# Cipher and Transposition Encoding Jailbreak

- **Severity:** High
- **Signature ID:** `223d1c24-17a6-4097-b699-fd09339ed0e5`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Attackers wrap harmful instructions in classical text ciphers or letter substitutions like ROT13, Caesar shift, Atbash, or 1337-speak, then ask the AI to decode and follow them. Because the encoded text still looks like ordinary letters and words, safety filters trained to spot suspicious patterns often let it through.

## How the attack works

The attacker takes a request the model would normally refuse and encodes it with a simple, well-known cipher such as ROT13, a Caesar shift, Atbash (A-to-Z reversal), or leet-speak character substitution. They send the model a prompt like 'apply ROT13 to this' or 'decipher this Atbash message' along with the scrambled text. The model decodes the instruction as asked and, having 'discovered' the harmful request itself through a puzzle-like exercise, is more likely to comply. This bypasses filters that look for known-bad phrases in plain, unencoded text.

## Why it matters

An organization's AI agent can be tricked into producing or acting on instructions that its safety controls were meant to block, because the harmful content never appears in cleartext until the model decodes it internally.

## What you can do

- Log and review prompts that ask the model to decode, decipher, or translate text using named ciphers (ROT13, Caesar, Atbash) or leet-speak before acting on the decoded content.
- Run safety/content filters on the model's decoded interpretation of ambiguous input, not just on the raw prompt text.
- Expect legitimate uses (cryptography coursework, CTF writeups, novelty ROT13 tools) and tune review around intent and follow-on actions rather than blocking cipher mentions outright.
- Test your own agent with known jailbreak probe sets (e.g., garak's InjectROT13, InjectAtbash, InjectLeet) to see whether encoded instructions slip past your existing safeguards.

## Known benign look-alikes

- Cryptography coursework discussing historical ciphers
- CTF writeups or security-research blog posts explaining classical cryptanalysis
- Developer tools implementing ROT13 for novelty (e.g., Outlook Express easter egg)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00257
- https://github.com/NVIDIA/garak/blob/main/garak/probes/encoding.py

---
Source: https://www.netzilo.com/threats/atr-cipher-and-transposition-encoding-jailbreak