Why MOSS is useless
for educators in 2026.

MOSS — Measure of Software Similarity — was published by Alex Aiken at Stanford in 1994. At the time it was a remarkable piece of work. The web had roughly 600 sites. Most undergraduates wrote their first program on a paper handout. There was no Stack Overflow, no Copilot, no GitHub, no ChatGPT. A student who wanted to cheat had to find another student to copy from. MOSS, then, was an elegant solution to a narrow problem: catching one classmate copying another.

The mechanism is straightforward. MOSS strips comments and whitespace, normalizes every identifier to the same token, generates k-grams from the resulting sequence, and uses the winnowing algorithm to pick representative fingerprints. Two submissions that produce overlapping fingerprints are flagged. That is the entire system. There is no parser. There is no semantic model. There is no concept of what the code does.

Today, the threats to academic integrity in a programming course look almost nothing like 1994. The dominant sources of unoriginal work are large language models, commercial homework-help platforms, public GitHub solutions, and discussion forums. None of those are pairs of students copying each other. MOSS, by design, was never built to address any of them.

Because MOSS compares token sequences and normalizes identifiers, defeating it does not require obfuscation, code generation, or any sophistication at all. It requires changing the shape of the token stream without changing what the code does. There are exactly three transformations that account for the majority of MOSS bypasses observed in the wild, and a student who learns them once can apply them to any future assignment.

• Loop swap. Rewrite every for loop as a while loop. The bookkeeping moves outside the loop header. The token sequence is completely different. The program behaves identically.
• Operator expansion. Replace i++ with i = i + 1. Replace x += y with x = x + y. A two-token sequence becomes five tokens. K-grams shift everywhere.
• Expression splitting. Break int r = a + b * c into int t = b * c; int r = a + t. The expression tree is identical. The token sequence is not.

“Renaming variables doesn’t work. Restructuring the program does. Any student who reads one Reddit thread can do it before lunch.” — Anonymous CS50 TA

Worse: this is not a secret. The techniques have been openly documented for over a decade in academic papers (Mossad, UMass 2020), tutorials, and now — demonstrably — in a free webpage that performs all three transformations automatically. The tool you used above is not adversarial research. It is the same toolkit a student finds in a five-minute Google search.

The uncomfortable conclusion: any course that relies on MOSS as a deterrent is relying on student ignorance of how MOSS works. That is a brittle foundation for academic policy.

We did not set out to replace MOSS so much as to surround it. A modern course needs token-based matching for the cases MOSS still handles well, semantic analysis for the cases it never could, web and repository search for the public-source problem, and AI-generation detection for the dominant cheating vector of the past three years. Codequiry runs all four engines in a single scan.

What MOSS is, technically

MOSS (Measure of Software Similarity) is a code plagiarism detection system developed at Stanford University by Alex Aiken in 1994. It uses the winnowing algorithm to produce document fingerprints from source code: input is tokenized, identifiers are normalized, k-grams are extracted, and a sliding window selects representative hashes. Two submissions with overlapping fingerprints are reported as similar. MOSS is widely used by universities to detect code plagiarism in programming assignments.

What “bypassing MOSS” actually means

Bypassing MOSS means producing code that performs the same task as the original but whose token sequence is different enough that MOSS’s k-gram fingerprints no longer overlap. Variable renaming does not bypass MOSS — identifiers are normalized before fingerprinting. Whitespace and comment changes do not bypass MOSS — they are stripped. Only structural transformations — loop-form changes, operator expansion, expression decomposition, control-flow inversion, dead-code insertion, and declaration splitting — alter the token sequence in ways that defeat detection.

Why this matters for educators

The techniques above are publicly documented (see the UMass Mossad research project, 2020) and widely shared in online forums. Any student motivated to cheat can apply them in minutes. For educators, the practical implication is that a clean MOSS report can no longer be treated as evidence of original work — only as evidence that the student knew enough not to submit a byte-for-byte copy. Modern detection systems compensate by adding semantic analysis, public-web search, and AI-generation detection on top of token-based matching.

What languages MOSS supports

MOSS supports C, C++, Java, Python, JavaScript, C#, MATLAB, Perl, and several others. The bypass tool above supports Python, Java, JavaScript, C++, and C with transformations designed for each language’s syntax.