Encoding Evasion via Homoglyphs and Synonym Substitution
Some prompt injection attempts try to sneak past keyword filters by swapping letters for visually identical Unicode characters (like a Cyrillic 'а' instead of a Latin 'a') or by rephrasing trigger words (like 'circumvent' instead of 'bypass'). The text looks the same to a human or a language model, but slips past simple text-matching security filters.
How the attack works
An attacker crafts a prompt injection payload meant to override an AI agent's instructions, such as 'ignore previous instructions.' Instead of using the exact keywords a filter watches for, they substitute homoglyphs (characters from other scripts that render identically to Latin letters) or synonyms for flagged words. The rewritten payload is visually and semantically equivalent but no longer matches the filter's regex or keyword list. The agent processes the payload normally, since it interprets meaning rather than exact byte sequences, so the override succeeds while detection based on literal text matching fails.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 4ae712e0-5c48-43b4-a5ed-a14e8d799487
- Severity
- High
Why it matters
Keyword- or regex-based prompt injection defenses can be bypassed, letting an attacker's override instructions reach the agent undetected and potentially hijack its behavior or authorization.
What you can do
- →Normalize text (Unicode NFKC normalization, homoglyph mapping to a canonical script) before running any keyword or regex-based filtering.
- →Use semantic or embedding-based detection in addition to literal string matching, since paraphrased and homoglyph-substituted payloads keep the same meaning.
- →Review flagged content in context to separate genuine multilingual text or security documentation from actual evasion attempts, since Cyrillic text and hex dumps can trigger false positives.
- →Log and periodically audit inputs that mix scripts unexpectedly (e.g., Latin sentence with a few Cyrillic characters), since this mixing is itself a strong evasion signal.
Known benign look-alikes
- Legitimate Cyrillic text in Russian/Ukrainian content
- Security documentation discussing evasion techniques
- Hex dumps in debugging output