. The point is to show why a MOSS-only integrity policy leaves a course exposed, and what modern detection adds.

Why can't MOSS detect transformed code?

MOSS relies on token sequence matching. When control flow changes (for to while), operators are expanded (++ to = + 1) or expressions are decomposed, the token sequences are completely different. MOSS's fingerprints no longer match even though the code does the same thing. Semantic detection compares what the code does, so it is not fooled the same way.

What languages does MOSS support?

MOSS supports many programming languages including C, C++, Java, Python, JavaScript, C#, MATLAB, Perl, and more. The demonstration on this page covers Python, Java, JavaScript, C++ and C.

Codequiry · Educator Brief

Issue No. 01 2026

An Educator Brief on Plagiarism Detection

Why MOSS is useless
for educators in 2026.

A 32-year-old token matcher still proctors millions of programming assignments every year. It cannot keep up with how students write code today. The worked example below shows exactly where it fails.

By Codequiry Research

Read 8 minutes

Audience CS Educators & TAs

Demo Live, below

Worked example · fixed teaching sample

Two files. One program. MOSS reports no match.

Below is a fixed pair of files we wrote, shown side by side. The right-hand file is the left-hand file after the kind of ordinary restructuring a copied assignment tends to arrive with: a for loop written as a while, a compound assignment expanded, a comparison inverted, a value lifted into a named variable. MOSS’s winnowing fingerprints stop matching. The program still runs identically. That gap is what this brief is about.

Language

Sample

Read only. This page cannot process code you supply.

MOSS similarity on this pair

Codequiry similarity on this pair

98%

Same program, same logic, same output. Token-sequence fingerprinting sees two unrelated files. Semantic analysis sees one.

Check this pair with Codequiry

What differs between the two files

Why this page exists

This is a teaching illustration for computer science faculty, written to show why text-matching similarity no longer protects academic integrity on its own. It is a fixed example on a fixed pair of files. It does not accept, transform, rewrite or return any code you provide, and it is not a service for students. The restructurings shown are standard refactorings documented in every compilers course. Codequiry’s semantic engine is built to match both files above as the same program.

Chapter One

A 1994 algorithm in a 2026 classroom.

MOSS was published the same year Netscape Navigator shipped. It has not been meaningfully updated since. The world it was designed to police no longer exists.

MOSS, the Measure of Software Similarity, was published by Alex Aiken at Stanford in 1994. At the time it was a remarkable piece of work. The web had roughly 600 sites. Most undergraduates wrote their first program on a paper handout. There was no Stack Overflow, no Copilot, no GitHub, no ChatGPT. A student who wanted to cheat had to find another student to copy from. MOSS, then, was an elegant solution to a narrow problem: catching one classmate copying another.

The mechanism is straightforward. MOSS strips comments and whitespace, normalizes every identifier to the same token, generates k-grams from the resulting sequence, and uses the winnowing algorithm to pick representative fingerprints. Two submissions that produce overlapping fingerprints are flagged. That is the entire system. There is no parser. There is no semantic model. There is no concept of what the code does.

1994

MOSS was first released

Major algorithm changes since

~5 min

Of restructuring makes a copy invisible to it

2022

ChatGPT shipped. MOSS cannot see it

Today, the threats to academic integrity in a programming course look almost nothing like 1994. The dominant sources of unoriginal work are large language models, commercial homework-help platforms, public GitHub solutions, and discussion forums. None of those are pairs of students copying each other. MOSS, by design, was never built to address any of them.

Chapter Two

Why ordinary edits get past MOSS.

Three edits, all publicly documented for years, are enough to take a copied submission off the report.

Because MOSS compares token sequences and normalizes identifiers, slipping past it does not require obfuscation, code generation, or any sophistication at all. It only requires changing the shape of the token stream without changing what the code does. Three transformations account for most of the restructured copies that reach a grader, and they are the three this demo applies.

Loop swap. Rewrite every for loop as a while loop. The bookkeeping moves outside the loop header. The token sequence is completely different. The program behaves identically.
Operator expansion. Replace i++ with i = i + 1. Replace x += y with x = x + y. A two-token sequence becomes five tokens. K-grams shift everywhere.
Expression splitting. Break int r = a + b * c into int t = b * c; int r = a + t. The expression tree is identical. The token sequence is not.

A clean MOSS report tells you the student did not hand in a byte-for-byte copy. It does not tell you the work is original.

None of this is a secret. The techniques have been openly documented for years in academic papers (Mossad, UMass 2020), tutorials and forum threads. The demo above is not novel research. It reproduces what is already public so that the people grading with MOSS can see the gap for themselves, which is exactly why a MOSS report needs a second opinion.

The uncomfortable conclusion: any course that relies on MOSS as a deterrent is relying on student ignorance of how MOSS works. That is a brittle foundation for academic policy.

Chapter Three

MOSS vs. modern detection.

A side-by-side of what MOSS does, and what a 2026 detection stack needs to do.

Token-based detection

Yes

Included

Semantic / AST analysis

Hexagram engine

Catches restructured code

Yes

Detects AI-generated code

Yes

Searches public web & GitHub

Yes

Cross-language detection

Yes

LMS / GitHub Classroom integration

Yes

Modern reporting dashboard

Plain HTML

Interactive

Audit trail for academic appeals

Manual

Built-in

Chapter Four

What educators should use now.

Codequiry is the detection stack we built for the threats that exist in 2026. It still runs MOSS-style matching underneath, so nothing is lost.

We did not set out to replace MOSS so much as to surround it. A modern course needs token-based matching for the cases MOSS still handles well, semantic analysis for the cases it never could, web and repository search for the public-source problem, and AI-generation detection for the dominant cheating vector of the past three years. Codequiry runs all four engines in a single scan.

MOSS-equivalent built in

Token fingerprinting still has its place. We run it alongside everything else, so educators do not give anything up.

Semantic Hexagram engine

Operates on parsed AST and control-flow graphs. Catches loop swaps, expression splits, and the restructuring demonstrated above.

AI-generated code detection

Identifies output from ChatGPT, Claude, Copilot, and Gemini with calibrated confidence intervals. The post-2022 cheating vector MOSS literally cannot see.

Public-web & GitHub search

Cross-references submissions against billions of lines of public code. The largest source of code plagiarism today is not other students. It is the internet.

Built for the modern classroom

Native integrations with Canvas, Moodle, Blackboard, and GitHub Classroom. Reports faculty can hand to a dean without translation.

Trusted at scale

Used by over 500 institutions worldwide for academic integrity in programming courses, including coursework at Stanford, MIT, and Carnegie Mellon.

Chapter Five

Frequently asked.

Questions we hear most often from CS faculty, TAs, and academic integrity officers.

Yes. You just watched it happen. MOSS’s winnowing algorithm relies on token-sequence matching. Loop conversion, operator expansion, and expression splitting all change the token sequence without changing what the code does. There is no fix for this inside the MOSS architecture.

No. MOSS normalizes every identifier to the same token during preprocessing. total, sum, and x all become identical. This is the one thing MOSS handles well, which is why a report full of renamed variables still shows up as a match.

Institutional inertia. MOSS is free, faculty have used it for decades, and replacing a campus-wide policy is slow. The cost is borne quietly: undetected plagiarism, weakened academic integrity, and graders who trust scores that no longer mean what they used to.

Yes. Our AI-generated code detector identifies output from major LLMs with calibrated confidence intervals. It is the single biggest gap in legacy token-based systems. ChatGPT was released in 2022, and MOSS has not changed since 1994. There is no overlap in the threat model.

Everything it does is already documented in academic papers and forum threads, so students who want it already have it. Educators are usually the ones who do not know, and they are the ones a MOSS-only policy leaves exposed. The demo is here so faculty can check their own setup and see exactly what their tools can and cannot catch.

No detection system is unbeatable in principle. But Codequiry combines token, semantic, web-search, and AI-detection layers, and defeating all four at once takes effort comparable to writing the assignment from scratch. That is, in fact, the point.

Yes. Canvas, Moodle, Blackboard, and GitHub Classroom are first-class integrations. Submissions sync automatically; reports are accessible from inside the gradebook.

Python, Java, JavaScript / TypeScript, C, C++, C#, Go, Rust, Ruby, PHP, Swift, Kotlin, R, MATLAB, and SQL among others. Semantic analysis is enabled for the languages most commonly used in coursework.

Appendix

What MOSS is, technically

MOSS (Measure of Software Similarity) is a code plagiarism detection system developed at Stanford University by Alex Aiken in 1994. It uses the winnowing algorithm to produce document fingerprints from source code: input is tokenized, identifiers are normalized, k-grams are extracted, and a sliding window selects representative hashes. Two submissions with overlapping fingerprints are reported as similar. MOSS is widely used by universities to detect code plagiarism in programming assignments.

What “getting past MOSS” actually means

A submission gets past MOSS when it performs the same task as the original but its token sequence is different enough that MOSS’s k-gram fingerprints no longer overlap. Variable renaming does not do this, because identifiers are normalized before fingerprinting. Whitespace and comment changes do not either, because they are stripped. Only structural transformations (loop-form changes, operator expansion, expression decomposition, control-flow inversion, dead-code insertion, and declaration splitting) alter the token sequence in ways MOSS misses.

Why this matters for educators

The techniques above are publicly documented (see the UMass Mossad research project, 2020) and widely shared in online forums. For educators, the practical implication is that a clean MOSS report can no longer be treated as evidence of original work, only as evidence that the student did not submit a byte-for-byte copy. Modern detection systems compensate by adding semantic analysis, public-web search, and AI-generation detection on top of token-based matching.

What languages MOSS supports

MOSS supports C, C++, Java, Python, JavaScript, C#, MATLAB, Perl, and several others. The demonstration above covers Python, Java, JavaScript, C++, and C, with transformations written for each language’s syntax.

End of brief

Stop grading with a 1994 algorithm.

Codequiry combines MOSS, semantic Hexagram, public-web search, and AI-detection in a single scan. Trusted by 500+ institutions. Free to start.

See pricing & plans Learn more about Codequiry

Tools and sources referenced on this page

Codequiry is compared with these tools above. Each link goes to the project's official site so you can check the claims yourself.

MOSS (Measure of Software Similarity) Stanford University, Alex Aiken
Free academic similarity service from 1994 that fingerprints code with winnowing and reports matching passages between submissions.
Winnowing: Local Algorithms for Document Fingerprinting Schleimer, Wilkerson and Aiken, SIGMOD 2003
The paper that defines the fingerprinting algorithm MOSS is built on, and the reference point for every "winnowing-based" detector.

Indexed terms

what MOSS misses · MOSS limitations · MOSS false negatives · does MOSS detect restructured code · Measure of Software Similarity limitations · winnowing algorithm weaknesses · k-gram fingerprinting limits · Mossad research · MOSS alternative for educators · MOSS vs Codequiry · semantic code plagiarism detection · AST-based plagiarism detection · AI-generated code detection · code plagiarism detection for educators · MOSS Python limitations · MOSS Java limitations · MOSS JavaScript limitations.

Why MOSS is useless for educators in 2026.