Obfuscation / encoding
Rewriting a payload so it survives the defence but is still recoverable by the model — base64, hex, ROT13 and Caesar shifts, character or word reversal, zero-width characters wedged between letters, homoglyphs, leetspeak, letter-spacing, or several of these chained. It is the most consequential category in practice, because it targets the gap between what a text scanner sees and what the model understands. The only structural answer is to decode and normalise before scanning.
See also normalization pre-pass · CipherChat · FlipAttack · homoglyph
Related terms
-
Normalization pre-pass
MoorAI terms
A bounded decode-and-fold stage that runs before the detectors: strip zero-width and bidirectional control characters, fold homoglyphs and leetspeak…
-
CipherChat
Attack families
The harmful request is encoded in a cipher — Caesar shift, ROT13, base64, hex, a custom substitution — and the model is asked to work in that cipher.
-
FlipAttack
Attack families
A reversal attack: the payload is written backwards — by character, by word, or by line — and the model is instructed to un-reverse it before following…
-
Homoglyph
Attack concepts
A character that looks identical or near-identical to another but has a different Unicode code point — Cyrillic а for Latin a, Greek ο for o, a full-width…
Attack concepts
The mechanisms the families above exploit, plus the agent-specific ones that have no chatbot equivalent. If you only read one entry on this page, read indirect prompt injection.