# Mathematical Bold / Fullwidth Unicode Obfuscation in User Input

- **Severity:** Medium
- **Signature ID:** `548a2b0e-019e-4c97-9339-fd81615dd732`
- **MITRE ATLAS:** AML.T0050 (Command and Scripting Interpreter), AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Some AI attack prompts use decorative Unicode character sets like Mathematical Bold, Fullwidth, or Script letters that look like normal Latin text but are technically different characters. This lets an attacker's payload slip past filters that only check for plain ASCII keywords, while a human or the AI model still reads it as ordinary text.

## How the attack works

An attacker writes a known jailbreak or injection payload, such as a phrase confirming the attack worked, but substitutes each letter with a stylised Unicode look-alike from blocks like Mathematical Bold or Fullwidth Latin. Simple keyword filters that scan for the plain-ASCII phrase do not match the stylised version and let it through. The AI model, however, typically still interprets the stylised text as the intended letters and processes the payload normally. This is a documented technique from AI red-teaming competitions such as HackAPrompt.

## Why it matters

An organization relying on plain-text keyword filtering to block known jailbreak or injection phrases can be bypassed, letting disallowed instructions or confirmation payloads reach the model undetected.

## What you can do

- Normalize user input by mapping decorative Unicode blocks (Mathematical Bold/Italic, Fullwidth, Sans-Serif Bold, Script) to their plain Latin equivalents before running any keyword or policy checks.
- Do not rely solely on exact ASCII string matching for filtering prompts; use Unicode-aware normalization (e.g. NFKC) as a preprocessing step.
- Review flagged inputs manually before blocking, since legitimate math notation, branded text, or security-education content can trigger the same pattern.
- Log and monitor for a high density of characters from these Unicode blocks appearing together, as this pattern is uncommon in normal writing.

## Known benign look-alikes

- Mathematical / scientific documents that legitimately use Mathematical Bold for variables.
- Stylised social-media handles or branding text reproduced inside the user prompt.
- Educational discussion of Unicode obfuscation as a security topic.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00444

---
Source: https://www.netzilo.com/threats/atr-mathematical-bold-fullwidth-unicode-obfuscation-in-user-inpu