Researchers introduced a plain-English prompt-crafting method that hides a policy-violating payload inside an obfuscated prose wrapper, allowing quick LLM gatekeepers to miss it while a stronger target model can recover and act on the embedded request. In tests against gpt-4o-mini-2024-07-18, gpt-oss-safeguard:20b, claude-3-haiku-20240307, and llama-guard3, the crafted prompts bypassed gatekeepers in all trials, and gpt-5-thinking-high recovered and executed the payload in most target tests. #gpt-4o-mini-2024-07-18 #gpt-oss-safeguard:20b #claude-3-haiku-20240307 #llama-guard3 #gpt-5-thinking-high
Keypoints
- Researchers described a prompt-crafting technique that uses ordinary prose to conceal an embedded payload from quick LLM policy checks.
- The method is designed for a fast gatekeeper → stronger target pipeline, where the gatekeeper classifies input as safe before the target model sees it.
- 23 crafted prompts were generated and tested against multiple gatekeeper models, including gpt-4o-mini-2024-07-18, gpt-oss-safeguard:20b, claude-3-haiku-20240307, and llama-guard3.
- All gatekeeper trials classified the crafted prompts as safe, despite the plain versions of the same prompts being blocked by policy.
- Target testing with gpt-5-thinking-high showed that the embedded payload was extracted, considered, and acted on in 17 of 18 trials, with >90% success overall.
- The technique is not itself a jailbreak, but it can carry jailbreak prompts or other harmful instructions through the gatekeeper unnoticed.
- Proposed mitigations include paraphrasing untrusted input, adding more specific gatekeeper policy clauses, monitoring model output and actions, or using a gatekeeper as powerful as the target model.
MITRE Techniques
- [T1056.001] Input Capture: Prompt Injection – The attacker hides malicious instructions inside a prose wrapper so the gatekeeper accepts them as benign and passes them to the target model. [‘a policy-violating payload … is embedded in a specially crafted prose wrapper’ and ‘the quick policy check classified the input as safe and did not notice the payload existed’]
- [T1027] Obfuscated Files or Information – The payload is concealed using plain-English obfuscation rather than obvious encoding artifacts like Base64 or emojis. [‘using plain English (no emojis, base64, invisible formatting, etc.)’ and ‘These prompts are constructed … [as] obfuscated “wrapper” prompts that contain a hidden “payload”’]
- [T1204] User Execution – The target model is induced to process and carry out the embedded instruction after the payload is recovered. [‘the target model successfully extracted the payload, processed it as further input and acted on it’]
- [T1565.001] Stored Data Manipulation – The payload can instruct destructive or unauthorized actions against local files, such as encrypting documents and removing plain copies. [‘encrypt documents; rm plain copies’ and ‘encrypting local documents’]
Indicators of Compromise
- [Model names ] gatekeeper and target systems evaluated in the study – gpt-4o-mini-2024-07-18, gpt-oss-safeguard:20b, claude-3-haiku-20240307, gpt-5-thinking-high
- [Model names ] additional model referenced in testing and comparison – llama-guard3:8b, Opus-class models
- [Payload strings ] examples of hidden or plain test prompts – print flag last word, encrypt documents; rm plain copies
- [File names ] target-test file and local document references – flag.txt, ~/Documents
- [Environment / tool artifacts ] execution context used for target testing – Python code interpreter, emulated desktop environment
Read more: https://research.checkpoint.com/2026/puzzlemask-abusing-plain-prose-as-a-covert-ai-attack-vector/