Obfuscated Token Reconstruction via Character Substitution
This attack hides a forbidden word or phrase (like a forced compliance marker) from input filters by never writing it in full. Instead, the attacker writes a broken or disguised version and gives the AI step-by-step character-swap instructions so the model reassembles the word itself when it answers.
How the attack works
The attacker plants a placeholder, misspelling, or lookalike-character version of the target token in the prompt, so it never appears intact where a content filter could catch it. They follow it with explicit instructions like 'replace X with Y' or 'remove the dashes' that tell the model how to turn the broken text into the real word. The model executes these instructions during generation, producing the forbidden token as part of its output even though the raw prompt never contained it. This can be used to force a compliance marker, bypass a content filter, or smuggle other blocked strings past screening.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 11394704-adb7-47a5-ad70-b6c2b011ceed
- Severity
- High
Why it matters
An organization's input filtering and content moderation can be bypassed, letting an attacker force the model to output banned text or trigger downstream logic that trusts that output, undermining safety controls that assume filters see the full text before generation.
What you can do
- →Screen model output, not just input, for the reconstructed forbidden tokens, especially near the end of a response.
- →Treat prompts that combine broken/placeholder text with explicit character-substitution instructions as suspicious, even if no banned word appears literally.
- →Review legitimate find-and-replace, recipe, or config-migration use cases separately so filtering rules don't just get disabled to avoid false positives.
- →Log and review cases where model output contains a token that never appeared verbatim in the input.
Known benign look-alikes
- Legitimate find-and-replace instructions in text editing, recipes, or configuration migration contexts
- Software/IT instructions to replace or remove a component 'with' a replacement part
- Cooking or crafting instructions substituting one ingredient/material for another