02 — attack concepts

Homoglyph

Also written confusable

A character that looks identical or near-identical to another but has a different Unicode code point — Cyrillic а for Latin a, Greek ο for o, a full-width or mathematical-italic letterform. Swapping a few of them makes a word visually unchanged to a human and completely different to a string comparison, defeating exact matching and most fuzzy matching too. Defending against them means Unicode confusable-folding as part of normalisation; a related trick uses bidirectional control characters (Trojan Source) to make text render differently from how it parses.

Related terms

  • Obfuscation / encoding Attack concepts

    Rewriting a payload so it survives the defence but is still recoverable by the model — base64, hex, ROT13 and Caesar shifts, character or word reversal…

  • Normalization pre-pass MoorAI terms

    A bounded decode-and-fold stage that runs before the detectors: strip zero-width and bidirectional control characters, fold homoglyphs and leetspeak…

  • Leetspeak Attack concepts

    Substituting digits and symbols for visually similar letters — 3 for e, 1 or ! for i/l, 4 or @ for a, 0 for o — as in h4rm3l. Models read it fluently;

Attack concepts

The mechanisms the families above exploit, plus the agent-specific ones that have no chatbot equivalent. If you only read one entry on this page, read indirect prompt injection.

Homoglyph is term 6 of 14 in this part of the glossary.

Get started free Full glossary → How we test → Community agent on GitHub ↗

This page is one entry from the agentic AI security glossary, which defines 60 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.

glick.run — AGPL-3.0