Alternate Encoding Jailbreak — Morse, NATO, Zalgo, Leet, UU, QP, Braille
This detects attempts to trick an AI model into ignoring its safety rules by hiding a harmful request inside an unusual text encoding, like Morse code, NATO phonetic alphabet, Braille Unicode, leetspeak, or UUencoding. The attacker asks the model to decode the text and then act on it, hoping the encoding slips past filters that scan for plain-language harmful requests.
How the attack works
An attacker writes a harmful instruction and converts it into one of several encoding schemes: Morse code, NATO phonetic spelling, Zalgo text (Unicode diacritic overload), leetspeak substitutions, UU-encoding, quoted-printable, Braille Unicode characters, Ecoji, Ascii85, or Base2048. The attacker sends this encoded text to the model along with a prompt asking it to decode the message and carry out whatever it says. Because content filters and safety checks often look for harmful language in plain text, the encoded form can bypass those checks while the model still understands and executes the underlying request. This is a known technique from the NVIDIA garak red-teaming toolkit's encoding probes.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 773206e3-6cd6-4da7-a937-1a18989c6204
- Severity
- High
Why it matters
If successful, this lets an attacker get a model to produce content or take actions it would normally refuse, undermining safety controls and potentially exposing the organization to misuse of its AI agent.
What you can do
- →Apply content safety checks after decoding any obfuscated or encoded text a user submits, not just on the raw input.
- →Flag or rate-limit prompts containing dense Morse code, Braille Unicode ranges, Zalgo diacritics, or explicit 'decode this' instructions paired with unusual scripts.
- →Distinguish legitimate uses (ham radio, aviation training, email headers) from adversarial patterns by checking whether the decoded content is then treated as an instruction to the model.
- →Log and review cases where a model is asked to decode a payload and then act on the decoded result, since that combination is the core attack pattern.
Known benign look-alikes
- Morse code learning apps or ham radio documentation with legitimate decode examples
- NATO alphabet pronunciation guides for aviation/military communication training
- Email system logs containing QP-encoded non-ASCII headers
- UU-encoding documentation or legacy email system content