If they have an auto-complete feature, the keypresses WILL be seen in not even in a smuggled way. They'll be directly in the URL to the search function!
You could probably hide that from anything but a deep dive by chucking the data through a websocket. Unless you see and recognise the initial socket connection you may miss it entirely.
