CipherChat
The harmful request is encoded in a cipher — Caesar shift, ROT13, base64, hex, a custom substitution — and the model is asked to work in that cipher. A filter scanning plain text sees nothing recognisable, and a model capable enough to decode the payload may then act on it. Defences that only match on words fail here by construction; the fix is to decode first and scan the result, which is what a normalization pre-pass does.
See also obfuscation / encoding · FlipAttack · normalization pre-pass
Related terms
-
Obfuscation / encoding
Attack concepts
Rewriting a payload so it survives the defence but is still recoverable by the model — base64, hex, ROT13 and Caesar shifts, character or word reversal…
-
FlipAttack
Attack families
A reversal attack: the payload is written backwards — by character, by word, or by line — and the model is instructed to un-reverse it before following…
-
Normalization pre-pass
MoorAI terms
A bounded decode-and-fold stage that runs before the detectors: strip zero-width and bidirectional control characters, fold homoglyphs and leetspeak…
Attack families
The ten families in the HackAgent attack taxonomy (AISecurityLab/hackagent ↗), which is the taxonomy MoorAI's red-team corpora are keyed to. They are not ten unrelated tricks — they cluster into two groups that behave very differently. Obfuscation families hide the payload so the model never recognises it as harmful. Persuasion families state the harmful request plainly and argue the model into it. That split matters, because a model that refuses persuasion outright will happily comply with an encoding it cannot decode — see marginal value.