# Unicode/Encoding Obfuscation Instruction Injection

- **Severity:** High
- **Signature ID:** `092013b9-8c3a-442f-bdb4-0340d7ca0751`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Attackers hide malicious instructions to AI chatbots using encoding tricks like invisible text-reversal characters or Morse code, so the harmful request looks like gibberish to automated safety filters but the AI still reads and follows it. This lets attackers bypass content moderation and get the model to ignore its safety rules.

## How the attack works

The attacker writes a prompt containing an encoded instruction rather than plain text. One method uses the Unicode Right-to-Left Override character (U+202E) combined with reversed text, so the visible output is scrambled while the model still parses the intended command. Another method spells out the jailbreak instruction in Morse code (dots and dashes), telling the model to decode it and comply — the decoded payload typically asks the model to ignore prior instructions and act as an unrestricted version of itself. In both cases the goal is to slip past simple keyword or pattern-based content filters that only scan literal text, while relying on the model's ability to decode unusual encodings.

## Why it matters

An organization's AI agent can be tricked into ignoring its safety instructions and following attacker commands, bypassing content moderation controls that were assumed to catch this kind of manipulation.

## What you can do

- Decode or normalize unusual encodings (Unicode control characters, Morse code, and similar obfuscation) before running text through safety filters, so filters see the actual intended instruction.
- Flag or strip bidirectional control characters like U+202E in user input unless there is a legitimate internationalization use case.
- Apply content-safety checks to the model's interpreted/decoded meaning, not just the raw literal input string.
- Review logs for prompts containing Morse-code-like patterns or unexplained bidirectional Unicode characters as a sign of attempted filter evasion.

## Known benign look-alikes

- Unicode documentation: "U+202E RIGHT-TO-LEFT OVERRIDE is a bidirectional control character — see Unicode spec section 6.3" (technical or educational Unicode reference)
- Morse code education: "The Morse code for SOS is ... --- ..." (short 3-word Morse example in educational context)
- Internationalization testing: "Test your app with U+202E to verify bidirectional text rendering" (i18n QA instruction)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00342
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/inthewild_jailbreak_llms.json

---
Source: https://www.netzilo.com/threats/atr-unicode-encoding-obfuscation-instruction-injection