02 — attack concepts

Obfuscation / encoding

Rewriting a payload so it survives the defence but is still recoverable by the model — base64, hex, ROT13 and Caesar shifts, character or word reversal, zero-width characters wedged between letters, homoglyphs, leetspeak, letter-spacing, or several of these chained. It is the most consequential category in practice, because it targets the gap between what a text scanner sees and what the model understands. The only structural answer is to decode and normalise before scanning.

Related terms

  • Normalization pre-pass MoorAI terms

    A bounded decode-and-fold stage that runs before the detectors: strip zero-width and bidirectional control characters, fold homoglyphs and leetspeak…

  • CipherChat Attack families

    The harmful request is encoded in a cipher — Caesar shift, ROT13, base64, hex, a custom substitution — and the model is asked to work in that cipher.

  • FlipAttack Attack families

    A reversal attack: the payload is written backwards — by character, by word, or by line — and the model is instructed to un-reverse it before following…

  • Homoglyph Attack concepts

    A character that looks identical or near-identical to another but has a different Unicode code point — Cyrillic а for Latin a, Greek ο for o, a full-width…

Attack concepts

The mechanisms the families above exploit, plus the agent-specific ones that have no chatbot equivalent. If you only read one entry on this page, read indirect prompt injection.

Obfuscation / encoding is term 5 of 14 in this part of the glossary.

Get started free Full glossary → How we test → Community agent on GitHub ↗

This page is one entry from the agentic AI security glossary, which defines 60 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.

glick.run — AGPL-3.0