Most prompt injections that succeed in the real world are ones a human reviewer could not see: zero-size text, invisible characters, a page title, image metadata or an encoded string. MITRE ATLAS tracks this as AML.T0068 LLM Prompt Obfuscation, in the Defense Evasion tactic (AML.TA0007). ATLAS describes hiding or obfuscating prompt injections or retrieval content to avoid detection by humans, LLM guardrails or other detection mechanisms, through rendering tricks, data hidden in images or file metadata, and encodings such as base64 or ROT13. Prompt injection itself is covered in the OWASP LLM Top 10 LLM01 Prompt Injection Guide, and invisible characters in general in Unicode Security. This page focuses on the gap between what a person sees and what the model reads, and on building an ingestion pipeline that closes it. It is for engineers who build RAG ingestion, agent tool outputs and AI review workflows, and for SOC teams triaging suspected injections.
Key takeaways
- The model reads the raw text, people read the render. Every obfuscation in ATLAS exploits a difference between the two, so the core control is to inspect what the model will actually receive.
- Human approval is weakened, not removed. An approver cannot reject an instruction they cannot see, so approval screens must show normalised, revealed content.
- Normalise before you classify. Guardrails that scan text before decoding, stripping and extraction will miss encoded and hidden payloads.
- Metadata is content. ATLAS case studies include instructions in a web page title tag and in hidden document text; ingestion must treat titles, alt text, comments and EXIF fields as model input.
- Hidden text is a strong signal. Legitimate business documents rarely contain text a reader cannot see, so its presence is worth an alert even before you decide what it says.
Obfuscation methods ATLAS describes
ATLAS created AML.T0068 in March 2025, last modified it in January 2026, and rates it as demonstrated. The table groups the methods in its description and case studies by where the hiding happens.
| Class | Examples | Who is fooled | Where to catch it |
|---|---|---|---|
| Rendering | Font size zero, text the same colour as the background, hidden HTML elements | Human readers | Extract text from source, compare with visible render |
| Invisible characters | Unicode Tags block (U+E0000 to U+E007F), zero-width and bidirectional characters | Human readers and code reviewers | Code point scanning and stripping |
| Structural fields | Page title tags, alt text, comments, document properties | Humans, who rarely look there | Treat every extracted field as content |
| Multimodal | Instructions in image pixels, EXIF for images, ID3 for audio | Humans and text-only filters | Metadata stripping, OCR and image-text checks |
| Encoding | Base64, ROT13, other languages or emoji (OWASP LLM01 scenario) | Guardrails and humans | Decode or detect encoded spans before classification |
What the case studies show
- Zero-size text on a web page (AML.CS0020): in the 2023 indirect prompt injection research against Bing Chat, the malicious prompt was hidden by setting the font size to 0.
- Invisible Unicode in rules files (AML.CS0041): researchers hid instructions in AI coding assistant rules files using zero-width joiners and bidirectional markers, invisible in editors and in pull request review. GitHub announced on 1 May 2025 that github.com shows a warning when a file contains hidden Unicode text.
- Title tag and base64 (AML.CS0045): a proof of concept placed the prompt in a web page title tag returned by an MCP scraping tool, and base64-encoded the shell command, making it less obvious to the user who was asked to approve it. ATLAS notes the assistant did prompt before running the command, which is the control doing its job only if the approver can read what is proposed.
- Obfuscated email content (AML.CS0026): the malicious part of an email to a Microsoft 365 Copilot user was obfuscated so the recipient would not notice it; see the MITRE ATLAS AML.T0071 False RAG Entry Injection page for the retrieval half of that attack.
Unicode Tags deserve a note. Embrace the Red's January 2024 analysis explains that the block mirrors ASCII, most interfaces do not render it, and models can still read it. The author's advice is to strip or filter these code points from untrusted input and from model output, flag occurrences, and test the pipeline with harmless canary strings.
Building an obfuscation-aware ingestion pipeline
The order matters: reveal and normalise first, then classify. This is the sequence we recommend for RAG ingestion, tool output and inbound messages before they reach a model.
- Extract everything: body text plus titles, alt text, comments, hidden elements, document properties and image or audio metadata, keeping a record of which field each span came from.
- Compute visibility: for HTML and office documents, mark spans that would not be visible (zero size, matching colours, hidden attributes, off-page positioning).
- Normalise text: apply Unicode normalisation, strip or flag the Tags block and other invisible format characters, and record that you did.
- Detect encodings: flag long base64-like or hex-like spans and ROT13 patterns; decode for inspection only, never pass decoded text on as trusted.
- Classify the revealed text: run the prompt injection classifier on normalised and decoded content, not the raw input. Microsoft's July 2025 MSRC post describes Prompt Shields as a classifier for injection in external content.
- Decide: quarantine items with hidden instruction-like text, strip hidden spans from items that are otherwise legitimate, and log both.
- Mark what passes: spotlighting, as Microsoft describes it, wraps or marks untrusted content (delimiting, datamarking or encoding) so the model is told not to follow instructions inside it.
Test the pipeline in monitor-only mode against a sample of real business documents first. Some legitimate files contain hidden text (template fields, tracked changes, accessibility labels), so tune the quarantine rule before enforcing it, and keep a bypass process for false positives.
Detection and measurement
| Signal | Meaning | Data source |
|---|---|---|
| Hidden spans with imperative language | Likely injection hidden from humans | Ingestion pipeline output |
| Invisible Unicode in prompts, files or tool output | Hidden text or watermarking; investigate | Code point scanner, repository checks |
| Encoded strings in approval requests | User asked to approve something they cannot read | Agent approval logs |
| Instructions in metadata fields | Title, EXIF or property fields addressing an AI | Ingestion field records |
| Behaviour change after reading a document | Tool calls or tone shift with no visible cause | Agent telemetry (AML.M0024) |
Measuring it
- Normalisation coverage: share of ingestion and tool output paths that run reveal and normalise before classification.
- Hidden-content rate: items per thousand ingested with hidden spans, and the share quarantined after review.
- Canary pass rate: share of benign canary tests (hidden text, Tags block, base64, metadata) caught on each path.
- Readable approvals: share of agent approval prompts that show decoded, normalised content.
Prevention controls mapped to ATLAS
- AML.M0033 Input and Output Validation for AI Agent Components: ATLAS includes data sanitisation to remove potential injections; the pipeline above is its practical form.
- AML.M0020 Generative AI Guardrails: classifiers and rules, applied after normalisation, on both input and output (hidden characters can also be used to smuggle data out).
- AML.M0030 Restrict AI Agent Tool Invocation on Untrusted Data: when content with hidden spans enters context, block high-impact tools or require confirmation.
- AML.M0029 Human In-the-Loop for AI Agent Actions: approval screens must render decoded commands and reveal hidden characters, otherwise the approver is the target.
- AML.M0024 AI Telemetry Logging: log the normalised text the model received, so investigators see the injection rather than an innocent render.
- Repository controls: scan agent instruction and rules files for invisible characters in CI and review; see the AI Coding Agents Security Guide.
Response
- Reveal: extract and normalise the suspect item and record the hidden content and the field it was in.
- Sweep: search indexes, mailboxes and repositories for the same hiding pattern and source.
- Trace effect: from agent telemetry, find sessions that ingested the item and what tools ran afterwards.
- Close the path: add the method to the pipeline and to canary tests; follow the Prompt Injection Incident Response Playbook for scoping and notification.
Common failure patterns
- Classifying before decoding: guardrails see base64 or Tags characters as noise and pass them.
- Body text only: ingestion scans the body and passes titles, alt text and metadata straight to the model.
- Approval of unreadable content: a user approves an encoded command or a diff with invisible characters.
- Stripping without logging: hidden text is removed silently, so nobody learns that a source is hostile.
- Input-only checks: invisible characters in model output are not stripped before display or onward use.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATLAS | AML.T0068, AML.TA0007, AML.CS0020, AML.CS0026, AML.CS0041, AML.CS0045 | Technique, tactic and case studies |
| MITRE ATLAS mitigations | AML.M0020, AML.M0024, AML.M0029, AML.M0030, AML.M0033 | Guardrails, telemetry, approval, tool restriction, sanitisation |
| MITRE ATT&CK | T1027 Obfuscated Files or Information | Closest enterprise analogue for detection engineers |
| OWASP Top 10 for LLM Applications 2025 | LLM01 Prompt Injection (multimodal and encoding scenarios), LLM08 Vector and Embedding Weaknesses (hidden text scenario) | Entry points |
| NIST SP 800-53 Rev. 5 | SI-10, SI-15 | Input validation, output filtering |
Practitioner checklist
- Extract titles, alt text, comments, properties and media metadata as model input, with field labels.
- Mark visually hidden spans in HTML and documents during ingestion.
- Strip or flag Unicode Tags and other invisible format characters on input and output.
- Detect and decode encoded spans for inspection before classification.
- Run injection classifiers on normalised text only.
- Show decoded, revealed content on every agent approval screen.
- Scan agent rules and instruction files for invisible characters in CI.
- Run benign canary tests for each hiding method on every ingestion path.
Standards and references
- MITRE ATLAS: LLM Prompt Obfuscation (AML.T0068)
- MITRE ATLAS: Rules File Backdoor: Supply Chain Attack on AI Coding Assistants (AML.CS0041)
- OWASP: Top 10 for LLM Applications 2025
- Microsoft MSRC: How Microsoft defends against indirect prompt injection attacks
- GitHub Changelog: GitHub now provides a warning about hidden Unicode text
- Embrace the Red: Hiding and finding text with Unicode Tags
- MITRE ATT&CK: Obfuscated Files or Information (T1027)
Related NHI Mgmt Group resources: OWASP LLM Top 10 LLM01 Prompt Injection Guide, Unicode Security, Steganography in Attacks Guide, T1027 Obfuscated Files or Information Defensive Guide.