# Zalgo Combining-Diacritic Overload Encoding

- **Severity:** High
- **Signature ID:** `57d7b58f-936f-44e4-9027-5da9af8628df`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Attackers can hide instructions inside text that is heavily decorated with stacked Unicode combining marks, making words look visually corrupted ("Zalgo text") while an AI model still reads them as normal characters. This lets malicious prompts slip past keyword filters and safety classifiers that only check clean, normalized text.

## How the attack works

An attacker writes a jailbreak or injection prompt in plain ASCII, then stacks multiple Unicode combining diacritical marks onto each character so the text renders as garbled, spiky glyphs. Safety filters and moderation tools that scan for known bad phrases in normalized text don't recognize the heavily marked-up version. The underlying language model's tokenizer, however, still decodes the marks back to the original ASCII letters, so it reads and can act on the hidden instruction. This is a known technique automated by the NVIDIA garak security-testing tool's InjectZalgo probe.

## Why it matters

An organization's input filtering or content moderation for an AI agent can be bypassed, letting attacker-controlled instructions reach the model even though a keyword or pattern-based defense would normally catch them.

## What you can do

- Normalize and strip excessive combining diacritical marks (Unicode NFC/NFD normalization plus a cap on consecutive combining characters) before running any keyword or safety filtering on user input.
- Flag or reject input where any character carries three or more consecutive combining marks, while allowing legitimate uses like Vietnamese, Yoruba, or Igbo text and mathematical notation.
- Run safety/jailbreak classifiers on the normalized text, not the raw input, so obfuscated variants get the same scrutiny as plain text.
- Log and review inputs with abnormal combining-mark density to catch new obfuscation attempts.

## Known benign look-alikes

- Linguistic discussion of Vietnamese / Yoruba / Igbo text which legitimately uses stacked combining diacritics
- Academic paper on Unicode normalization NFC/NFD or combining-character overflow
- Mathematical notation using combining marks for accents on variables

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00308
- https://github.com/NVIDIA/garak/blob/main/garak/probes/encoding.py

---
Source: https://www.netzilo.com/threats/atr-zalgo-combining-diacritic-overload-encoding