Wordlist Generator All articles
Security Testing

One Word, Two Opposite Meanings: How Contronyms Quietly Sabotage Your Wordlists

Wordlist Generator
One Word, Two Opposite Meanings: How Contronyms Quietly Sabotage Your Wordlists

Photo: Unknown authorUnknown author, CC BY 3.0, via Wikimedia Commons

There's a weird corner of English where a word can mean its own opposite. Cleave means to split apart — and also to cling tightly. Dust is what you remove from a shelf, and also what you sprinkle onto a cake. Sanction is permission and punishment at the same time. Linguists call these contronyms, or Janus words, named for the two-faced Roman god. Everyone else calls them a headache.

If you run a wordlist generator, they're more than a headache. They're a silent source of bad data.

The Frequency Fallacy

Most wordlist generation pipelines are built on a simple assumption: count how often a word appears in a corpus, rank the results, done. It's the same logic behind why 'password' and 'qwerty' sit at the top of every cracking dictionary. Frequency equals probability, probability equals priority.

But frequency counting treats every occurrence of a word as the same word. And contronyms break that assumption in both directions.

Take 'sanction.' In news corpora — which many of us feed into our generators because they're free, large, and current — the dominant sense is almost always the punitive one. 'Sanctions imposed,' 'sanctions violated,' 'sanctions regime.' The 'approve' sense shows up in legal documents and formal writing. If your wordlist weights 'sanction' based on news text, you've silently encoded a guess about which meaning your target audience actually uses. You didn't decide to make that guess. Your corpus did.

Same story with 'table' (to propose something versus to shelve it — and the two camps are on opposite sides of the Atlantic, which matters for US-focused testing), 'left' (the direction versus the past tense of leave), and 'fast' (speedy versus stuck in place).

Why This Matters for Entropy

Here's where it gets technical, and where security folks should pay attention.

When you estimate the entropy of a passphrase or password guess, you're really estimating the size of the space a human might draw from. Frequency-weighted wordlists feed directly into that math. If a contronym's frequency is inflated because your corpus double-counts two distinct senses, you'll overestimate how likely that token is — or worse, underestimate it if the corpus only captured one sense.

The practical effect: your ranking is wrong in ways that are hard to spot. A contronym doesn't look anomalous in a spreadsheet. It's just a word with a number next to it. The error is invisible unless you know to look for sense ambiguity in the first place.

Puzzle generation has the mirror-image problem. If you're building wordlists for crosswords or word games, a contronym can generate clues that are logically incoherent — a clue that points at one sense while the answer grid expects the other. Ask any constructor who's tangled with 'seed' (to plant, or to remove seeds from).

Building a Contronym-Aware Generator

You don't need a research lab to fix this. You need a sense-disambiguation pass between your corpus and your ranking step. Here's a practical walkthrough.

Step 1: Flag the candidates. Start with a published list of known contronyms — there are several open datasets floating around, and WordNet's synsets let you detect polysemy programmatically. Any word whose synsets include antonymous pairs gets flagged. You'll end up with a few hundred candidates, not thousands. This is a tractable problem.

Step 2: Split by context. For each flagged word, sample its occurrences from your corpus and look at the surrounding words. Contronym senses tend to have different collocates. 'Sanction' in the punitive sense co-occurs with 'against,' 'imposed,' 'economic.' The approval sense pairs with 'official,' 'grant,' 'formal.' A simple bag-of-words classifier — even a naive Bayes model — can sort occurrences into sense buckets with decent accuracy.

Step 3: Rank senses, not words. Now your frequency table has two rows where it used to have one: 'sanction-punitive: 8,400' and 'sanction-approval: 1,100.' Your downstream tooling — entropy estimation, cracking rules, puzzle clue generation — gets to make explicit decisions about which sense to include and at what weight.

Step 4: Weight for your audience. This is the judgment call. A wordlist targeting corporate password audits might weight the bureaucratic senses higher. A puzzle generator might want both senses available, tagged. The point isn't picking the 'right' weight — it's that you're now choosing deliberately instead of inheriting your corpus's bias.

The Bigger Lesson

Contronyms are the extreme case of a problem that runs through all of computational linguistics: words aren't data points, they're bundles of meanings wearing one spelling. Any pipeline that treats surface forms as atomic will inherit errors it can't see.

You don't have to go full NLP on every list you build. But adding one disambiguation pass for the few hundred genuinely ambiguous words in English is cheap, and it makes the rest of your frequency data more honest. Your entropy estimates tighten up. Your puzzle clues stop contradicting themselves. Your cracking runs stop wasting cycles on mis-weighted tokens.

Two-faced words have been confusing people since the Romans. There's no reason to let them confuse your wordlist generator too.

All Articles

Related Articles

Government Paperwork, Cracker Gold: The Strange Afterlife of SSA Baby Name Data

Government Paperwork, Cracker Gold: The Strange Afterlife of SSA Baby Name Data

From Blockbusters to Baby Names: Why Your Next Wordlist Should Skim the Pop Culture Charts

From Blockbusters to Baby Names: Why Your Next Wordlist Should Skim the Pop Culture Charts

Champions Hear Patterns: What Spelling Bee Intuition Can Teach Your Wordlist Generator