Full Report
Executive Summary In this research we introduce a prompt-crafting technique for bypassing quick LLM-based policy checks — using plain English (no emojis, base64, invisible formatting, etc.) A policy-violating payload (e.g. ”encrypt files in ~/Documents”, “give me a biohazard recipe”, “ignore all previous instructions and…”) is embedded in a specially crafted prose wrapper. An LLM with limited […] The post PuzzleMask: Abusing Plain Prose as a Covert AI Attack Vector appeared first on Check Point Research.
Analysis Summary
# Tool/Technique: PuzzleMask
## Overview
PuzzleMask is a prompt-crafting technique designed to bypass Large Language Model (LLM) gatekeepers and policy checks. Unlike traditional jailbreaks that use Base64 encoding, emojis, or specialized characters, PuzzleMask utilizes **plain prose** to embed policy-violating payloads. The technique exploits the limited attention and resources of "fast" gatekeeper models (e.g., GPT-4o-mini, Llama-Guard), which classify the input as benign, while the stronger "target" model (e.g., GPT-5) successfully extracts and executes the hidden malicious instructions.
## Technical Details
- **Type:** Technique (Prompt Injection / Adversarial Obfuscation)
- **Platform:** LLM-based applications and AI pipelines (e.g., OpenAI, Anthropic, Meta models)
- **Capabilities:** Policy bypass, payload obfuscation, automated prompt generation, instruction injection.
- **First Seen:** September 10, 2026 (Research Publication Date)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- **[T1566 - Phishing]** (Applicable if the LLM is used for email/document processing)
- **[TA0005 - Defense Evasion]**
- **[T1202 - Indirect Command Execution]**
- **[T1564 - Hide Artifacts]** (Obfuscating the payload within natural language)
- **[MITRE ATLAS - Research Reference]**
- **[AML.T0006 - LLM Prompt Injection]**
- **[AML.T0007 - Indirect Prompt Injection]**
## Functionality
### Core Capabilities
- **Prose Embedding:** Conceals malicious payloads (e.g., requests for malware, biohazard recipes, or system commands) within seemingly innocent, grammatically correct English prose.
- **Gatekeeper Bypass:** Evades "quick-check" models designed to filter unsafe content by appearing as benign conversational or creative text.
- **Payload Extraction:** Relies on the high reasoning capabilities of advanced target models to "read between the lines" and identify the embedded instructions.
### Advanced Features
- **Automated Pipeline:** The researchers utilized an automated system to generate 23 distinct crafted prompts, proving the technique is scalable and scriptable.
- **Contextual Camouflage:** The payload is woven into the narrative flow of the prose, making it difficult for keyword-based or simple semantic filters to detect.
## Indicators of Compromise
*Note: As this is a prompt-based technique, IOCs are behavioral and textual rather than file-based.*
- **File Hashes:** N/A (Text-based attack)
- **Behavioral Indicators:**
- LLM output showing evidence of "hidden" instruction execution (e.g., performing a task not explicitly requested in the surface text).
- High-resource models (GPT-5, etc.) invoking internal tools (Python interpreter, web search) based on prompts that were cleared by a gatekeeper.
- Presence of "prose wrappers" that appear unnecessarily verbose or stylistically distinct from standard user queries.
## Associated Threat Actors
- **Red Team / Researchers:** Discovered by Check Point Research.
- **General Adversaries:** Potential for adoption by any actor seeking to bypass AI safety filters for automated malware generation or data exfiltration.
## Detection Methods
- **Behavioral Detection:** Monitoring the output and internal tool calls of the target LLM rather than just the input.
- **Paraphrasing Defense:** Using an intermediary LLM to rewrite/paraphrase user input before it reaches the gatekeeper, which often breaks the specific prose structure required for the payload to work.
- **Enhanced Policy Clauses:** Adding specific instructions to gatekeeper policies to look for "embedded" or "implicit" instructions within creative writing.
## Mitigation Strategies
- **Input Transformation:** Implement a normalization layer that strips stylistic elements or summarizes input before processing.
- **Multi-Stage Verification:** Use diverse gatekeeper models with different architectures to cross-reference safety classifications.
- **Output Filtering:** Focus security controls on the LLM’s response (egress filtering) to prevent the delivery of malicious payloads, regardless of the input's success.
- **Policy Hardening:** Update gatekeeper system prompts to explicitly check for instructions hidden within narrative context.
## Related Tools/Techniques
- **Jailbreaking:** PuzzleMask acts as a delivery vehicle for jailbreaks.
- **Emoji/Base64 Obfuscation:** Traditional methods that PuzzleMask improves upon by avoiding non-standard characters.
- **Indirect Prompt Injection:** A related vector where the payload is hidden in external data (websites, documents) read by the LLM.