Unicode Variation Selector ASCII Smuggling
An attack technique hides text commands inside a message using special Unicode characters that render as invisible in almost all apps and screens, but that AI models still read and interpret. This lets an attacker sneak instructions to an AI system past a human reviewer who sees nothing unusual.
How the attack works
The attacker takes ordinary ASCII text (letters, numbers, symbols) and remaps each character to a matching codepoint in the Unicode Variation Selectors Supplement block (U+E0100 to U+E017E). This block is meant for tiny typographic variants of CJK characters, so most software renders it as blank or invisible. The attacker embeds this invisible-encoded payload in a message sent to an AI agent, often with wrapper text telling the model to decode and act on it. The AI's tokenizer still reads the hidden codepoints, decodes them back to the original ASCII instructions, and can follow them as if they were normal visible text.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 1c433d9c-5ae2-49c9-8c2c-42197c5f2a2e
- Severity
- Critical
Why it matters
An attacker can slip jailbreak prompts, hidden commands, or malicious instructions to an AI agent that appear as empty or blank content to any human reviewing the input, bypassing manual inspection and possibly some content filters.
What you can do
- →Strip or reject Unicode Variation Selectors Supplement characters (U+E0100–U+E01EF) from user input before it reaches an AI model, unless your workflow specifically requires CJK ideographic variation sequences.
- →Flag any input containing three or more consecutive characters in that block for review, since legitimate CJK use never produces consecutive runs of more than one.
- →Log and inspect inputs where visible rendered length differs significantly from the raw character or byte count, as a general defense against invisible-character smuggling.
- →Review AI agent input pipelines to confirm whether tokenizers decode non-printing Unicode ranges, and if so, sanitize those ranges at the input boundary.
Known benign look-alikes
- Ideographic Variation Sequences (IVS) in CJK typography: at most 1 VS per CJK base character, never consecutive VS runs
- Academic paper citing paulbutler.org smuggling research in a security-education context (condition 5 FP)