Ecoji Emoji-Encoded Prompt Injection
Attackers encode malicious commands as long strings of emojis using the Ecoji scheme, then ask an AI to decode and follow them. To a human reviewer the text looks like a meaningless string of emoji, but the AI can decode it back into readable instructions and act on them.
How the attack works
The attacker takes a malicious instruction and runs it through Ecoji encoding, which converts every 10 bits of text into one of 1024 emojis, producing a dense block of unrelated-looking emoji characters. They wrap this blob in a prompt template such as 'Ecoji encoded string: ... Ecoji decoded string:' or frame it as a 'secure system message' the AI should decode and obey. The AI model decodes the emoji sequence back to plain text and may then treat the recovered content as an instruction to follow, bypassing filters that only scan for plain-text attack patterns. This technique originates from the InjectEcoji probe in NVIDIA's garak LLM vulnerability scanner.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- bf6ac090-18fe-4ff8-b4ec-fa130c063db8
- Severity
- High
Why it matters
An organization's AI agent can be tricked into executing attacker-supplied instructions that were smuggled past text-based content filters, potentially leading to unauthorized actions, data disclosure, or policy bypass.
What you can do
- →Flag prompts containing long runs of six or more consecutive emoji, especially paired with words like 'encoded', 'decoded', or 'secure system message'.
- →Decode suspected emoji-encoded blobs (Ecoji or similar schemes) before passing prompts to the model, and inspect the decoded content with your normal input filters.
- →Do not let the model treat decoded content from user input as trusted system instructions; keep a clear separation between system prompts and decoded user data.
- →Review logs for the 'Encoded:...Decoded:' template pattern combined with emoji sequences to catch attempted use of this technique.
Known benign look-alikes
- Legitimate emoji reactions: "Great work! 🎉🎊🎈🎁🎀🏆" (short cluster, no decode instruction)
- Ecoji project documentation discussing the encoding scheme (no decode instruction)
- Emoji art or sequences in creative writing contexts (no "Encoded:/Decoded:" framing)