PIP-008
Encoding and character obfuscation
The instruction is encoded, transliterated, or built from lookalike characters so that filters miss it while the model still resolves it.
How it works
The payload is expressed in a form a string matcher does not recognise but a model does: an encoding scheme, spacing or separator insertion, visually similar characters from other scripts, or a different language. Capable models decode such text readily.
Why it works
Filtering operates on surface form while comprehension operates on meaning. Any transformation that preserves meaning while changing surface form defeats the filter without defeating the model.
What it looks like
An instruction rendered in an encoded or visually altered form, sometimes with a preceding request to decode and act on what follows.
Described rather than reproduced. This library publishes mechanisms, not payloads: recognising a class of attack and choosing a control does not require a working copy of it.
Defences
Normalise Unicode and reject unexpected scripts
Raises cost
Apply canonical normalisation and flag content mixing scripts without a reason to. This closes the lookalike-character route specifically and is cheap.
Stop depending on input matching
Architectural
This pattern exists to demonstrate that surface-form filtering cannot be the control. Its real lesson is architectural: assume the filter is bypassed and ensure the outcome is still contained.
Framework mapping
- LLM01:2025 · OWASP LLM Top 10
- AML.T0051 · MITRE ATLAS
Mappings are asserted only where the identifier is known correct, and omitted where uncertain. Last reviewed 2026-08-03.