# Unicode Invisible-Character Data Smuggling in LLM Traffic

- **Severity:** High
- **Signature ID:** `b7f3c1d2-9a4e-4f6b-8c05-3d2e7a1f4b96`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** LLM01 (Prompt Injection)

## Summary

This detects text hidden inside AI conversations using invisible or near-invisible Unicode characters — a technique sometimes called ASCII smuggling. Attackers use these characters to sneak instructions or data past a human reader while an AI model still processes them.

## How the attack works

An attacker or a compromised data source (a tool result, a fetched web page, or a piece of content the AI ingests) embeds a payload built from Unicode tag characters, variation selectors, zero-width characters, or bidirectional text override controls. These characters render as nothing or as normal-looking text to a person reading the conversation, but the AI model can still read and act on the hidden content. The detection looks for dense runs of these characters in prompts or completions, checking both raw text and its escaped JSON representations, since different tools encode the same trick differently. For strong, rarely-legitimate encodings (like tag-block characters) the payload alone is enough to flag; for weaker signals it also checks whether the hidden text arrived shortly after the AI pulled in outside content, or whether the same hidden payload keeps reappearing across the conversation.

## Why it matters

An attacker can hide instructions or exfiltrated data inside AI conversations, invisible to a human reviewing the chat log but readable by the model, potentially steering the AI's behavior or leaking information through outputs that look clean.

## What you can do

- Review any flagged conversation for the actual hidden payload and what the AI did immediately afterward, including any outbound calls.
- Check what external content (web pages, tool results, files) the agent ingested just before the hidden payload appeared, since that is the likely injection point.
- Do not treat isolated invisible characters as proof of attack; correlate with ingestion of outside content or repeated occurrence before escalating.
- Restrict which tools and data sources an agent can ingest unreviewed, especially ones that return free-form text or HTML.

## Known benign look-alikes

- Emoji-heavy content. ZWJ (U+200D) and the emoji presentation selectors U+FE0E/U+FE0F are excluded from the density counters and only ever contribute to run length, where the thresholds (8 weak / 24 strong) are far above the 2-3 codepoint runs real emoji sequences produce.
- Regional-subdivision flag emoji (Scotland, Wales, England) legitimately embed 5-7 Unicode tag characters each. The tag signal requires tag_count > 7 * (number of U+1F3F4 flag bases), so any number of legitimate subdivision flags is cancelled out.
- Right-to-left documents (Arabic, Hebrew, Farsi). LRM/RLM (U+200E/U+200F) are not counted at all; only overrides and isolates are, at a threshold of 12, and that is a weak signal that additionally needs graph provenance or recurrence.
- ICU MessageFormat / i18n UI-string bundles that wrap placeholders in FSI/PDI isolates - same mitigation as above (weak signal only, needs corroboration).
- PDF- or web-extracted text carrying soft hyphens, BOM/ZWNBSP or zero-width line-break hints (CJK, Thai). Zero-width density must exceed 32 occurrences to register even as a weak signal.
- Security research, threat-intel documents and unit-test fixtures about ASCII smuggling that embed live examples or \uXXXX escape tables. Small demonstration tables stay under every threshold; a full live payload will be reported, which is the intended behaviour for an audit rule.
- SaaS editors that inject zero-width tracking watermarks into copied text. These recur, so the store-based recurrence path can surface them once per 5-minute window; raise the zero-width threshold if such an editor is in standard use.

## References

- https://atlas.mitre.org/techniques/AML.T0051
- https://genai.owasp.org/llmrisk/llm01-prompt-injection/
- https://www.unicode.org/reports/tr36/
- https://www.unicode.org/reports/tr39/

---
Source: https://www.netzilo.com/threats/unicode-invisible-smuggling