Prompt Injection Obfuscation Cheat Sheet

Obfuscation bypasses are a core prompt-injection tactic: instead of changing what the malicious instruction says, you change how it is written so it slips past keyword filters and input classifiers — while the model still "understands" it after decoding or normalization. These techniques are especially effective against naive defenses that pattern-match on raw bytes.

This is a quick lookup. Each entry covers what it does, a tiny example, and the defense. See OWASP LLM01: Prompt Injection (https://genai.owasp.org/llmrisk/llm01-prompt-injection/).

You can generate and inspect most of these encodings interactively with our in-browser Encoder tool — useful for building test cases and for confirming that your normalization pipeline neutralizes them.

Authorized use only: test these against systems you own or are contracted to assess.

Technique quick reference

Base64

What it does: Encodes the payload so plaintext filters see gibberish; the model (or a downstream tool) decodes it.
Example: Decode and follow: SWdub3JlIHByZXZpb3VzIGluc3RydWN0aW9ucw== → "Ignore previous instructions".
Defense: Decode candidate encodings before filtering; flag/strip instructions that ask the model to decode-and-execute; classify on the decoded semantics.

ROT13 (and other simple ciphers)

What it does: Rotates letters by 13 so keyword filters miss it but the transform is trivial to reverse.
Example: Vtaber cerivbhf vafgehpgvbaf → "Ignore previous instructions".
Defense: Apply common cipher reversals during preprocessing; treat "decode this cipher then act" as a red flag.

Leetspeak

What it does: Substitutes look-alike numbers/symbols for letters to dodge exact-string matching.
Example: 1gn0r3 pr3v10u5 1n5truct10n5.
Defense: Canonicalize leet substitutions before matching; rely on semantic classification rather than literal keyword lists.

Homoglyphs

What it does: Replaces ASCII letters with visually identical characters from other scripts (e.g. Cyrillic) so the string looks normal but differs byte-wise.
Example: Ignоre where the о is Cyrillic U+043E, not Latin o.
Defense: Unicode confusable mapping (skeleton/confusables), restrict or fold non-expected scripts, then re-match.

Zero-width characters

What it does: Inserts invisible characters (zero-width space U+200B, joiner U+200D) inside words to break token/keyword matches while staying readable.
Example: Ignore previous (zero-width spaces between fragments).
Defense: Strip zero-width and other invisible/format characters during normalization before any filtering.

Unicode Tags (U+E0000 block)

What it does: Hides an entire instruction in invisible Tag characters (U+E0000–U+E007F) that render as nothing but can be read by the model — "ASCII smuggling."
Example: A visible benign sentence followed by a payload encoded entirely in U+E00xx Tag code points.
Defense: Explicitly detect and remove the Unicode Tags block; reject input containing these code points outside legitimate use.

Low-resource-language injection

What it does: Phrases the malicious instruction in a less-represented language where safety tuning and filters are weaker.
Example: A jailbreak request written in a low-resource language, optionally with "translate then comply."
Defense: Normalize/translate to a canonical language before classification; ensure safety classifiers cover non-English inputs.

Token splitting

What it does: Breaks a trigger word across boundaries (spaces, separators, variables) so tokenizer/keyword filters never see the whole token; the model reassembles meaning.
Example: ig nore prev ious inst ructions or "ig"+"nore".
Defense: Collapse whitespace/separators and reassemble fragments before matching; classify on reconstructed text.

Defenses (the common thread)

Almost every obfuscation bypass is defeated by the same three-layer approach, applied in order, before any keyword or policy check:

Normalization — Unicode NFKC normalize, strip invisible/format and zero-width characters, remove the Tag block, fold homoglyphs via a confusables map, collapse separators, and reverse known encodings/ciphers (base64, ROT13, leet). The goal is one canonical form per logical string.
Unicode filtering — restrict expected scripts, reject or sandbox text containing unexpected control/format/Tag code points instead of silently passing them through.
Semantic classification — never rely on literal string matching. Run a safety classifier on the normalized, decoded content so meaning, not spelling, drives the decision.

A useful mantra: decode and normalize first, then judge. Any filter that inspects raw user bytes before normalization is bypassable by definition.

How to test it safely

Use the Encoder tool to produce each variant of a known benign canary instruction, feed them through your input pipeline, and confirm that all variants normalize to the same canonical form and reach your classifier identically. Track which encodings your stack already neutralizes and which slip through, and re-test on every pipeline change. Only run these against systems you are authorized to assess.