# Base-N Encoding Instruction Bypass

- **Severity:** High
- **Signature ID:** `40b7845e-96ad-4fb5-bf54-cf58830356cb`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

An attacker hides malicious instructions inside encoded text (Base64, hex, Base32, MIME, quoted-printable, UUencode, etc.) and asks the AI model to decode and follow them. This works because safety filters trained to catch plainly-worded harmful requests often fail to recognize the same request once it's encoded.

## How the attack works

The attacker crafts a harmful instruction and encodes it using a standard scheme like Base64 or hex. They send the model a message containing a decode verb, the name of the encoding, and the opaque encoded blob, sometimes dressed up as a 'secure system message' to make the request seem legitimate and authoritative. The model decodes the blob, treats the recovered text as an instruction, and may act on it. Because the harmful content never appears in plaintext in the prompt, safety classifiers looking for known bad phrases can miss it.

## Why it matters

An attacker can get a safety-trained model to carry out instructions it would normally refuse, effectively bypassing content filters and potentially triggering unauthorized actions if the model is connected to tools or agents.

## What you can do

- Treat any prompt that pairs a decode instruction with an encoded blob (Base16/32/64/85, hex, MIME, quoted-printable, UUencode) as suspicious, especially if framed as a 'system' or 'secure' message.
- Decode and inspect such payloads before allowing the model to act on them, rather than letting the model auto-decode and execute.
- Apply safety classification to the decoded content, not just the raw prompt text.
- Distinguish legitimate encoded data transfer (keys, certs, patches, API payloads) from cases where the encoded blob is explicitly framed as instructions to be followed.

## Known benign look-alikes

- Documentation explaining encoding schemes in educational context (no decode-and-execute instruction)
- Legitimate data-transfer tool output (SSH keys, TLS certs, git patches) without instruction context
- Normal base64 transmission in API payloads (decoded server-side only)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00256
- https://github.com/NVIDIA/garak/blob/main/garak/probes/encoding.py
- https://arxiv.org/abs/2307.02483

---
Source: https://www.netzilo.com/threats/atr-base-n-encoding-instruction-bypass