# Backspace Deletion Character Injection

- **Severity:** High
- **Signature ID:** `8c911354-6fbd-4f94-9fd1-7d1a44b8c5a2`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Attackers hide instructions from human reviewers by using the old-school backspace character (0x08), which makes text visually 'erase' itself in a terminal display while the AI model still reads every character. This lets malicious instructions look blank or harmless to anyone reviewing logs, while the model still processes and acts on them.

## How the attack works

An attacker crafts an input string containing visible words or instructions followed or preceded by a dense run of ASCII backspace characters. When rendered in a terminal or log viewer, the backspaces make the preceding text appear to vanish or get overwritten, so a human reviewer sees blank space or an innocent word. The underlying model, however, receives the full raw string including the hidden instruction and processes it as-is. Variants include hiding whole jailbreak instructions behind a backspace burst, or swapping characters (e.g., 'safex\x08y' displays as 'safey' but the model reads 'safex\x08y').

## Why it matters

An organization can have malicious or policy-violating instructions smuggled past human review and log inspection, letting an attacker manipulate model behavior (including jailbreaks) without leaving an obviously suspicious visible trace.

## What you can do

- Reject or strip ASCII backspace (0x08) and other control characters from user input before it reaches the model, since this character is essentially never legitimate in API/MCP text payloads.
- Log and review raw byte content of inputs rather than only terminal-rendered output, so hidden characters are visible during audits.
- Flag inputs with dense clusters of control characters or control characters positioned immediately before known jailbreak keywords for manual review.
- Ensure binary or terminal-capture data is base64-encoded before being passed as text fields, rather than allowing raw control bytes into MCP messages.

## Known benign look-alikes

- Terminal emulator raw output captured with backspace keystrokes in interactive sessions (should not appear in API/MCP payloads)
- Legacy MIME-encoded data streams containing 0x08 for BEL-adjacent protocols (extremely rare in modern MCP contexts)
- Binary file content accidentally passed as text field (should be base64-encoded in well-formed MCP messages)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00394
- https://github.com/NVIDIA/garak/blob/main/garak/probes/badchars.py
- https://arxiv.org/abs/2309.00614
- https://trojansource.codes/

---
Source: https://www.netzilo.com/threats/atr-backspace-deletion-character-injection